logo elektroda
logo elektroda
X
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

Wirus z Facebooka wyłącza komputer i usuwa antywirusa - jak usunąć?

ustaszewski 19 Sie 2011 19:39 1935 5
REKLAMA
  • #1 9841591
    ustaszewski
    Poziom 2  
    Posty: 3
    witam,
    mam ten sam problem co kolega w tym poście
    https://www.elektroda.pl/rtvforum/topic2045517.html

    wchodzę, na facebook i nagle kolega przesyła mi taką wiadomość:
    1.Hi
    2.Wanna Laugh? )
    3.YouTube
    4.I 'll be back
    Link do youtuba, w którym wyświetla się, że muszę zainstalować flash playera. Mam aktualnego, ale za późno się zorientowałem, że cos nie tak. W tak prosty sposób zawirusowałem sobie komputer i system sam usuwa antywira. Proszę o pomoc
    Załączniki:
    • OTL.Txt (89.01 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • #2 9841757
    Kolobos
    Spec od komputerów
    Posty: 85181
    Pomógł: 17173
    Ocena: 10458
    Wykonaj skrypt w OTL:

    :OTL
    PRC - [2011-06-14 15:51:54 | 006,962,815 | ---- | M] () -- C:\WINDOWS\phoenix\phoenix.exe
    MOD - [2011-08-18 20:20:14 | 000,232,960 | ---- | M] () -- C:\WINDOWS\l1rezerv.exe
    MOD - [2011-08-18 20:19:16 | 000,348,672 | ---- | M] () -- C:\WINDOWS\update.5.0\svchost.exe
    MOD - [2011-08-18 20:15:48 | 000,258,048 | ---- | M] () -- C:\WINDOWS\sysdriver32.exe
    MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.tray-7-0\svchost.exe
    MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.tray-12-0\svchost.exe
    MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.1\svchost.exe
    MOD - [2011-06-14 15:51:54 | 006,962,815 | ---- | M] () -- C:\WINDOWS\phoenix\phoenix.exe
    SRV - [2011-08-18 20:19:16 | 000,348,672 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.5.0\svchost.exe -- (srvbtcclient)
    SRV - [2011-08-18 20:18:49 | 000,359,936 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\update.4.1\svchost.exe -- (srvbtc1)
    SRV - [2011-08-18 20:15:48 | 000,258,048 | ---- | M] () [Auto | Running] -- C:\WINDOWS\sysdriver32.exe -- (srvsysdriver32)
    SRV - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () [Auto | Running] -- C:\WINDOWS\update.1\svchost.exe -- (wxpdrivers)
    O4 - HKLM..\Run: [3631519.exe] C:\WINDOWS\TEMP\3631519.exe ()
    O4 - HKLM..\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe ()
    O4 - HKLM..\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe ()
    O4 - HKLM..\Run: [sysdriver32_.exe] File not found
    O4 - HKLM..\Run: [tray_ico] File not found
    O4 - HKLM..\Run: [tray_ico0] C:\WINDOWS\update.tray-7-0\svchost.exe ()
    O4 - HKLM..\Run: [tray_ico1] C:\WINDOWS\update.tray-12-0\svchost.exe ()
    O4 - HKLM..\Run: [tray_ico2] File not found
    O4 - HKLM..\Run: [tray_ico3] File not found
    O4 - HKLM..\Run: [tray_ico4] File not found
    O4 - HKLM..\Run: [wxpdrv] C:\WINDOWS\services32.exe ()
    O31 - SafeBoot: AlternateShell - services32.exe
    [2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
    [2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
    [2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
    [2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\rpcminer
    [2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix
    [2011-08-18 20:19:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\Bitcoin
    [2011-08-18 20:19:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0
    [2011-08-18 20:18:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.4.1
    [2011-08-18 20:17:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\WinRAR
    [2011-08-18 20:17:37 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.3
    [2011-08-18 20:16:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
    [2011-08-18 18:33:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
    [2011-08-18 18:32:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1
    [2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0-lnk
    [2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0
    [2011-08-18 20:26:44 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
    [2011-08-18 20:26:43 | 005,589,370 | ---- | M] () -- C:\WINDOWS\phoenix.rar
    [2011-08-18 20:26:43 | 000,182,617 | ---- | M] () -- C:\WINDOWS\ufa.rar
    [2011-08-18 20:26:40 | 001,075,284 | ---- | M] () -- C:\WINDOWS\rpcminer.rar
    [2011-08-18 20:23:51 | 001,507,840 | ---- | M] () -- C:\WINDOWS\bitcoind.exe
    [2011-08-18 20:21:52 | 000,000,179 | ---- | M] () -- C:\WINDOWS\info1
    [2011-08-18 20:20:14 | 000,232,960 | ---- | M] () -- C:\WINDOWS\l1rezerv.exe
    [2011-08-18 20:18:19 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
    [2011-08-18 20:17:43 | 000,904,792 | ---- | M] () -- C:\WINDOWS\geoiplist.rar
    [2011-08-18 20:17:24 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hîsts
    [2011-08-18 20:26:43 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
    [2011-08-18 20:26:43 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
    [2011-08-18 20:26:40 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
    [2011-08-18 20:21:36 | 001,507,840 | ---- | C] () -- C:\WINDOWS\bitcoind.exe
    [2011-08-18 20:20:18 | 000,232,960 | ---- | C] () -- C:\WINDOWS\l1rezerv.exe
    [2011-08-18 20:17:44 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
    [2011-08-18 20:17:43 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
    [2011-08-18 20:17:43 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
    [2011-08-18 20:16:58 | 000,000,179 | ---- | C] () -- C:\WINDOWS\info1
    [2011-08-18 20:16:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
    [2011-08-18 20:15:48 | 000,258,048 | ---- | C] () -- C:\WINDOWS\sysdriver32.exe
    [2011-08-18 18:21:32 | 001,208,832 | ---- | C] () -- C:\WINDOWS\services32.exe

