HELP ! BŁAGAM ! WIRUS

[MRMMati]

Co robić ;(

Jeśli jesteś na tej stronie, to znaczy, że w przeszłości na ten komputer pobrane zostały nielegalne pliki. Ponieważ są to elementy niedopuszczalne w internecie z troski o twórców, została zablokowana część zasobów internetu dla tego komputera. W ciągu 2 godzin będzie możliwe zdjęcie blokady, później zmiany nadane będą na stałe. Aby zdjąć blokadę należy stosować się do zasad zawartych w filmie. Twój unikalny link działa wyłącznie przez 2 godziny od przeczytania tej wiadomości.

to mi wyskakuje ;c

[Janusz.]

@up

To tylko skanowanie mam zrobić ze standardowymi opcjami i tymi infekcjami?

Masz ustawić to tak jak jest na ssie i kliknąć skanuj.

[MRMMati]

Okk mam coś OTL logfile created on: 2014-06-04 19:37:57 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\lckj\Downloads

64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation

Internet Explorer (Version = 9.11.9600.17031)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

 

7,89 Gb Total Physical Memory | 6,35 Gb Available Physical Memory | 80,45% Memory free

15,89 Gb Paging File | 14,28 Gb Available in Paging File | 89,84% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 345,23 Gb Total Space | 181,19 Gb Free Space | 52,48% Space Free | Partition Type: NTFS

Drive D: | 585,94 Gb Total Space | 585,77 Gb Free Space | 99,97% Space Free | Partition Type: NTFS

 

Computer Name: LCK | User Name: lckj | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 

========== Processes (SafeList) ==========

 

PRC - [2014-06-04 19:37:42 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\lckj\Downloads\OTL.exe

PRC - [2014-06-04 19:36:01 | 000,526,848 | ---- | M] () -- C:\Users\lckj\AppData\Local\Temp\net-log\net-log-noadmin.exe

PRC - [2014-06-04 19:20:50 | 000,215,040 | ---- | M] () -- C:\Users\lckj\Downloads\net-log.exe

PRC - [2014-05-14 01:40:56 | 000,860,488 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

PRC - [2014-05-08 15:24:15 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe

PRC - [2013-12-19 13:20:16 | 000,411,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2013-12-10 04:22:32 | 002,279,712 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

PRC - [2013-12-10 04:21:14 | 001,494,304 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

PRC - [2013-08-22 04:54:00 | 000,312,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\cmd.exe

PRC - [2013-08-22 04:53:48 | 000,015,872 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWOW64\TRACERT.EXE

PRC - [2013-04-11 16:30:58 | 000,366,552 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

PRC - [2013-04-11 16:30:22 | 000,169,432 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

 

 

========== Modules (No Company Name) ==========

 

MOD - [2014-06-04 19:36:01 | 000,526,848 | ---- | M] () -- C:\Users\lckj\AppData\Local\Temp\net-log\net-log-noadmin.exe

MOD - [2014-06-04 19:20:50 | 000,215,040 | ---- | M] () -- C:\Users\lckj\Downloads\net-log.exe

MOD - [2014-05-14 01:40:54 | 000,414,536 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll

MOD - [2014-05-14 01:40:53 | 013,695,816 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll

MOD - [2014-05-14 01:40:50 | 004,217,672 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll

MOD - [2014-05-14 01:40:45 | 000,716,616 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libglesv2.dll

MOD - [2014-05-14 01:40:44 | 000,126,280 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\libegl.dll

MOD - [2014-05-14 01:40:43 | 001,732,424 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ffmpegsumo.dll

 

 

========== Services (SafeList) ==========

 

SRV:64bit: - [2014-04-29 17:26:12 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)

SRV:64bit: - [2014-03-24 04:31:14 | 000,347,880 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)

SRV:64bit: - [2014-03-24 04:31:14 | 000,023,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV:64bit: - [2014-03-08 07:41:25 | 001,306,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)

SRV:64bit: - [2014-03-06 09:02:13 | 000,834,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)

SRV:64bit: - [2014-03-06 08:34:46 | 000,201,216 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)

SRV:64bit: - [2014-02-22 17:53:10 | 003,394,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)

SRV:64bit: - [2014-02-22 11:57:16 | 000,710,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)

SRV:64bit: - [2014-02-22 11:26:58 | 000,366,080 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)

SRV:64bit: - [2014-02-22 11:25:39 | 000,399,872 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)

SRV:64bit: - [2014-02-22 11:25:14 | 000,269,824 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)

SRV:64bit: - [2014-02-22 11:23:58 | 001,576,960 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)

SRV:64bit: - [2014-01-27 17:38:59 | 001,584,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)

SRV:64bit: - [2013-12-10 09:35:18 | 000,530,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)

SRV:64bit: - [2013-12-10 04:20:28 | 015,129,376 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)

SRV:64bit: - [2013-11-23 06:50:00 | 000,282,112 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)

SRV:64bit: - [2013-08-31 12:00:10 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped

O to chodzi ?

[MRMMati]

Odinstaluj Google Toolbar for Internet Explorer

:OTL
O4 - HKLM..\Run: [fst_pl_110]  File not found
O4 - Startup: C:\Users\lckj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Torpedo.lnk =  File not found
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

:Files
C:\Users\lckj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows.bat

:Commands
[emptytemp]
[resethosts]

Wykonaj skrypt, zatwierdź restart. otwórz wiersz poleceń i wpisz "netsh winsock reset" zatwierdź enterem. w otl użyj opcji sprzątanie i to by było na tyle.

Odinstalowałem, jak ten skrypt mam zrobić ? 

Wpisać to co jest w commands do windows.bat ?

[Janusz.]

Wyraźnie w poradniku jest napisane że masz logi wstawić na Wklej.to..

[Janusz.]

Otwórz program OTL i tam wklej ten skrypt. Naciśnij Wykonaj skrypt. Po ponownym uruchomieniu komputera kliknij w przycisk "Windows" na klawiaturze oraz "R" i wpisz "CMD" w wierszu poleceń wpisz "netsh winsock reset"

 

"Wpisać to co jest w commands do windows.bat ?" Nie. Ten plik Windows.bat i tak zostanie usunięty z systemu. nim się nie przejmuj.

[MRMMati]

Ok już zaczaiłem i co po tym jak wkleje ? 

tu 1 link i zaraz drugi http://wklej.to/sMMqm

2 http://wklej.to/lHxe6

ten 2 to otl.txt

A tu masz z net loga http://wklej.to/KHfn7