Wirus udający policje

[raper1916]

Witam !!
wskoczył mi jakiś wirus udający policje i nie wiem jak się tego pozbyć >
czytałem trochę na forum .Komputer działa tylko w trybie awaryjnym.
podaje logi
OTL
OTL http://www.wklej.eu/index.php?id=dd30b2d808
eXTRAS http://www.wklej.eu/index.php?id=2af0149d61


TDSSKiller

http://www.wklej.eu/index.php?id=9eb52e4a29

pROSZĘ O POMOC i jakieś proste wyjaśnienie jak to mam zrobić

[mateo8898]

Odinstaluj DAEMON Tools Toolbar. Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL
IE - HKU\S-1-5-21-41670986-3017183319-1330053149-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=758c0aa0-1e57-11e1-9d39-20cf307d48fb&q={searchTerms}
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:  File not found
[2011-07-11 20:04:02 | 000,000,633 | ---- | M] () -- C:\Users\dom\AppData\Roaming\Mozilla\Firefox\Profiles\n2qijtpl.default\searchplugins\startsear.xml
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [TNOD UP] "C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe" /i File not found
O4 - HKLM..\Run: [iSaverCtrl] "C:\Program Files (x86)\iSaver\iSaverCtrl.exe" --startup File not found
O4 - HKU\S-1-5-21-41670986-3017183319-1330053149-1000..\Run: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKU\S-1-5-21-41670986-3017183319-1330053149-1000..\Run: [rgjcmkbbntgspzt] C:\ProgramData\rgjcmkbbntgspzturido.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
[2012-05-18 14:58:33 | 000,001,058 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-05-18 11:16:35 | 000,000,448 | ---- | M] () -- C:\ProgramData\idfvxsdbuylehoh
[2012-05-18 11:10:30 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateLBPShortCut"=-
"UpdateP2GoShortCut"=-
"WinampAgent"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ALLUpdate"=-
"EA Core"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

[raper1916]

dzięki działa trochę na starcie zamula ale ważne że działa

http://wklej.eu/index.php?id=58ee3abfe7

otl http://wklej.eu/index.php?id=95d3098bf9

extras http://wklej.eu/index.php?id=4e36113afe

[mateo8898]

Odinstaluj jeszcze McAfee Security Scan

W OTL wklej:

Kod: Zaznacz wszystko

:OTL
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:[b]64bit:[/b] - HKLM..\Run: [TNOD UP] "C:\Program Files (x86)\TNod User & Password Finder\TNODUP.exe" /i File not found
@Alternate Data Stream - 81 bytes -> C:\Program Files (x86)\Jetbull Poker:MID

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

[raper1916]

log usuwania http://www.wklej.eu/index.php?id=e1a20f3624

log extras http://www.wklej.eu/index.php?id=18ada1fc59

log otl http://www.wklej.eu/index.php?id=6595a804b1

[kominekl]

Odinstaluj Bing Bar.

Następnie uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

Kod: Zaznacz wszystko

:OTL

IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{50A5D3D3-2969-408F-8632-ADDEF02E30DF}: "URL" = http://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-41670986-3017183319-1330053149-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
IE - HKU\S-1-5-21-41670986-3017183319-1330053149-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
[2011-02-10 16:45:50 | 000,180,896 | ---- | M] ( ) -- C:\Program Files (x86)\mozilla firefox\plugins\npVividasPlayer.dll
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
[2012-05-19 01:00:00 | 000,441,122 | ---- | M] () -- C:\Users\dom\Documents\cc_20120519_005915.reg
[2011-12-28 15:12:47 | 000,000,000 | ---- | C] () -- C:\Users\dom\AppData\Local\{3EDBEBF8-9D4C-4076-90CA-A54CBC41DB2E}
[2011-11-24 11:01:35 | 000,000,000 | ---- | C] () -- C:\Users\dom\AppData\Local\{FBF08DE6-9AC2-44B8-A6C0-D008238D4243}
[2011-11-23 17:28:46 | 000,000,000 | ---- | C] () -- C:\Users\dom\AppData\Local\{51A4C2A9-F29B-4DF1-AA39-631D5FDA05A0}
[2011-10-04 12:46:24 | 000,000,000 | ---- | C] () -- C:\Users\dom\AppData\Local\{7B81AF33-9DB9-401E-98D4-E4329279713B}
@Alternate Data Stream - 140 bytes -> C:\ProgramData\Temp:81F83028
@Alternate Data Stream - 134 bytes -> C:\ProgramData\Temp:DAF232F8
@Alternate Data Stream - 133 bytes -> C:\ProgramData\Temp:5D458568
@Alternate Data Stream - 120 bytes -> C:\ProgramData\Temp:3E7393FC

:Files
C:\Program Files (x86)\Google\Update

:Reg
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

:Commands
[emptyflash]
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania. Następnie podajesz nowe logi z OTL + log z Autoruns otl-gmer-silent-runners-sdfix-i-inne-poradnik-t13967-15.html#p138589.