Wykonaj skrypt w OTL:
:OTL
PRC - [2011-06-14 15:51:54 | 006,962,815 | ---- | M] () -- C:\WINDOWS\phoenix\phoenix.exe
MOD - [2011-08-18 20:20:14 | 000,232,960 | ---- | M] () -- C:\WINDOWS\l1rezerv.exe
MOD - [2011-08-18 20:19:16 | 000,348,672 | ---- | M] () -- C:\WINDOWS\update.5.0\svchost.exe
MOD - [2011-08-18 20:15:48 | 000,258,048 | ---- | M] () -- C:\WINDOWS\sysdriver32.exe
MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.tray-7-0\svchost.exe
MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.tray-12-0\svchost.exe
MOD - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () -- C:\WINDOWS\update.1\svchost.exe
MOD - [2011-06-14 15:51:54 | 006,962,815 | ---- | M] () -- C:\WINDOWS\phoenix\phoenix.exe
SRV - [2011-08-18 20:19:16 | 000,348,672 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.5.0\svchost.exe -- (srvbtcclient)
SRV - [2011-08-18 20:18:49 | 000,359,936 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\update.4.1\svchost.exe -- (srvbtc1)
SRV - [2011-08-18 20:15:48 | 000,258,048 | ---- | M] () [Auto | Running] -- C:\WINDOWS\sysdriver32.exe -- (srvsysdriver32)
SRV - [2011-08-18 18:21:08 | 001,208,832 | -H-- | M] () [Auto | Running] -- C:\WINDOWS\update.1\svchost.exe -- (wxpdrivers)
O4 - HKLM..\Run: [3631519.exe] C:\WINDOWS\TEMP\3631519.exe ()
O4 - HKLM..\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] File not found
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\WINDOWS\update.tray-7-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] C:\WINDOWS\update.tray-12-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] C:\WINDOWS\services32.exe ()
O31 - SafeBoot: AlternateShell - services32.exe
[2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0-lnk
[2011-08-18 23:06:09 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-7-0
[2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\ufa
[2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\rpcminer
[2011-08-18 20:26:45 | 000,000,000 | ---D | C] -- C:\WINDOWS\phoenix
[2011-08-18 20:19:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\Bitcoin
[2011-08-18 20:19:17 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.5.0
[2011-08-18 20:18:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.4.1
[2011-08-18 20:17:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Dane aplikacji\WinRAR
[2011-08-18 20:17:37 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.3
[2011-08-18 20:16:58 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.2
[2011-08-18 18:33:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\av_ico
[2011-08-18 18:32:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.1
[2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0-lnk
[2011-08-18 18:31:39 | 000,000,000 | -H-D | C] -- C:\WINDOWS\update.tray-12-0
[2011-08-18 20:26:44 | 000,246,272 | ---- | M] () -- C:\WINDOWS\unrar.exe
[2011-08-18 20:26:43 | 005,589,370 | ---- | M] () -- C:\WINDOWS\phoenix.rar
[2011-08-18 20:26:43 | 000,182,617 | ---- | M] () -- C:\WINDOWS\ufa.rar
[2011-08-18 20:26:40 | 001,075,284 | ---- | M] () -- C:\WINDOWS\rpcminer.rar
[2011-08-18 20:23:51 | 001,507,840 | ---- | M] () -- C:\WINDOWS\bitcoind.exe
[2011-08-18 20:21:52 | 000,000,179 | ---- | M] () -- C:\WINDOWS\info1
[2011-08-18 20:20:14 | 000,232,960 | ---- | M] () -- C:\WINDOWS\l1rezerv.exe
[2011-08-18 20:18:19 | 000,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011-08-18 20:17:43 | 000,904,792 | ---- | M] () -- C:\WINDOWS\geoiplist.rar
[2011-08-18 20:17:24 | 000,000,734 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hîsts
[2011-08-18 20:26:43 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
[2011-08-18 20:26:43 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
[2011-08-18 20:26:40 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
[2011-08-18 20:21:36 | 001,507,840 | ---- | C] () -- C:\WINDOWS\bitcoind.exe
[2011-08-18 20:20:18 | 000,232,960 | ---- | C] () -- C:\WINDOWS\l1rezerv.exe
[2011-08-18 20:17:44 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
[2011-08-18 20:17:43 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
[2011-08-18 20:17:43 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2011-08-18 20:16:58 | 000,000,179 | ---- | C] () -- C:\WINDOWS\info1
[2011-08-18 20:16:05 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2011-08-18 20:15:48 | 000,258,048 | ---- | C] () -- C:\WINDOWS\sysdriver32.exe
[2011-08-18 18:21:32 | 001,208,832 | ---- | C] () -- C:\WINDOWS\services32.exe
:Commands
[resethosts]
[emptytemp]
Po wykonaniu zrob skan przy pomocy mbam oraz cureit i daj nowy log z OTL.