Kmj.exe

[slimynoise]

Witam… nie wiem skąd się to wzięło

logi:

otl:

http://wklej.org/id/263274/

extras:

http://wklej.org/id/263277/

[deFco247]

skąd się to wzięło

Z zainfekowanego pendrive.

W białe dolne okno Custom Scans/Fixes w OTL wklej:

:Processes Explorer.EXE :OTL MOD - [2010-01-15 12:19:45 | 00,093,184 | RHS- | M] () – C:\Documents and Settings\Mandaya\Ustawienia lokalne\Temp\cvasds0.dll IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi … t=&gc=1&q= IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedi … t=&gc=1&q= IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=13928&l=dis IE - HKCU…\URLSearchHook: {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll () FF - prefs.js…browser.search.defaultenginename: “Ask” FF - prefs.js…browser.search.order.1: “Ask” FF - prefs.js…keyword.URL: “http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=” [2009-11-19 17:46:48 | 00,000,000 | —D | M] – C:\Documents and Settings\Mandaya\Dane aplikacji\Mozilla\Firefox\Profiles\8q49q1v9.default\extensions\DTToolbar@toolbarnet.com [2009-09-21 16:34:42 | 00,000,523 | ---- | M] () – C:\Documents and Settings\Mandaya\Dane aplikacji\Mozilla\Firefox\Profiles\8q49q1v9.default\searchplugins\daemon-search.xml O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM…\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU…\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKCU…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKCU…\Run: [cdoosoft] C:\Documents and Settings\Mandaya\Ustawienia lokalne\Temp\herss.exe () O32 - AutoRun File - [2010-01-15 13:03:40 | 00,000,053 | RHS- | M] () - C:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-01-15 13:03:40 | 00,000,053 | RHS- | M] () - D:\autorun.inf – [NTFS] O32 - AutoRun File - [2010-01-15 13:03:40 | 00,000,053 | RHS- | M] () - E:\autorun.inf – [NTFS] O33 - MountPoints2{91c931ca-dc55-11de-b46d-001d7d9b3505}\Shell\AutoRun\command - “” = 9u.exe O33 - MountPoints2{91c931ca-dc55-11de-b46d-001d7d9b3505}\Shell\open\Command - “” = 9u.exe O33 - MountPoints2{a65e6a49-a6b7-11de-882c-806d6172696f}\Shell - “” = AutoRun O33 - MountPoints2{a65e6a49-a6b7-11de-882c-806d6172696f}\Shell\AutoRun\command - “” = F:\Run.exe – File not found O33 - MountPoints2{a65e6a4a-a6b7-11de-882c-806d6172696f}\Shell\AutoRun\command - “” = C:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{a65e6a4a-a6b7-11de-882c-806d6172696f}\Shell\open\Command - “” = C:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{a65e6a4b-a6b7-11de-882c-806d6172696f}\Shell\AutoRun\command - “” = D:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{a65e6a4b-a6b7-11de-882c-806d6172696f}\Shell\open\Command - “” = D:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{a65e6a4c-a6b7-11de-882c-806d6172696f}\Shell\AutoRun\command - “” = E:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{a65e6a4c-a6b7-11de-882c-806d6172696f}\Shell\open\Command - “” = E:\kmj.exe – [2010-01-15 01:11:47 | 00,116,736 | RHS- | M] () O33 - MountPoints2{b4eaf50c-a6cb-11de-b3de-001d7d9b3505}\Shell\AutoRun\command - “” = I:\kmj.exe – File not found O33 - MountPoints2{b4eaf50c-a6cb-11de-b3de-001d7d9b3505}\Shell\open\Command - “” = I:\kmj.exe – File not found :Services ASKUpgrade :Files C:\Program Files\AskSearch C:\Program Files\AskBarDis C:\kmj.exe D:\kmj.exe E:\kmj.exe :Commands [emptytemp] [start explorer]

Run Fix. Restart, jeśli będzie potrzebny.

Potem log z usuwania oraz nowy log robiony opcją Run Scan.

[slimynoise]

log z usuwania

http://wklej.org/id/263312/

nowy log:

http://wklej.org/id/263319/

[deFco247]

Teraz log jest czysty.

W OTL kliknij CleanUp.

Usuń infekcje z pendrive lub kart pamięci za pomocą Flash Disinfector lub Panda USB Vaccine.

Lub format.

Jeśli korzystasz z Przywracania Systemu, to wyłącz i włącz je na wszystkich dyskach. Instrukcja XP.

Wykonaj pełny skan Dr.Web CureIt.

Gdy będą wirusy, pokaż raport.

Wyczyść rejestr i dysk CCleaner oraz wyłącz nim zbędniki z autostartu (Narzędzia -> Autostart).

No i zaktualizuj system do stanu Service Pack 3.

[JNJN]

kmj.exe

Proszę zmienić temat na konkretny, opcja EDYTUJ i popraw.JNJN