Prosze o pomoc w usunieciu Adware.VirtuMonde

nikunisia · 17 Październik 2007 17:50

Witam, czy moge prosic o pomoc? Zlapalam chyba advare virtumonde nie wiem czym to usunac. To logi z HijackThis.

Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:19:19, on 2007-10-17 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: G:\WINDOWS\System32\smss.exe G:\WINDOWS\system32\winlogon.exe G:\WINDOWS\system32\services.exe G:\WINDOWS\system32\lsass.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\System32\svchost.exe G:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe G:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe G:\WINDOWS\system32\spoolsv.exe G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe G:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE G:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe G:\WINDOWS\system32\HPZipm12.exe G:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe G:\WINDOWS\system32\svchost.exe G:\WINDOWS\Explorer.EXE G:\Program Files\Common Files\Symantec Shared\ccApp.exe G:\Program Files\Skype\Phone\Skype.exe G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe G:\Program Files\Gadu-Gadu\gg.exe G:\Program Files\Skype\Plugin Manager\SkypePM.exe G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe G:\Program Files\Mozilla Firefox\firefox.exe G:\WINDOWS\system32\WISPTIS.EXE G:\WINDOWS\system32\rundll32.exe G:\Program Files\Internet Explorer\IEXPLORE.EXE G:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - G:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - g:\program files\google\googletoolbar2.dll O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - G:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - G:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - G:\WINDOWS\system32\roqepbnz.dll O4 - HKLM…\Run: [ccApp] “G:\Program Files\Common Files\Symantec Shared\ccApp.exe” O4 - HKLM…\Run: [osCheck] “G:\Program Files\Norton Internet Security\osCheck.exe” O4 - HKLM…\Run: [symantec PIF AlertEng] “G:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe” /a /m “G:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll” O4 - HKLM…\Run: [searchIndexer] rundll32.exe “G:\WINDOWS\system32\qvcybhjj.dll”,sitypnow O4 - HKCU…\Run: [skype] “G:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized O4 - HKCU…\Run: [Odkurzacz-MCD] G:\Program Files\Odkurzacz\odk_mcd.exe O4 - HKCU…\Run: [spybotSD TeaTimer] G:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU…\Run: [swg] G:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA LOKALNA’) O4 - HKUS\S-1-5-20…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘USŁUGA SIECIOWA’) O4 - HKUS\S-1-5-18…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\Run: [CTFMON.EXE] G:\WINDOWS\system32\CTFMON.EXE (User ‘Default user’) O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - G:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - G:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU) O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - G:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: COM Host (comHost) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe O23 - Service: Google Updater Service (gusvc) - Google - G:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Harmonogram automatycznej usługi LiveUpdate - Symantec Corporation - G:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - G:\Program Files\Norton Internet Security\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - G:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\PIF{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Pml Driver HPZ12 - HP - G:\WINDOWS\system32\HPZipm12.exe O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - G:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - G:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - G:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Symantec Core LC - Unknown owner - G:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - G:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe – End of file - 7070 bytes

arekmalek · 17 Październik 2007 18:37

Użyj VundoFix + FixVundo + VirtumondoBeGone.

Użyj combofix (temat przyklejony)

Daj z nich logi.

nikunisia · 19 Październik 2007 08:29

W takim razie przesylam logi, nie pojawil mi sie jednak z Vudnofix.

Tu jest z FixVundo

Tutaj VirtumondoBeGone

[10/18/2007, 9:25:26] - VirtumundoBeGone v1.5 ( “G:\Documents and Settings\Admin\Pulpit\VirtumundoBeGone.exe” ) [10/18/2007, 9:25:27] - Detected System Information: [10/18/2007, 9:25:27] - Windows Version: 5.1.2600, Dodatek Service Pack 2 [10/18/2007, 9:25:27] - Current Username: Admin (Admin) [10/18/2007, 9:25:27] - Windows is in NORMAL mode. [10/18/2007, 9:25:27] - Searching for Browser Helper Objects: [10/18/2007, 9:25:27] - BHO 1: {0082A6B3-794F-44EF-AB15-6A3901CBDD9D} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - No filename found. Continuing. [10/18/2007, 9:25:27] - BHO 2: {00D53ABE-91B2-4B26-8917-2B54D81D16E9} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - Checking for HKLM…\Winlogon\Notify\pmnll [10/18/2007, 9:25:27] - Key not found: HKLM…\Winlogon\Notify\pmnll, continuing. [10/18/2007, 9:25:27] - BHO 3: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class) [10/18/2007, 9:25:27] - BHO 4: {1E8A6170-7264-4D0F-BEAE-D42A53123C75} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - Checking for HKLM…\Winlogon\Notify\NppBho [10/18/2007, 9:25:27] - Key not found: HKLM…\Winlogon\Notify\NppBho, continuing. [10/18/2007, 9:25:27] - BHO 5: {259F616C-A300-44F5-B04A-ED001A26C85C} (Solid Converter PDF) [10/18/2007, 9:25:27] - BHO 6: {34B34870-5241-45FD-89C0-DCAB057DEFF9} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - No filename found. Continuing. [10/18/2007, 9:25:27] - BHO 7: {53707962-6F74-2D53-2644-206D7942484F} (Spybot-S&D IE Protection) [10/18/2007, 9:25:27] - BHO 8: {673924CC-922E-4F3B-9B54-21E2DD08C8E1} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - No filename found. Continuing. [10/18/2007, 9:25:27] - BHO 9: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class) [10/18/2007, 9:25:27] - BHO 10: {89AD4D75-2429-462e-BD4E-443F233F6033} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - Checking for HKLM…\Winlogon\Notify\vrurints [10/18/2007, 9:25:27] - Key not found: HKLM…\Winlogon\Notify\vrurints, continuing. [10/18/2007, 9:25:27] - BHO 11: {A95B2816-1D7E-4561-A202-68C0DE02353A} () [10/18/2007, 9:25:27] - WARNING: BHO has no default name. Checking for Winlogon reference. [10/18/2007, 9:25:27] - No filename found. Continuing. [10/18/2007, 9:25:27] - BHO 12: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper) [10/18/2007, 9:25:27] - BHO 13: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO) [10/18/2007, 9:25:27] - BHO 14: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class) [10/18/2007, 9:25:27] - Finished Searching Browser Helper Objects [10/18/2007, 9:25:27] - Finishing up… [10/18/2007, 9:25:27] - Nothing found! Exiting…

A tutaj z Combofix

http://wklej.org/id/c97e3d0b39