Problem z wirusem, prawdopodobnie plik UQGVF.EXE

system · 20 Grudzień 2009 10:34

Witam, wydaje mi się, że plik ten bruździ mi na dysku, proszę o pomoc.

log z otl.txt

http://wklej.org/id/241277/

log z extras.txt

http://wklej.org/id/241278/

log z hijackthis

http://wklej.org/id/241283/

log z SREng

http://wklej.org/id/241281/

pozdrawiam.

jessica · 20 Grudzień 2009 11:37

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

:OTL MOD - [2009-12-20 11:07:36 | 00,073,850 | RHS- | M] () – C:\Documents and Settings\ells0022\Local Settings\temp\cvasds0.dll O3 - HKCU…\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKCU…\Run: [CatUserRun] File not found O4 - HKCU…\Run: [cdoosoft] C:\Documents and Settings\ells0022\Local Settings\temp\herss.exe () O32 - AutoRun File - [2009-12-20 11:09:18 | 00,000,057 | RHS- | M] () - C:\autorun.inf – [NTFS] O33 - MountPoints2{02642265-d441-11dd-bf0f-00037aa9c4c7}\Shell - “” = AutoRun O33 - MountPoints2{65a7f749-132d-11de-bf70-0017422ed1b5}\Shell - “” = Autorun O33 - MountPoints2{e2f5b23a-1707-11de-bf72-00037aa9c4c7}\Shell\AutoRun\command - “” = G:\uqgvf.exe – File not found O33 - MountPoints2{e2f5b23a-1707-11de-bf72-00037aa9c4c7}\Shell\open\Command - “” = G:\uqgvf.exe – File not found @Alternate Data Stream - 23552 bytes -> C:\WINNT\explorer.exe:userini.exe :Files C:\uqgvf.exe :Services NMIndexingService :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera.

Następnie uruchom OTL ponownie, tym razem wywołaj opcję Run Scan.

Pokaż nowy log OTL.txt oraz log z czyszczenia.

Uruchom System Repair Engineer > zakładka “System Repair” >>karta “BrowserAdd-ons”>

>wyszukaj i zaznaczaj w polu “CLSID 1” po kolei te:

i klikaj na przycisk “Delete Selected”.

jessi