Problem z wirusem Win 7 Security 2012

Mój kumpel ma taki sam problem wiec jakbym jutro wkleił tutaj jego loga to pomoglibyście mi też ?


//Temat wydzielony

[mateo8898]

Jak jest ten sam problem to podaj logi OTL i GMER

Ostatnio edytowany przez mateo8898, 19 Cze 2011, 13:10, edytowano w sumie 1 raz
Powód: Dodanie linków do narzędzi

tutaj log z otl a zaraz podam z gmera
http://wklej.eu/index.php?id=616523d1f6

przepraszam za double posta tutaj mam log z gmera
http://wklej.eu/index.php?id=90a882b080

Nie podałeś drugiego logu z OTL (Extras.txt), uzupełnij to.

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE - HKLM\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - File not found
IE - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\..\URLSearchHook: {cd90bf73-20f6-44ef-993d-bb920303bd2e} - File not found
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.defaultthis.engineName: "Veoh Web Player Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2653012&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.startup.homepage: "http://vshare.toolbarhome.com/?hp=df"
FF - prefs.js..extensions.enabledItems: [email protected]:3.0.497.0
FF - prefs.js..extensions.enabledItems: [email protected]:1.1.3.0244
FF - prefs.js..extensions.enabledItems: [email protected]:3.3.3.2
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
[2011/03/25 11:42:12 | 000,000,000 | ---D | M] (ToggleEN Community Toolbar) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}
[2011/03/25 11:42:11 | 000,000,000 | ---D | M] (Zynga Community Toolbar) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011/05/19 17:14:57 | 000,000,000 | ---D | M] (Veoh Web Player Community Toolbar) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\{cd90bf73-20f6-44ef-993d-bb920303bd2e}
[2011/03/25 11:42:10 | 000,000,000 | ---D | M] (PHPNukeEN Community Toolbar) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\{dd02a4eb-4afd-4d60-99d8-e67f964ca813}
[2011/01/15 00:10:33 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\[email protected]
[2011/03/25 11:42:09 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\[email protected]
[2011/05/03 21:25:29 | 000,000,000 | ---D | M] (vShare) -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\extensions\vshare@toolbar
[2011/03/21 14:46:56 | 000,000,933 | ---- | M] () -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\searchplugins\conduit.xml
[2011/01/15 00:10:22 | 000,002,055 | ---- | M] () -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\searchplugins\daemon-search.xml
[2011/05/20 09:03:40 | 000,001,583 | ---- | M] () -- C:\Users\bohu\AppData\Roaming\Mozilla\Firefox\Profiles\blc56jk6.default\searchplugins\web-search.xml
[2010/10/03 08:59:14 | 000,000,000 | ---D | M] (Hotbar Component) -- C:\PROGRAM FILES (X86)\HBLITE\BIN\11.0.267.0\FIREFOX\EXTENSIONS
[2010/10/03 08:59:08 | 000,000,000 | ---D | M] (ShopperReports) -- C:\PROGRAM FILES (X86)\SHOPPERREPORTS3\BIN\3.0.497.0\FIREFOX\FIREFOXTOOLBAR\EXTENSIONS
O2 - BHO: (Veoh Web Player Toolbar) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - File not found
O4:64bit: - HKLM..\Run: [FullScreen] File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [F5D7050v3] File not found
O4 - HKU\S-1-5-21-573479321-3105213002-3763592640-1000..\Run: [VeohPlugin] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] File not found
O4 - Startup: C:\Users\bohu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windate.exe ()
O4 - Startup: C:\Users\bohu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wostock417.exe ()
O4 - Startup: C:\Users\bohu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xe0304.exe ()
O35 - HKU\S-1-5-21-573479321-3105213002-3763592640-1000..exefile [open] -- "C:\Users\bohu\AppData\Local\twe.exe" -a "%1" %* (Microsoft Corporation)
O37 - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\...exe [@ = exefile] -- "C:\Users\bohu\AppData\Local\twe.exe" -a "%1" %* (Microsoft Corporation)
[2011/06/19 13:16:47 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{CABC024C-851D-48B5-A7FA-742CB39B9515}
