Problem z usunięciem wirusa Olmarik. Proszę o pomoc

[GRZEGORZK11 (Sneer0)]

Witam, tak jak jest napisane w temacie mam problem z wirusem Olmarik. Wklejam logi z OTL i czekam na pomoc. Z góry dziękuję.

OTL.txt

http://wklejto.pl/83911

Extras.txt

http://wklejto.pl/83912

[anon57460748]

Przeklej logi z pliku na www.wklej.org , bo tam poznikały ukośniki,przez co log jest nieczytelny.

Pozdrawiam

[GRZEGORZK11 (Sneer0)]

OLT.txt

http://www.wklej.org/id/439296/

Extras.txt

http://www.wklej.org/id/439300/

[jessica]

Nic tu nie wskazuje na Olmarik’a.

Ale na wszelki wypadek:

Użyj > TDSSKiller >http://www.bezpieczenstwosystemow.pl/index.php?topic=7461.0

Daj z niego raport.

Uruchom OTL i w oknie Własne opcje skanowania/Script wklej to:

:OTL IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.theprizeday.com/today.php IE - HKCU…\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - Reg Error: Key error. File not found IE - HKCU…\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.) FF - prefs.js…browser.search.selectedEngine: “DAEMON Search” FF - prefs.js…extensions.enabledItems: toolbar@ask.com:3.9.1.14019 FF - prefs.js…extensions.enabledItems: {8141440E-08F0-4339-9959-5C31C6A69F23}:4.1.0.5050 FF - prefs.js…extensions.enabledItems: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}:2.0.0.66311 FF - prefs.js…extensions.enabledItems: {E889F097-B0BE-471B-89AD-B86B6F04B506}:3.1.0.1540 FF - prefs.js…extensions.enabledItems: DTToolbar@toolbarnet.com:1.0.8.0552 FF - prefs.js…extensions.enabledItems: {40f1eb95-4de4-4f36-a826-054ee36bb905}:2.1.1.0 FF - prefs.js…extensions.enabledItems: {F2DDDB92-1605-4260-9B25-45A4DAE87B50}:1.0 FF - prefs.js…extensions.enabledItems: {E63605FC-D583-4C81-867F-9457BDB3EA1B}:3.1.0.1800 FF - prefs.js…extensions.enabledItems: engine@conduit.com:3.2.1.3 FF - HKLM\software\mozilla\Firefox\Extensions\{40f1eb95-4de4-4f36-a826-054ee36bb905}: C:\Program Files\Gameztar Toolbar\2.1.1.5200\FFToolbar [2009-11-27 21:16:55 | 000,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{E63605FC-D583-4C81-867F-9457BDB3EA1B}: C:\Program Files\Web Search Operator\3.1.0.1800\FF [2009-11-27 21:17:05 | 000,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{8141440E-08F0-4339-9959-5C31C6A69F23}: C:\Program Files\Automated Content Enhancer\4.1.0.5050\FF [2009-11-27 21:17:14 | 000,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{E889F097-B0BE-471B-89AD-B86B6F04B506}: C:\Program Files\Customized Platform Advancer\3.1.0.1540\FF [2009-11-27 21:17:24 | 000,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\firefox\ [2009-05-23 08:30:11 | 000,000,000 | —D | M] – C:\Documents and Settings\gk\Dane aplikacji\Mozilla\Firefox\Profiles\kdlmuebm.default\extensions\DTToolbar@toolbarnet.com [2010-12-03 19:47:23 | 000,000,000 | —D | M] – C:\Documents and Settings\gk\Dane aplikacji\Mozilla\Firefox\Profiles\kdlmuebm.default\extensions\engine@conduit.com [2010-10-14 16:01:11 | 000,000,000 | —D | M] – C:\Documents and Settings\gk\Dane aplikacji\Mozilla\Firefox\Profiles\kdlmuebm.default\extensions\toolbar@ask.com [2009-05-23 08:29:52 | 000,000,523 | ---- | M] () – C:\Documents and Settings\gk\Dane aplikacji\Mozilla\Firefox\Profiles\kdlmuebm.default\searchplugins\daemon-search.xml [2009-06-01 12:30:51 | 000,000,000 | —D | M] (BearShare MediaBar) – C:\Program Files\Mozilla Firefox\extensions{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} [2010-01-16 01:29:18 | 000,000,000 | —D | M] (QuestService) – C:\Program Files\Mozilla Firefox\extensions{F2DDDB92-1605-4260-9B25-45A4DAE87B50} [2009-11-27 23:05:11 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice127.xml [2010-01-01 17:09:50 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice133.xml [2010-01-16 01:29:19 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice135.xml [2010-01-23 08:13:29 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice137.xml [2010-01-30 10:13:35 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice139.xml [2010-03-03 16:36:21 | 000,002,405 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\questservice141.xml O2 - BHO: (Automated Content Enhancer) - {1D74E9DD-8987-448b-B2CB-67FFF2B8A932} - C:\Program Files\Automated Content Enhancer\4.1.0.5050\ACEIEAddOn.dll () O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.3.2.dll (BitComet) O2 - BHO: (Customized Platform Advancer) - {42C7C39F-3128-4a17-BDB7-91C46032B5B9} - C:\Program Files\Customized Platform Advancer\3.1.0.1540\CPAIEAddOn.dll () O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Content Management Wizard) - {B72681C0-A222-4b21-A0E2-53A5A5CA3D41} - Reg Error: Value error. File not found O2 - BHO: (Softonic-Polska Toolbar) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.) O2 - BHO: (TCP) - {CAC89FF9-34A9-4431-8CFE-292A47F843BC} - C:\Program Files\Textual Content Provider\1.1.0.1380\TCPIE.dll () O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (Web Search Operator) - {EB4A577D-BCAD-4b1c-8AF2-9A74B8DD3431} - C:\Program Files\Web Search Operator\3.1.0.1800\WSO.dll () O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\gk\Dane aplikacji\Nowe Gadu-Gadu_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM…\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (Softonic-Polska Toolbar) - {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.) O3 - HKLM…\Toolbar: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (BearShare) O3 - HKLM…\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU…\Toolbar\WebBrowser: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll (BearShare) O3 - HKCU…\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU…\Toolbar\WebBrowser: (Gameztar Toolbar) - {D45817B8-3EAD-4D1D-8FCA-EC63A8E35DE2} - Reg Error: Value error. File not found O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [rcnsexywallpapers] C:\Program Files\RCN Sexy Wallpapers\wallpaper.exe File not found O4 - HKLM…\Run: [uUSeeMediaCenter] C:\Program Files\Common Files\uusee\UUSeeMediaCenter.exe File not found O4 - HKCU…\Run: [VideoBarApp] C:\Program Files\Gameztar Toolbar\2.1.1.5200\mvbapp.exe File not found [2010-12-16 19:01:03 | 000,000,228 | ---- | M] () – C:\WINDOWS\Tasks\Scheduled Update for Ask Toolbar.job :Files C:\Program Files\Gameztar Toolbar C:\Program Files\Web Search Operator C:\Program Files\Automated Content Enhancer C:\Program Files\Customized Platform Advancer C:\Program Files\MyWebSearch :Commands [emptytemp]

