Blokada UHASH Prosze o przejrzenie logow

[jarosz23 (Shukor)]

Witam toto moje logi

http://speedy.sh/jppxM/Extras.Txt

http://speedy.sh/y44Vx/OTL.Txt

Z gory dzieki za pomoc

[Atis]

Babylon toolbar on IE, StartNow Toolbar, LiveVDO plugin, QuestScan.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\rdvgkmd.sys – (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\tsusbhub.sys – (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\synth3dvsc.sys – (Synth3dVsc) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=2&cf=4a4dbad0- … 248c626d04 IE - HKLM…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=4a … c626d04&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=2&cf=4a4dbad0- … 248c626d04 IE - HKCU…\SearchScopes{0388404D-6072-4CEB-B521-8F090FEAEE57}: “URL” = http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.3.0&install_country=PL&install_date=20110825&user_guid=81BF8E0A4DF44DB890077F9F06088838&machine_id=b86d64a8ec8c082c1158ffed70d7cb4f&browser=IE&os=win&os_version=6.1-x86-SP1&iesrc={referrer:source} IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=4a … c626d04&q={searchTerms} IE - HKCU…\SearchScopes{4B8C28A7-A9BC-45F8-990D-21499EED643C}: “URL” = http://www.questscan.com/?prt=QstscanPB&keywords={searchTerms} IE - HKCU…\SearchScopes{BB02BB06-CABF-4A66-95F3-6843121DD71B}: “URL” = http://search.babylon.com/?q={searchTerms}&AF=100478&babsrc=SP_ss&mntrId=f8027a8c00000000000000248c626d04 FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.order.1: “Web Search” FF - prefs.js…browser.search.selectedEngine: “Search the web (Babylon)” FF - prefs.js…keyword.URL: “http://search.babylon.com/?AF=100478&babsrc=adbartrp&mntrId=f8027a8c00000000000000248c626d04&q=” [2011-08-26 18:14:14 | 000,000,000 | —D | M] (StartNow Toolbar) – C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\pjmzeqht.default\extensions{5911488E-9D1E-40ec-8CBB-06B231CC153F} [2011-12-18 12:48:14 | 000,000,000 | —D | M] (Babylon) – C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\pjmzeqht.default\extensions\ffxtlbr@babylon.com [2012-01-25 23:12:47 | 000,000,792 | ---- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\pjmzeqht.default\searchplugins\startsear.xml [2011-08-26 18:14:14 | 000,001,390 | ---- | M] () – C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\pjmzeqht.default\searchplugins\yahoo-zugo.xml [2011-09-25 12:46:31 | 000,000,000 | —D | M] (QuestScan) – d:\Program Files\Mozilla Firefox\extensions{F0E1168A-B4B5-484C-B77E-0D28E6B64096} [2011-10-27 15:45:50 | 000,083,456 | ---- | M] (LiveVDO ) – d:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll O2 - BHO: (ShoppingReport2) - {258C9770-1713-4021-8D7E-1F184A2BD754} - Reg Error: Value error. File not found O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - Reg Error: Value error. File not found O2 - BHO: (no name) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - No CLSID value found. O4 - HKCU…\Run: [ares] “D:\Program Files\Ares\Ares.exe” -h File not found O4 - HKCU…\Run: [asepluvrdzgvjne] C:\ProgramData\asepluvr.exe (Origin PC) O4 - HKCU…\Run: [fsm] File not found O4 - HKCU…\Run: [HPUpdate] C:\Users\user\AppData\Roaming\Microsoft\igfxpers.exe () O4 - HKCU…\Run: [updateLBPShortCut] C:\Users\user\AppData\Roaming\Microsoft\sensorsv.exe () O20 - Winlogon\Notify\LogonInit: DllName - (logonInit.dll) - C:\Program Files\Common Files\logonInit.dll () [2012-08-13 19:50:26 | 000,000,000 | —D | C] – C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum [2012-08-13 19:13:27 | 000,089,088 | ---- | C] (Origin PC) – C:\ProgramData\asepluvr.exe [2012-08-13 19:13:27 | 000,000,000 | —D | C] – C:\ProgramData\jfgxxzhddkngarv [2012-08-13 19:13:23 | 000,089,088 | ---- | C] (Origin PC) – C:\Users\user\0.02300247763558505.exe [2012-08-13 19:50:26 | 000,002,000 | ---- | M] () – C:\Users\user\Desktop\Live Security Platinum.lnk [2012-08-13 19:13:27 | 000,000,051 | ---- | M] () – C:\ProgramData\ixgoeifybxsvdun [2012-07-17 17:10:30 | 000,027,958 | ---- | M] () – C:\Program Files\Common Files\logonInit.dll [2011-09-25 12:46:31 | 000,000,000 | ---- | C] () – C:\ProgramData\89ec07d1a35190e4a610338206694d8c_c :Files C:\ProgramData\6C82ED49000D22070303F307F875EF7E :Reg [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

Wklej do OTL i kliknij Skanuj:

HKEY_CURRENT_USER\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s /md5start services.exe /md5stop

Pokaż ten log.

[jarosz23 (Shukor)]

Raport z usuwania

http://speedy.sh/Mc8XK/08132012-215850.log

log

http://speedy.sh/WCYam/log-ostatni.Txt

[Atis]

Masz trojana ZeroAccess (Sirefef) i zainfekowany plik systemowy services.exe

Odinstaluj StartNow Toolbar.

1. Uruchom cmd.exe jako administrator:

Jak uruchomić polecenie z pełnymi uprawnieniami?

Wklej i zatwierdź enterem:

sfc /scanfile=C:\Windows\system32\services.exe

reg delete HKCU\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /f

Zrestartuj system.

2. Do okna Własne opcje skanowania / skrypt wklej:

:OTL [2011-12-18 12:33:58 | 000,002,310 | ---- | M] () – d:\Program Files\mozilla firefox\searchplugins\babylon.xml O4 - HKCU…\Run: [PCSpeedUp] d:\Program Files\Przyspiesz Komputer\PCSpeedUp.lnk () :Files C:\Windows\Installer{5d0a1fd2-b8de-6455-fc26-014af86b1175} C:\Users\user\AppData\Local{5d0a1fd2-b8de-6455-fc26-014af86b1175} :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

3. Wklej do OTL i kliknij Skanuj:

HKEY_CURRENT_USER\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s /md5start services.exe /md5stop

Pokaż ten log.

4. Pobierz i uruchom Farbar Service Scanner

Zaznacz wszystkie pozycje i kliknij Scan.

Pokaż ten raport.

[jarosz23 (Shukor)]

http://speedy.sh/Rxz9g/trzeci0.log

http://speedy.sh/TBrES/czwarty.Txt

Scan

http://speedy.sh/9Tsfh/FSS.txt

[Atis]

Napraw usługi uszkodzone przez ZeroAccess (Sirefef)

Rekonstrukcja Zapory systemu Windows

Rekonstrukcja Centrum zabezpieczeń systemu Windows

Windows defender i aktualizacje.

Pobierz i rozpakuj archiwum:

http://sendfile.pl/191604/plik.zip

Kliknij prawym na pliku FIX i wybierz Scal.

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

Dysk przeskanuj Malwarebytes-AntiMalware.

Podczas instalacji odznacz Uruchom okres testowy Malwarebytes Anti-Malware PRO.

http://www.dobreprogramy.pl/Malwarebyte … 13117.html