Wirus z facebooka

ryder0102 · 21 Sierpień 2011 17:07

Niestety i mnie nie ominął problem z powodu wirusa z face’a.

Proszę o pomoc bo nie umiem sobie z tym problemem poradzić.

Z góry dziękuję.

Leon1 · 21 Sierpień 2011 17:34

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL IE - HKCU…\URLSearchHook: {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.) FF - prefs.js…browser.search.defaultthis.engineName: “Softonic Deutsch Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1351351&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.startup.homepage: “http://search.conduit.com/?ctid=CT1351351&SearchSource=13” FF - prefs.js…extensions.enabledItems: support@burn4free-toolbar.com:1.0 FF - HKLM\Software\MozillaPlugins@ganymede/GanymedeNetPlugin,version=1.0: E:\Alek\metin\Ganymede\Plugins\npganymedenet.dll File not found [2011-03-21 17:06:28 | 000,000,935 | ---- | M] () – C:\Documents and Settings\SPECIAL\Dane aplikacji\Mozilla\Firefox\Profiles\7wofq8ej.default\searchplugins\conduit.xml O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O2 - BHO: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (Softonic Deutsch Toolbar) - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Program Files\Softonic_Deutsch\prxtbSof0.dll (Conduit Ltd.) O3 - HKCU…\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No CLSID value found. O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico1] File not found O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - Startup: C:\Documents and Settings\SPECIAL\Menu Start\Programy\Autostart\Registration .LNK = File not found O4 - Startup: C:\Documents and Settings\SPECIAL\Menu Start\Programy\Autostart\Registration Heroes of Might & Magic 5.LNK = File not found O4 - Startup: C:\Documents and Settings\SPECIAL\Menu Start\Programy\Autostart\Registration Prince of Persia T2T.LNK = File not found [2011-08-19 13:19:21 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.7.1 [2011-08-19 10:27:35 | 000,000,000 | —D | C] – C:\WINDOWS\ufa [2011-08-19 10:27:35 | 000,000,000 | —D | C] – C:\WINDOWS\phoenix [2011-08-19 10:25:38 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.5.0 [2011-08-19 10:21:25 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.2 [2011-08-19 10:19:37 | 000,000,000 | —D | C] – C:\WINDOWS\av_ico [2011-08-19 10:17:40 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.1 [2011-08-19 10:17:37 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-2-0-lnk [2011-08-19 10:17:37 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-2-0 [2011-08-15 07:51:21 | 000,000,000 | -HSD | C] – C:\found.000 [2011-08-21 13:06:48 | 000,004,826 | ---- | M] () – C:\Documents and Settings\SPECIAL\Pulpit\cc_20110821_130639.reg [2011-08-21 13:06:20 | 000,010,944 | ---- | M] () – C:\Documents and Settings\SPECIAL\Pulpit\cc_20110821_130614.reg [2011-08-21 13:05:45 | 000,363,102 | ---- | M] () – C:\Documents and Settings\SPECIAL\Pulpit\cc_20110821_130509.reg [2011-08-19 12:16:07 | 000,000,734 | ---- | M] () – C:\WINDOWS\System32\drivers\etc\hîsts [2011-08-19 10:28:25 | 000,904,792 | ---- | M] () – C:\WINDOWS\geoiplist.rar [2011-08-19 10:28:25 | 000,246,272 | ---- | M] () – C:\WINDOWS\unrar.exe [2011-08-19 10:27:33 | 005,589,370 | ---- | M] () – C:\WINDOWS\phoenix.rar [2011-08-19 10:27:33 | 000,182,617 | ---- | M] () – C:\WINDOWS\ufa.rar [2011-08-19 10:27:27 | 001,075,284 | ---- | M] () – C:\WINDOWS\rpcminer.rar [2011-08-19 10:20:38 | 000,000,000 | ---- | M] () – C:\WINDOWS\loader2.exe_ok [2011-08-19 10:23:04 | 004,636,907 | ---- | C] () – C:\WINDOWS\geoiplist [2011-08-19 10:21:23 | 000,000,179 | ---- | C] () – C:\WINDOWS\info1 :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] “C:\WINDOWS\update.1\svchost.exe”=- “C:\WINDOWS\update.tray-2-0\svchost.exe”=- “C:\WINDOWS\update.2\svchost.exe”=- :Commands [CLEARALLRESTOREPOINTS] [RESETHOSTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)

ryder0102 · 21 Sierpień 2011 17:58

Dziękuję za szybką odpowiedź

Log z usuwania : http://wklej.to/ddzcb

Nowy log OTL: http://wklej.to/15F9K

Leon1 · 21 Sierpień 2011 19:24

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

W OTL kilknij CleanUp (Sprzątanie)

Pobierz CCleaner http://www.filehippo.com/download_ccleaner/

przeskanuj nim i wyczyść rejestr.

przeskanuj

Dr.WEB CureIt! http://www.dobreprogramy.pl/DrWEB-CureI … 12976.html