zjw
14 Maj 2011 04:53
#1
Windows Vista Home Premium
Service Pack 2
ASUS Notebook M50Vn
RAM 2GB
Intel Core 2 Duo CPU P8400@ 2,26GHz
rootkit:
http://www.wklej.org/id/528632/txt/
otl
http://www.wklej.org/id/528599/txt/
http://www.wklej.org/id/528597/txt/
Acorus
14 Maj 2011 07:25
#2
Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:
:OTL IE - HKLM…\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net \tbfree.dll (Conduit Ltd.) IE - HKU\S-1-5-21-3458520719-1019345456-675649581-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource= … =CT1098640 IE - HKU\S-1-5-21-3458520719-1019345456-675649581-1000…\URLSearchHook: {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net \tbfree.dll (Conduit Ltd.) FF - prefs.js…browser.startup.homepage: “http://search.conduit.com/?ctid=CT1098640&SearchSource=13 ” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&q= ” [2011-05-06 21:24:39 | 000,000,000 | —D | M] (free-downloads.net Community Toolbar) – C:\Users\Robert\AppData\Roaming\mozilla\Firefox\Profiles\ibmiqnvo.default\extensions{ecdee021-0d17-467f-a1ff-c7a115230949} [2011-05-06 21:24:38 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\Robert\AppData\Roaming\mozilla\Firefox\Profiles\ibmiqnvo.default\extensions\engine@conduit.com [2011-03-21 17:07:24 | 000,000,939 | ---- | M] () – C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\ibmiqnvo.default\searchplugins\conduit.xml [2011-04-13 21:29:52 | 000,002,059 | ---- | M] () – C:\Users\Robert\AppData\Roaming\Mozilla\Firefox\Profiles\ibmiqnvo.default\searchplugins\daemon-search.xml O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net \tbfree.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net \tbfree.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-3458520719-1019345456-675649581-1000…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKU\S-1-5-21-3458520719-1019345456-675649581-1000…\Toolbar\WebBrowser: (free-downloads.net Toolbar) - {ECDEE021-0D17-467F-A1FF-C7A115230949} - C:\Program Files\free-downloads.net \tbfree.dll (Conduit Ltd.) O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-3458520719-1019345456-675649581-1000…\Run: [iVONA Reader] File not found O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.) [2011-05-12 22:35:34 | 000,000,000 | -HSD | C] – C:\found.000 :Commands [emptytemp]
Kliknij Wykonaj skrypt…Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.
Odinstaluj DAEMON Tools Toolbar,free-downloads.net Toolbar.
zjw
17 Maj 2011 16:25
#3
Dzieki za pomoc oto
raport z usuwania: http://www.wklej.org/id/531124/txt/
ponowny scan OTL :http://www.wklej.org/id/531136/txt/
http://www.wklej.org/id/531138/txt/
Przypuszczam że auto start tez mam zasmiecony ale niektorych programow nie potrafie odinstalowac.
Acorus
17 Maj 2011 16:46
#4
W porządku.W OTL użyj opcji Sprzątanie.Wyłącz i włącz przywracanie systemu na wszystkich dyskach:http://support.microsoft.com/kb/310405/pl
http://www.vista.pl/artykuly/11250_przy … vista.html
Przeskanuj progr.Malwarebytes Anti-Malware http://www.malwarebytes.org/mbam.php