log ComboFix

[meler89]

Witam, proszę o pomoc z logiem z ComboFix, z góry dziękuję.

http://www.wklej.eu/index.php?id=9388b88d3f

[mateo8898]

Wylecz pamięci przenośne Flash Disinfector lub sformatuj

Odinstaluj Winamp Toolbar

Pobierz The Avenger w pole Input script here wklej poniższy tekst:

Kod: Zaznacz wszystko

Files to delete:
C:\ljy.exe
D:\ljy.exe
F:\ljy.exe
G:\ljy.exe

klikasz Execute Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu wklej raport na forum C:\avenger.txt

[meler89]

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\ljy.exe" deleted successfully.
File "D:\ljy.exe" deleted successfully.
File "G:\ljy.exe" deleted successfully.
File "F:\ljy.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

[mateo8898]

Usunięte.

Pobierz OTC uruchom i kliknij CleanUp

Przeczyść dysk oraz rejestr CCleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach Instrukcja

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport

[meler89]

Wszystko wykonane zgodnie z poleceniami, oto wynik czterogodzinnego skanowania:

Malwarebytes' Anti-Malware 1.44
Wersja bazy definicji: 3741
Windows 5.1.2600 Dodatek Service Pack 2
Internet Explorer 6.0.2900.2180

2010-02-15 17:41:13
mbam-log-2010-02-15 (17-41-13).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|F:\|G:\|)
Przeskanowane obiekty: 226590
Upłynęło: 4 hour(s), 24 minute(s), 0 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 0
Zainfekowane klucze rejestru: 17
Zainfekowane wartości rejestru: 1
Zainfekowane pliki rejestru: 0
Zainfekowane foldery: 0
Zainfekowane pliki: 7

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
(Nie wykryto groźnych plików)

Zainfekowane klucze rejestru:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) Quarantined and deleted successfully.

Zainfekowane wartości rejestru:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) Quarantined and deleted successfully.

Zainfekowane pliki rejestru:
(Nie wykryto groźnych plików)

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
C:\Documents and Settings\x\Pulpit\IZA\CursorManiaSetup2.3.50.22.ZCfox000.exe (Adware.MyWebSearch) Quarantined and deleted successfully.
G:\i9bwjpqc.exe (Spyware.OnlineGames) Quarantined and deleted successfully.
G:\31lyx.exe (Spyware.OnlineGames) Quarantined and deleted successfully.
G:\6ruaqx.exe (Spyware.OnlineGames) Quarantined and deleted successfully.
G:\System Volume Information\_restore{E9C6FFFC-AEFB-4B53-B3BF-E4DC75738CB9}\RP187\A0076339.exe (Spyware.OnlineGames) Quarantined and deleted successfully.
G:\System Volume Information\_restore{E9C6FFFC-AEFB-4B53-B3BF-E4DC75738CB9}\RP187\A0076340.exe (Spyware.OnlineGames) Quarantined and deleted successfully.
G:\System Volume Information\_restore{E9C6FFFC-AEFB-4B53-B3BF-E4DC75738CB9}\RP187\A0076341.exe (Spyware.OnlineGames) Quarantined and deleted successfully.

[mateo8898]

Ok, opróżnij jeszcze kwarantannę Malwarebytes.