Problem z wirusem i pendrive'm - logi OTL

[vabian]

Witam, bardzo proszę o sprawdzenie poniższych logów:

http://wklej.org/id/360883/

Po podpięciu pendrive'a został wykryty jakiś wirus (prawdopodobnie trojan), jednakże nie został on chyba poprawnie usunięty. Jednym z widocznych problem jest brak możliwości otwarcia dysku poprzez dwukrotne kliknięcie (trzeba korzystać z prawy eksploruj). Zaznaczę, że na dyskach nie ma plików autorun.ini.

Z góry dziękuję za pomoc!

[mateo8898]

Pobierz ten http://www.speedyshare.com/files/23276178/appmgmts.dll oraz ten plik http://www.dlldump.com/cgi-bin/testwrap ... idserv.dll i wklej je do folderu C:\WINDOWS\System32

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com?o=15561&l=dis
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Yahoo! Search"
FF - prefs.js..keyword.URL: "http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg&type=yahoo_avg_hs2-tb-web_us&p="
[2010-04-11 03:04:17 | 000,002,424 | ---- | M] () -- C:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\l7zqm37o.default\searchplugins\askcom.xml
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe File not found
O4 - HKCU..\Run: [DriverUpdaterPro] C:\Program Files\iXi Tools\Driver Updater Pro\DriverUpdaterPro.exe File not found
O4 - HKCU..\Run: [dso32] C:\DOCUME~1\User\USTAWI~1\Temp\dsoqq.exe File not found
O4 - HKCU..\Run: [GoD] C:\Documents and Settings\User\Moje dokumenty\GoD\GoD.exe File not found
O32 - AutoRun File - [2010-06-23 20:51:00 | 000,000,055 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-06-23 20:51:00 | 000,000,055 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{15c3501b-7cbe-11df-b275-0019700715da}\Shell\AutoRun\command - "" = F:\09lf.exe -- File not found
O33 - MountPoints2\{15c3501b-7cbe-11df-b275-0019700715da}\Shell\open\Command - "" = F:\09lf.exe -- File not found
O33 - MountPoints2\{1c77af53-3b37-11df-91eb-806d6172696f}\Shell\AutoRun\command - "" = 09lf.exe
O33 - MountPoints2\{1c77af53-3b37-11df-91eb-806d6172696f}\Shell\open\Command - "" = 09lf.exe
O33 - MountPoints2\{1c77af55-3b37-11df-91eb-806d6172696f}\Shell\AutoRun\command - "" = 09lf.exe
O33 - MountPoints2\{1c77af55-3b37-11df-91eb-806d6172696f}\Shell\open\Command - "" = 09lf.exe
O33 - MountPoints2\{37747171-4648-11df-b1e3-0019700715da}\Shell\AutoRun\command - "" = 09lf.exe
O33 - MountPoints2\{37747171-4648-11df-b1e3-0019700715da}\Shell\open\Command - "" = 09lf.exe
O33 - MountPoints2\{411bd131-4785-11df-b1e7-0019700715da}\Shell - "" = AutoRun
O33 - MountPoints2\{411bd132-4785-11df-b1e7-0019700715da}\Shell\AutoRun\command - "" = chxnxyx.exe
O33 - MountPoints2\{411bd132-4785-11df-b1e7-0019700715da}\Shell\open\Command - "" = chxnxyx.exe
O33 - MountPoints2\{469b4b48-3b52-11df-b1bf-000b6af54999}\Shell\AutoRun\command - "" = 09lf.exe
O33 - MountPoints2\{469b4b48-3b52-11df-b1bf-000b6af54999}\Shell\open\Command - "" = 09lf.exe
O33 - MountPoints2\{4c00e6e7-3b46-11df-b1b9-000b6af54999}\Shell\Open(&0)\command - "" = F:\Recycled\ctfmon.exe -- File not found
O33 - MountPoints2\{92fa2315-4592-11df-b1e0-0019700715da}\Shell\AutoRun\command - "" = krwyrv0d.exe
O33 - MountPoints2\{92fa2315-4592-11df-b1e0-0019700715da}\Shell\open\Command - "" = krwyrv0d.exe
O33 - MountPoints2\{ecf718bb-471e-11df-b1e6-0019700715da}\Shell\AutoRun\command - "" = 09lf.exe
O33 - MountPoints2\{ecf718bb-471e-11df-b1e6-0019700715da}\Shell\open\Command - "" = 09lf.exe
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\ZDCndis5.SYS -- (ZDCndis5)

:Files
C:\WINDOWS\tasks\expressburnShakeIcon.job

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=-
"InCD"=-
"NeroCheck"=-
"NeroFilterCheck"=-

:Commands
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL

Wylecz pamięci przenośne Flash Disinfector lub sformatuj