Polizja Biuro Spraw Kryminalnych

wiewior96 · 11 Lipiec 2014 19:27

Witam, mam problem z wirusem podanym w temacie, poniżej podaję linki do logów z otl, proszę o pomoc

http://wklej.org/id/1414942/

http://wklej.org/id/1414944/

Z góry dziękuję za pomoc

Atis · 11 Lipiec 2014 20:28

W jakim celu używasz przestarzałego OTLPE?

Przecież wystarczyło uruchomić komputer w trybie awaryjnym.

Wklej i kliknij Run Fix:

:Files
C:\Users\Sznupa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autostart.lnk
C:\ProgramData\00918985C2DF4A6EE1903397786FA4E4

Pobierz Farbar Recovery Scan Tool 64-Bit Version

Uruchom FRST i kliknij Scan. Pokaż raport FRST i Addition.

wiewior96 · 11 Lipiec 2014 21:00

Stokrotne dzięki…

FRST:

http://wklej.org/id/1415039/

Addition:

http://wklej.org/id/1415037/

Atis · 11 Lipiec 2014 21:15

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM-x32\...\Runonce: [AvgUninstallURL] - cmd.exe /c start http://www.avg.com/pl.special-uninstallation-feedback-app?lic=SUFKUzMtQlFCUk4tVkczOTktQUxCTFUtOVM2U0YtWg"&"inst=NzYtMTgwMDU2NTc0Ny1TVDEwT0krMS1ERFQrMC1TVDEwQVBQKzEtQ0lBVis2LUNJQTEwKzItVEJDMTArMi1JTExJRCsxMjE3NzIyNDkwLUlZUisxLUlJU1IrMi1JSVNSVEUrMS1JSVNSVCsx"&"prod=94"&"ver=10.0.1432 [X]
HKU\S-1-5-21-3561755773-3832347821-2925207776-1001\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-3561755773-3832347821-2925207776-1001\...\Run: [RGSC] => D:\Gry\RGSC\Rockstar Games Social Club\RGSCLauncher.exe /silent
HKU\S-1-5-21-3561755773-3832347821-2925207776-1001\...\Policies\Explorer: [] 
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
DPF: HKLM {DE625294-70E6-45ED-B895-CFFA13AEB044} http://212.59.238.5/activex/AMC.cab
FF DefaultSearchEngine: Search.us
CHR Extension: (No Name) - C:\Users\Sznupa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejljmhdnjpebgefffhdkojadifiiphmf [2013-03-26]
CHR HKLM-x32\...\Chrome\Extension: [bildoibdboopgomcbiplincneeicgipj] - C:\Program Files (x86)\StartSearch plugin\startsplg.crx [2013-03-26]
C:\Program Files (x86)\StartSearch plugin
S2 Winmgmt; C:\PROGRA~3\wlhavjv.faa [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S2 VBoxDRV; \??\G:\VirtualBox\Portable-VirtualBox\app64\drivers\VBoxDrv\VBoxDrv.sys [X]
S2 VBoxUSBMon; \??\G:\VirtualBox\Portable-VirtualBox\app64\drivers\USB\filter\VBoxUSBMon.sys [X]
C:\ProgramData\RUNDLL32.EXE*.txt
C:\Users\Sznupa\AppData\Roaming\Origin\update.vbe
C:\Users\Sznupa\AppData\Local\Temp\*.exe
C:\Users\Sznupa\AppData\Local\Temp\*.dll
Task: {0044BD00-BDBF-4126-8A41-C8B88DFB688D} - System32\Tasks\ReclaimerUpdateFiles_Sznupa => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe [2014-06-25] (RealNetworks, Inc.)
Task: {0157A6B1-01A9-4348-AD45-7E39374B6973} - System32\Tasks\ReclaimerUpdateXML_Sznupa => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe [2014-06-25] (RealNetworks, Inc.)
Task: {0946141D-451F-4AAB-A3A3-54080BA278BC} - System32\Tasks\RNUpgradeHelperResumePrompt_Sznupa => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe [2014-06-25] (RealNetworks, Inc.)
Task: {1D2B80D9-E6AD-450E-B248-0A8A993C9847} - System32\Tasks\RNUpgradeHelperLogonPrompt_Sznupa => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe [2014-06-25] (RealNetworks, Inc.)
Task: {1EA9CE56-F635-4645-9ABC-644B6749A464} - System32\Tasks\RealCreateProcessScheduledTask1045066S-1-5-21-3561755773-3832347821-2925207776-1001 => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2012-09-15] (RealNetworks, Inc.)
Task: {241871E6-5317-499D-89D3-C2E19B6E51EE} - System32\Tasks\RealCreateProcessScheduledTask71323S-1-5-21-3561755773-3832347821-2925207776-1001 => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2012-09-15] (RealNetworks, Inc.)
Task: {60B8D6AD-FAE0-45E5-9525-8E43DC7B76C0} - System32\Tasks\0 => Iexplore.exe <==== ATTENTION
Task: {71C65FAA-1EC0-43C1-8ECD-4B96368CD57F} - System32\Tasks\Origin => C:\Users\Sznupa\AppData\Roaming\Origin\update.vbe [2014-05-17] () <==== ATTENTION
Task: {764BE2C8-53FF-46E2-8451-DB073DCFF407} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-3561755773-3832347821-2925207776-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {8C847C67-3732-401B-80DB-FA550494801E} - \GoforFilesUpdate No Task File <==== ATTENTION
Task: {97782229-016C-4487-B8F3-2972FBBB08EE} - System32\Tasks\RealCreateProcessScheduledTask58359S-1-5-21-3561755773-3832347821-2925207776-1001 => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2012-09-15] (RealNetworks, Inc.)
Task: {ADEE3F44-D3E8-4059-9554-28A759D52FCE} - System32\Tasks\4822 => Wscript.exe C:\Users\Sznupa\AppData\Local\Temp\launchie.vbs //B <==== ATTENTION
Task: {DBFC3E19-9265-4FBE-AAB6-178D8669D561} - System32\Tasks\DLL-Files.Com Fixer_Updates => D:\Programy\Dll-Files.com Fixer\DLLFixer.exe
Task: {E98117F2-0EFE-46EE-ACF4-D4211BD411DB} - System32\Tasks\RealCreateProcessScheduledTask144098S-1-5-21-3561755773-3832347821-2925207776-1001 => C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [2012-09-15] (RealNetworks, Inc.)
Task: {ECAA6656-617E-47B8-B467-16C3FCA84507} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => D:\Programy\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => D:\Programy\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => D:\Programy\Dll-Files.com Fixer\DLLFixer.exe
Task: C:\Windows\Tasks\ReclaimerUpdateFiles_Sznupa.job => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe
Task: C:\Windows\Tasks\ReclaimerUpdateXML_Sznupa.job => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe
Task: C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Sznupa.job => C:\Users\Sznupa\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\11.01\agent\rnupgagent.exe

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.