Kliknij w Wykonaj Script. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.

Pokaż nowy log OTL.txt oraz raport z usuwania.

jessi

[GRZEGORZK11 (Sneer0)]

nowy log OTL:

http://www.wklej.org/id/439376/

raport z usuwania:

http://wklej.org/id/439365/

TDSSKiller:

http://www.wklej.org/id/439350/

[jessica]

A więc jednak Olmarik (TDSS) był.

Teraz powinno już być OK.

JESSI

[GRZEGORZK11 (Sneer0)]

Niestety nie jest ok. Wg mojego NOD’a wirus wciąż istnieje i stwarza zagrożenie.

[jessica]

Zrób nowy log z TDSSKiller

Oraz log z > MBRCheck.exe >http://www.bezpieczenstwosystemow.pl/index.php?topic=7494.0

I napisz, gdzie NOD wykrywa tego Olmarik’a.

jessi

[GRZEGORZK11 (Sneer0)]

nowy log z TDSSKiller:

http://www.wklej.org/id/439421/

MBRCheck.exe:

http://www.wklej.org/id/439422/

NOD wyświetla mi coś takiego:

[jessica]

C:\WINDOWS\system32\DRIVERS\ehdrv.sys - processing error

No tak, TDSSKiller nie potrafi tego wyleczyć.

Daj na DELETE (lub Quarantine), zamiast na Cure.

Jeśli TDSSKiler usunie ten plik, to potem przeinstaluj NOD’a, bo to jego plik.

W MBR nie ma Rootkita

jessi

[GRZEGORZK11 (Sneer0)]

Wszystko wygląda już w porządku. Dziękuję Jessi za tak szybką i efektywną pomoc.

Pozdrawiam serdecznie i życzę Wesołych Świąt.