Wirus "Hi, wanna laugh" logi OTL

[sanchezpr0]

Tak jak w temacie podaje logi z programu OTL.Co robić dalej?

OTL: Dostępne tylko dla zarejestrowanych użytkowników
Extras: Dostępne tylko dla zarejestrowanych użytkowników

[filutka78]

1) Użyj USBFix, >http://www.hotfix.pl/uzytkowanie-programu-usbfix-a310.htm
Kliknij w nim na:DELETION.
Daj raport z tego usuwania.

2) Uruchom OTL i w oknie Własne opcje skanowania/Script wklej to:

:OTL
IE - HKU\S-1-5-21-583907252-1004336348-725345543-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Dostępne tylko dla zarejestrowanych użytkowników
IE - HKU\S-1-5-21-583907252-1004336348-725345543-1001\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-583907252-1004336348-725345543-1001\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
[2011-03-13 21:57:45 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\Uzytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\a4rs3jhp.default\extensions\vshare@toolbar
[2011-08-12 15:55:29 | 000,002,567 | ---- | M] () -- C:\Documents and Settings\Uzytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\a4rs3jhp.default\searchplugins\askcom.xml
[2008-06-25 20:28:17 | 000,002,921 | ---- | M] () -- C:\Documents and Settings\Uzytkownik\Dane aplikacji\Mozilla\Firefox\Profiles\a4rs3jhp.default\searchplugins\daemon-search.xml
O2 - BHO: (no name) - {02996BA0-3866-4B73-A55A-9E17142701B6} - No CLSID value found.
O2 - BHO: (no name) - {BBD383EE-9F8A-4579-AB22-18FED942C025} - No CLSID value found.
O3 - HKU\S-1-5-21-583907252-1004336348-725345543-1001\..\Toolbar\WebBrowser: (no name) - {C11483F7-D7D8-4804-98D8-6055470BB989} - No CLSID value found.
O3 - HKU\S-1-5-21-583907252-1004336348-725345543-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-583907252-1004336348-725345543-1001\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [LanzarL2007] File not found
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [UserFaultCheck] File not found
O30 - LSA: Authentication Packages - (C:\WINDOWS\system32\rqRKEXQI) - File not found
O31 - SafeBoot: AlternateShell - services32.exe
O33 - MountPoints2\{9807096c-f52d-11de-83cd-001a4d4da2dc}\Shell\AutoRun\command - "" = s3ek.exe
O33 - MountPoints2\{9807096c-f52d-11de-83cd-001a4d4da2dc}\Shell\open\Command - "" = s3ek.exe
OO33 - MountPoints2\{99e056c6-b561-11dc-bec2-001a4d4da2dc}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe MS32DLL.dll.vbs
O33 - MountPoints2\{a196dfbe-c39f-11dd-8129-001a4d4da2dc}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe
O33 - MountPoints2\{a63dcaa6-be20-11dd-811b-001a4d4da2dc}\Shell\Auto\command - "" = J:\fun.xls.exe
O33 - MountPoints2\{a63dcaa6-be20-11dd-811b-001a4d4da2dc}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL fun.xls.exe
[2011-08-20 16:29:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011-08-20 15:06:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011-08-20 15:06:20 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix
[2011-08-20 15:01:23 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0
[2011-08-20 14:59:44 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
[2011-08-20 14:59:08 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.7.1
[2011-08-20 14:56:35 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1
[2011-08-20 14:56:28 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011-08-20 14:56:28 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011-08-22 11:37:31 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hîsts
[2011-08-20 15:06:19 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
[2011-08-20 15:06:18 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
[2011-08-20 15:06:18 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
[2011-08-20 15:00:06 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
[2011-08-20 15:00:05 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
[2011-08-20 15:00:05 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011-08-20 14:59:07 | 000,000,202 | ---- | C] () -- C:\WINDOWS\info1
[2011-08-20 14:58:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2008-06-19 15:44:50 | 001,694,792 | -HS- | C] () -- C:\WINDOWS\System32\ctaxavkk.ini
[2008-06-18 15:43:44 | 001,694,612 | -HS- | C] () -- C:\WINDOWS\System32\wsyadthn.ini
[2008-06-16 17:21:33 | 001,687,148 | -HS- | C] () -- C:\WINDOWS\System32\vfnsuhlg.ini
[2008-06-15 17:20:12 | 001,517,797 | -HS- | C] () -- C:\WINDOWS\System32\uhreivxx.ini
[2008-06-15 17:18:58 | 001,521,242 | -HS- | C] () -- C:\WINDOWS\System32\udrcfqyi.ini
[2008-05-27 19:55:45 | 000,002,814 | -HS- | C] () -- C:\WINDOWS\System32\rimvcrww.ini
[2008-05-23 15:37:51 | 000,002,694 | -HS- | C] () -- C:\WINDOWS\System32\eyhmrpnd.ini
[2008-05-21 19:31:59 | 000,002,274 | -HS- | C] () -- C:\WINDOWS\System32\dhgyvkff.ini
[2008-05-19 17:46:29 | 000,002,094 | -HS- | C] () -- C:\WINDOWS\System32\fyrblxjq.ini
[2008-05-18 11:58:38 | 000,001,734 | -HS- | C] () -- C:\WINDOWS\System32\eqgqqowl.ini
[2008-05-17 10:39:07 | 000,001,554 | -HS- | C] () -- C:\WINDOWS\System32\ceepuefb.ini
[2008-05-17 10:38:20 | 000,088,160 | -HS- | C] () -- C:\WINDOWS\System32\IQXEKRqr.ini2
[2008-05-17 10:38:20 | 000,088,160 | -HS- | C] () -- C:\WINDOWS\System32\IQXEKRqr.ini
[2008-05-17 10:33:36 | 000,001,314 | -HS- | C] () -- C:\WINDOWS\System32\vkettksb.ini
[2008-05-14 17:07:31 | 002,898,015 | -HS- | C] () -- C:\WINDOWS\System32\saxcxaao.ini
[2008-05-13 17:07:04 | 001,519,942 | -HS- | C] () -- C:\WINDOWS\System32\pmpejfcp.ini
[2008-05-12 17:05:07 | 001,978,305 | -HS- | C] () -- C:\WINDOWS\System32\yekhxhya.ini
[2008-05-11 14:50:09 | 001,499,859 | -HS- | C] () -- C:\WINDOWS\System32\jqbgpobi.ini
[2008-05-10 13:40:17 | 001,505,103 | -HS- | C] () -- C:\WINDOWS\System32\yngdsypq.ini
[2008-05-09 13:37:27 | 001,504,983 | -HS- | C] () -- C:\WINDOWS\System32\whgfpfbl.ini
[2008-05-09 13:36:22 | 000,234,976 | -HS- | C] () -- C:\WINDOWS\System32\UFfiPXbc.ini2
[2008-05-09 13:36:22 | 000,234,976 | -HS- | C] () -- C:\WINDOWS\System32\UFfiPXbc.ini

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\update.1\svchost.exe"=-
"C:\WINDOWS\services32.exe"=-
"C:\WINDOWS\update.2\svchost.exe"=-

:Commands
[emptyflash]
[emptytemp]
[resethosts]

Kliknij w Wykonaj Script. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania.

F.

[sanchezpr0]

Facebook działa. Dzięki za pomoc.

[djarta]

Lepiej żebyś pokazał wszystkie logi / raporty po operacjach.