Komp STRASZNIE MULI

[超級親密]

OTL : http://wklej.eu/index.php?id=759b321d2d
OTL EXTRAS SIĘ NIE ZRIOBIŁ
GMER : http://wklej.eu/index.php?id=4c632175d1

[adamsik]

OTL EXTRAS musiał się zrobić zrób jeszcze raz i powinno być. Przeczytaj jeszcze raz to http://forum.instalki.pl/otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html

[kominekl]

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

Mamy tu natłok infekcji do tego jeszcze dość poważnych. Ponadto mam jeszcze jedno podejrzenie. Dlatego też użyj w tym przypadku Combofix`a (przed jego użyciem popodłączaj pamięci przenośne, gdyż są zainfekowane) otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967.html#p73687 i podaj raport z jego pracy.

[超級親密]

odpalam cf i nic nie wyskakuje. Wziąłem nacisnąłem, na ikonkę. I wlaczylo sie, i nic nie wyskoczylo.

[mateo8898]

Odinstaluj: Reganam Toolbar, McAfee Security Scan, Norton Security Scan. Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL
IE - HKLM\..\SearchScopes\{40439b93-f815-4122-8073-d03bed94c303}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-shoutcast-chromesbox-en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/ins/ins_1330860147_359394
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.myplaycity.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.myplaycity.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/ins/ins_1330860147_359394
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=108298&babsrc=SP_ss&mntrId=b8b3f2bc0000000000000015ce332844
IE - HKCU\..\SearchScopes\{40439b93-f815-4122-8073-d03bed94c303}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-shoutcast-chromesbox-en-us
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1601497
IE - HKCU\..\SearchScopes\{BC476300-567E-4001-91D4-9D046F91209D}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50-ff-shoutcast-chromesbox-en-us&query="
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=937811&ilc=12"
FF - prefs.js..extensions.enabledItems: [email protected]:1.2.0
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p="
FF - prefs.js..browser.startup.homepage: "http://home.myplaycity.com/"
[2012-01-19 13:21:44 | 000,001,184 | ---- | M] () -- C:\Documents and Settings\Lelon\Dane aplikacji\Mozilla\Firefox\Profiles\kd1rsone.default\searchplugins\winamp-search.xml
[2012-01-19 13:21:03 | 000,000,000 | ---D | M] (SHOUTcast Radio Toolbar) -- C:\Documents and Settings\Lelon\Dane aplikacji\Mozilla\Firefox\Profiles\kd1rsone.default\extensions\{12e4c684-c03e-4e4d-85bc-0c065e7a9489
[2012-01-18 13:48:15 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O4 - HKLM..\Run: [COMODO] C:\Program Files\COMODO\COMODO GeekBuddy\CLPSLA.exe File not found
O4 - HKLM..\Run: [CPA] C:\Program Files\COMODO\COMODO GeekBuddy\VALA.exe File not found
O4 - HKCU..\Run: [Norton Download Manager{NISADOEN-B191-4abb-B07C-C084B04B4F12}] C:\Documents and Settings\All Users\Dokumenty\Norton\{NISADOEN-B191-4abb-B07C-C084B04B4F12}\FSDUI.exe /m File not found
O4 - Startup: C:\Documents and Settings\Lelon\Menu Start\Programy\Autostart\scvhost.exe ()
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1
O33 - MountPoints2\{43424ed6-0dec-11e1-8291-806d6172696f}\Shell\AutoRun\command - "" = C:\WINDOWS\spolis.exe -- [2007-09-15 02:23:56 | 000,102,840 | RHS- | M] ()
