Prośba o pomoc w usuwaniu robaków i innych wirusów

[rysinski8826]

Oto mój log, proszę o szybką pomoc w rozwiązaniu tego problemu. Jestem niedoświadczonym użytkownikiem programu Combofix, więc proszę o wskażowki co mam dalej z tym zrobić? Z góry dziękuję.
A to link : http://www.wklej.eu/index.php?id=f1012811cc

[mateo8898]

Pobierz ten plik [strona nie jest już dostępna] i wypakuj bezpośrednio na dysk C. Następnie wklej do notatnika:

Kod: Zaznacz wszystko

RenV::
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Canon\MyPrinter\bjmyprt .exe
c:\program files\Canon\SolutionMenu\cnslmain .exe
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe
c:\program files\Common Files\InstallShield\UpdateService\issch .exe
c:\program files\Common Files\Java\Java Update\jusched .exe
c:\program files\Common Files\Nero\Lib\nerocheck .exe
c:\program files\Common Files\Nero\Lib\nmindexstoresvr  .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\Google\Quick Search Box\googlequicksearchbox .exe
c:\program files\Nero\Nero8\Nero BackItUp\nbkeyscan .exe
c:\program files\QuickTime\qttask  .exe
c:\program files\Winamp\winampa .exe
c:\program files\Windows Defender\msascui .exe

FCopy::
c:\ndis.sys | c:\windows\system32\drivers\ndis.sys

File::
c:\windows\system32\DRIVERS\83040441.sys
c:\windows\Tasks\Google Software Updater.job
c:\windows\Tasks\AppleSoftwareUpdate.job
c:\windows\Tasks\User_Feed_Synchronization-{C716DD38-A18E-43B8-835E-69F676CC0E7C}.job
c:\windows\Tasks\1-Click Maintenance.job

Driver::
83040441
83040442

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"=-
"SkyTel"=-
"nwiz"=-

Plik zapisz jako CFScript.txt
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe


Rozpocznie się usuwanie i powstanie log, który dajesz na forum.

[rysinski8826]

juz gotowe http://www.wklej.eu/index.php?id=05423a0518

[rysinski8826]

Przy okazji mam podobny problem z pendrivem :0 flash disinfector nic nie dziala
pozostaje na penie plik autorun.inf i dziwny taki folder kosz o nazwie MARIJA. jak to rozwiazac zrobie moze loga w otlu a potem podam go na forum w tym samym temacie.

[rysinski8826]

to jest log otl : http://www.wklej.eu/index.php?id=c6ece9a8bf
a to jest extras.txt : http://www.wklej.eu/index.php?id=1353d82ea5

[mateo8898]

Podłącz pamięć przenośną, a następnie uruchom OTL w oknie Custom Scans/Fixes wklej:

:OTL
SRV - [2010-04-06 16:02:21 | 002,504,280 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\rswin_3653.dll -- (Akamai)
DRV - File not found [Kernel | On_Demand | Running] -- -- (PavTPK.sys)
DRV - File not found [Kernel | On_Demand | Running] -- -- (PavSRK.sys)
DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - File not found [File_System | On_Demand | Running] -- -- (AvFlt)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = C:\Program Files\SAGEM WiFi manager\WLANUTL.exe File not found
O32 - AutoRun File - [2010-04-11 23:17:36 | 000,000,466 | ---- | M] () - K:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{872ef104-8b0c-11de-9bfd-001966217ac8}\Shell\AutoRun\command - "" = K:\MARIJA/ludasam.exe -- [2010-04-07 09:58:28 | 000,182,784 | RHS- | M] ()
O33 - MountPoints2\{872ef104-8b0c-11de-9bfd-001966217ac8}\Shell\open\command - "" = K:\MARIJA/ludasam.exe -- [2010-04-07 09:58:28 | 000,182,784 | RHS- | M] ()

:Files
c:\Program Files\Common Files\Akamai
K:\MARIJA
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\Tasks\MP Scheduled Scan.job
C:\Documents and Settings\All Users\Dane aplikacji\Wru
c:\recycler
e:\recycler
k:\recycler

:Commands
[emptytemp]

Klikasz Run Fix. Dajesz log z usuwania + nowe logi z OTL

[rysinski8826]

Ok to zrobie a co z tym poprzednim logiem? z combofix mam cos jeszcze zrobic?

[mateo8898]

W logu z Combofix już czysto. Wykonaj teraz operację z OTL.

