Robak Win32/Gamarue.gen!Ink

[dagor1 (dagor.)]

Program antywirusowy wykrył takiego robaka na pendrivie jak w tytule. Proszę o wskazówki.

OTL:

http://wklej.org/id/1077998/

Extras:

http://wklej.org/id/1077999/

USBFix Listing:

http://wklej.org/id/1078001/

[Atis]

Odinstaluj Spybot - Search & Destroy 2.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL SRV:64bit: - File not found [Auto | Running] – C:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe SOFTWARE\SRAC\COSMOS_FloWorks 2013 – (RemoteSolverDispatcher) IE:64bit: - HKLM…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzuyCyEtByBtAyB0DtCtD0CyE0AzzyC0DyEtN0D0TzutBtDtCtBtDyDtAtC&cr=84320278 IE - HKLM…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzuyCyEtByBtAyB0DtCtD0CyE0AzzyC0DyEtN0D0TzutBtDtCtBtDyDtAtC&cr=84320278 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-search.com/?affID=4444 … 737D10C49/ IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://www.delta-search.com/?q={searchTerms}&affID=44444&babsrc=SP_ss&mntrId=7C4E642737D10C49 IE - HKCU…\SearchScopes{38CDCE1E-4689-6D1A-1706-7BFA95FC7246}: “URL” = http://isearch.avg.com/search?cid={44B690A0-FD48-4240-A1EB-16F65D464E71}&mid=b545b06b95a747d0a1f0b56e7135e5b9-79c2a86bc21f352a28a6d9218af820bd8665cf2b〈=en&ds=yu012&pr=sa&d=2012-05-22 01:26:32&v=11.1.0.7&sap=dsp&q={searchTerms} IE - HKCU…\SearchScopes{AD7FFAAB-1CB5-4552-B5D5-A3A530E30085}: “URL” = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=nv1&chnl=nv1&cd=2XzutAtN2Y1L1QzuyCyEtByBtAyB0DtCtD0CyE0AzzyC0DyEtN0D0TzutBtDtCtBtDyDtAtC&cr=84320278 [2013-04-15 00:51:37 | 000,000,000 | —D | M] (Broowsie2saavie) – C:\Users\Petrus\AppData\Roaming\mozilla\Firefox\Profiles\2i25qc1i.default\extensions\grrqnr7y@aaiiaouy.org [2013-04-08 12:54:32 | 000,000,000 | —D | M] (MMAAgneiiPicc) – C:\Users\Petrus\AppData\Roaming\mozilla\Firefox\Profiles\2i25qc1i.default\extensions\pb2x9arff@rjiiauaao.edu [2013-03-04 13:49:07 | 000,000,000 | —D | M] (BrowsE22savea) – C:\Users\Petrus\AppData\Roaming\mozilla\Firefox\Profiles\2i25qc1i.default\extensions\vecghc@zieuoqhbq.net [2013-06-15 19:24:49 | 000,006,469 | ---- | M] () – C:\Users\Petrus\AppData\Roaming\mozilla\firefox\profiles\2i25qc1i.default\searchplugins\babylon.xml [2013-06-15 19:24:56 | 000,001,294 | ---- | M] () – C:\Users\Petrus\AppData\Roaming\mozilla\firefox\profiles\2i25qc1i.default\searchplugins\delta.xml [2013-03-18 13:36:10 | 000,002,090 | ---- | M] () – C:\Users\Petrus\AppData\Roaming\mozilla\firefox\profiles\2i25qc1i.default\searchplugins\Searchou.xml O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120626214033.dll File not found O2:64bit: - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120626214033.dll File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: 34516 = C:\PROGRA~3\LOCALS~1\Temp\ccvoyv.com O20 - Winlogon\Notify\SDWinLogon: DllName - (SDWinLogon.dll) - File not found [2013-06-29 00:07:35 | 000,000,000 | —D | C] – C:\Program Files (x86)\Enigma Software Group [2013-06-28 23:29:05 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group [2013-02-12 14:01:34 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Abywry [2013-06-29 03:26:27 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Acanh [2013-02-08 11:57:24 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Agob [2013-06-29 03:26:27 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ahvoy [2013-02-15 13:05:52 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Aruha [2013-06-15 19:24:35 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Babylon [2013-02-16 21:26:13 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Buos [2013-07-01 00:14:38 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Curiolab [2013-03-06 07:00:01 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ebef [2013-01-27 14:51:31 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Eroqs [2013-03-19 16:30:10 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\f-secure [2013-02-12 14:01:34 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Hacy [2013-03-27 13:46:41 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Huhol [2013-02-13 00:01:37 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Itophi [2013-07-01 00:37:22 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ivypa [2013-03-06 07:00:01 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ixyty [2013-06-26 19:41:29 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Onuq [2013-03-05 21:00:00 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Overn [2013-02-05 02:05:51 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Paucv [2013-07-01 00:35:37 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Seuxw [2013-02-05 02:05:51 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Uleb [2013-02-13 00:01:37 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Uzudcu [2013-07-01 00:35:37 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Vupazu [2013-06-29 03:26:26 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Xeahqy [2013-03-05 21:00:00 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Xiamv [2013-06-29 03:26:26 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Xyciev [2013-06-29 03:26:26 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ychiu [2013-02-15 13:05:52 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Ynnop [2013-02-16 21:26:13 | 000,000,000 | —D | M] – C:\Users\Petrus\AppData\Roaming\Zynua :Files G:\autorun.inf attrib /d /s -s -h G:* /c :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

