Znalazlem arking0.dll

[zibikid (Z Kida)]

Witam

Mam cos takiego jak w temacie i bardzo chcialbym sie tego pozbyc

Oto logi :

OTL : http://www.wklej.org/id/506745/

Gmer : http://www.wklej.org/id/506762/

Dziekuje i pzdr

[djkamil09061991]

Wklej w OTL i naciśnij wykonaj skrypt:

:OTL MOD - [2011-04-05 17:30:44 | 000,113,664 | RHS- | M] () – C:\Documents and Settings\Ja\Ustawienia lokalne\Temp\apiqq0.dll MOD - [2011-04-05 17:30:42 | 000,116,736 | RHS- | M] () – C:\WINDOWS\system32\mgking0.dll O4 - HKLM…\Run: [KernelFaultCheck] File not found O4 - HKLM…\Run: [sunJavaUpdateSched] File not found O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [api32] C:\Documents and Settings\Ja\Ustawienia lokalne\Temp\apiqq.exe () O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [King_ar] C:\WINDOWS\system32\arking.exe () O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [king_mg] C:\WINDOWS\system32\mgking.exe () O4 - HKU.DEFAULT…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-19…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-20…\RunOnce: [nltide_2] File not found O32 - AutoRun File - [2011-04-05 18:34:44 | 000,000,061 | RHS- | M] () - C:\autorun.inf – [FAT32] O32 - AutoRun File - [2010-11-21 18:09:18 | 000,000,061 | RHS- | M] () - D:\AUTORUN.FCB – [NTFS] O32 - AutoRun File - [2011-04-05 18:34:42 | 000,000,061 | RHS- | M] () - D:\autorun.inf – [NTFS] O33 - MountPoints2{18924911-5ba0-11e0-adfd-0016d3601f95}\Shell - “” = AutoRun O33 - MountPoints2{18924911-5ba0-11e0-adfd-0016d3601f95}\Shell\AutoRun\command - “” = F:\AutoRunCardDetector.exe O33 - MountPoints2{4c02cffe-5d6c-11e0-b6ab-806d6172696f}\Shell\AutoRun\command - “” = F:\w9.exe O33 - MountPoints2{4c02cffe-5d6c-11e0-b6ab-806d6172696f}\Shell\open\Command - “” = F:\w9.exe O33 - MountPoints2{6c39b886-d784-11df-a7d7-806d6172696f}\Shell\AutoRun\command - “” = C:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b886-d784-11df-a7d7-806d6172696f}\Shell\open\Command - “” = C:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b887-d784-11df-a7d7-806d6172696f}\Shell\AutoRun\command - “” = D:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b887-d784-11df-a7d7-806d6172696f}\Shell\open\Command - “” = D:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6e457a80-de19-11df-ad68-0016d3601f95}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{6e457a80-de19-11df-ad68-0016d3601f95}\Shell\open\Command - “” = F:\io3yalc.exe O33 - MountPoints2{74660498-20cc-11e0-addc-0016d3601f95}\Shell\AutoRun\command - “” = F:\w9.exe O33 - MountPoints2{74660498-20cc-11e0-addc-0016d3601f95}\Shell\open\Command - “” = F:\w9.exe O33 - MountPoints2{869fc24a-20f2-11e0-adde-0016d3601f95}\Shell - “” = AutoRun O33 - MountPoints2{869fc24a-20f2-11e0-adde-0016d3601f95}\Shell\AutoRun\command - “” = F:\LaunchU3.exe -a O33 - MountPoints2{869fc24b-20f2-11e0-adde-0016d3601f95}\Shell\AutoRun\command - “” = H:\w9.exe O33 - MountPoints2{869fc24b-20f2-11e0-adde-0016d3601f95}\Shell\open\Command - “” = H:\w9.exe O33 - MountPoints2{ba859218-d784-11df-ad50-f203656384ee}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{ba859218-d784-11df-ad50-f203656384ee}\Shell\open\Command - “” = F:\io3yalc.exe O33 - MountPoints2{c447099e-f589-11df-ad88-0016d3601f95}\Shell\AutoRun\command - “” = F:\i00dvoym.exe O33 - MountPoints2{c447099e-f589-11df-ad88-0016d3601f95}\Shell\open\Command - “” = F:\i00dvoym.exe O33 - MountPoints2{d3035853-dd26-11df-ad64-0016d3601f95}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{d3035853-dd26-11df-ad64-0016d3601f95}\Shell\open\Command - “” = F:\io3yalc.exe [2011-03-31 16:20:56 | 000,000,000 | -HSD | C] – C:\FOUND.031 [2011-03-09 17:35:18 | 000,000,000 | -HSD | C] – C:\FOUND.030 [2011-04-05 17:30:42 | 000,116,736 | RHS- | M] () – C:\WINDOWS\System32\mgking0.dll [2011-04-05 17:30:28 | 000,000,104 | ---- | M] () – C:\WINDOWS\System32\nvapps.xml [2011-04-02 23:05:14 | 000,198,144 | RHS- | M] () – C:\WINDOWS\System32\arking.exe [2011-03-09 15:55:36 | 000,116,736 | RHS- | M] () – C:\WINDOWS\System32\mgking1.dll [2011-03-31 16:23:00 | 000,181,760 | RHS- | C] () – C:\w9.exe [2011-03-31 16:22:51 | 000,174,592 | RHS- | C] () – C:\io3yalc.exe [2010-12-14 21:09:24 | 000,118,272 | RHS- | C] () – C:\WINDOWS\System32\arking1.dll [2010-11-28 16:04:28 | 000,198,144 | RHS- | C] () – C:\WINDOWS\System32\arking.exe [2010-11-17 20:10:12 | 000,115,200 | RHS- | C] () – C:\WINDOWS\System32\mgking2.dll [2010-11-14 19:38:54 | 000,116,736 | RHS- | C] () – C:\WINDOWS\System32\mgking1.dll [2010-11-14 11:54:09 | 000,181,760 | RHS- | C] () – C:\WINDOWS\System32\mgking.exe [2010-11-14 11:54:09 | 000,116,736 | RHS- | C] () – C:\WINDOWS\System32\mgking0.dll :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]