[2011/06/18 13:51:10 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{7EA8C9AA-3FCB-4557-88A2-04D7FAA2CB91}
[2011/06/17 20:02:19 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Users\bohu\AppData\Local\twe.exe
[2011/06/17 20:02:11 | 000,331,776 | ---- | C] (Microsoft Corporation) -- C:\Users\bohu\AppData\Local\ccq.exe
[2011/06/17 14:28:12 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{4F520D1E-B635-4BB4-90E4-01F73A292FB6}
[2011/06/16 14:55:51 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{BF357C18-C0C0-4042-86B8-808E779213EB}
[2011/06/15 14:56:49 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{24046236-0AC6-4CBA-821C-19C8C1A18EBC}
[2011/06/14 14:57:17 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{889CF48F-628B-4155-B308-CF0D0C4BCC8F}
[2011/06/13 16:45:38 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{1A3B8D02-E3E9-4C0D-BE30-83A9BB27AB2B}
[2011/06/11 18:16:56 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{67549D07-37F3-4A78-A398-E58EFEADFFFC}
[2011/06/10 21:11:30 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{A3265D72-1A40-4E71-A318-C03DA0D427BF}
[2011/06/09 12:09:28 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{FCF7D008-5D30-436B-A0CD-C273E93E81C1}
[2011/06/08 08:46:43 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{9B836A33-0D4D-4586-BCF2-CD70D07BA2C7}
[2011/06/07 09:15:28 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{3DC6A9DE-EA8E-4D5F-8709-555C55B71088}
[2011/06/06 11:13:50 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{A50F9FD3-C1AC-4567-9712-AAB4AE6DEC44}
[2011/06/05 06:56:03 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{D655326C-5BA3-4566-A53C-EB09FB932BFA}
[2011/06/04 18:42:33 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{8A853504-10AC-4387-986A-44901DD2CFDB}
[2011/06/04 14:35:27 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{78739ED3-4F74-4367-A20C-5830508D1549}
[2011/06/03 13:46:56 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{CE977F36-780A-4075-910E-DAC7896A4604}
[2011/06/02 15:55:07 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{79052DFF-5B56-4895-84EC-46150E89581B}
[2011/06/01 15:21:59 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{F83EBF5D-3D8E-4CC0-A06F-BF8695DDBCF0}
[2011/05/31 16:32:49 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{BCD4F95C-BC2D-4C5C-AD82-9164BE0835E5}
[2011/05/29 00:47:03 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{3A5DF998-2E57-4FAA-BCBC-D76BC16BFD7F}
[2011/05/28 07:46:24 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{ED685E9C-FE0B-43F4-9FD9-4E3F321882B1}
[2011/05/27 23:24:52 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{CA8C48CB-5DD8-4A75-8011-80A43606739A}
[2011/05/24 14:53:10 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{40D844E0-4DB5-49D7-8DAD-3E684F9EB77F}
[2011/05/23 08:18:26 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{85C7AD2E-2BD2-402E-946D-4E8BE6CB172B}
[2011/05/22 08:18:14 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{490CC585-EC7E-482A-9654-5687C1A66414}
[2011/05/21 09:32:31 | 000,000,000 | ---D | C] -- C:\Users\bohu\AppData\Local\{D259A64B-121F-4BC0-84B4-79797B57DB6E}
[2011/06/19 13:17:11 | 000,010,516 | -HS- | M] () -- C:\Users\bohu\AppData\Local\47gcvy372m31d035j471c3wx3rlp70351dt0r1jy6byv6e
[2011/06/17 20:04:27 | 000,009,912 | -HS- | M] () -- C:\ProgramData\47gcvy372m31d035j471c3wx3rlp70351dt0r1jy6byv6e
[2011/02/24 01:24:31 | 000,489,223 | ---- | C] () -- C:\Windows\windate.exe
[2011/02/24 01:24:29 | 000,105,760 | ---- | C] () -- C:\Windows\os4.exe
[2011/02/24 01:24:27 | 000,059,904 | ---- | C] () -- C:\Windows\zlib1.dll
[2011/02/24 01:24:27 | 000,000,031 | ---- | C] () -- C:\Windows\memlist.dat
[2011/02/24 01:24:27 | 000,000,004 | ---- | C] () -- C:\Windows\test.dat
[2011/02/24 01:24:26 | 000,000,329 | ---- | C] () -- C:\Windows\Last.dat
[2011/02/24 01:24:26 | 000,000,009 | ---- | C] () -- C:\Windows\Language.dat
O4 - HKLM..\Run: [HBLiteSA] C:\Program Files (x86)\HBLite\bin\11.0.267.0\HBLiteSA.exe (Pinball Corporation.)
O4 - HKU\S-1-5-21-573479321-3105213002-3763592640-1000..\Run: [3093799173] C:\Users\bohu\AppData\Local\twe.exe (Microsoft Corporation)

