Wirus cyber policji

waski11333 · 10 Listopad 2012 21:47

Witam

Także i ja mam problem z tym wirusem.

Wszedłem przez: Tryb awaryjny z obsługą sieci i oto raport z OTL:

http://wklej.org/id/867647/

Co robić dalej?

będe naprawde wdzięczny za pomoc!

Pozdrawiam

Atis · 10 Listopad 2012 21:59

Do okna Własne opcje skanowania / skrypt wklej:

:OTL O3:64bit: - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - Startup: C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation) O9 - Extra Button: PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Szymon\Desktop\PartyCasino.lnk File not found O9 - Extra ‘Tools’ menuitem : PartyCasino - {B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - C:\Users\Szymon\Desktop\PartyCasino.lnk File not found O9 - Extra Button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Szymon\Desktop\PartyPoker.lnk File not found O9 - Extra ‘Tools’ menuitem : PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Users\Szymon\Desktop\PartyPoker.lnk File not found [2012-11-10 20:15:01 | 000,044,544 | ---- | C] (Microsoft Corporation) – C:\ProgramData\lsass.exe [2012-11-10 20:15:03 | 000,000,829 | ---- | M] () – C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk [2012-11-10 20:15:02 | 083,023,306 | ---- | C] () – C:\ProgramData\dsgsdgdsgdsgw.pad :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

Uruchom system w normalnym trybie i odinstaluj:

Searchqu Toolbar

VShareToolBar

Babylon Toolbar

uTorrentBar Toolbar

Sopcast Ask Toolbar

Yontoo

Pobierz AdwCleaner

Zamknij przeglądarkę internetową.

Uruchom AdwCleaner i kliknij Delete

4.Kliknij Skanuj i pokaż nowy log.

waski11333 · 11 Listopad 2012 09:50

Wielkie dzięki za szybką odpowiedź.

Raport z adw cleanera:

http://wklej.org/id/867799/

Nowy log:

http://wklej.org/id/867800/

Natomiast nie znalazłem Searchqu i Vshare Toolbar, pozostałe 4 usunąłem…

Co dalej robić?

Atis · 11 Listopad 2012 10:12

Wklej i kliknij Wykonaj skrypt:

:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/idd/idd_1331339493_152790 IE - HKLM…\SearchScopes{55D57EBB-66B0-4D32-A02A-3D4BD3C24552}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=63 … 888e845&q={searchTerms} IE - HKLM…\SearchScopes{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=63 … 888e845&q={searchTerms} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/idd/idd_1331339493_152790 IE - HKCU…\SearchScopes{5A7BAFB7-9A78-4067-A34E-35AD17DDBCD5}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=&apn_ptnrs=PV&apn_dtid=YYYYYYYYPL&apn_uid=2a3ba420-b65f-40a5-876c-37515c6a6bc4&apn_sauid=649DE909-44C3-4BC0-A121-F1214045D0E3 IE - HKCU…\SearchScopes{7F4EFF06-7032-458e-AE16-1C1D8255C28A}: “URL” = http://home.speedbit.com/search.aspx?si … fault&pid=%s&aid=%s&shr=%d&q={searchTerms} IE - HKCU…\SearchScopes{81D97971-01A6-4A9A-83AF-0CAFDD3F85A7}: “URL” = http://home.speedbit.com/search.aspx?aff=106&q={searchTerms} IE - HKCU…\SearchScopes{B937C7EB-E790-47C3-91AA-30CA755A29F3}: “URL” = http://rover.ebay.com/rover/1/4908-4461 … 4?satitle={searchTerms} IE - HKCU…\SearchScopes{CC0D0B3C-BB5E-48A3-9006-52D154F7BDC7}: “URL” = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2 IE - HKCU…\SearchScopes{E9ADC30C-1ABB-4AB8-9A98-4E8408493ACB}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=63 … 888e845&q={searchTerms} O4 - HKCU…\Run: [RMFon] File not found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll (Bandoo Media, inc) O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll) - C:\PROGRA~2\SEARCH~1\SEARCH~1\IEBHO.dll (Bandoo Media, inc)