    :Commands
    [resethosts]
    [emptytemp]


    Po wykonaniu zrob skan przy pomocy mbam oraz cureit i daj nowy log z OTL.
  • REKLAMA
  • #3 9842357
    ustaszewski
    Poziom 2  
    Posty: 3
    Zrobiłem jak napisano
    Załączniki:
    • OTL.Txt (82.29 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • Pomocny post
    #4 9842507
    Kolobos
    Spec od komputerów
    Posty: 85181
    Pomógł: 17173
    Ocena: 10458
    Nowy skrypt:

    :OTL
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - Reg Error: Value error. File not found
    O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
    O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - File not found
    O4 - HKLM..\Run: [avast] File not found
    O4 - HKLM..\Run: [tray_ico] File not found
    O4 - HKLM..\Run: [tray_ico2] File not found
    O4 - HKLM..\Run: [tray_ico3] File not found
    O4 - HKLM..\Run: [tray_ico4] File not found
    O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Reg Error: Value error. File not found
    O31 - SafeBoot: AlternateShell - services32.exe
    [2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
    [2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
    [2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
    [2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix
    [2011-08-18 20:19:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\Bitcoin
    [2011-08-18 20:19:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0
    [2011-08-18 20:18:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.4.1
    [2011-08-18 20:17:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\WinRAR
    [2011-08-18 20:17:37 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.3
    [2011-08-18 20:16:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
    [2011-08-18 18:33:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
    [2011-08-18 18:32:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1
    [2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0-lnk
    [2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0
    [2011-08-18 20:26:44 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
    [2011-08-18 20:26:43 | 005,589,370 | ---- | M] () -- C:\WINDOWS\phoenix.rar
    [2011-08-18 20:26:43 | 000,182,617 | ---- | M] () -- C:\WINDOWS\ufa.rar
    [2011-08-18 20:26:40 | 001,075,284 | ---- | M] () -- C:\WINDOWS\rpcminer.rar
    [2011-08-18 20:23:51 | 001,507,840 | ---- | M] () -- C:\WINDOWS\bitcoind.exe
    [2011-08-18 20:21:52 | 000,000,179 | ---- | M] () -- C:\WINDOWS\info1
    [2011-08-18 20:17:43 | 000,904,792 | ---- | M] () -- C:\WINDOWS\geoiplist.rar
    [2011-08-18 20:17:24 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hîsts
    [2011-08-18 20:16:20 | 000,000,000 | ---- | M] () -- C:\WINDOWS\loader2.exe_ok
    [2011-08-18 20:26:43 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
    [2011-08-18 20:26:43 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
    [2011-08-18 20:26:40 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
    [2011-08-18 20:21:36 | 001,507,840 | ---- | C] () -- C:\WINDOWS\bitcoind.exe
    [2011-08-18 20:17:44 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
    [2011-08-18 20:17:43 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
    [2011-08-18 20:17:43 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
    [2011-08-18 20:16:58 | 000,000,179 | ---- | C] () -- C:\WINDOWS\info1
    [2011-08-18 20:16:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok


    Po wykonaniu daj nowy log.

    Uzyj remover'a do avasta, avg tez odinstaluj.
  • REKLAMA
  • #5 9842860
    ustaszewski
    Poziom 2  
    Posty: 3
    dzięki wielki :)
  • #6 9843028
    Kolobos
    Spec od komputerów
    Posty: 85181
    Pomógł: 17173
    Ocena: 10458
    Daj nowy log.
REKLAMA