Wirus z facebooka - proszę o pomoc

Dla specjalistów Bezpieczeństwo
#1

Witam,

Bardzo proszę o pomoc. Wyczyściłam wirusy programem Malwarebytes’ Anti-Malware, ale nie mogę zalogować się na facebooka.

OTL: http://wklej.to/N8iIN

EXTRAS: http://wklej.to/2hORi

#2

Wklej w własne opcje skanowania:

:OTL

SRV - File not found [Auto | Stopped] -- -- (Norton Internet Security)

SRV - File not found [On_Demand | Stopped] -- -- (McComponentHostService)

SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found

File not found (No name found) -- 

O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - File not found

O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - File not found

O4 - HKLM..\Run: [tray_ico] File not found

O4 - HKLM..\Run: [tray_ico3] File not found

O4 - HKLM..\Run: [tray_ico4] File not found

O4 - HKCU..\Run: [WinDefender] File not found

O31 - SafeBoot: AlternateShell - services32.exe

[2011-08-23 10:02:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa

[2011-08-23 10:02:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix

[2011-08-23 10:02:16 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.7.1

[2011-08-23 10:01:47 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2

[2011-08-23 10:01:26 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0

[2011-08-23 09:59:24 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico

[2011-08-23 09:58:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1

[2011-08-23 09:56:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-9-0-lnk

[2011-08-23 09:56:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-9-0

[2011-08-23 09:56:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-10-0-lnk

[2011-08-23 09:56:27 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-10-0

[2011-08-23 09:56:25 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-2-0-lnk

[2011-08-23 09:56:25 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-2-0

[2011-08-23 10:18:36 | 000,000,223 | ---- | M] () -- C:\WINDOWS\info1

[2011-08-23 10:02:49 | 005,589,370 | ---- | M] () -- C:\WINDOWS\phoenix.rar

[2011-08-23 10:02:49 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe

[2011-08-23 10:02:49 | 000,182,617 | ---- | M] () -- C:\WINDOWS\ufa.rar

[2011-08-23 10:02:48 | 001,075,284 | ---- | M] () -- C:\WINDOWS\rpcminer.rar

[2011-08-23 10:02:13 | 000,904,792 | ---- | M] () -- C:\WINDOWS\geoiplist.rar

[2011-08-23 10:02:06 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hîsts

[2011-08-23 10:01:11 | 000,000,000 | ---- | M] () -- C:\WINDOWS\loader2.exe_ok

[2011-08-23 10:02:49 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar

[2011-08-23 10:02:49 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar

[2011-08-23 10:02:48 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar

[2011-08-23 10:01:58 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist

[2011-08-23 10:01:57 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar

[2011-08-23 10:01:57 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe

[2011-08-23 10:01:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok

[2011-08-23 10:01:04 | 000,000,223 | ---- | C] () -- C:\WINDOWS\info1


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot]

"AlternateShell"="cmd.exe"


:Commands

[RESETHOSTS] 

[emptytemp]

Kliknij wykonaj skrypt.

#3

Dziękuję za zainteresowanie …

Oto log z usuwania: http://wklej.to/e5qP3

i log z nowego skanowania: http://wklej.to/QwWPj

Co dalej?

– Dodane 24.08.2011 (Śr) 9:31 –

facebook odblokowany :slight_smile: dziękuję za pomoc :slight_smile:

#4

Użyj opcji sprzątanie, przeczyść ccleanerem.