O33 - MountPoints2\{43424ed6-0dec-11e1-8291-806d6172696f}\Shell\explore\Command - "" = C:\WINDOWS\spolis.exe -- [2007-09-15 02:23:56 | 000,102,840 | RHS- | M] ()
O33 - MountPoints2\{43424ed6-0dec-11e1-8291-806d6172696f}\Shell\open\Command - "" = C:\WINDOWS\spolis.exe -- [2007-09-15 02:23:56 | 000,102,840 | RHS- | M] ()
O33 - MountPoints2\{88626889-6545-11e1-9177-0015ce332844}\Shell\AutoRun\command - "" = L:\-.exe
O33 - MountPoints2\{88626889-6545-11e1-9177-0015ce332844}\Shell\explore\Command - "" = L:\-.exe
O33 - MountPoints2\{88626889-6545-11e1-9177-0015ce332844}\Shell\open\Command - "" = L:\-.exe
O33 - MountPoints2\{b4e3a533-5fed-11e1-916c-0015ce332844}\Shell\AutoRun\command - "" = M:\-.exe
O33 - MountPoints2\{b4e3a533-5fed-11e1-916c-0015ce332844}\Shell\explore\Command - "" = M:\-.exe
O33 - MountPoints2\{b4e3a533-5fed-11e1-916c-0015ce332844}\Shell\open\Command - "" = M:\-.exe
O35 - HKLM\..comfile [open] -- C:\WINDOWS\system32\wins.exe "%1" %* ()
O35 - HKLM\..exefile [open] -- C:\WINDOWS\system32\wins.exe "%1" %* ()
O37 - HKLM\...com [@ = comfile] -- C:\WINDOWS\system32\wins.exe "%1" %* ()
O37 - HKLM\...exe [@ = exefile] -- C:\WINDOWS\system32\wins.exe "%1" %* ()
[2012-02-26 12:44:18 | 000,000,000 | ---D | C] -- C:\Program Files\v9Soft
[2012-03-06 15:07:00 | 000,001,164 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-854245398-838170752-682003330-500UA.job
[2012-03-06 14:41:00 | 000,001,132 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-854245398-838170752-682003330-1002UA.job
[2012-03-06 14:14:53 | 000,000,460 | -H-- | M] () -- C:\WINDOWS\tasks\Norton Security Scan for Lelon.job
[2012-03-06 13:09:00 | 000,001,034 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-854245398-838170752-682003330-500UA.job
[2012-03-06 13:07:00 | 000,001,112 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-854245398-838170752-682003330-500Core.job
[2012-03-05 22:41:00 | 000,001,080 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-854245398-838170752-682003330-1002Core.job
[2012-02-10 19:09:00 | 000,001,012 | ---- | M] () -- C:\WINDOWS\tasks\FacebookUpdateTaskUserS-1-5-21-854245398-838170752-682003330-500Core.job
[2012-02-06 17:32:10 | 000,000,190 | RHS- | M] () -- C:\autorun.inf
[2012-02-26 12:44:18 | 000,001,651 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Deinstalator Strony V9.lnk
[2012-02-08 18:57:34 | 000,000,460 | -H-- | C] () -- C:\WINDOWS\tasks\Norton Security Scan for Lelon.job
[2011-11-16 05:01:38 | 000,102,840 | RHS- | C] () -- C:\WINDOWS\System32\wins.exe
[2011-11-16 05:01:38 | 000,102,840 | RHS- | C] () -- C:\WINDOWS\spolis.exe
[2011-11-16 05:01:38 | 000,102,840 | RHS- | C] () -- C:\WINDOWS\regedit.com
[2011-11-16 05:01:38 | 000,102,840 | RHS- | C] () -- C:\WINDOWS\System32\LeChucK.exe
[2011-11-16 05:01:38 | 000,102,840 | RHS- | C] () -- C:\WINDOWS\System32\cmd.com
[2012-03-06 13:09:00 | 000,001,034 | ---- | M] () -- C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-854245398-838170752-682003330-500UA.job

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"Alcmtr"=-
"OODefragTray"=-
"WinampAgent"=-

:Files
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL (mają być obydwa: OTL.txt i Extras.txt) + nowy log z Gmer + log z TDSSKiller http://forum.instalki.pl/otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292