furles
4 Luty 2013 18:34
#1
Witam, otrzymałem wiadomość na skype, brzmi ona następująco:
“witam, to sa naprawde twoje zdjecia?? http://goo.gl/uSXJ6?photo=tutajmojnick ”
No i ja, głupiec kliknąłem w to, po czym ściągnąłem jakiś program który włączyłem i kliknąłem uruchom. Automatycznie owa wiadomość została wysłana do wszystkich moich znajomych na skype. Plik od razu usunąłem, proszę o pomoc, jakieś rady co do tego wirusa, jak go usunąć. Proszę o pomoc.
Raporty:
OTL.Txt http://www.wklej.org/id/947575/
Extras.Txt http://www.wklej.org/id/947579/
Agaton
4 Luty 2013 18:42
#2
furles ,
Proszę zapoznać się z tematem
Zignorowanie zalecenia będzie skutkowało przeniesieniem tematu do Kosza.
Przeniesiono do działu Bezpieczeństwo.
analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html
Atis
4 Luty 2013 19:55
#3
Odinstaluj Conduit Engine, Vid-Saver, vShare Plugin, SFT_Polska Toolbar.
Do okna Własne opcje skanowania / skrypt wklej:
:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\rdvgkmd.sys – (VGPU) DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\tsusbhub.sys – (tsusbhub) DRV - File not found [Kernel | On_Demand | Stopped] – System32\drivers\synth3dvsc.sys – (Synth3dVsc) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\mcdbus.sys – (mcdbus) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\Metin2_PL\Emerald_MU_Patch_June_2011\Emerald MU Patch June 2011\MuGuard\llck.sys – (LLRING0) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\EagleXNt.sys – (EagleXNt) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Windows\system32\drivers\EagleNT.sys – (EagleNT) DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\Matrix\AppData\Local\Temp\catchme.sys – (catchme) IE - HKLM…\URLSearchHook: {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No CLSID value found IE - HKLM…\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found IE - HKLM…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=1d … 9f3f568&q={searchTerms} IE - HKLM…\SearchScopes{10E637C1-F5F8-4C4C-A3E1-101831B83326}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 IE - HKLM…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: “URL” = http://dts.search-results.com/sr?src=ie … 06&sr=0&q={searchTerms} IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110824&tt=4912_7&babsrc=SP_ss&mntrId=7491fb0000000000000002248ce37aee IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{10E637C1-F5F8-4C4C-A3E1-101831B83326}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: “URL” = http://www.bigseekpro.com/search/browser/hypercam/{ECA8671D-DA50-4320-ADAF-A69A1C54FEAF}?q={searchTerms} IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: “URL” = http://dts.search-results.com/sr?src=ie … 06&sr=0&q={searchTerms} IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{C6666357-2C99-4C1F-B814-A490CCB58042}: “URL” = http://search.babylon.com/?q={searchTerms}&AF=108603&babsrc=SP_ss&mntrId=7491fb00000000000000485b39f3f568 IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{E05265F3-E4FA-41D4-9CFC-72F15B382558}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=YYYYYYYYPL&apn_uid=8E0DEEEE-493A-45F6-BE77-A35106664AC5&apn_sauid=27C4CD7D-4E98-4812-BFB7-DB5B8E5E3DC7 IE - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={D953305F-7AA1-4DF5-89D6-44A96DB63687} FF - prefs.js…browser.search.defaultengine: “Ask.com Search” FF - prefs.js…browser.search.defaultthis.engineName: “SFT_Polska Customized Web Search” FF - prefs.js…browser.search.selectedEngine: “Search the web (Babylon)” [2013-01-30 22:42:09 | 000,000,000 | —D | M] (“Vid-Saver”) – C:\Users\Matrix\AppData\Roaming\mozilla\Firefox\Profiles\9gpck4nd.default\extensions\crossriderapp3491@crossrider.com [2012-04-02 21:15:25 | 000,002,580 | ---- | M] () – C:\Users\Matrix\AppData\Roaming\mozilla\firefox\profiles\9gpck4nd.default\searchplugins\askcom.xml [2012-04-03 11:57:02 | 000,002,306 | ---- | M] () – C:\Users\Matrix\AppData\Roaming\mozilla\firefox\profiles\9gpck4nd.default\searchplugins\askcomsearch.xml [2012-12-09 09:11:10 | 000,002,432 | ---- | M] () – C:\Users\Matrix\AppData\Roaming\mozilla\firefox\profiles\9gpck4nd.default\searchplugins\babylon1.xml [2012-08-03 01:13:13 | 000,004,002 | ---- | M] () – C:\Users\Matrix\AppData\Roaming\mozilla\firefox\profiles\9gpck4nd.default\searchplugins\sweetim.xml [2011-01-01 15:17:18 | 000,001,583 | ---- | M] () – C:\Users\Matrix\AppData\Roaming\mozilla\firefox\profiles\9gpck4nd.default\searchplugins\web-search.xml O3 - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\Toolbar\WebBrowser: (no name) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - No CLSID value found. O3 - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\Toolbar\WebBrowser: (no name) - {5C5B9468-D672-4EB7-B52F-B5AFABF28C5B} - No CLSID value found. O4 - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\Run: [AdobeBridge] File not found O4 - HKU\S-1-5-21-2167339944-929822516-566260283-1000…\Run: [Gtpmps] C:\Users\Matrix\AppData\Roaming\Gtpmps.exe (MVOuzHR SlLKI6 Q0Jkc) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Reg Error: Value error.) [2011-06-28 19:11:15 | 000,000,061 | -HS- | C] () – C:\Windows\cnerolf.dat [2012-12-09 09:10:51 | 000,000,000 | —D | M] – C:\Users\Matrix\AppData\Roaming\Babylon :Files C:\Users\Matrix\AppData\Roaming*.exe :Commands [emptytemp]
Kliknij Wykonaj skrypt i zatwierdź restart.
Pokaż raport z usuwania i nowy log Skanuj.