Prośba o przejrzenie logów/pomoc z systemem

przez **Hipek** » 24 Lip 2012, 20:08

Witam… otóż mam mały problem, w sumie to duży problem. Przedwczoraj, gdy szukałem nowego dostawcy internetu nod32 wykrył jakiegoś dziwnego wirusa w moim systemie. Było to dla mnie zaskoczenie, nigdy wcześniej nie widziałem wirusa zaczynającego się na win64.

Ciągle wyskakiwały mi komunikaty dot. „services.exe win64/patched.b.gen”, nod nie mógł sobie z nim poradzić.

Ktoś poradził mi przeskanować system za pomocą „Malwarebytes Anti-Malware”, jednak niewiele to pomogło. Program nic nie wykrył, a z systemem było coraz gorzej. Aktualnie nie mogę uruchomić firewalla, a do niedawna użytkownik z którego korzystam był oznaczony jako administrator, jednak uprawnień nie posiadał (nie mogłem nawet wejść w msconfig). Zniknął też nod… a zainstalować ponownie się nie da (nieznany błąd przy instalacji).

hijackthis.log
OTL – OTL.Txt
OTL – Extras.Txt
Silent Runners – Startup Programs (MOE) 2012-07-24 18.08.29.txt

Nie mogę dać loga z gmer, ponieważ po uruchomieniu nie mogę zaznaczyć skanowania systemu czy czegokolwiek (uruchamiam jako administrator).

Proszę o pomoc!

//Przepraszam, nie wrzucę na otofotki.pl, ponieważ po wrzuceniu otrzymuję „404 not found”.

przez **kominekl** » 24 Lip 2012, 20:28

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
Wszystko od Windows Live.

Odinstaluj to oprogramowanie za pomocą Revo Uninstaller`a

https://www.instalki.pl/download/programy/windows/narzedzia/narzedzia-systemowe/revo-uninstaller/ w trybie zaawansowanym (po wcześniejszym zaznaczeniu w Nim opcji

Pokazuj Elementy Systemowe).

Ciągle wyskakiwały mi komunikaty dot. „services.exe win64/patched.b.gen”, nod nie mógł sobie z nim poradzić.

Wejdź w START

URUCHOM

i wklej tam:

sfc /scanfile=C:\Windows\system32\services.exe

Logi.

