Wirus z facebooka

[bednarska]

]Oczywiście ja też weszłam w ten podejrzany link. Początkowo nie mogłam usunąć pliku, ale zeskanowałam online Nodem i on sobie jakoś poradził. Odinstalowałam też jakieś toolbary, bo analogicznie doradzacie w pozostałych tematach.


Dzięki z góry za pomoc.

OTL.Txt

Log OTL

(94.44 KiB) Ściągnięto 81 razy

Extras.Txt

(86.22 KiB) Ściągnięto 69 razy

a

gmer.txt

(81.05 KiB) Ściągnięto 75 razy

[defacto19]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
PRC - [2012-06-23 01:25:56 | 000,302,592 | ---- | M] () -- C:\Users\Bednarczyk\Desktop\lbsbln9x.exe
MOD - [2012-06-23 01:25:56 | 000,302,592 | ---- | M] () -- C:\Users\Bednarczyk\Desktop\lbsbln9x.exe
SRV - File not found [Auto | Stopped] -- E:\Michał\strona\xampp\service.exe -- (XAMPP)
DRV - File not found [Kernel | Disabled | Stopped] -- System32\Drivers\sptd.sys -- (sptd)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\Admin\AppData\Local\Temp\fxddikoc.sys -- (fxddikoc)
IE - HKLM\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2405280
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\URLSearchHook: {CA3EB689-8F09-4026-AA10-B9534C691CE0} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbhelper.dll ()
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2405280
IE - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
O2 - BHO: (FGCatchUrl) - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll File not found
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.4.8.11.dll File not found
O2 - BHO: (Softonic-Polska Toolbar) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O2 - BHO: (FlashGet GetFlash Class) - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll File not found
O2 - BHO: (TBSB07458 Class) - {FCBCCB87-9224-4B8D-B117-F56D924BEB18} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MartView DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\MartView DB Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Softonic-Polska Toolbar) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Free software Gooofull toolbar) - {C86FF9FA-AEED-451B-A9CC-39A53173AE2E} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbcore3.dll ()
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Softonic-Polska Toolbar) - {C86EB8A9-CCC2-4B6C-B75D-73576ED591BF} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Softonic-Polska Toolbar) - {C86EB8A9-CCC2-4B6C-B75D-73576ED591BF} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\Toolbar\WebBrowser: (MartView DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\MartView DB Toolbar\tbcore3.dll ()
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001\..\Toolbar\WebBrowser: (Softonic-Polska Toolbar) - {C86EB8A9-CCC2-4B6C-B75D-73576ED591BF} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003\..\Toolbar\WebBrowser: (MartView DB Toolbar) - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files\MartView DB Toolbar\tbcore3.dll ()
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003\..\Toolbar\WebBrowser: (Softonic-Polska Toolbar) - {C86EB8A9-CCC2-4B6C-B75D-73576ED591BF} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003\..\Toolbar\WebBrowser: (Free software Gooofull toolbar) - {C86FF9FA-AEED-451B-A9CC-39A53173AE2E} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbcore3.dll ()
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001..\Run: [3xAV] C:\Program Files\Enounce\MySpeed\MySpeed.exe File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001..\Run: [AdobeBridge] File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001..\Run: [KeyTurion] "C:\Program Files\Datpol\KeyTurion.exe" File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1001..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [AQQ] C:\Users\BEDNAR~1\Desktop\AQQ.exe File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [Desktop Notes] E:\POBIERANIE\aplikacje produktynwosc\DesktopNotes.exe File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [Facebook Update] C:\Users\Bednarczyk\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe /autorun File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [itmtqbp] C:\Users\Bednarczyk\AppData\Local\hixlyk.exe File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [KeyTurion] "C:\Program Files\Datpol\KeyTurion.exe" File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden File not found
O4 - HKU\S-1-5-21-34174271-3308388829-3214552451-1003..\Run: [PCinMyHand Server] E:\BUZAN\PC in My Hand\pcinmyhand.exe File not found
O4 - Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\click.to.lnk = C:\Program Files\Axonic\click.to\clicktoapp.exe (Axonic)
O4 - Startup: C:\Users\Bednarczyk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = File not found
O4 - Startup: C:\Users\Bednarczyk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_link.htm File not found
O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files\FlashGet\jc_all.htm File not found
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm File not found
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm File not found
O9 - Extra Button: Free software Gooofull toolbar - {C86FF9FA-AEED-451B-A9CC-39A53173AE2E} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbcore3.dll ()
O9 - Extra 'Tools' menuitem : Free software Gooofull toolbar - {C86FF9FA-AEED-451B-A9CC-39A53173AE2E} - C:\Program Files\iTalk Sync 1.0.1\mybarnse90E4.tmp\tbcore3.dll ()
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.4.8.11.dll/206 File not found
O9 - Extra Button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe File not found
O9 - Extra 'Tools' menuitem : FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe File not found
[2012-06-23 03:20:02 | 000,000,948 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-34174271-3308388829-3214552451-1003UA.job
[2012-06-23 03:14:04 | 000,001,034 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012-06-23 02:42:03 | 000,001,030 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-06-22 21:20:00 | 000,000,926 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-34174271-3308388829-3214552451-1003Core.job
[2012-06-22 15:08:25 | 000,001,126 | ---- | M] () -- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\click.to.lnk
[2012-06-21 10:50:00 | 000,000,972 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job
[2012-06-20 08:35:00 | 000,001,026 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-34174271-3308388829-3214552451-1003Core.job
@Alternate Data Stream - 136 bytes -> C:\ProgramData\Temp:5D68E797
@Alternate Data Stream - 123 bytes -> C:\ProgramData\Temp:1C209B86

:Commands
[emptytemp]
[RESETHOSTS]

Kliknij Wykonaj skrypt.Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.

[Mikou@j]

defacto19, wypadałaby żebyś najpierw przeczytał regulamin, zanim zaczniesz pomagać. Wyedytuj ten post tak jak należy.

[bednarska]

Jeśli chodzi o raport po restarcie to zapisałam go na pulpicie i... nie ma go - dosłownie O.o Więc daję tylko skan OTL.txt

OTL.Txt

(58.51 KiB) Ściągnięto 79 razy

[defacto19]

W OTL użyj opcji Sprzątanie.

zastosuj AdwCleaner z opcji Delete.
http://general-changelog-team.fr/fr/downloads/viewdownload/20-outils-de-xplode/2-adwcleaner

[bednarska]

Zrobione.

Coś jeszcze trzeba zrobić?

[defacto19]

Wykonaj pełne skanowanie programem MBAM Po zakończeniu kliknij Usuń zaznaczone.
http://www.malwarebytes.org/

Użyj Security Check i uaktualnij to co wskaże program
http://www.fixitpc.pl/topic/61-diagnostyka-ogolne-raporty-systemowe/page__p__9515#entry9515

Przeczyść dysk i rejestr CCleaner`em
http://www.piriform.com/CCLEANER

Autor postu otrzymał pochwałę

[Xoran1990]

Potrzebuje pomocy bo nie moge usunąć wirusa MultiBundle.Od kilku dni walcze z wirusem tego typu.

[NieWiem]

Cieszymy się z tego powodu. A może poczytać najpierw?
wszystko-o-logach-aktualizacja-30-01-2012-vt117887.html