KMJ.exe i Autorun :/ Jak to usunąć?

zima13 · 14 Styczeń 2010 21:10

Mam taki sam problem jak PrisonHunter

Poniżej zamieszczam logi:

otl

http://wklej.org/id/262979/

extras

http://wklej.org/id/262985/

Czekam na pomoc

Gutek · 14 Styczeń 2010 21:27

Nie podpinaj się pod temat - wydzielam posta.

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

:Processes Explorer.EXE :OTL MOD - [2010-01-14 20:08:43 | 00,093,184 | RHS- | M] () – C:\Documents and Settings\zima\Ustawienia lokalne\Temp\cvasds0.dll O4 - HKLM…\Run: [combofix] File not found O4 - HKU\S-1-5-21-823518204-1390067357-1417001333-1004…\Run: [cdoosoft] C:\Documents and Settings\zima\Ustawienia lokalne\Temp\herss.exe () O4 - HKU\S-1-5-21-823518204-1390067357-1417001333-1004…\Run: [FlashGet] C:\Program Files\FlashGet Network\FlashGet universal\flashget.exe File not found O32 - AutoRun File - [2010-01-14 20:21:06 | 00,000,053 | RHS- | M] () - C:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-01-14 20:21:06 | 00,000,053 | RHS- | M] () - D:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-01-14 20:21:06 | 00,000,053 | RHS- | M] () - E:\autorun.inf – [NTFS] O33 - MountPoints2{d347c93e-f7a0-11de-b6f5-0015af868d62}\Shell - “” = AutoRun O33 - MountPoints2{d347c93e-f7a0-11de-b6f5-0015af868d62}\Shell\AutoRun\command - “” = H:\LaunchU3.exe – File not found O33 - MountPoints2{f06575df-ba61-11de-b665-0015af868d62}\Shell\AutoRun\command - “” = H:\kmj.exe – File not found O33 - MountPoints2{f06575df-ba61-11de-b665-0015af868d62}\Shell\open\Command - “” = H:\kmj.exe – File not found O33 - MountPoints2{f1d49ff4-ba61-11de-9c9a-806d6172696f}\Shell\AutoRun\command - “” = C:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f1d49ff4-ba61-11de-9c9a-806d6172696f}\Shell\open\Command - “” = C:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f1d49ff5-ba61-11de-9c9a-806d6172696f}\Shell\AutoRun\command - “” = D:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f1d49ff5-ba61-11de-9c9a-806d6172696f}\Shell\open\Command - “” = D:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f1d49ff6-ba61-11de-9c9a-806d6172696f}\Shell\AutoRun\command - “” = E:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f1d49ff6-ba61-11de-9c9a-806d6172696f}\Shell\open\Command - “” = E:\kmj.exe – [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () O33 - MountPoints2{f90c81f4-c857-11de-b688-0015af868d62}\Shell - “” = AutoRun O33 - MountPoints2{f90c81f4-c857-11de-b688-0015af868d62}\Shell\Menu\command - “” = H:\autorun.exe – File not found O33 - MountPoints2\H\Shell - “” = AutoRun O33 - MountPoints2\H\Shell\AutoRun\command - “” = H:\LaunchU3.exe – File not found [2010-01-14 20:23:13 | 00,000,053 | RHS- | M] () – C:\autorun.inf [2010-01-14 19:37:21 | 00,293,376 | ---- | M] () – C:\Documents and Settings\zima\Pulpit\1re6c7p5.exe [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () – C:\kmj.exe [2010-01-14 19:45:02 | 00,293,376 | ---- | C] () – C:\Documents and Settings\zima\Pulpit\1re6c7p5.exe [2010-01-14 19:27:31 | 00,116,736 | RHS- | C] () – C:\kmj.exe [2010-01-14 18:07:58 | 00,000,053 | RHS- | C] () – C:\autorun.inf [2010-01-14 20:23:39 | 00,000,053 | RHS- | M] () – C:\autorun.inf [2010-01-14 18:08:13 | 00,116,736 | RHS- | M] () – C:\kmj.exe :Files C:\Documents and Settings\zima\Ustawienia lokalne\Temp\cvasds0.dll C:\Documents and Settings\zima\Ustawienia lokalne\Temp\herss.exe C:\Documents and Settings\zima\Pulpit\1re6c7p5.exe C:\kmj.exe C:\autorun.inf D:\autorun.inf E:\autorun.inf :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera.

Następnie uruchom OTL ponownie, tym razem wywołaj opcję Run Scan.

Pokaż nowy log OTL.txt oraz log z czyszczenia.

zima13 · 14 Styczeń 2010 22:06

Dzięki za pomoc i przepraszam ze te problemy z moim postem

deFco247 · 15 Styczeń 2010 12:51

zima13 , to jeszcze nie koniec…