zarazek
19 Październik 2012 19:15
#1
Witam
Komputer był zainfekowany wirusem typu UKASH. Usunąłem go programem Malwarebytes Anti-Malware, ale podejrzewam że coś zostało. Proszę o pomoc.
http://wklej.to/2fAdb OTL
http://wklej.to/oEZu2 EXTRAS
W okno Własne opcje skanowania / skrypt w OTL wklej:
:OTL DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ewusbdev.sys – (hwusbdev) DRV - File not found [Kernel | On_Demand | Stopped] – C:\windows\system32\DRIVERS\btwrchid.sys – (btwrchid) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwl2cap.sys – (btwl2cap) DRV - File not found [Kernel | On_Demand | Stopped] – C:\windows\system32\DRIVERS\btwavdt.sys – (btwavdt) DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\btwaudio.sys – (btwaudio) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med … 1350505183 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med … 1350505183 IE - HKLM…\SearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=ab … 03be0f0&q={searchTerms} IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med … 1350505183 IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med … 1350505183 IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://search.v9.com/web/?q={searchTerms} IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\SearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}: “URL” = http://search.v9.com/web/?q={searchTerms} IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\SearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=ab … 03be0f0&q={searchTerms} IE - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search?q={searchTerms} O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000…\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. F3 - HKU\S-1-5-21-1965351225-1943171528-3210152717-1000 WinNT: Load - (C:\Users\Kamilka\LOCALS~1\Temp\mszawc.cmd) - File not found :Files C:\Program Files\mozilla firefox\searchplugins\v9.xml C:\Users\Kamilka\AppData\Roaming*.exe :Commands [emptytemp]
Klikasz na Wykonaj skrypt . Zgadzasz się na restart komputera. Log z usuwania pokaż na forum.
Następnie ponownie uruchamiasz OTL klikasz raz jeszcze Skanuj i dajesz nowy log na forum Czyli dwa logi jeden z usuwania drugi z nowego skanowania po usuwaniu.
zarazek
20 Październik 2012 10:38
#3