Facebook wirus hi. błagam pomocy!!

**Posty:** 1 · przez **brayan5** 23 Sie 2011, 11:56

prosze rowniez o pomoc zlapalem wirusa hi
otl: http://wklej.org/id/582706/

Dodano Dzisiaj, 11:58:
otl extras : http://wklej.org/id/582709/

Dodano Dzisiaj, 12:02:
przeskanowałem malwarebytem usunalem wszystko ale nadal wlacza sie tryb awaryjny mam viste

**Posty:** 2183 · przez **NieWiem** 24 Sie 2011, 09:49

Nie jesteś w stanie odpalić komputera w trybie normalnym?

**Posty:** 85 · przez **kominekl** 24 Sie 2011, 15:35

Odinstaluj -> vShare, Conduit Engine, Softonic-Polska Toolbar. Zainstaluj jakiegoś antywirusa.

Następnie uruchom OTL -> w oknie Własne opcje skanowania/skrypt wklej:

:OTL

SRV - File not found [Auto | Stopped] -- -- (NIHardwareService)
SRV - File not found [Auto | Stopped] -- -- (avast! Antivirus)
IE - HKLM\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.defaultthis.engineName: "free-downloads.net Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q="
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..keyword.URL: "http://vshare.toolbarhome.com/search.aspx?srch=ku&q="
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa2,version=2.0.0: C:\Program Files\Picasa2\npPicasa2.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
[2011-08-01 15:51:13 | 000,000,000 | ---D | M] (free-downloads.net Community Toolbar) -- C:\Users\Grzesiek\AppData\Roaming\mozilla\Firefox\Profiles\ikx53wfe.default\extensions\{ecdee021-0d17-467f-a1ff-c7a115230949}(298)
[2011-03-23 19:54:11 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Grzesiek\AppData\Roaming\mozilla\Firefox\Profiles\ikx53wfe.default\extensions\engine@conduit.com
[2011-05-02 16:41:30 | 000,000,000 | ---D | M] (vShare) -- C:\Users\Grzesiek\AppData\Roaming\mozilla\Firefox\Profiles\ikx53wfe.default\extensions\vshare@toolbar
[2009-01-15 09:42:56 | 000,000,898 | ---- | M] () -- C:\Users\Grzesiek\AppData\Roaming\Mozilla\Firefox\Profiles\ikx53wfe.default\searchplugins\conduit.xml
[2009-06-07 21:01:53 | 000,000,523 | ---- | M] () -- C:\Users\Grzesiek\AppData\Roaming\Mozilla\Firefox\Profiles\ikx53wfe.default\searchplugins\daemon-search.xml
[2011-05-02 16:41:40 | 000,001,583 | ---- | M] () -- C:\Users\Grzesiek\AppData\Roaming\Mozilla\Firefox\Profiles\ikx53wfe.default\searchplugins\web-search.xml
[2009-06-25 19:19:55 | 000,000,000 | ---D | M] (BearShare MediaBar) -- C:\Program Files\Mozilla Firefox\extensions\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}
O2 - BHO: (no name) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No CLSID value found.
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - File not found
O3 - HKLM\..\Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O4 - HKCU..\Run: [iGoD] File not found
O4 - HKCU..\Run: [Rubin] File not found
O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
O33 - MountPoints2\{0ab147b5-3c94-11df-bfd6-002269f3cb98}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\gaiGaeN.eXe
O33 - MountPoints2\{3add7e13-2c17-11df-ac1d-002269f3cb98}\Shell\ArcaVir\command - "" = G:\ArcaSetupExecutor.exe
O33 - MountPoints2\{3add7e13-2c17-11df-ac1d-002269f3cb98}\Shell\AutoRun\command - "" = G:\ArcaSetupExecutor.exe
O33 - MountPoints2\{7511069e-4a46-11df-815c-002269f3cb98}\Shell\AutoRun\command - "" = fk.exe
O33 - MountPoints2\{7511069e-4a46-11df-815c-002269f3cb98}\Shell\open\Command - "" = fk.exe
O33 - MountPoints2\{a70505d3-02dd-11df-be4f-002269f3cb98}\Shell\AutoRun\command - "" = G:\k8jc.exe
O33 - MountPoints2\{a70505d3-02dd-11df-be4f-002269f3cb98}\Shell\open\Command - "" = G:\k8jc.exe
O33 - MountPoints2\{bce62250-3bc5-11de-9a1a-002269f3cb98}\Shell - "" = AutoRun
O33 - MountPoints2\{bce62250-3bc5-11de-9a1a-002269f3cb98}\Shell\AutoRun\command - "" = D:\autorun6e.exe
O33 - MountPoints2\{d6312dca-fad5-11dd-b29e-002269f3cb98}\Shell\AutoRun\command - "" = G:\setise\\zeljko.exe
O33 - MountPoints2\{d6312dca-fad5-11dd-b29e-002269f3cb98}\Shell\explore\command - "" = G:\setise\\\zeljko.exe
O33 - MountPoints2\{d6312dca-fad5-11dd-b29e-002269f3cb98}\Shell\open\command - "" = G:\setise\\\zeljko.exe
@Alternate Data Stream - 24 bytes -> C:\Windows:140A72070FD010CC
@Alternate Data Stream - 129 bytes -> C:\ProgramData\TEMP:A31FAD21

:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Malwarebytes' Anti-Malware (reboot)"=-
"QuickTime Task"=-
"TkBellExe"=-
"ALLUpdate"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

Malwarebytes coś znalazł? Jeśli tak to usuń i podaj raport z tego skanowania.