Typu rootkit

[lukasz141 (Keewayr8)]

witam jak się tego pozbyć ??

mam loga z OTL ale nic z niego nie rozumiem

http://wklej.org/id/271763/

proszę o pomoc

[Gutek]

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

:Processes Explorer.EXE :OTL PRC - [2009-10-01 08:50:46 | 000,515,072 | ---- | M] () – C:\WINDOWS\Temp_ex-08.exe DRV - [2009-06-27 16:59:53 | 000,000,000 | ---- | M] () [Kernel | System | Stopped] – C:\WINDOWS\System32\drivers\878cf061.sys – (878cf061) [2009-07-21 09:41:49 | 000,002,233 | ---- | M] () – C:\Documents and Settings\Domek\Dane aplikacji\Mozilla\Firefox\Profiles\to9qg6ga.default\searchplugins\askcom.xml [2009-05-20 16:35:06 | 000,000,897 | ---- | M] () – C:\Documents and Settings\Domek\Dane aplikacji\Mozilla\Firefox\Profiles\to9qg6ga.default\searchplugins\conduit.xml O2 - BHO: (free-downloads.net Toolbar) - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll (Conduit Ltd.) O4 - HKLM…\Run: [PromoReg] C:\WINDOWS\Temp_ex-08.exe () O4 - Startup: C:\Documents and Settings\Domek\Menu Start\Programy\Autostart\ikowin32.exe (Qgtjcyo Purmolohput) O4 - Startup: C:\Documents and Settings\Domek\Menu Start\Programy\Autostart\sysupd32.exe () O32 - AutoRun File - [2008-07-10 16:18:52 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT – [NTFS] O33 - MountPoints2{56b3f04c-238d-11de-aebd-001d60d87ca1}\Shell\AutoRun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{56b3f04c-238d-11de-aebd-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{76651b81-e8e4-11de-b22f-001d60d87ca1}\Shell\autorun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{76651b81-e8e4-11de-b22f-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{7e2101c0-c554-11dd-acf2-001d60d87ca1}\Shell\autorun\command - “” = J:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{7e2101c0-c554-11dd-acf2-001d60d87ca1}\Shell\open\command - “” = J:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{7ef1be2e-f366-11dd-add0-001d60d87ca1}\Shell\autorun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{7ef1be2e-f366-11dd-add0-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{9704b906-9166-11dd-ac31-001d60d87ca1}\Shell\autorun\command - “” = H:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{9704b906-9166-11dd-ac31-001d60d87ca1}\Shell\open\command - “” = H:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{9e9331a4-5847-11de-afa3-001d60d87ca1}\Shell\autorun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{9e9331a4-5847-11de-afa3-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{bedc2d78-d25d-11dd-ad35-001d60d87ca1}\Shell\autorun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{bedc2d78-d25d-11dd-ad35-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b44c-4e9f-11dd-b662-001d60d87ca1}\Shell\autorun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b44c-4e9f-11dd-b662-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b44d-4e9f-11dd-b662-001d60d87ca1}\Shell\autorun\command - “” = I:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b44d-4e9f-11dd-b662-001d60d87ca1}\Shell\open\command - “” = I:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b47b-4e9f-11dd-b662-001d60d87ca1}\Shell\AutoRun\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found O33 - MountPoints2{d7b2b47b-4e9f-11dd-b662-001d60d87ca1}\Shell\open\command - “” = F:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe – File not found [2010-01-31 15:01:03 | 000,087,168 | ---- | M] () – C:\WINDOWS\System32\drivers\620514b4.sys [2010-01-31 14:00:39 | 000,763,904 | ---- | M] () – C:\WINDOWS\System32\drivers\hzmnd.sys [2010-01-31 10:22:12 | 000,000,016 | ---- | M] () – C:\Documents and Settings\Domek\Dane aplikacji\zxcvbd.dat [2010-01-31 10:23:12 | 000,763,904 | ---- | C] () – C:\WINDOWS\System32\drivers\hzmnd.sys [2009-11-18 17:06:52 | 000,000,016 | ---- | C] () – C:\Documents and Settings\Domek\Dane aplikacji\zxcvbd.dat [2009-11-18 17:06:38 | 000,000,012 | ---- | C] () – C:\Documents and Settings\Domek\Dane aplikacji\avdrn.dat [2009-10-01 08:49:42 | 000,087,168 | ---- | C] () – C:\WINDOWS\System32\drivers\620514b4.sys :Files C:\Program Files\free-downloads.net C:\WINDOWS\System32\drivers\878cf061.sys C:\WINDOWS\Temp\ C:\Documents and Settings\Domek\Menu Start\Programy\Autostart\ikowin32.exe C:\Documents and Settings\Domek\Menu Start\Programy\Autostart\sysupd32.exe F:\RESTORE H:\RESTORE I:\RESTORE J:\RESTORE C:\WINDOWS\System32\drivers\620514b4.sys C:\Documents and Settings\Domek\Dane aplikacji\zxcvbd.dat C:\Documents and Settings\Domek\Dane aplikacji\avdrn.dat C:\WINDOWS\System32\drivers\620514b4.sys :Services 878cf061 :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [Reboot]

Kliknij w Run Fix. Zatwierdź restart komputera.

Następnie uruchom OTL ponownie, tym razem wywołaj opcję Run Scan.

Pokaż nowy log OTL.txt oraz log z czyszczenia.

Pobierz GMER

W GMER nic nie zmieniasz-> wciskasz Szukaj (odczekaj swoje) -> po skanie Kopiuj.

>>>> otl-gmer-rsit-dds-inne-instrukcje-t370405.html