WIRUS z facebooka hi.how are you?!

[arturartur]

proszę o pomoc
Dostępne tylko dla zarejestrowanych użytkowników Extras
Dostępne tylko dla zarejestrowanych użytkowników OTL

Już jestem wdzięczny, pleeeese

[djkamil09061991]

arturartur Uruchom OTL i w oknie Własne opcje skanowania/Script wklej to:

:OTL
MOD - [2011-08-22 21:10:01 | 000,137,728 | ---- | M] () -- C:\Windows\systemup.exe
MOD - [2011-08-11 00:41:24 | 000,273,920 | ---- | M] () -- C:\Windows\update.3\svchost.exe
MOD - [2011-07-25 13:34:37 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
SRV - [2011-08-21 21:45:01 | 000,382,464 | ---- | M] () [Auto | Running] -- C:\Windows\update.7.1\svchostdriver.exe -- (ddservice)
SRV - [2011-07-25 16:23:53 | 000,256,000 | ---- | M] () [Auto | Running] -- C:\Windows\sysdriver32.exe -- (srvsysdriver32)
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaulturl: "http://search.winamp.com/search/search?query={searchTerms}&invocationType=tb50-ff-winamp-chromesbox-en-us&tb_uuid=20110329151436152&tb_oid=27-12-2010&tb_mrud=29-03-2011&query="
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - File not found
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - File not found
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
O3 - HKLM\..\Toolbar: (vShare Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [7010666.exe] C:\Windows\Temp\7010666.exe ()
O4 - HKLM..\Run: [86047899-loader2.exe] C:\Windows\Temp\86047899-loader2.exe ()
O4 - HKLM..\Run: [9302793.exe] C:\Windows\Temp\9302793.exe ()
O4 - HKLM..\Run: [9454703.exe] C:\Windows\Temp\9454703.exe ()
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [avast] File not found
O4 - HKLM..\Run: [l1rezerv.exe] C:\Windows\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\Windows\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\Windows\sysdriver32_.exe ()
O4 - HKLM..\Run: [systemup] C:\Windows\systemup.exe ()
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\Windows\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [w_distrib.exe] C:\Windows\update.3\svchost.exe ()
O4 - HKLM..\Run: [wxpdrv] C:\Windows\services32.exe ()
O4 - HKU\S-1-5-21-2813612389-1769262059-3843914376-1000..\Run: [EA Core] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 0
O31 - SafeBoot: AlternateShell - services32.exe
O32 - AutoRun File - [2010-09-11 01:40:25 | 000,000,000 | R--D | M] - E:\AutoRun -- [ UDF ]
O32 - AutoRun File - [2010-09-11 01:40:30 | 000,439,056 | R--- | M] (Electronic Arts) - E:\AutoRun.exe -- [ UDF ]
O32 - AutoRun File - [2010-09-11 01:40:29 | 008,098,816 | R--- | M] () - E:\autorun.dat -- [ UDF ]
O32 - AutoRun File - [2010-09-11 01:40:02 | 000,000,141 | R--- | M] () - E:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (aswBoot.exe /A:"*" /L:"English" /KBD:2 /wow /dir:"C:\PROGRA~1\AVASTS~1\Avast\defs\11081000")
[2011-08-21 21:45:02 | 000,000,000 | -H-D | C] -- C:\Windows\update.7.1
[2011-08-11 00:41:25 | 000,000,000 | -H-D | C] -- C:\Windows\update.3
[2011-07-25 13:52:27 | 000,000,000 | ---D | C] -- C:\Windows\ufa
[2011-07-25 13:52:27 | 000,000,000 | ---D | C] -- C:\Windows\rpcminer
[2011-07-25 13:52:27 | 000,000,000 | ---D | C] -- C:\Windows\phoenix
[2011-07-25 13:40:53 | 000,000,000 | ---D | C] -- C:\Windows\av_ico
[2011-07-25 13:34:45 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011-07-25 13:34:18 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011-07-25 13:27:54 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011-07-25 13:27:53 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0-lnk
[2011-07-25 13:27:53 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0
[2011-08-22 22:01:43 | 000,000,734 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hîsts
[2011-08-22 21:10:02 | 000,000,269 | ---- | M] () -- C:\Windows\info1
[2011-08-22 21:10:01 | 000,137,728 | ---- | M] () -- C:\Windows\systemup.exe
[2011-07-25 16:23:53 | 000,256,000 | ---- | M] () -- C:\Windows\sysdriver32_.exe
[2011-07-25 16:23:53 | 000,256,000 | ---- | M] () -- C:\Windows\sysdriver32.exe
[2011-07-25 13:52:26 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011-07-25 13:52:26 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011-07-25 13:52:26 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011-07-25 13:52:26 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011-07-25 13:34:38 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011-07-25 13:34:37 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
[2011-07-25 13:31:17 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011-07-25 13:16:21 | 001,185,280 | ---- | M] () -- C:\Windows\services32.exe
[2011-07-25 13:34:39 | 004,636,907 | ---- | C] () -- C:\Windows\geoiplist

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Users\asus\Downloads\Flash-Player.exe"=-
"C:\Windows\update.1\svchost.exe"=-
"C:\Windows\update.2\svchost.exe"=-
"C:\Windows\update.3\svchost.exe"=-

:Commands
[emptyflash]
[resethosts]
[emptytemp]

Uruchom to poprzez Wykonaj skrypt i zatwierdź restart.
Po restarcie wykonaj nowy zestaw logów OTL oraz pokaż raport z usuwania OTL powstały po wykonaniu powyższego skryptu.