Po usunieciu infekcji zainstaluj aktualizacje do:
Java(TM) 6 Update 15
Adobe Reader 6.0 CE
Opera 10.10
Zrob skan przy pomocy mbam oraz cureit.
Wykonaj skrypt w OTL:
:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
http://start.facemoods.com/?a=iron&s={searchTerms}&f=4
IE - HKU\S-1-5-21-3904847517-2762031198-712403611-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://www.qooqlle.com/
FF - prefs.js..browser.search.selectedEngine: "qooqlle"
FF - prefs.js..browser.startup.homepage: "http://www.qooqlle.com/"
[2010-01-20 13:13:52 | 000,000,921 | ---- | M] () -- C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5b3n95wb.default\searchplugins\conduit.xml
[2011-07-20 20:35:57 | 000,001,860 | ---- | M] () -- C:\Users\David\AppData\Roaming\Mozilla\Firefox\Profiles\5b3n95wb.default\searchplugins\search.xml
[2011-03-16 21:37:13 | 000,002,047 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml
[2011-07-19 09:12:18 | 000,000,780 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo.xml
O3 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001\..\Toolbar\WebBrowser: (no name) - {2C688203-7EB3-4327-9995-1CB417BA23F9} - No CLSID value found.
O3 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001\..\Toolbar\WebBrowser: (no name) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - No CLSID value found.
O3 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [csrs] C:\ProgramData\csrs.exe (Created with WinAutomation (http://www.WinAutomation.com))
O4 - HKLM..\Run: [NWEReboot] File not found
O4 - HKLM..\Run: [OFFICEKB] File not found
O4 - HKLM..\Run: [svhost] C:\Program Files\Common Files\svhost.exe ()
O4 - HKLM..\Run: [winloqon] C:\ProgramData\winloqon.exe (Created with WinAutomation (http://www.WinAutomation.com))
O4 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001..\Run: [ares] File not found
O4 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001..\Run: [BitComet] File not found
O4 - HKU\S-1-5-21-3904847517-2762031198-712403611-1001..\Run: [cdoosoft] File not found
O33 - MountPoints2\{41aa3f73-3ab6-11e0-b924-001a4d7ac336}\Shell - "" = AutoRun
O33 - MountPoints2\{41aa3f73-3ab6-11e0-b924-001a4d7ac336}\Shell\AutoRun\command - "" = "K:\WD SmartWare.exe" autoplay=true
O33 - MountPoints2\{645e146b-a6b3-11de-b200-001a4d7ac336}\Shell - "" = AutoRun
O33 - MountPoints2\{645e146b-a6b3-11de-b200-001a4d7ac336}\Shell\AutoRun\command - "" = K:\LaunchU3.exe -a
O33 - MountPoints2\{690bd832-e862-11dc-b4eb-001a4d7ac336}\Shell - "" = AutoRun
O33 - MountPoints2\{690bd832-e862-11dc-b4eb-001a4d7ac336}\Shell\AutoRun\command - "" = J:\autorun.exe
O33 - MountPoints2\{690bd832-e862-11dc-b4eb-001a4d7ac336}\Shell\setup\command - "" = J:\setup.exe
O33 - MountPoints2\{84f746ce-2cb4-11df-b9b7-ae694d7ac336}\Shell\AutoRun\command - "" = rfg.exe
O33 - MountPoints2\{84f746ce-2cb4-11df-b9b7-ae694d7ac336}\Shell\open\Command - "" = rfg.exe
O33 - MountPoints2\{c1d78b2c-de97-11de-b0b1-001a4d7ac336}\Shell\AutoRun\command - "" = K:\SamsungSoftware\APPInst.exe
[2011-05-28 18:54:37 | 000,331,776 | RHS- | C] (Created with WinAutomation (http://www.WinAutomation.com)) -- C:\ProgramData\winloqon.exe
[2011-05-28 18:54:36 | 000,339,968 | RHS- | C] (Created with WinAutomation (http://www.WinAutomation.com)) -- C:\ProgramData\csrs.exe
[2011-05-28 18:54:22 | 006,855,168 | RHS- | M] () -- C:\Program Files\Common Files\svhost.exe
:Files
C:\Users\David\AppData\Local\Temp*.html
:Commands
[emptytemp]
Po wykonaniu daj nowy log z OTL, tym razem NIC nie zmieniaj.