dajesz log z usuwania i nowy log z OTL, dodatkowo z podłączonymi urządzeniami przenośnymi zaprezentuj log z USBFix z opcji deletion:

http://www.teamxscript.org/usbfixTelechargement.html

[Leon1 (Leon$)]

użyj http://www.instalki.pl/programy/downloa … sbFix.html z opcji deletion

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL MOD - [2011-04-05 17:30:44 | 000,113,664 | RHS- | M] () – C:\Documents and Settings\Ja\Ustawienia lokalne\Temp\apiqq0.dll MOD - [2011-04-05 17:30:42 | 000,116,736 | RHS- | M] () – C:\WINDOWS\system32\mgking0.dll O4 - HKLM…\Run: [sunJavaUpdateSched] File not found O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [api32] C:\Documents and Settings\Ja\Ustawienia lokalne\Temp\apiqq.exe () O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [King_ar] C:\WINDOWS\system32\arking.exe () O4 - HKU\S-1-5-21-1229272821-602162358-1801674531-1003…\Run: [king_mg] C:\WINDOWS\system32\mgking.exe () O4 - HKU.DEFAULT…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-19…\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-20…\RunOnce: [nltide_2] File not found O32 - AutoRun File - [2011-04-05 18:34:44 | 000,000,061 | RHS- | M] () - C:\autorun.inf – [FAT32] O32 - AutoRun File - [2010-11-21 18:09:18 | 000,000,061 | RHS- | M] () - D:\AUTORUN.FCB – [NTFS] O32 - AutoRun File - [2011-04-05 18:34:42 | 000,000,061 | RHS- | M] () - D:\autorun.inf – [NTFS] O33 - MountPoints2{18924911-5ba0-11e0-adfd-0016d3601f95}\Shell - “” = AutoRun O33 - MountPoints2{18924911-5ba0-11e0-adfd-0016d3601f95}\Shell\AutoRun\command - “” = F:\AutoRunCardDetector.exe O33 - MountPoints2{4c02cffe-5d6c-11e0-b6ab-806d6172696f}\Shell\AutoRun\command - “” = F:\w9.exe O33 - MountPoints2{4c02cffe-5d6c-11e0-b6ab-806d6172696f}\Shell\open\Command - “” = F:\w9.exe O33 - MountPoints2{6c39b886-d784-11df-a7d7-806d6172696f}\Shell\AutoRun\command - “” = C:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b886-d784-11df-a7d7-806d6172696f}\Shell\open\Command - “” = C:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b887-d784-11df-a7d7-806d6172696f}\Shell\AutoRun\command - “” = D:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6c39b887-d784-11df-a7d7-806d6172696f}\Shell\open\Command - “” = D:\w9.exe – [2010-11-26 23:23:12 | 000,181,760 | RHS- | M] () O33 - MountPoints2{6e457a80-de19-11df-ad68-0016d3601f95}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{6e457a80-de19-11df-ad68-0016d3601f95}\Shell\open\Command - “” = F:\io3yalc.exe O33 - MountPoints2{74660498-20cc-11e0-addc-0016d3601f95}\Shell\AutoRun\command - “” = F:\w9.exe O33 - MountPoints2{74660498-20cc-11e0-addc-0016d3601f95}\Shell\open\Command - “” = F:\w9.exe O33 - MountPoints2{869fc24a-20f2-11e0-adde-0016d3601f95}\Shell - “” = AutoRun O33 - MountPoints2{869fc24a-20f2-11e0-adde-0016d3601f95}\Shell\AutoRun\command - “” = F:\LaunchU3.exe -a O33 - MountPoints2{869fc24b-20f2-11e0-adde-0016d3601f95}\Shell\AutoRun\command - “” = H:\w9.exe O33 - MountPoints2{869fc24b-20f2-11e0-adde-0016d3601f95}\Shell\open\Command - “” = H:\w9.exe O33 - MountPoints2{ba859218-d784-11df-ad50-f203656384ee}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{ba859218-d784-11df-ad50-f203656384ee}\Shell\open\Command - “” = F:\io3yalc.exe O33 - MountPoints2{c447099e-f589-11df-ad88-0016d3601f95}\Shell\AutoRun\command - “” = F:\i00dvoym.exe O33 - MountPoints2{c447099e-f589-11df-ad88-0016d3601f95}\Shell\open\Command - “” = F:\i00dvoym.exe O33 - MountPoints2{d3035853-dd26-11df-ad64-0016d3601f95}\Shell\AutoRun\command - “” = F:\io3yalc.exe O33 - MountPoints2{d3035853-dd26-11df-ad64-0016d3601f95}\Shell\open\Command - “” = F:\io3yalc.exe [2011-03-31 16:20:56 | 000,000,000 | -HSD | C] – C:\FOUND.031 [2011-03-09 17:35:18 | 000,000,000 | -HSD | C] – C:\FOUND.030 [2011-04-05 18:39:14 | 000,000,051 | RHS- | M] () – C:\autorun.inf [2011-04-05 17:30:42 | 000,116,736 | RHS- | M] () – C:\WINDOWS\System32\mgking0.dll [2011-04-02 23:05:14 | 000,198,144 | RHS- | M] () – C:\WINDOWS\System32\arking.exe [2011-03-09 15:55:36 | 000,116,736 | RHS- | M] () – C:\WINDOWS\System32\mgking1.dll [2011-03-31 16:23:00 | 000,181,760 | RHS- | C] () – C:\w9.exe [2011-03-31 16:22:51 | 000,174,592 | RHS- | C] () – C:\io3yalc.exe [2011-03-31 16:22:51 | 000,000,061 | RHS- | C] () – C:\autorun.inf [2010-12-14 21:09:24 | 000,118,272 | RHS- | C] () – C:\WINDOWS\System32\arking1.dll [2010-11-17 20:10:12 | 000,115,200 | RHS- | C] () – C:\WINDOWS\System32\mgking2.dll [2010-11-14 11:54:09 | 000,181,760 | RHS- | C] () – C:\WINDOWS\System32\mgking.exe :Files autorun.inf /alldrives arking.exe /alldrives arking1.dll /alldrives mgking.exe /alldrives mgking1.dll /alldrives mgking2.dll /alldrives :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [CLEARALLRESTOREPOINTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

potem nowy log OTL robiony opcją Run Scan (Skanuj)