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko: :Processes killallprocesses :OTL IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://samsung.msn.com IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://samsung.msn.com IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://samsung.msn.com IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\..\URLSearchHook: {f999a48b-1950-4d81-9971-79018f807b4b} - No CLSID value found IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\..\SearchScopes\{57C2DEF9-7AB4-4EC9-BCFA-14B69C0C3085}: "URL" = http://www.bing.com/search?FORM=SMSTDF&PC=MASM&q={searchTerms}&src=IE-SearchBox IE - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Hipek\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Hipek\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) O2:[b]64bit:[/b] - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found. O2:[b]64bit:[/b] - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found. O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found. O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKU\S-1-5-19..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found O4 - HKU\S-1-5-20..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found O4 - HKU\S-1-5-21-3135873756-1747778033-1847798441-1000..\Run: [AdobeBridge] File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Reg Error: Key error.) [2012-07-24 17:58:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Trend Micro [2012-07-24 15:30:45 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{E0BF146D-6BB5-4197-93A5-D9FAC25AF838} [2012-07-24 15:30:35 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{FA5148B2-2C26-443C-9B37-72663802F23A} [2012-07-24 15:22:00 | 000,000,000 | ---D | C] -- C:\64fa203556cbee47b76aa99010 [2012-07-24 11:56:02 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Hipek\Desktop\esetsmartinstaller_enu.exe [2012-07-23 19:39:33 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET [2012-07-23 18:54:20 | 001,378,744 | ---- | C] (ESET) -- C:\Users\Hipek\Desktop\eset_nod32_antivirus_live_installer.exe [2012-07-23 17:12:15 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe.33A161B54B8C16F2 [2012-07-23 17:12:15 | 000,050,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\nbcqqepo.sys [2012-07-23 17:06:01 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe.C4A06F035659B23A [2012-07-23 17:02:47 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe.C7C54169198C053C [2012-07-23 17:00:19 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe.D69142D61195038F [2012-07-23 16:57:31 | 000,328,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\services.exe.64677A65CA4D1EEF [2012-07-23 16:19:41 | 012,633,984 | ---- | C] (Microsoft Corporation) -- C:\Users\Hipek\Desktop\mseinstall.exe [2012-07-23 12:54:59 | 000,000,000 | -HSD | C] -- C:\Windows\SysNative\%APPDATA% [2012-07-22 21:32:54 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{80177C59-29AC-4461-86C5-0A82B2C90C37} [2012-07-22 21:32:43 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{C599108A-934F-4DD4-A2A8-48B070665D35} [2012-07-20 20:08:02 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{CF7E3CFC-6133-4199-ABCF-3DB559C011D9} [2012-07-20 20:07:51 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{2D372CBD-D01A-4497-9F5D-DEBE191840FF} [2012-07-19 12:38:48 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{04C946A5-5E25-4105-9B02-53D085F059A2} [2012-07-19 12:38:38 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{498EDE02-E6D0-4529-81A7-5B8C675C1F0F} [2012-07-19 00:41:02 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{958EDEC4-D79E-417F-848C-7F47D35EE4CD} [2012-07-19 00:40:41 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{D6F0934B-957C-4189-9B6C-CAA8F03F4FCF} [2012-07-18 20:02:05 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{A0036607-1107-4619-9D59-A97D17EF3E7A} [2012-07-18 20:01:55 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{340FEAB1-B6C6-4168-B59E-43624FCCDE57} [2012-07-18 09:52:17 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{5EAF45CF-3878-47FA-BD5A-4BB166BE7BBA} [2012-07-18 09:52:06 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{8C848B08-8AED-40C0-9896-A392FB366DE2} [2012-07-18 04:42:21 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{9A91B586-5F5E-4499-AC36-2783BE4AF859} [2012-07-18 04:42:11 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{5A99B98D-6E44-4568-9AAA-2E0A3FFB69CD} [2012-07-17 20:46:57 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{385FB535-D0B6-4213-9607-9B8336921866} [2012-07-17 20:46:47 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{04765473-1F78-4F69-A1B4-F0B183F4ECAF} [2012-07-17 15:59:17 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{565F8511-03FB-4C4D-905E-4B3C6D9AAA3B} [2012-07-17 15:59:07 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{82E5BED6-8B35-4DA7-A634-D7E10622FBB7} [2012-07-17 04:58:32 