Herss i inne wirusy

gosiunqa1993 · 31 Październik 2010 15:49

Zauważyłem spowolnienie komputera.

A także avast wyświetla mi ciągle wirusy a także znany herss.exe

Leon1 · 31 Październik 2010 16:48

OTL w oknie Custom Scans-Fixes wklej następujący skrypt:

:OTL MOD - [2010-10-31 16:12:09 | 000,113,152 | RHS- | M] () – C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\mgking2.dll MOD - [2010-10-31 16:06:01 | 000,112,640 | RHS- | M] () – C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\apiqq0.dll IE - HKU\S-1-5-21-117609710-813497703-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15470&l=dis IE - HKU\S-1-5-21-117609710-813497703-854245398-1003…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) [2010-10-17 10:55:52 | 000,000,000 | —D | M] – C:\Documents and Settings\rafal\Dane aplikacji\Mozilla\Firefox\Profiles\gd0yleoj.default\extensions\toolbar@ask.com [2010-06-10 16:24:08 | 000,002,254 | ---- | M] () – C:\Documents and Settings\rafal\Dane aplikacji\Mozilla\Firefox\Profiles\gd0yleoj.default\searchplugins\askcom.xml O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKLM…\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O3 - HKU\S-1-5-21-117609710-813497703-854245398-1003…\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask.com) O32 - AutoRun File - [2010-10-31 16:13:08 | 000,000,061 | RHS- | M] () - C:\autorun.inf – [NTFS] O33 - MountPoints2{75cd4b33-81fe-11df-a238-806d6172696f}\Shell\AutoRun\command - “” = C:\9keibj.exe – [2010-10-31 15:38:56 | 000,175,616 | RHS- | M] () O33 - MountPoints2{75cd4b33-81fe-11df-a238-806d6172696f}\Shell\open\Command - “” = C:\9keibj.exe – [2010-10-31 15:38:56 | 000,175,616 | RHS- | M] () O33 - MountPoints2{c8cbcc92-c3c6-11df-b554-000ae6ab4e0c}\Shell\AutoRun\command - “” = F:\3exi.exe – File not found O33 - MountPoints2{c8cbcc92-c3c6-11df-b554-000ae6ab4e0c}\Shell\open\Command - “” = F:\3exi.exe – File not found O33 - MountPoints2{e45ff442-c2f2-11df-a9af-000ae6ab4e0c}\Shell\AutoRun\command - “” = F:\3exi.exe – File not found O33 - MountPoints2{e45ff442-c2f2-11df-a9af-000ae6ab4e0c}\Shell\open\Command - “” = F:\3exi.exe – File not found O33 - MountPoints2\C\Shell\AutoRun\command - “” = C:\3exi.exe – [2009-12-29 18:37:46 | 000,103,936 | RHS- | M] () O33 - MountPoints2\C\Shell\open\Command - “” = C:\3exi.exe – [2009-12-29 18:37:46 | 000,103,936 | RHS- | M] () MsConfig - StartUpReg: api32 - hkey= - key= - C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\apiqq.exe () MsConfig - StartUpReg: ares - hkey= - key= - C:\Program Files\Ares\Ares.exe File not found MsConfig - StartUpReg: cdoosoft - hkey= - key= - C:\DOCUME~1\rafal\USTAWI~1\Temp\herss.exe File not found MsConfig - StartUpReg: king_mg - hkey= - key= - C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\mgking.exe () [2010-10-17 10:55:49 | 000,000,000 | —D | C] – C:\Program Files\Ask.com [2010-10-31 16:13:08 | 000,000,061 | RHS- | M] () – C:\autorun.inf [2010-10-31 15:38:56 | 000,175,616 | RHS- | M] () – C:\9keibj.exe [2010-10-28 16:51:28 | 000,175,616 | RHS- | M] () – C:\b9v.exe [2010-10-26 21:13:51 | 000,180,224 | RHS- | M] () – C:\lpl.exe [2010-10-25 19:30:08 | 000,139,264 | RHS- | M] () – C:\r3q63rok.exe [2010-10-24 09:07:34 | 000,162,816 | RHS- | M] () – C:\9d6resf.exe [2010-10-21 19:45:04 | 000,162,816 | RHS- | M] () – C:\jeo3ky.exe [2010-10-20 17:08:03 | 000,162,816 | RHS- | M] () – C:\jofk1wf.exe [2010-10-18 15:52:01 | 000,162,816 | RHS- | M] () – C:\o1o.exe [2010-10-17 18:37:39 | 000,175,104 | RHS- | M] () – C:\wq.exe [2010-10-16 16:35:06 | 000,174,592 | RHS- | M] () – C:\kyme.exe :Files C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\apiqq.exe C:\Documents and Settings\rafal\Ustawienia lokalne\Temp\mgking.exe :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] “C:\Program Files\Ares\Ares.exe”=- :Commands [emptytemp] [start explorer] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera.

zastosuj Flash Disinfector http://www.searchengines.pl/index.php?s … ntry369724

potem nowy log OTL robiony opcją Run Scan

gosiunqa1993 · 31 Październik 2010 17:30

Extras —> http://wklej.org/id/410335/

OTL —> http://wklej.org/id/410336/

Leon1 · 31 Październik 2010 17:39

OTL w oknie Custom Scans-Fixes wklej następujący skrypt:

Kliknij w Run Fix. Zatwierdź restart komputera.

Pobierz CCleaner http://www.filehippo.com/download_ccleaner/

przeskanuj nim i wyczyść rejestr.

W OTL kilknij CleanUp

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

przeskanuj

Dr.WEB CureIt! http://www.dobreprogramy.pl/DrWEB-CureI … 12976.html