wirus udający policje

[raper1916]

witam potrzebuje pomocy
Extras.txt http://www.wklej.eu/index.php?id=de06484db5
OTL.txt http://www.wklej.eu/index.php?id=3debfe5e69

tdsskiller http://www.wklej.eu/index.php?id=f5d3bf791d

[ZacnyWacław]

Poczytaj tutaj: http://www.instalki.pl/aktualnosci/bezp ... utery.html

[mateo8898]

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=c030e53c00000000000000197ea56c3c&tlver=1.4.19.19&affID=17160
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss&mntrId=c030e53c00000000000000197ea56c3c&tlver=1.4.19.19&affID=17160
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=DE5B209D-A79E-4E3F-90BB-AF6DEB4ACF93&apn_sauid=7297E013-8605-4168-BFB6-40AA389559B0
IE - HKCU\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=c030e53c00000000000000197ea56c3c&tlver=1.4.19.19&affID=17160
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=toolbar2&q="
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
[2011-12-31 17:54:07 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Robek\AppData\Roaming\mozilla\Firefox\Profiles\9918lveh.default\extensions\[email protected]
[2012-01-03 16:27:44 | 000,002,333 | ---- | M] () -- C:\Users\Robek\AppData\Roaming\Mozilla\Firefox\Profiles\9918lveh.default\searchplugins\askcom.xml
[2011-06-30 07:50:50 | 000,002,423 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" File not found
O4 - HKCU..\Run: [wdscore] C:\Users\Robek\AppData\Local\Microsoft\Windows\3936\wdscore.exe ()
[2012-08-09 13:13:23 | 000,000,000 | ---D | C] -- C:\$WINDOWS.~BT
[2012-08-09 12:21:05 | 000,000,000 | ---D | C] -- C:\Users\Robek\AppData\Roaming\hellomoto

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"=-
"WinampAgent"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=-

:Files
C:\Users\Robek\AppData\Local\Microsoft\Windows\3936

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania + nowe logi z OTL.

[Arkaszka]

Widzę ze nie byłem jedyny którego namierzył wirus "policja"