Zainfekowany Pendrive

Mefka90 · 6 Lipiec 2013 13:14

Witam, czy mogłabym prosić o pomoc, ponieważ nie mogę uruchomić nośnika, prawdopodobnie w ksero coś “złapał”. Nie wiem jaki mam dać raporty jeżeli chodzi o pendriva, wrzucam z otl, usbfix

http://www.wklejto.pl/166356

http://www.wklejto.pl/166357

usb fix http://www.wklejto.pl/166359

proszę o dalsze wskazówki :?

Atis · 6 Lipiec 2013 13:31

Odinstaluj AVG Security Toolbar i McAfee Security Scan Plus.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKU\S-1-5-21-118240352-1168459289-1284001362-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://isearch.avg.com/?cid={2FDDC50B-975C-45A7-BE8A-A724A125CC28}&mid=6a88ac13387147d08de841affcd3fec0-e6ac43ae725b14e36eb4aa1587546278b5ae7067〈=pl&ds=xn011&pr=sa&d=2012-09-24 20:11:30&v=13.0.0.7&sap=hp IE - HKU\S-1-5-21-118240352-1168459289-1284001362-1001…\SearchScopes{876FB707-01A4-4F84-B6CE-13FD5123E07A}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=8534C058-ED9D-4BBB-B15A-F6F7AA711D70&apn_sauid=0EA4B344-3D8B-4F08-BFD8-279F89FE18AC IE - HKU\S-1-5-21-118240352-1168459289-1284001362-1001…\SearchScopes{95B7759C-8C7F-4BF1-B163-73684A933233}: “URL” = http://isearch.avg.com/search?cid={2FDDC50B-975C-45A7-BE8A-A724A125CC28}&mid=6a88ac13387147d08de841affcd3fec0-e6ac43ae725b14e36eb4aa1587546278b5ae7067〈=pl&ds=xn011&pr=sa&d=2012-09-24 20:11:30&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms} FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…keyword.URL: “http://isearch.avg.com/search?cid={2FDDC50B-975C-45A7-BE8A-A724A125CC28}&mid=6a88ac13387147d08de841affcd3fec0-e6ac43ae725b14e36eb4aa1587546278b5ae7067〈=pl&ds=xn011&pr=sa&d=2012-09-24 20:11:30&pid=avg&sg=0&v=15.3.0.11&sap=ku&q=” [2012/09/27 19:48:39 | 000,002,299 | ---- | M] () – C:\Users\Patrycja\AppData\Roaming\Mozilla\Firefox\Profiles\cwmjgt5h.default\searchplugins\askcom.xml [2013/05/21 22:46:38 | 000,003,716 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-118240352-1168459289-1284001362-1001…\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKU\S-1-5-21-118240352-1168459289-1284001362-1001…\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe File not found O4 - HKLM…\Run: [NBKeyScan] “C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBKeyScan.exe” File not found O4 - HKU\S-1-5-21-118240352-1168459289-1284001362-1001…\Run: [EA Core] “C:\Program Files (x86)\Electronic Arts\EADM\Core.exe” -silent File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found :Files C:\Windows\tasks\AVG*.job C:\Users\Patrycja\AppData\Local\Temp*.html G:\desktop.ini G:\autorun.inf G:\Thumbs.db G:*.lnk attrib /d /s -s -h G:* /c :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

Pokaż nowy raport UsbFix z opcji Listing.