Pokaż nowy raport UsbFix z opcji Listing.

[dagor1 (dagor.)]

Raport:

http://wklej.org/id/1078069/

OTL:

http://wklej.org/id/1078071/

Listing:

http://wklej.org/id/1078073/

[Atis]

Uruchom AdwCleaner i kliknij Usuń.

Wklej i kliknij Wykonaj skrypt:

:OTL FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\msktbird@mcafee.com: C:\Program Files\McAfee\MSK [2013-06-29 01:44:31 | 000,000,000 | —D | C] – C:\ProgramData\Spybot - Search & Destroy [2013-06-15 19:24:36 | 000,000,000 | —D | C] – C:\ProgramData\Babylon [2013-06-10 12:12:31 | 000,000,000 | —D | C] – C:\ProgramData\StarApp [2013-06-10 10:45:51 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\conntinueetaoSSauve [2013-06-10 10:45:48 | 000,000,000 | —D | C] – C:\ProgramData\conntinueetaoSSauve [2013-06-10 10:44:46 | 000,000,000 | —D | C] – C:\ProgramData\InstallMate [2013-01-27 14:54:39 | 000,000,001 | ---- | C] () – C:\ProgramData\3f5DBf4m.exe_.b [2013-01-27 14:54:39 | 000,000,001 | ---- | C] () – C:\ProgramData\3f5DBf4m.exe.b [2012-05-09 19:27:21 | 001,411,016 | ---- | C] () – C:\Users\Petrus\AppData\Roaming\111.dat [2013-07-01 13:17:51 | 000,000,418 | -H-- | M] () – C:\windows\tasks\schedule!3036567561.job :Files C:\windows\tasks\schedule*.job

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

[dagor1 (dagor.)]

AdwCleaner

http://wklej.org/id/1078144/

OTL:

http://wklej.org/id/1078145/

Results of screen317’s Security Check version 0.99.68

Windows 7 Service Pack 1 x64 (UAC is disabled!)

Internet Explorer 10

Antivirus/Firewall Check:

WMI entry may not exist for antivirus; attempting automatic update.

Anti-malware/Other Utilities Check:

Java 7 Update 9

Java version out of Date!

Adobe Flash Player 11.7.700.224

Adobe Reader 10.1.4 Adobe Reader out of Date!

Mozilla Firefox 18.0.1 Firefox out of Date!

Google Chrome 27.0.1453.110

Google Chrome 27.0.1453.116

Process Check: objlist.exe by Laurent

Microsoft Security Essentials MSMpEng.exe

Microsoft Security Essentials msseces.exe

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Malwarebytes’ Anti-Malware mbamscheduler.exe

System Health check

Total Fragmentation on Drive C:

````````````````````End of Log``````````````````````

[Atis]

Odinstaluj Adobe Reader 10.1.4 i Java 7 Update 9.

Zainstaluj Java 7 Update 25 i Adobe Reader

[dagor1 (dagor.)]

Ok, coś jeszcze?

[Atis]

To wszystko.