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{E7DE63D5-E40F-4E5B-A86C-45F4CF223444} [2012-07-17 04:58:21 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{EFEEB66F-DCBC-4F78-9E7A-DC2CFD56E0EC} [2012-07-16 21:24:59 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{56795F20-0071-4371-B984-ABA08CB68B81} [2012-07-16 21:24:48 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{1A389777-776C-4161-8A3D-900DDCEE852D} [2012-07-16 11:55:14 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{223146EB-80C6-4E46-8B5F-32C8DD981464} [2012-07-16 11:55:04 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{B8353F00-F7C0-4046-8B38-F556A748C9C5} [2012-07-15 20:28:44 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{E7049E13-BF4E-45F8-B9D6-F87CCBE8A2EC} [2012-07-15 20:28:34 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{57E6F9FC-2211-48C9-B4D0-78DB7353BF4D} [2012-07-15 02:57:52 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{E86A4778-FDF4-4D21-972D-F50093A34F75} [2012-07-15 02:57:42 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{1B13807F-BC73-4209-B183-1081DE9207BC} [2012-07-14 15:37:08 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{0990A30F-12ED-4C9F-AF28-8C5E7FCDDB10} [2012-07-14 15:36:58 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{2B231F88-74DE-477B-B504-8A6571323A2C} [2012-07-13 17:38:25 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{AF2A1ABF-539A-4FA9-8E56-5BC3C65E9208} [2012-07-13 17:38:13 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{CE60E828-7C5B-4ED2-A7B5-344D4E369C1E} [2012-07-13 13:49:59 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{6F7FEC43-FB37-4C17-8E4B-77E5D25876F5} [2012-07-13 13:49:49 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{202CD145-F56D-4AC2-86B0-FDEC5BDFA2C0} [2012-07-13 03:41:55 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{5E3BD39A-2A7C-42C1-A5AB-5CB25BEFF2F9} [2012-07-13 03:41:45 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{2D688B0D-2835-4E53-8593-F00F62EA7348} [2012-07-12 22:31:59 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{7BF6307A-652E-4533-8C53-38D06FE8EEE7} [2012-07-12 22:31:49 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{B69190EA-8048-42CB-A767-FEB153DB2A17} [2012-07-12 17:49:27 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{C5EF3092-8CA7-4D58-9598-C7A1CC011851} [2012-07-12 17:49:15 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{1155CBA2-4FE9-45D1-A64C-D9D0D0933424} [2012-07-11 22:55:38 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{C2A4B0F6-E820-4A99-A069-2CBDFA5D127A} [2012-07-11 22:55:27 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{BB2DFD01-3622-4B8C-826D-3C154925A444} [2012-07-11 14:33:59 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{942C0D26-F666-4945-8384-074F810039AE} [2012-07-11 14:33:49 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{ADF20278-1E25-4A45-B4E7-18401EEB79BE} [2012-07-11 01:47:35 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{820E6C27-4BAF-48F8-BD90-FFDADADD4C23} [2012-07-11 01:47:25 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{6CC50D72-5ABB-4F5F-A556-32B08CCFB532} [2012-07-10 21:33:22 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{1B0AD29D-9724-4C8B-B806-5996D25E7D7C} [2012-07-10 21:33:11 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{9C5EFB5F-27E9-405C-A948-F393E5A03602} [2012-07-10 18:50:40 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{9A98A148-0495-4D84-9E09-547C2EECE26B} [2012-07-10 18:50:18 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{DD1B8D1C-9F9F-4E31-B37E-C4702965813C} [2012-07-10 12:56:29 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{ACC4D186-DD17-4E51-B623-6C12C93BF972} [2012-07-10 12:56:16 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{4A657934-54EF-4C14-A57E-D0BEFFBDBED7} [2012-07-09 19:40:31 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{9AF9A6C7-A047-4653-BA5B-FCE5A74DFCBA} [2012-07-09 19:40:20 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{BB107861-4F45-43B2-9DDA-67B75C9A22E8} [2012-07-09 15:58:45 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{781096A6-9DAE-44BD-87AA-407BBBECADEF} [2012-07-09 15:58:35 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{D319DC8D-0A86-4EB1-9894-6366C7866B84} [2012-07-09 02:45:27 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{A541E0BF-30B5-4B5D-9181-204A4AC49A1D} [2012-07-09 02:45:17 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{193DB104-19B8-4C08-8195-3C961074B979} [2012-07-08 13:08:54 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{F5B0D59B-6785-4193-B39D-5B86AEBEF739} [2012-07-08 13:08:44 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{4C97FC93-5110-4656-9991-BF06446F6927} [2012-07-07 13:50:00 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{DC892527-385D-4C0C-A4A1-10045C962262} [2012-07-07 13:49:50 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{24D16583-1F83-42ED-A493-01D5987EFCA2} [2012-07-07 02:59:15 