Wirus Policja

Dla specjalistów Bezpieczeństwo
#1

Witam,

proszę o pomoc w usunięciu wirusa Policja. Zrobiłam skan Malwarebytes. Zrobiłam także OTL.

To są logi

http://wklej.to/Goldo

http://wklej.to/bjGbk

Proszę o sprawdzenie i informację co dalej mam robić.

#2

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
DRV:64bit: - [2014-03-25 16:44:40 | 000,061,120 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\wStLibG64.sys -- (wStLibG64)
IE - HKU\S-1-5-21-522880329-1608233159-793353897-1000\..\SearchScopes\{AA614D9E-B175-4025-B5A8-6CC30EEB7513}: "URL" = http://search.yahoo.com/search?p={searchTerms}fr=tightropetbtype=10809
IE - HKU\S-1-5-21-522880329-1608233159-793353897-1000\..\SearchScopes\{B27FC281-F5C0-49C7-B494-56BA194C0357}: "URL" = http://search.findwide.com/serp?guid={DC4995C2-9AB7-42FE-82FA-C01DA885DB5B}action=default_searchserpv=22k={searchTerms}
O3:64bit: - HKLM\..\Toolbar: (no name) - {C355E2E6-EC25-4E6B-81B0-C768FDAA4DE1} - No CLSID value found.
O4 - HKU\S-1-5-21-522880329-1608233159-793353897-1000..\Run: [Facebook Update] C:\Users\ASUS\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
[2014-04-18 09:33:10 | 000,000,000 | -HSD | C] -- C:\found.004
[2014-04-26 00:17:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-522880329-1608233159-793353897-1000UA.job
[2014-04-26 00:17:01 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-522880329-1608233159-793353897-1000Core.job

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.Po restarcie uruchom OTL i użyj opcji Sprzątanie.

Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.

#3

Witam

przesyłam raport:

Addition: http://wklej.to/ARmjs

FRST:http://wklej.to/WN8JQ

Proszę o sprawdzenie i dalsze informacje.

#4

Otwórz Notatnik i wklej:

Task: {046BF72F-06C8-4430-8D82-2D7F8D397005} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-522880329-1608233159-793353897-1000UA = C:\Users\ASUS\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: {05555E2F-B733-4734-898E-E525CFC90DDF} - \DigitalSite No Task File ==== ATTENTION
Task: {E6360F4F-1C56-494D-ACB7-814155978081} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-522880329-1608233159-793353897-1000Core = C:\Users\ASUS\AppData\Local\Facebook\Update\FacebookUpdate.exe
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKCU - DefaultScope {B27FC281-F5C0-49C7-B494-56BA194C0357} URL =
CHR Plugin: (BonanzaDealsLive Update) - C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
CHR Extension: (YoutubeAdblocker) - C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\dcpplnbmiallcdbjaiajakdjjgcbiggp [2014-03-01]
CHR Extension: (WebbIIng) - C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkhegehmhkolineemkiknoohiigkhfai [2014-03-02]
CHR Extension: (webosave) - C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\kkbnoejnkekpameadifkgcihmpifamlj [2014-03-01]
CHR Extension: (NeexxTCoup) - C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfkhnialmfalpdfnipjjnleedimkgggc [2014-03-02]
CHR Extension: (Search-oNewTab) - C:\Users\ASUS\AppData\Local\Google\Chrome\User Data\Default\Extensions\mllfhmbjocdhmccdicecapbkhgcfkkoc [2014-03-01]
S3 ASUSProcObsrv; \\E:\I386\AsPrOb64.sys [X]

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST

#5

A dokładnie gdzie mam zapisać ten plik z notatnika?

#6

Po co te logi z OTL? Skasuj folder C:\FRST

Użyj http://www.bleepingcomputer.com/download/tfc/ (uruchom TFC i kliknij Start).

#7

Zrobiłam ,to zapis:

Getting user folders.

 

Stopping running processes.

 

Emptying Temp folders.

 

 

User: Administrator

 

User: All Users

 

User: ASUS

->Temp folder emptied: 179730 bytes

->Temporary Internet Files folder emptied: 1600902 bytes

->Java cache emptied: 0 bytes

->Google Chrome cache emptied: 0 bytes

->Flash cache emptied: 1037 bytes

 

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

->Flash cache emptied: 0 bytes

 

User: Gość

 

User: HomeGroupUser$

 

User: Public

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 1612 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 40860 bytes

%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 316 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes

 

Emptying RecycleBin. Do not interrupt.

 

RecycleBin emptied: 0 bytes

Process complete!

 

Total Files Cleaned = 2,00 mb

Czy coś jeszcze mam zrobić?

#8

To wszystko.