Facebook-virus-flash

**Posty:** 1 · przez **kfpp** 20 Sie 2011, 23:10

Witam
Jak widzicie po temacie, jestem kolejną ofiarą, która padła łupem tego virusa. Jednak nie potrafię sobie z tym poradzić i proszę was o pomoc.
Całą historię pewnie znacie z innych tematów, jak można złapać virusa, także tego chyba nie musze pisać.

Ekstras.txt : http://wklej.org/id/579911/

OTL.txt: http://wklej.org/id/579912/

RSIT x64: http://wklej.org/id/579768/

Bardzo byłbym wdzięczny za pomoc waszą.

**Posty:** 18165 · przez **wojtas** 21 Sie 2011, 20:14

odinstaluj : BrotherSoft Extreme Toolbar, Conduit Engine, HyperCam Toolbar, Winamp Toolbar,MediaBar

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
PRC - [2011-08-20 15:37:34 | 000,579,584 | ---- | M] () -- C:\Users\Adrian\Desktop\firefox.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:16:49 | 000,348,672 | ---- | M] () -- C:\Windows\update.5.0\svchost.exe
PRC - [2011-08-19 15:09:26 | 000,632,832 | ---- | M] () -- C:\Windows\update.2\svchost.exe
PRC - [2011-08-19 15:09:26 | 000,632,832 | ---- | M] () -- C:\Windows\update.2\svchost.exe
PRC - [2011-08-19 15:07:08 | 000,382,464 | ---- | M] () -- C:\Windows\update.7.1\svchostdriver.exe
PRC - [2011-08-19 15:04:10 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32.exe
PRC - [2011-08-19 14:51:46 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-7-0\svchost.exe
PRC - [2011-08-19 14:51:46 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-7-0\svchost.exe
PRC - [2011-08-19 14:51:46 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-7-0\svchost.exe
PRC - [2011-08-19 14:51:46 | 001,215,488 | -H-- | M] () -- C:\Windows\update.1\svchost.exe
PRC - [2011-06-29 12:20:24 | 000,743,936 | ---- | M] (Ufasoft) -- C:\Windows\ufa\ufa.exe
MOD - [2011-08-20 15:37:34 | 000,579,584 | ---- | M] () -- C:\Users\Adrian\Desktop\firefox.exe
MOD - [2011-08-19 14:51:46 | 001,215,488 | -H-- | M] () -- C:\Windows\update.tray-7-0\svchost.exe
SRV - [2011-08-19 15:07:08 | 000,382,464 | ---- | M] () [Auto | Running] -- C:\Windows\update.7.1\svchostdriver.exe -- (ddservice)
SRV - [2011-08-19 15:04:10 | 000,258,048 | ---- | M] () [Auto | Running] -- C:\Windows\sysdriver32.exe -- (srvsysdriver32)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/hypercam/{C2A281F3-AC2D-45EC-9A20-557F677BC2E3}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=gear&s={searchTerms}&f=4
IE - HKLM\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\S-1-5-21-3002999088-3213277068-1542237471-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2776682
IE - HKU\S-1-5-21-3002999088-3213277068-1542237471-1000\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - C:\Program Files (x86)\BrotherSoft_Extreme\prxtbBrot.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3002999088-3213277068-1542237471-1000\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL LLC.)
IE - HKU\S-1-5-21-3002999088-3213277068-1542237471-1000\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files (x86)\HyperCam Toolbar\tbhelper.dll ()

FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.defaultthis.engineName: "BrotherSoft Extreme Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2776682&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "iMesh Web Search"
FF - prefs.js..browser.search.selectedEngine: "Web Search..."
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "http://vshare.toolbarhome.com/?hp=df"
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.2.0185
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..keyword.URL: "http://search.imesh.com/web?src=ffb&systemid=1&q="
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
[2010-10-09 19:36:15 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2011-04-18 23:40:16 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
[2011-06-11 13:11:57 | 000,000,000 | ---D | M] (BrotherSoft Extreme Community Toolbar) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\{51a86bb3-6602-4c85-92a5-130ee4864f13}
[2011-05-23 20:44:22 | 000,000,000 | ---D | M] (HyperCam Toolbar) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}
[2011-06-11 13:11:55 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\engine@conduit.com
[2011-05-01 21:39:56 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Adrian\AppData\Roaming\mozilla\Firefox\Profiles\wvx4mrxm.default\extensions\vshare@toolbar
[2011-03-21 15:07:12 | 000,000,941 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\conduit.xml
[2011-04-16 00:29:44 | 000,002,059 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\daemon-search.xml
[2010-09-02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\iMeshWebSearch.xml
[2011-05-23 21:39:02 | 000,002,374 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\search.xml
[2011-06-11 21:40:53 | 000,001,583 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\web-search.xml
[2010-10-09 19:36:53 | 000,001,196 | ---- | M] () -- C:\Users\Adrian\AppData\Roaming\Mozilla\Firefox\Profiles\wvx4mrxm.default\searchplugins\winamp-search.xml
[2011-05-27 00:04:26 | 000,002,047 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrch.xml
[2010-09-02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\iMeshWebSearch.xml
O4:64bit: - HKLM..\Run: [Setwallpaper] File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [avast5] File not found
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\Windows\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] C:\Windows\services32.exe ()
O4 - HKU\S-1-5-21-3002999088-3213277068-1542237471-1000..\Run: [ALLUpdate] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\vsharechrome {3F3A4B8A-86FC-43A4-BB00-6D7EBE9D4484} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
[2011-08-19 15:16:50 | 000,000,000 | -H-D | C] -- C:\Windows\update.5.0
[2011-08-19 15:09:27 | 000,000,000 | -H-D | C] -- C:\Windows\update.2
[2011-08-19 15:07:09 | 000,000,000 | -H-D | C] -- C:\Windows\update.7.1
[2011-08-19 15:04:04 | 000,000,000 | ---D | C] -- C:\Windows\av_ico
[2011-08-19 15:02:39 | 000,000,000 | -H-D | C] -- C:\Windows\update.1
[2011-08-19 15:02:37 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0-lnk
[2011-08-19 15:02:37 | 000,000,000 | -H-D | C] -- C:\Windows\update.tray-7-0
[2011-08-19 15:19:28 | 000,000,179 | ---- | M] () -- C:\Windows\info1
[2011-08-19 15:18:00 | 005,589,370 | ---- | M] () -- C:\Windows\phoenix.rar
[2011-08-19 15:18:00 | 000,246,272 | ---- | M] () -- C:\Windows\unrar.exe
[2011-08-19 15:18:00 | 000,182,617 | ---- | M] () -- C:\Windows\ufa.rar
[2011-08-19 15:17:59 | 001,075,284 | ---- | M] () -- C:\Windows\rpcminer.rar
[2011-08-19 15:17:27 | 000,232,960 | ---- | M] () -- C:\Windows\l1rezerv.exe
[2011-08-19 15:10:45 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2011-08-19 15:06:39 | 000,904,792 | ---- | M] () -- C:\Windows\geoiplist.rar
[2011-08-19 15:05:06 | 000,000,000 | ---- | M] () -- C:\Windows\loader2.exe_ok
[2011-08-19 15:04:10 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32_.exe
[2011-08-19 15:04:10 | 000,258,048 | ---- | M] () -- C:\Windows\sysdriver32.exe
[2011-08-19 14:51:46 | 001,215,488 | ---- | M] () -- C:\Windows\services32.exe
@Alternate Data Stream - 943 bytes -> C:\ProgramData\Temp:24721E3C
@Alternate Data Stream - 130 bytes -> C:\ProgramData\Temp:AB689DEA
@Alternate Data Stream - 117 bytes -> C:\ProgramData\Temp:553CA6CA

:Files
C:\Users\Adrian\AppData\Local\Temp*.html
C:\Windows\ufa

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).