tptpcola
27 Październik 2011 19:11
#1
Cześć. Mam problem z wirusem z facebook’a - “hi, wanna laugh?”. Przyznam, że nie za bardzo na komputerach.
Oto logi:
OTL - http://www.wklejto.pl/107831
Extras - http://www.wklejto.pl/107830
Z góry bardzo dziękuję
Pozdrawiam, Tomek
Acorus
28 Październik 2011 08:38
#2
Odinstaluj DAEMON Tools Toolbar,Przyspiesz Komputer.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL SRV - File not found [Auto | Stopped] – -- (StarWindServiceAE) SRV - File not found [Auto | Stopped] – -- (avgwd) SRV - File not found [Auto | Stopped] – -- (AVGIDSAgent) SRV - [2011-10-27 18:48:41 | 001,944,576 | ---- | M] () [Auto | Running] – C:\Windows\update.2\svchost.exe – (srviecheck) SRV - [2011-10-27 15:19:48 | 000,258,048 | ---- | M] () [Auto | Running] – C:\Windows\sysdriver32.exe – (srvsysdriver32) SRV - [2011-10-27 15:05:49 | 001,198,080 | -H-- | M] (Cronosoft) [Auto | Running] – C:\Windows\update.1\svchost.exe – (wxpdrivers) FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.startup.homepage: “http://startsear.ch/?aff=1 ” FF - prefs.js…extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.4.0024 FF - prefs.js…keyword.URL: “http://search.avg.com/?d=4db89f70&i=23&tp=ab&nt=1&q= ” [2011-03-30 23:22:54 | 000,000,000 | —D | M] (“DAEMON Tools Toolbar”) – C:\Users\TP\AppData\Roaming\mozilla\Firefox\Profiles\pxas4q8p.default\extensions\DTToolbar@toolbarnet.com [2011-01-13 23:23:23 | 000,001,737 | ---- | M] () – C:\Users\TP\AppData\Roaming\Mozilla\Firefox\Profiles\pxas4q8p.default\searchplugins\ask.uk.xml [2011-03-30 23:22:46 | 000,002,059 | ---- | M] () – C:\Users\TP\AppData\Roaming\Mozilla\Firefox\Profiles\pxas4q8p.default\searchplugins\daemon-search.xml O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM…\Run: [4522119.exe] C:\Windows\Temp\4522119.exe () O4 - HKLM…\Run: [4553430.exe] C:\Windows\Temp\4553430.exe () O4 - HKLM…\Run: [784025.exe] C:\Windows\Temp\784025.exe () O4 - HKLM…\Run: [990835.exe] C:\Users\TP\AppData\Local\Temp\990835.exe () O4 - HKLM…\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe File not found O4 - HKLM…\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\Windows\update.tray-12-0\svchost.exe (Cronosoft) O4 - HKLM…\Run: [tray_ico1] File not found O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [wxpdrv] C:\Windows\services32.exe (Cronosoft) O4 - HKCU…\Run: [AdobeBridge] File not found O4 - HKCU…\Run: [Twoje TVN24] File not found [2011-10-27 18:48:43 | 000,000,000 | -H-D | C] – C:\Windows\update.2 [2011-10-27 15:20:10 | 000,000,000 | —D | C] – C:\Windows\av_ico [2011-10-27 15:17:29 | 000,000,000 | -H-D | C] – C:\Windows\update.1 [2011-10-27 15:17:18 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-12-0-lnk [2011-10-27 15:17:18 | 000,000,000 | -H-D | C] – C:\Windows\update.tray-12-0 [2011-10-27 15:06:16 | 001,198,080 | ---- | C] (Cronosoft) – C:\Windows\services32.exe [2011-10-27 15:27:32 | 000,904,792 | ---- | M] () – C:\Windows\geoiplist.rar [2011-10-27 15:27:32 | 000,246,272 | ---- | M] () – C:\Windows\unrar.exe [2011-10-27 15:23:47 | 000,000,000 | ---- | M] () – C:\Windows\loader2.exe_ok [2011-10-27 15:19:48 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32_.exe [2011-10-27 15:19:48 | 000,258,048 | ---- | M] () – C:\Windows\sysdriver32.exe [2011-10-27 15:05:49 | 001,198,080 | ---- | M] (Cronosoft) – C:\Windows\services32.exe :Files C:\Users\TP\AppData\Local\Temp*.html :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]
Kliknij Wykonaj skrypt .Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.