wirus paysafecard

[magnitiusz9999]

znowu złapałem wirusa tym razem paysafecard i prosze o pomoc


logi:

OTL http://www.wklej.eu/index.php?id=a17396ad49
EXTRAS http://www.wklej.eu/index.php?id=cb632a075e

GMER http://www.wklej.eu/index.php?id=3e70607075

autoruns http://www9.zippyshare.com/v/65219467/file.html

[mateo8898]

1. Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
SRV - File not found [Auto | Stopped] -- C:\Windows\system32\Ati2evxx.exe -- (Ati External Event Utility)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\XDva400.sys -- (XDva400)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Damian\Desktop\DragonMu.biz_v2_S6Ep3\DragonMu.biz S6Ep3\MuGuard\llck.sys -- (LLRING0)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_medium=vlt2&from=vlt2&uid=WDC_WD2500AAJS-00RYA0_WD-WCAPZ043110931109&ts=1347184025
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?st=6&barid={FC3117D9-1522-11E2-B733-5404A6D1DE78}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://search.v9.com/web/?q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.v9.com/web/?q={searchTerms}
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2790392
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q=
{searchTerms}&crg=3.1010000.10002&barid={FC3117D9-1522-11E2-B733-5404A6D1DE78}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_medium=vlt2&from=vlt2&uid=WDC_WD2500AAJS-00RYA0_WD-WCAPZ043110931109&ts=1347184025
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?st=6&barid={FC3117D9-1522-11E2-B733-5404A6D1DE78}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.v9.com/web/?q={searchTerms}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{0D7562AE-8EF6-416d-A838-AB665251703A}: "URL" = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=111015&mntrId=e00321c2000000000000000fea563f07
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.v9.com/web/?q={searchTerms}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = https://isearch.avg.com/search?cid={61EA5D7A-CE8F-4A2C-8FC0-514E73B2A008}&mid=d8ae3df3d9a747d08bda854de035378b-4e78bfa2f673298adc1ccc5050adab4972cd031c&lang=pl&ds=st011&pr=sa&d=2012-08-16 14:19:28&v=12.2.5.32&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = http://dts.search-results.com/sr?src=ieb&appid=341&systemid=406&sr=0&q={searchTerms}
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2790392
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10002&barid={FC3117D9-1522-11E2-B733-5404A6D1DE78}
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Here"
FF - prefs.js..keyword.URL: "http://search.sweetim.com/search.asp?barid={FC3117D9-1522-11E2-B733-5404A6D1DE78}&src=2&crg=3.1010000.10002&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search Results"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Search Results"
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
[2012-09-20 16:18:59 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ked78l2w.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2011-12-22 14:34:55 | 000,000,000 | ---D | M] (Facemoods) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ked78l2w.default\extensions\[email protected]
[2010-10-10 15:46:56 | 000,004,669 | ---- | M] () (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\ked78l2w.default\extensions\[email protected]\content\xpiInstallLgc.js
[2013-01-21 14:10:33 | 000,001,982 | ---- | M] () -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\ked78l2w.default\searchplugins\search-here.xml
[2012-09-20 16:18:55 | 000,002,519 | ---- | M] () -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\ked78l2w.default\searchplugins\Search_Results.xml
[2012-10-13 11:44:57 | 000,003,998 | ---- | M] () -- C:\Users\Damian\AppData\Roaming\mozilla\firefox\profiles\ked78l2w.default\searchplugins\sweetim.xml
[2012-09-20 16:19:05 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2012-03-22 10:23:15 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
[2010-12-13 13:36:54 | 000,002,035 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrchddr.xml
[2012-09-20 16:18:55 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2012-09-09 10:47:06 | 000,000,402 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\v9.xml
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKU\S-1-5-21-4063461499-783861807-1344796114-1000..\Run: [AudioMenager] C:\Users\Damian\AppData\Roaming\mgr.exe File not found
O4 - HKU\S-1-5-21-4063461499-783861807-1344796114-1000..\Run: [Media Finder] "C:\Program Files\Media Finder\MF.exe" /opentotray File not found
O4 - Startup: C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Reg Error: Value error.)
[2012-11-11 16:36:12 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
[2012-11-11 16:36:13 | 083,023,306 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Zgadzasz się na restart i podajesz log z usuwania.

2. Odinstaluj: SweetIM for Messenger 3.7, BitTorrentBar Toolbar, facemoods, McAfee Security Scan Plus, Searchqu Toolbar, Akamai NetSession Interface
3. W Autoruns usuń:
zakładka Logon:

Adobe ARM
DATAMNGR
facemoods
HotKeysCmds
IgfxTray
Persistence
RTHDVCPL
StartCCC
SunJavaUpdateSched
SweetIM
Sweetpacks
Microsoft Office.lnk
Microsoft Windows
ALLUpdate
Komunikator
Media Finder

zakładka Services (odznacz):

WinDefend
WMPNetworkSvc

4. Wykonaj nowe logi opcją Skanuj

Kolejność jak podałem.

[magnitiusz9999]

OTL http://www.wklej.eu/index.php?id=b4f5a7ed15

EXTRAS http://www.wklej.eu/index.php?id=9837554211

[mateo8898]

Tryb normalny działa?? Bo widzę, że logi znów zrobiłeś w awaryjnym.

Odinstaluj jeszcze SweetIM for Messenger 3.7, DefaultTab, DefaultTab Chrome

Wklej w OTL:

:OTL
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html File not found
O4 - HKLM..\RunOnce: [removeSearchqudatamngr] cmd.exe /c RD /S /Q "C:\Program Files\Searchqu Toolbar" File not found
O4 - HKLM..\RunOnce: [removeSearchqutoolbar] cmd.exe /c RD /S /Q "C:\Program Files\Searchqu Toolbar\Datamngr\ToolBar" File not found
O4 - HKU\S-1-5-21-4063461499-783861807-1344796114-1000..\Run: [Akamai NetSession Interface] "C:\Users\Damian\AppData\Local\Akamai\netsession_win.exe" File not found
O3 - HKLM\..\Toolbar: (no name) - !{EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~1\SEARCH~1\Datamngr\ToolBar\searchqudtx.dll File not found
O3 - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found.
O3 - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O2 - BHO: (DefaultTab Browser Helper) - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\Damian\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.)
O2 - BHO: (no name) - {95B7759C-8C7F-4BF1-B163-73684A933233} - No CLSID value found.
IE - HKU\S-1-5-21-4063461499-783861807-1344796114-1000\..\URLSearchHook: {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - No CLSID value found

Klikasz Wykonaj skrypt i podajesz log z usuwania.

[magnitiusz9999]

działa. podaje log


http://www.wklej.eu/index.php?id=2760118da5

[mateo8898]

OK, jeszcze czekam aż odpowiesz na pytanie.

[magnitiusz9999]

tryb normalny działa no chyba ze ci chodziło o inne pytanie. a tak przy okazji na xp windows tez złapałem tego wirusa troche wstyd o tym mowic bo to juz 4 raz ale jak włonczylem tryb awaryjny to przez chwile pochodzilem na internecie i wirus zablokowal tryb awaryjny

[mateo8898]

W OTL Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Zainstaluj SP1 http://www.instalki.pl/programy/downloa ... ack_1.html

Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz) http://www.instalki.pl/programy/downloa ... rer_9.html

Co do problemu na XP, wykonaj logi z OTLPE http://traxter-online.net/otlpe-tworzen ... -systemie/