Wirus z Facebook'a

czachpolice · 31 Październik 2011 22:20

Problem jak w temacie. Proszę o pomoc.

log z otl :

EXTRAS-> http://www.wklej.org/id/618225/

Proszę o instrukcję krok po kroku, ponieważ jestem zielony w tych tematach

Acorus · 1 Listopad 2011 08:10

Odinstaluj QuickStores-Toolbar 1.1.0.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL SRV - File not found [Auto | Stopped] – -- (avgwd) SRV - File not found [Auto | Stopped] – -- (AVGIDSAgent) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss … 1a92313a0a O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll File not found O4 - HKLM…\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM…\Run: [tray_ico0] C:\WINDOWS\update.tray-12-0\svchost.exe (Cronosoft) O4 - HKLM…\Run: [tray_ico1] C:\WINDOWS\update.tray-13-0\svchost.exe (Cronosoft) O4 - HKLM…\Run: [wxpdrv] C:\WINDOWS\services32.exe (Cronosoft) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll File not found [2011-10-31 09:26:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-13-0-lnk [2011-10-31 09:26:49 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-13-0 [2011-10-31 09:16:50 | 000,000,000 | —D | C] – C:\WINDOWS\ufa [2011-10-31 09:16:50 | 000,000,000 | —D | C] – C:\WINDOWS\rpcminer [2011-10-31 09:16:50 | 000,000,000 | —D | C] – C:\WINDOWS\phoenix [2011-10-31 09:13:35 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.5.0 [2011-10-31 09:11:40 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.2 [2011-10-31 09:06:41 | 000,000,000 | —D | C] – C:\WINDOWS\av_ico [2011-10-31 09:04:23 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.1 [2011-10-31 09:02:17 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-12-0-lnk [2011-10-31 09:02:17 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-12-0 [2011-10-30 23:00:57 | 001,204,736 | ---- | C] (Cronosoft) – C:\WINDOWS\services32.exe [2011-10-25 19:50:18 | 000,000,000 | —D | C] – C:\Program Files\Conduit [2011-10-31 09:16:49 | 005,589,370 | ---- | M] () – C:\WINDOWS\phoenix.rar [2011-10-31 09:16:49 | 000,246,272 | ---- | M] () – C:\WINDOWS\unrar.exe [2011-10-31 09:16:49 | 000,182,617 | ---- | M] () – C:\WINDOWS\ufa.rar [2011-10-31 09:16:47 | 001,075,284 | ---- | M] () – C:\WINDOWS\rpcminer.rar [2011-10-31 09:14:37 | 000,000,113 | ---- | M] () – C:\WINDOWS\info1 [2011-10-31 09:11:37 | 000,904,792 | ---- | M] () – C:\WINDOWS\geoiplist.rar [2011-10-31 09:09:10 | 000,000,000 | ---- | M] () – C:\WINDOWS\loader2.exe_ok :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt .Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.