Odinstaluj:
Crawler Toolbar with Web Security Guard
Fix My Registry v2.9
Skaner on-line mks_vir
Spyware Terminator
Po usunieciu infekcji zainstaluj aktualizacje do:
Java(TM) 6 Update 21
Adobe Reader 7.0.9
Opera 11.10
Zainstaluj SP3.
Wykonaj skrypt w OTL:
:OTL
PRC - [2011-07-26 09:59:00 | 000,181,248 | ---- | M] () -- C:\Documents and Settings\user\Ustawienia lokalne\temp\Udh.exe
PRC - [2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazod.exe
SRV - File not found [Auto | Stopped] -- -- (Xyqus)
SRV - File not found [Auto | Stopped] -- -- (VideoAcceleratorService)
SRV - File not found [On_Demand | Stopped] -- -- (GoogleDesktopManager-051210-111108)
IE - HKU\S-1-5-21-1409082233-920026266-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://174.37.200.81
IE - HKU\S-1-5-21-1409082233-920026266-839522115-1003\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Livebox\SearchURLHook\SearchPageURL.dll ()
O2 - BHO: (&Crawler Toolbar Helper) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKLM\..\Toolbar: (Pasek &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O3 - HKU\S-1-5-21-1409082233-920026266-839522115-1003\..\Toolbar\ShellBrowser: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No CLSID value found.
O3 - HKU\S-1-5-21-1409082233-920026266-839522115-1003\..\Toolbar\WebBrowser: (Pasek &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com)
O4 - HKU\S-1-5-21-1409082233-920026266-839522115-1003..\Run: [8DDYX0ZBPZ] C:\Documents and Settings\user\Ustawienia lokalne\temp\Udh.exe ()
O4 - HKU\S-1-5-21-1409082233-920026266-839522115-1003..\Run: [SpywareTerminatorUpdate] C:\Program Files\Spyware Terminator\SpywareTerminatorUpdate.exe (Crawler.com)
O4 - HKU\S-1-5-21-1409082233-920026266-839522115-1003..\Run: [XMZH42I4GI] C:\WINDOWS\Ufazod.exe ()
[2011-07-26 13:06:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Pasek Crawler
[2011-07-26 13:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2011-07-27 13:50:07 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2011-07-27 13:44:22 | 000,000,244 | -H-- | M] () -- C:\WINDOWS\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
[2011-07-27 13:35:54 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
[2011-07-27 11:45:09 | 000,000,300 | -HS- | M] () -- C:\WINDOWS\tasks\omvgrftf.job
[2011-07-26 10:00:01 | 000,064,000 | RHS- | M] () -- C:\WINDOWS\System32\wscsvci.dll
[2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazoe.exe
[2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazod.exe
[2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazoc.exe
[2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazob.exe
[2011-07-26 09:58:57 | 000,173,568 | ---- | M] () -- C:\WINDOWS\Ufazoa.exe
[2010-11-17 01:05:10 | 000,000,143 | ---- | C] () -- C:\Documents and Settings\user\Dane aplikacji\scgdfgasfbh.bat
[2010-01-28 17:41:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Wru
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Opera\Opera\temporary_downloads\facebook-pic00023434023402.exe" =-
:Commands
[emptytemp]
Po wykonaniu daj nowy log.