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{EAD1A9AC-46BE-4DFA-9C71-AAD0E0DDFD30} [2012-07-07 02:59:04 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{56FF72DE-1EC0-426E-B6AE-F1067065B0F0} [2012-07-06 17:13:31 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{AF022569-6941-405B-9D5F-86DD0F390874} [2012-07-06 17:13:21 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{4D5771B7-7B3C-46AF-B178-2214FFFD0AB0} [2012-07-06 02:38:41 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{51E3096E-B227-4878-9160-619474F55046} [2012-07-06 02:38:31 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{0F3E3D89-F5C0-4021-9979-7AA7754AEDE7} [2012-07-05 14:03:07 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{838B7746-36C1-471B-BE4F-8089390F85AF} [2012-07-05 14:02:57 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{80A75FF4-B2A4-48AA-8CFA-DFA7E333AB8B} [2012-07-04 22:21:15 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{76D30BC5-112D-4EBE-BD2B-F61A7C12ED5B} [2012-07-04 22:21:02 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{AD325537-BD33-4ED9-8BFA-E2ADB2B78093} [2012-07-04 08:07:07 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{6DF1E69B-ADDC-4E43-ABD7-8B00464653FC} [2012-07-04 08:06:57 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{95770F3D-626B-4088-B7B4-2D30669F6E29} [2012-07-04 03:29:52 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{95F3FFCD-127F-4A47-8D35-73E844E9A85B} [2012-07-04 03:29:41 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{74AE1219-41F8-4A3A-A848-19498C25E683} [2012-07-03 14:26:01 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{EF91A537-876C-48B2-A969-781A9C3FD013} [2012-07-03 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{C53C9169-D5C6-4482-A1A9-15A8EBA5D905} [2012-07-02 17:06:53 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{3D502C1F-05BD-411D-89F7-B98A20F338FA} [2012-07-02 17:06:43 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{441621EE-D7FD-427E-B657-1EAAD4CD4A40} [2012-07-02 03:51:58 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{0DD78768-B493-41A5-93B0-9187176C3F75} [2012-07-02 03:51:47 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{428408A5-6663-41F0-BE97-1EF071CC21BC} [2012-07-01 13:33:17 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{A2C859E2-BFEA-49C7-8836-909755D08454} [2012-07-01 13:33:05 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{EEAD267C-D496-459B-A9FF-64F47F2487BD} [2012-07-01 03:43:24 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{DC2246B3-15F4-4984-9D5E-1C14B20B0B23} [2012-07-01 03:43:14 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{53F7041C-A3A6-41D2-AFEA-F2AF42817205} [2012-06-30 14:23:17 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{F5B0192C-D3A0-4F6E-8DF4-A1F83682560F} [2012-06-30 14:23:07 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{0467C260-EFE2-45BB-84A1-D05BB3B8FE11} [2012-06-29 14:47:48 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{02840FE4-A5A1-444D-89E1-ABE68EF31B1E} [2012-06-29 14:47:26 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{8A81D8AE-6E8A-46F4-A2A2-F3E7D4D71736} [2012-06-28 11:38:06 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{793A3FB3-5A8F-4690-8CEF-CD792BFF86C9} [2012-06-28 11:37:56 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{A75DDABB-9B0D-4EB8-B837-5E3C81B052F6} [2012-06-27 12:25:48 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{3D251E31-6ABC-4C11-96FE-F561EC49B0F1} [2012-06-27 12:25:38 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{432BA01D-371A-4AE8-9EC8-C5D681102B24} [2012-06-26 15:01:58 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{BD23C0B8-7B09-4B21-8ED2-0BF715B701E1} [2012-06-26 15:01:48 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{C94A193C-9D77-4036-B652-E375024DF636} [2012-06-25 14:16:49 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{04CE2783-B48D-43EC-BDE1-781EDCA35859} [2012-06-25 14:16:39 | 000,000,000 | ---D | C] -- C:\Users\Hipek\AppData\Local\{ADDF3CF2-1609-4CDB-BCEA-0AE919E6D3DF} @Alternate Data Stream - 24 bytes -> C:\Windows:A6FF3B357E7B4614 @Alternate Data Stream - 144 bytes -> C:\ProgramData\Temp:05EE1EEF @Alternate Data Stream - 124 bytes -> C:\ProgramData\Temp:8530A643 :Files $RECYCLE.BIN /alldrives C:\Program Files (x86)\Google\Update C:\Users\Hipek\AppData\Local\Google\Update C:\Windows\tasks\*.* C:\Users\Hipek\Desktop\BFE.reg C:\Users\Hipek\Desktop\MicrosoftFixit50535.msi C:\Users\Hipek\Documents\23072012.reg C:\Users\Hipek\Desktop\eav_nt64_plk.msi C:\Users\Hipek\Desktop\gmer.zip C:\Windows\Installer\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}\U\00000001.@ C:\Windows\Installer\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}\@ C:\Users\Hipek\AppData\Local\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}\@ C:\Users\Hipek\AppData\Roaming\EurekaLog :Commands [emptyflash] [clearallrestorepoints] [emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podaj log z ADWCleaner (z opcji Delete)

