Wirus z facebooka

tomo58 · 23 Sierpień 2011 13:18

Witam. Mam problem kolega wysłała mi filmik z youtube, który niby mnie wyśmiewał i były komentarze znajomych. Aby go obejrzeć trzeba było ściągnąć Adobe’a. Wtedy wirus zaczął działać.Avas nic nie zdziałał.

raporty ze skanu w OTL - http://wklej.to/7foDP

Extras- http://wklej.to/dzvJT

Bardzo proszę o pomoc

Acorus · 23 Sierpień 2011 13:33

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL MOD - [2011-08-22 14:58:20 | 000,137,728 | ---- | M] () – C:\WINDOWS\systemup.exe MOD - [2011-08-21 20:51:18 | 000,355,840 | ---- | M] () – C:\WINDOWS\update.5.0\5152.exe MOD - [2011-08-21 15:30:12 | 000,634,880 | ---- | M] () – C:\WINDOWS\update.2\svchost.exe MOD - [2011-08-20 21:33:14 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe MOD - [2011-08-20 21:19:24 | 000,382,464 | ---- | M] () – C:\WINDOWS\update.7.1\svchostdriver.exe MOD - [2011-08-20 21:17:56 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe MOD - [2011-08-20 21:14:34 | 001,216,000 | -H-- | M] () – C:\WINDOWS\update.tray-7-0\svchost.exe MOD - [2011-08-20 21:14:34 | 001,216,000 | -H-- | M] () – C:\WINDOWS\update.1\svchost.exe SRV - [2011-08-21 20:51:18 | 000,355,840 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.5.0\5152.exe – (srvbtcclient) SRV - [2011-08-21 15:30:12 | 000,634,880 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.2\svchost.exe – (srviecheck) SRV - [2011-08-20 21:19:24 | 000,382,464 | ---- | M] () [Auto | Running] – C:\WINDOWS\update.7.1\svchostdriver.exe – (ddservice) SRV - [2011-08-20 21:17:56 | 000,258,048 | ---- | M] () [Auto | Running] – C:\WINDOWS\sysdriver32.exe – (srvsysdriver32) SRV - [2011-08-20 21:14:34 | 001,216,000 | -H-- | M] () [Auto | Running] – C:\WINDOWS\update.1\svchost.exe – (wxpdrivers) O3 - HKLM…\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.10\facemoodsTlbr.dll (facemoods.com) O3 - HKU\S-1-5-21-73586283-602162358-839522115-1004…\Toolbar\ShellBrowser: (Free Lunch Design Toolbar) - {57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC} - C:\Program Files\Free_Lunch_Design\prxtbFre2.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-73586283-602162358-839522115-1004…\Toolbar\WebBrowser: (Softonic-Eng7 Toolbar) - {414B6D9D-4A95-4E8D-B5B1-149DD2D93BB3} - C:\Program Files\Softonic-Eng7\prxtbSof0.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-73586283-602162358-839522115-1004…\Toolbar\WebBrowser: (Free Lunch Design Toolbar) - {57CC715D-37CA-44E4-9EC2-8C2CBDDB25EC} - C:\Program Files\Free_Lunch_Design\prxtbFre2.dll (Conduit Ltd.) O4 - HKLM…\Run: [21899677-loader2.exe] C:\WINDOWS\TEMP\21899677-loader2.exe () O4 - HKLM…\Run: [4StoryPrePatch] File not found O4 - HKLM…\Run: [6676810.exe] C:\Documents and Settings\Rodzina.DOM\Ustawienia lokalne\Temp\6676810.exe () O4 - HKLM…\Run: [7953370.exe] C:\WINDOWS\TEMP\7953370.exe () O4 - HKLM…\Run: [8688702.exe] C:\WINDOWS\TEMP\8688702.exe () O4 - HKLM…\Run: [913613.exe] C:\WINDOWS\TEMP\913613.exe () O4 - HKLM…\Run: [9504679.exe] C:\Documents and Settings\Rodzina.DOM\Ustawienia lokalne\Temp\9504679.exe () O4 - HKLM…\Run: [avast] File not found O4 - HKLM…\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.10\facemoodssrv.exe (facemoods.com) O4 - HKLM…\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe () O4 - HKLM…\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\WINDOWS\sysdriver32_.exe () O4 - HKLM…\Run: [systemup] C:\WINDOWS\systemup.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\WINDOWS\update.tray-7-0\svchost.exe () O4 - HKLM…\Run: [tray_ico1] File not found O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [wxpdrv] C:\WINDOWS\services32.exe () O4 - HKLM…\Run: [zzzHPSETUP] File not found O4 - HKU\S-1-5-21-73586283-602162358-839522115-1004…\Run: [skype] File not found [2011-08-21 14:25:18 | 000,000,000 | —D | C] – C:\WINDOWS\av_ico [2011-08-21 14:23:51 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-7-0-lnk [2011-08-21 14:23:51 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-7-0 [2011-08-20 21:32:05 | 000,000,000 | —D | C] – C:\WINDOWS\ufa [2011-08-20 21:32:05 | 000,000,000 | —D | C] – C:\WINDOWS\rpcminer [2011-08-20 21:32:05 | 000,000,000 | —D | C] – C:\WINDOWS\phoenix [2011-08-20 21:29:17 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.5.0 [2011-08-20 21:27:26 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.2 [2011-08-20 21:19:23 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.7.1 [2011-08-20 21:17:32 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.1 [2011-08-22 14:58:20 | 000,137,728 | ---- | M] () – C:\WINDOWS\systemup.exe [2011-08-22 14:58:20 | 000,000,200 | ---- | M] () – C:\WINDOWS\info1 [2011-08-20 21:33:14 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe [2011-08-20 21:32:06 | 005,589,370 | ---- | M] () – C:\WINDOWS\phoenix.rar [2011-08-20 21:32:06 | 000,246,272 | ---- | M] () – C:\WINDOWS\unrar.exe [2011-08-20 21:32:06 | 000,182,617 | ---- | M] () – C:\WINDOWS\ufa.rar [2011-08-20 21:32:04 | 001,075,284 | ---- | M] () – C:\WINDOWS\rpcminer.rar [2011-08-20 21:24:14 | 000,904,792 | ---- | M] () – C:\WINDOWS\geoiplist.rar [2011-08-20 21:18:50 | 000,000,000 | ---- | M] () – C:\WINDOWS\loader2.exe_ok [2011-08-20 21:17:56 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32_.exe [2011-08-20 21:17:56 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe [2011-08-20 21:14:34 | 001,216,000 | ---- | M] () – C:\WINDOWS\services32.exe :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt…Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

tomo58 · 23 Sierpień 2011 13:50

odrazu po zresetowaniu komputera - http://wklej.to/r8bTn

po skanowaniu - http://wklej.to/C1FwE

co teraz ??