Problem z plikiem ws.exe - nie daje sie usunąć

Sokar · 11 Luty 2010 13:10

Mam problem, od jakiegoś czasu na dysku mam plik ws.exe. Nie mogę go w żaden sposób usunąć. Plik jest niewidoczny lecz kiedy zaznaczam w opcjach folderów=>widok=>“pokaż ukryte pliki i foldery” nic się nie zmienia - ukryte rzeczy się nie pojawiają, a jak wchodzę do tego menu jeszcze raz wszystko jest tak jak gdybym nic nie zmieniał w tym zakresie.

Link do loga z OTL: http://www.wklejto.pl/57268

Z góry dziękuję za jakąkolwiek pomoc.

jessica · 11 Luty 2010 13:29

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

:OTL MOD - [2010-02-11 13:32:54 | 000,082,432 | RHS- | M] () – C:\Documents and Settings\SysOp\Ustawienia lokalne\Temp\cvasds1.dll SRV - [2008-12-09 17:40:16 | 000,464,264 | ---- | M] () [Auto | Running] – C:\Program Files\AskBarDis\bar\bin\AskService.exe – (ASKService) SRV - [2008-12-09 17:40:16 | 000,234,888 | ---- | M] () [Auto | Running] – C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe – (ASKUpgrade) O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM…\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O4 - HKLM…\Run: [KernelFaultCheck] File not found O4 - HKLM…\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe File not found O4 - HKU\S-1-5-21-1547161642-879983540-1644491937-1001…\Run: [cdoosoft] C:\Documents and Settings\SysOp\Ustawienia lokalne\Temp\herss.exe () O4 - HKU.DEFAULT…\RunOnce: [_nltide_2] File not found O4 - HKU\S-1-5-18…\RunOnce: [_nltide_2] File not found O4 - HKU\S-1-5-19…\RunOnce: [_nltide_2] File not found O4 - HKU\S-1-5-20…\RunOnce: [_nltide_2] File not found O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - C:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - D:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - E:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - F:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - G:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - H:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-02-11 13:55:29 | 000,000,063 | RHS- | M] () - I:\autorun.inf – [NTFS] O32 - AutoRun File - [2006-11-27 14:54:54 | 000,000,175 | R— | M] () - J:\autorun.inf – [CDFS] O32 - AutoRun File - [2001-04-18 16:23:00 | 000,000,041 | R— | M] () - L:\AUTORUN.INF – [CDFS] O32 - AutoRun File - [2009-06-18 22:12:18 | 000,000,088 | R— | M] () - M:\autorun.inf – [UDF] O32 - AutoRun File - [2009-08-18 22:15:14 | 000,000,051 | R— | M] () - N:\Autorun.inf – [UDF] O33 - MountPoints2{09ccd12a-1d59-11de-9b35-00195e3944d4}\Shell\AutoRun\command - “” = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe O33 - MountPoints2{09ccd12a-1d59-11de-9b35-00195e3944d4}\Shell\open\command - “” = RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe O33 - MountPoints2{3fd9532a-f1f7-11dd-9afc-00195e3944d4}\Shell\AutoRun\command - “” = O:\ws.exe – File not found O33 - MountPoints2{3fd9532a-f1f7-11dd-9afc-00195e3944d4}\Shell\open\Command - “” = O:\ws.exe – File not found O33 - MountPoints2{c4800050-43dd-11de-a379-00195e3944d4}\Shell\Open(&0)\command - “” = K:\Recycled\ctfmon.exe – File not found O33 - MountPoints2{da6fa2fa-ebf3-11dd-9af0-00c0f02873b2}\Shell\AutoRun\command - “” = O:\bveijo.exe – File not found O33 - MountPoints2{da6fa2fa-ebf3-11dd-9af0-00c0f02873b2}\Shell\open\Command - “” = O:\bveijo.exe – File not found O33 - MountPoints2\G\Shell\AutoRun\command - “” = G:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () O33 - MountPoints2\G\Shell\open\Command - “” = G:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () O33 - MountPoints2\H\Shell\AutoRun\command - “” = H:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () O33 - MountPoints2\H\Shell\open\Command - “” = H:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () O33 - MountPoints2\I\Shell\AutoRun\command - “” = I:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () O33 - MountPoints2\I\Shell\open\Command - “” = I:\ws.exe – [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () [2010-02-11 13:59:08 | 000,000,063 | RHS- | M] () – C:\autorun.inf [2010-02-11 13:32:53 | 000,091,648 | RHS- | M] () – C:\9qqigqwf.exe [2010-02-08 16:27:53 | 000,091,648 | RHS- | M] () – C:\ws.exe [2010-02-03 23:19:11 | 000,094,208 | RHS- | M] () – C:\bveijo.exe [2010-02-02 16:06:10 | 000,094,208 | RHS- | M] () – C:\9d6tpg.exe :Files C:\Program Files\AskBarDis D:\9qqigqwf.exe E:\9qqigqwf.exe F:\9qqigqwf.exe G:\9qqigqwf.exe H:\9qqigqwf.exe I:\9qqigqwf.exe J:\9qqigqwf.exe L:\9qqigqwf.exe M:\9qqigqwf.exe N:\9qqigqwf.exe D:\ws.exe E:\ws.exe F:\ws.exe G:\ws.exe H:\ws.exe I:\ws.exe J:\ws.exe L:\ws.exe M:\ws.exe N:\ws.exe D:\bveijo.exe E:\bveijo.exe F:\bveijo.exe G:\bveijo.exe H:\bveijo.exe I:\bveijo.exe J:\bveijo.exe L:\bveijo.exe M:\bveijo.exe N:\bveijo.exe D:\9d6tpg.exe E:\9d6tpg.exe F:\9d6tpg.exe G:\9d6tpg.exe H:\9d6tpg.exe I:\9d6tpg.exe J:\9d6tpg.exe L:\9d6tpg.exe M:\9d6tpg.exe N:\9d6tpg.exe :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [resethosts] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

Następnie uruchom OTL ponownie, tym razem kliknij “Run Scan”.

Pokaż nowy log OTL.txt oraz raport z usuwania.

jessi

Sokar · 11 Luty 2010 13:53

Link do loga z OTL po restarcie: http://www.wklejto.pl/57276

Link do raportu z usuwania: http://www.wklejto.pl/57277

jessica · 11 Luty 2010 14:02

Jest OK.

W OTL kliknij na przycisk “CleanUp” - to go usunie razem z jego Kwarantanną.

Usuń kopie szkodników z folderu “System Volume Information” poprzez chwilowe wyłączenie “Przywracania Systemu”:

Użyj którejś szczepionki:

>Flash Disinfector

>Panda Vaccine

jessi

Sokar · 11 Luty 2010 14:31

Już wszystko ok.

Bardzo dziękuję za pomoc!