http://www.instalki.pl/programy/downloa ... eaner.html + log z TDSSKiller

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p120292 + nowe logi z OTL.

Optymalizacja.

Jeśli jej pragniesz to podaj log z Autoruns

otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.

przez **Hipek** » 24 Lip 2012, 22:54

Usunięte Windows Live (wszystkie), HiJackThis. Nie znalazłem „Google Update Center”, więc nie ruszałem. (Prawdopodobnie usługa z Google Drive.)

Przez sfc przepuściłem wcześniej cały windows w trybie awaryjnym (sfc /scannow), kiedy były problemy z uruchomieniem (strasznie mulił, kilka minut uruchamiał). Teraz ponownie przeskanowałem i tym razem nic nie znalazł.

07242012_220233 – log z usuwania.
AdwCleaner[S1] – log z AdwCleaner.
TDSS rootkit removing tool 2.7.48.0 – log z TDSS.

OTL – log z OTL.
OTL Extras

Jeśli można i nie sprawi to kłopotu to byłbym wdzięczny.
AutoRuns.arn

przez **kominekl** » 25 Lip 2012, 13:04

Autoruns.

W Autoruns odznacz, a następnie usuń (co się będzie dało):

HKLM\System\CurrentControlSet\Control\Terminal Server\Wds\rdpwd\StartupPrograms

rdpclip

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

IgfxTray
Persistence
RtHDVCpl

HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components

Microsoft Windows

HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components

Microsoft Windows

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Windows Live ID Sign-in Helper

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects

Wszystko.

Task Scheduler

Wszystko.

HKLM\System\CurrentControlSet\Services

MozillaMaintenance
Steam Client Service
wlidsvc

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32

msacm.vorbis

"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client

Odinstaluj to oprogramowanie. Ponadto usuń resztki po ESET tym

http://kb.eset.com/esetkb/index?page=co ... &actp=LIST.

ADWCleaner.

Odinstaluj.

Logi.

Uruchom OTL

w oknie Własne opcje skanowania/skrypt wklej:

:OTL

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

:Files
C:\Program Files\ESET
C:\Users\Hipek\Desktop\Autoruns
C:\Users\Hipek\Desktop\tdsskiller.exe
$RECYCLE.BIN /alldrives
C:\Users\Hipek\Desktop\revosetup.exe
C:\Users\Hipek\AppData\Roaming\Malwarebytes
C:\ProgramData\Malwarebytes
C:\Program Files (x86)\Microsoft Security Client
C:\Users\Hipek\riotsGamesLogs
C:\Users\Hipek\Desktop\AutoRuns.arn
C:\Users\Hipek\Desktop\Autoruns.zip
C:\Users\Hipek\Desktop\9z9thwpr.exe
C:\Users\Hipek\Desktop\MicrosoftFixit50202.msi
C:\Users\Hipek\Desktop\adwcleaner.exe
C:\Users\Hipek\Desktop\gmer.exe

:Reg
[-HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]]

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL.

przez **mateo8898** » 25 Lip 2012, 17:15

Dodatkowo przeskanuj plik C:\Windows\system32\services.exe na https://www.virustotal.com/ i podaj wyniki.

przez **Hipek** » 25 Lip 2012, 21:06

"{9D046B26-7978-47CD-91E6-AC3C1DFBC3D0}" = Microsoft Security Client

^ Nie znalazłem w AutoRuns.

OTL — log z usuwania
__________
OTL — Extras
OTL — OTL
__________
skan na http://www.virustotal.com — nie mogłem wybrać pliku bezpośrednio z folderu, musiałem najpierw przenieść poza foldery systemowe.

przez **mateo8898** » 25 Lip 2012, 21:14

W OTL kliknij Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport (po uruchomieniu odrzuć okres testowy)

Zainstaluj jakiegoś antywira

Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz)

http://www.instalki.pl/programy/downloa ... rer_9.html

Prośba o przejrzenie logów/pomoc z systemem

Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Re: Prośba o przejrzenie logów/pomoc z systemem

Kto jest na forum