proszę o pomoc w sprawie wirusa z facebooka

[Jenijeni]

Tak jak w temacie. Wirus "hi, how are you". Bardzo proszę o pomoc. Tutaj raporty: Dostępne tylko dla zarejestrowanych użytkowników

pozdrawiam

[djkamil09061991]

Z poziomu Dodaj/usuń programy odinstaluj śmieci: conduitEngine,facemoods
W białe dolne okno Własne opcje skanowania/skrypt w OTL wklej:

:OTL
SRV - File not found [On_Demand | Stopped] -- -- (McComponentHostService)
SRV - [2011-07-27 23:07:12 | 000,348,672 | ---- | M] () [Auto | Running] -- C:\Windows\update.5.0\svchost.exe -- (srvbtcclient)
SRV - [2011-07-27 23:06:06 | 000,502,272 | ---- | M] () [Auto | Running] -- C:\Windows\update.2\svchost.exe -- (srviecheck)
SRV - [2011-07-25 23:24:10 | 000,256,000 | ---- | M] () [Auto | Running] -- C:\Windows\sysdriver32.exe -- (srvsysdriver32)
SRV - [2011-07-23 20:48:08 | 001,185,792 | -H-- | M] () [Auto | Running] -- C:\Windows\update.1\svchost.exe -- (wxpdrivers)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = Dostępne tylko dla zarejestrowanych użytkowników{searchTerms}&f=4
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
FF - prefs.js..browser.search.defaultthis.engineName: "4shared Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "4shared Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2233703&SearchSource=13"
FF - prefs.js..extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1
FF - prefs.js..keyword.URL: "http://start.facemoods.com/results.php?f=5&a=wbst&q="
[2011-01-07 22:02:41 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\k2vpacj1.default\extensions\ffxtlbr@Facemoods.com
O2 - BHO: (4shared.com Toolbar) - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files\4shared.com\prxtb4sha.dll (Conduit Ltd.)
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (4shared.com Toolbar) - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files\4shared.com\prxtb4sha.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodsTlbr.dll (facemoods.com)
O3 - HKCU\..\Toolbar\WebBrowser: (4shared.com Toolbar) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - C:\Program Files\4shared.com\prxtb4sha.dll (Conduit Ltd.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [1389608.exe] C:\Windows\Temp\1389608.exe ()
O4 - HKLM..\Run: [2212821.exe] C:\Windows\Temp\2212821.exe ()
O4 - HKLM..\Run: [3314107.exe] C:\Users\user\AppData\Local\Temp\3314107.exe ()
O4 - HKLM..\Run: [66605105-loader2.exe] C:\Windows\Temp\66605105-loader2.exe ()
O4 - HKLM..\Run: [8896227.exe] C:\Windows\Temp\8896227.exe ()
O4 - HKLM..\Run: [9455187.exe] C:\Users\user\AppData\Local\Temp\9455187.exe ()
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.17.3\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe ()
O4 - HKLM..\Run: [systemup] C:\Windows\systemup.exe ()
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\Windows\update.tray-12-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] C:\Windows\update.tray-9-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico2] C:\Windows\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [w_distrib.exe] C:\Windows\update.3\svchost.exe ()
O4 - HKLM..\Run: [wxpdrv] C:\Windows\services32.exe ()
O4 - HKCU..\Run: [ares] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O31 - SafeBoot: AlternateShell - services32.exe
O32 - AutoRun File - [2009-06-22 15:16:32 | 000,000,035 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
[2011-07-25 23:07:37 | 000,000,000 | -H-D | C] -- C:\Windows\update.3
[2011-07-24 22:14:19 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0-lnk
[2011-07-24 22:14:19 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0
[2011-07-24 00:05:28 | 000,000,000 | ---D | C] -- C:\Windows\ufa
[2011-07-24 00:05:28 | 000,000,000 | ---D | C] -- C:\Windows\rpcminer
[2011-07-24 00:05:28 | 000,000,000 | ---D | C] -- C:\Windows\phoenix
[2011-07-23 21:45:26 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011-07-23 21:03:57 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011-07-23 21:01:24 | 000,000,000 | ---D | C] -- C:\Windows\av_ico
[2011-07-23 20:59:49 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011-07-23 20:59:38 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-9-0-lnk
[2011-07-23 20:59:38 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-9-0
[2011-07-23 20:59:38 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-12-0-lnk
[2011-07-23 20:59:38 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-12-0
[2011-07-27 23:07:13 | 000,000,202 | ---- | M] () -- C:\Windows\info1
[2011-07-25 23:24:10 | 000,256,000 | ---- | M] () -- C:\Windows\sysdriver32_.exe
[2011-07-25 23:24:10 | 000,256,000 | ---- | M] () -- C:\Windows\sysdriver32.exe
[2011-07-24 22:11:32 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2011-07-24 00:05:27 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011-07-24 00:05:27 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011-07-24 00:05:27 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011-07-24 00:05:27 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011-07-23 21:47:42 | 000,114,176 | ---- | M] () -- C:\Windows\systemup.exe
[2011-07-23 21:05:42 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
[2011-07-23 21:04:29 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011-07-23 21:02:40 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011-07-23 20:48:08 | 001,185,792 | ---- | M] () -- C:\Windows\services32.exe
[2011-07-17 03:24:20 | 004,636,907 | ---- | M] () -- C:\Windows\geoiplist

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[resethosts]

Uruchom to poprzez Wykonaj skrypt i zatwierdź restart.
Po restarcie wykonaj nowy zestaw logów OTL oraz pokaż raport z usuwania OTL powstały po wykonaniu powyższego skryptu.

[Jenijeni]

Bardzo dziękuje:) już wszystko jest ok.

[djkamil09061991]

Bardzo dziękuje:) już wszystko jest ok.

Wypadałoby pokazać logi o które prosiłem