Fejsbukowy wirus.

[Barry]

Witam mam problem jak większość tutaj.
Chodzi o tego wirusa Wanna laugh.

Wklejam Logi:

OTL: Dostępne tylko dla zarejestrowanych użytkowników

Extras: Dostępne tylko dla zarejestrowanych użytkowników

[djkamil09061991]

W białe dolne okno Własne opcje skanowania/skrypt w OTL wklej:

:OTL
SRV - [2011-08-20 13:44:08 | 000,382,464 | ---- | M] () [Auto | Stopped] -- C:\Windows\update.7.1\svchostdriver.exe -- (ddservice)
SRV - [2011-08-20 13:42:44 | 000,258,048 | ---- | M] () [Auto | Running] -- C:\Windows\sysdriver32.exe -- (srvsysdriver32)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [22244914-loader2.exe] C:\Windows\Temp\22244914-loader2.exe ()
O4 - HKLM..\Run: [2346544.exe] C:\Users\Bary\AppData\Local\Temp\2346544.exe ()
O4 - HKLM..\Run: [3577398.exe] C:\Windows\Temp\3577398.exe ()
O4 - HKLM..\Run: [4408618.exe] C:\Windows\Temp\4408618.exe ()
O4 - HKLM..\Run: [4490679.exe] C:\Windows\Temp\4490679.exe ()
O4 - HKLM..\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe ()
O4 - HKLM..\Run: [wxpdrv] C:\Windows\update.1\svchost.exe ()
O4 - HKCU..\Run: [cacaoweb] File not found
O4 - HKCU..\Run: [MSSMSGS] File not found
O31 - SafeBoot: AlternateShell - services32.exe
[2011-08-20 13:57:23 | 000,000,000 | ---D | C] -- C:\Windows\ufa
[2011-08-20 13:57:23 | 000,000,000 | ---D | C] -- C:\Windows\rpcminer
[2011-08-20 13:57:23 | 000,000,000 | ---D | C] -- C:\Windows\phoenix
[2011-08-20 13:46:32 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011-08-20 13:45:32 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011-08-20 13:44:09 | 000,000,000 | -H-D | C] -- C:\Windows\update.7.1
[2011-08-20 13:42:22 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011-08-21 15:28:49 | 000,000,734 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hîsts
[2011-08-21 15:11:21 | 000,000,179 | ---- | M] () -- C:\Windows\info1
[2011-08-20 13:57:22 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011-08-20 13:57:22 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011-08-20 13:57:22 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011-08-20 13:57:22 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011-08-20 13:47:15 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
[2011-08-20 13:43:30 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011-08-20 13:43:15 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011-08-20 13:42:44 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32_.exe
[2011-08-20 13:42:44 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32.exe
[2011-08-20 13:41:30 | 001,182,208 | ---- | M] () -- C:\Windows\services32.exe
[2011-08-20 13:43:32 | 004,636,907 | ---- | C] () -- C:\Windows\geoiplist
@Alternate Data Stream - 145 bytes -> C:\ProgramData\Temp:AB689DEA

:Files
C:\Users\Bary\AppData\Local\Temp*.html

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[resethosts]

Uruchom to poprzez Wykonaj skrypt i zatwierdź restart.
Po restarcie wykonaj nowy zestaw logów OTL oraz pokaż raport z usuwania OTL powstały po wykonaniu powyższego skryptu.