FB wirus - otl i extras

[rafmil10]

Witam zrobiłem skan i załączam OTL i extras. Co dalej? Przepraszam ale jestem zielony w tych sprawach a zwiariować idzie od tego wirusa ;/

OTL:Dostępne tylko dla zarejestrowanych użytkowników
extras: Dostępne tylko dla zarejestrowanych użytkowników

Z góry dziękuje za pomoc

[djkamil09061991]

W białe dolne okno Własne opcje skanowania/skrypt w OTL wklej:

:OTL
MOD - [2011-08-20 00:56:24 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
MOD - [2011-08-20 00:33:23 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-7-0\svchost.exe
MOD - [2011-08-20 00:33:23 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-2-0\svchost.exe
SRV - [2011-08-21 14:53:10 | 000,634,880 | ---- | M] () [Auto | Running] -- C:\Windows\update.2\svchost.exe -- (srviecheck)
SRV - [2011-08-20 00:50:21 | 000,348,672 | ---- | M] () [Auto | Running] -- C:\Windows\update.5.0\svchost.exe -- (srvbtcclient)
SRV - [2011-08-20 00:47:24 | 000,382,464 | ---- | M] () [Auto | Running] -- C:\Windows\update.7.1\svchostdriver.exe -- (ddservice)
SRV - [2011-08-20 00:45:35 | 000,258,048 | ---- | M] () [Auto | Running] -- C:\Windows\sysdriver32.exe -- (srvsysdriver32)
SRV - [2011-08-20 00:33:23 | 001,215,488 | -H-- | M] () [Auto | Running] -- C:\Windows\update.1\svchost.exe -- (wxpdrivers)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [1339571.exe] C:\Windows\TEMP\1339571.exe ()
O4 - HKLM..\Run: [2600704-loader2.exe] C:\Windows\Temp\2600704-loader2.exe ()
O4 - HKLM..\Run: [3958041.exe] C:\Windows\Temp\3958041.exe ()
O4 - HKLM..\Run: [4742685.exe] C:\Windows\Temp\4742685.exe ()
O4 - HKLM..\Run: [avast] File not found
O4 - HKLM..\Run: [Chew7Hale] C:\Windows\System32\hale.exe ()
O4 - HKLM..\Run: [egui] File not found
O4 - HKLM..\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe ()
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\Windows\update.tray-2-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] C:\Windows\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] File not found
O4 - HKU\S-1-5-21-1036634806-4252851720-2425627376-1000..\Run: [] File not found
O4 - HKU\S-1-5-21-1036634806-4252851720-2425627376-1000..\Run: [LaunchList] File not found
O31 - SafeBoot: AlternateShell - services32.exe
[2011-08-20 01:12:05 | 000,000,000 | ---D | C] -- C:\Windows\ufa
[2011-08-20 01:12:05 | 000,000,000 | ---D | C] -- C:\Windows\rpcminer
[2011-08-20 01:12:05 | 000,000,000 | ---D | C] -- C:\Windows\phoenix
[2011-08-20 01:04:05 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0-lnk
[2011-08-20 01:04:05 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0
[2011-08-20 00:50:22 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011-08-20 00:48:37 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011-08-20 00:47:25 | 000,000,000 | -H-D | C] -- C:\Windows\update.7.1
[2011-08-20 00:40:21 | 000,000,000 | ---D | C] -- C:\Windows\av_ico
[2011-08-20 00:38:34 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011-08-20 00:38:31 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-2-0-lnk
[2011-08-20 00:38:31 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-2-0
[2011-08-21 15:48:57 | 000,000,179 | ---- | M] () -- C:\Windows\info1
[2011-08-21 14:53:41 | 000,000,734 | ---- | M] () -- C:\Windows\System32\drivers\etc\hîsts
[2011-08-20 01:12:04 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011-08-20 01:12:04 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011-08-20 01:12:04 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011-08-20 01:12:04 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011-08-20 00:59:51 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011-08-20 00:56:24 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
[2011-08-20 00:48:35 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011-08-20 00:46:06 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011-08-20 00:45:35 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32_.exe
[2011-08-20 00:45:35 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32.exe
[2011-08-20 00:48:36 | 004,636,907 | ---- | C] () -- C:\Windows\geoiplis
@Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:C8B8CEBD

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[resethosts]

Uruchom to poprzez Wykonaj skrypt i zatwierdź restart.
Po restarcie wykonaj nowy zestaw logów OTL oraz pokaż raport z usuwania OTL powstały po wykonaniu powyższego skryptu.