[rysinski8826]

Log z usuwania:

All processes killed
========== OTL ==========
Service Akamai stopped successfully!
Service Akamai deleted successfully!
c:\Program Files\Common Files\Akamai\rswin_3653.dll moved successfully.
Service PavTPK.sys stopped successfully!
Service PavTPK.sys deleted successfully!
Error: Unable to stop service PavSRK.sys!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PavSRK.sys deleted successfully.
Service catchme stopped successfully!
Service catchme deleted successfully!
Error: Unable to stop service AvFlt!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AvFlt deleted successfully.
C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk moved successfully.
K:\autorun.inf moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{872ef104-8b0c-11de-9bfd-001966217ac8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872ef104-8b0c-11de-9bfd-001966217ac8}\ not found.
K:\MARIJA/ludasam.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{872ef104-8b0c-11de-9bfd-001966217ac8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{872ef104-8b0c-11de-9bfd-001966217ac8}\ not found.
File K:\MARIJA/ludasam.exe not found.
========== FILES ==========
c:\Program Files\Common Files\Akamai\Languages folder moved successfully.
c:\Program Files\Common Files\Akamai\Cache\37309 folder moved successfully.
c:\Program Files\Common Files\Akamai\Cache folder moved successfully.
c:\Program Files\Common Files\Akamai folder moved successfully.
K:\MARIJA folder moved successfully.
C:\WINDOWS\tasks\Google Software Updater.job moved successfully.
C:\WINDOWS\Tasks\MP Scheduled Scan.job moved successfully.
C:\Documents and Settings\All Users\Dane aplikacji\Wru\Cache folder moved successfully.
C:\Documents and Settings\All Users\Dane aplikacji\Wru folder moved successfully.
File\Folder c:\recycler not found.
e:\RECYCLER\S-1-5-21-1935655697-1454471165-1801674531-1004 folder moved successfully.
e:\RECYCLER\S-1-5-21-1123561945-1788223648-839522115-500 folder moved successfully.
e:\RECYCLER folder moved successfully.
File\Folder k:\recycler not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: ADMIN
Temp folder emptied: 37582 bytes
Temporary Internet Files folder emptied: 13838299 bytes
Java cache emptied: 1088119 bytes
Google Chrome cache emptied: 47271389 bytes
Flash cache emptied: 28025 bytes

User: Administrator
Temp folder emptied: 0 bytes
Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: Default User
Temp folder emptied: 0 bytes
Temporary Internet Files folder emptied: 67 bytes
Flash cache emptied: 41 bytes

User: LocalService
Temp folder emptied: 0 bytes
Temporary Internet Files folder emptied: 32902 bytes

User: NetworkService
Temp folder emptied: 2068 bytes
Temporary Internet Files folder emptied: 32835 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 17402390 bytes
%systemroot%\System32 .tmp files removed: 401444 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 11966878 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 88,00 mb


OTL by OldTimer - Version 3.2.1.1 log created on 04122010_184823

Files\Folders moved on Reboot...
C:\Documents and Settings\ADMIN\Ustawienia lokalne\Temp\Google Toolbar\GoogleToolbarWelcome.log moved successfully.
C:\Documents and Settings\ADMIN\Ustawienia lokalne\Temporary Internet Files\Content.IE5\IM2R3WLQ\uwaga-nowy-bardzo-grony-robak[1].htm moved successfully.
C:\Documents and Settings\ADMIN\Ustawienia lokalne\Temporary Internet Files\Content.IE5\IM2R3WLQ\viewtopic[1].htm moved successfully.
C:\Documents and Settings\ADMIN\Ustawienia lokalne\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
C:\Documents and Settings\ADMIN\Ustawienia lokalne\Temporary Internet Files\SuggestedSites.dat moved successfully.

Registry entries deleted on Reboot...

[rysinski8826]

Coś jeszcze ?

[rysinski8826]

Jeżeli to wszystko to bardzo dziękuję za wszelką pomoc:) Życzę dalszych owocnych prac na forum!
Pozdrawiam.

[mateo8898]

Ok, jeszcze tylko kroki końcowe.

W OTL kliknij CleanUp

Przeczyść dysk oraz rejestr CCleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach Instrukcja

Wykonaj pełne skanowanie Dr.Web CureIt - jeśli coś znajdzie wylecz/usuń i daj raport (Plik Zapisz Listę Raportu)