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Odkurzacz-MCD"=-

:Files
C:\Users\bohu\AppData\Local\Temp*.html
C:\Program Files (x86)\HBLite

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt i zatwierdź restart.

Następnie odinstaluj toolbary: ToggleEN Toolbar, ShopperReports, Conduit Engine, PHPNukeEN Toolbar, DAEMON Tools Toolbar.

Po wykonaniu powyższych podaj nowe logi z OTL robione opcją Skanuj.

tutaj wklejam ten extras i przepraszam za kłopot
http://www.wklej.eu/index.php?id=c176fd2bc9

Podaj jeszcze nowe logi OTL

I jeszcze jedno: widzę w logu dwa antywiry: Avast i Norton IS, co jest niedopuszczalne. Odinstaluj jednego z nich jak najszybciej (najlepiej jeszcze przed utworzeniem nowych logów).

już teraz wszystko działa poprawnie i wklejam jeszcze ten log o który prosiłeś
http://www.wklej.eu/index.php?id=f7268f673d
mam jeszcze pytanko jak Ty robiłeś tego loga bo mam jeszcze 2 innych znajomych którzy maja ten sam problem

ten Norton to jest tylko wersja podstawowa i ona była od nowości w komputerze ale i tak odinstaluje

ten Norton to jest tylko wersja podstawowa i ona była od nowości w komputerze ale i tak odinstaluje

Zapewne testowa, a nie podstawowa bo nie ma czegoś takiego. Zresztą tak czy siak posiada moduł antywira, więc go odinstaluj. Możesz się posłużyć tym ftp://ftp.symantec.com/public/english_us_canada/removal_tools/Norton_Removal_Tool.exe I zrób to przed wykonaniem nowych logów.

mam jeszcze pytanko jak Ty robiłeś tego loga bo mam jeszcze 2 innych znajomych którzy maja ten sam problem

To podaj logi z OTL z tamtych komputerów, bo dla każdego przypadku trzeba inny skrypt zastosować.

Nie odinstalowałeś toolbara PHPNukeEN Toolbar, to także wykonaj. Następnie w OTL wklej:

:OTL
IE - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2653012
IE - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\..\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - Reg Error: Key error. File not found
FF - HKLM\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files (x86)\HBLite\bin\11.0.267.0\firefox\extensions
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found
O3 - HKLM\..\Toolbar: (no name) - {cd90bf73-20f6-44ef-993d-bb920303bd2e} - No CLSID value found.
O3 - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\..\Toolbar\WebBrowser: (no name) - {038CB5C7-48EA-4AF9-94E0-A1646542E62B} - No CLSID value found.
O3:64bit: - HKU\S-1-5-21-573479321-3105213002-3763592640-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - File not found

:Files
C:\Users\bohu\AppData\Local\Temp*.html

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinampAgent"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Odkurzacz-MCD"=-

Klikasz Wykonaj skrypt (Run Fix). Dajesz log z usuwania + nowe logi z OTL.