Wirus department policja

[pomios]

Witam, zostałem ofiarą znanego wirusa polskiej policji

Oto log z otl http://wklej.org/id/927303/

Proszę o pomoc

Pozdrawiam!

[Atis]

Do okna Własne opcje skanowania / skrypt wklej:

:OTL SRV - File not found [Auto | Stopped] – C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe – (vToolbarUpdater13.2.0) DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\drivers\EagleXNt.sys – (EagleXNt) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=hp FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.search.order.1: “v9” FF - prefs.js…browser.search.selectedEngine: “AVG Secure Search” FF - prefs.js…browser.startup.homepage: “http://isearch.avg.com/?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=hp” FF - prefs.js…keyword.URL: “http://isearch.avg.com/search?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=ku&q=” [2012-10-09 14:25:18 | 000,002,299 | ---- | M] () – C:\Documents and Settings\PFK\Dane aplikacji\Mozilla\Firefox\Profiles\vi07h6vu.default\searchplugins\askcom.xml O3 - HKCU…\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found. O4 - HKLM…\Run: [ROC_roc_ssl_v12] “C:\Program Files\AVG Secure Search\ROC_roc_ssl_v12.exe” / /PROMPT /CMPID=roc_ssl_v12 File not found O4 - HKLM…\Run: [vProt] “C:\Program Files\AVG Secure Search\vprot.exe” File not found O4 - HKCU…\Run: [dso32] C:\Documents and Settings\PFK\Ustawienia lokalne\Temp\dsoqq.exe () [2013-01-13 13:38:53 | 095,023,320 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\dsgsdgdsgdsgw.pad [2013-01-13 13:07:35 | 000,002,909 | ---- | M] () – C:\Documents and Settings\All Users\Dane aplikacji\dsgsdgdsgdsgw.js [2013-01-12 13:50:58 | 000,000,780 | ---- | M] () – C:\Documents and Settings\PFK\Menu Start\Programy\Autostart\runctf.lnk [2013-01-12 13:50:54 | 000,139,264 | ---- | M] (Microsoft Corporation) – C:\Documents and Settings\PFK\wgsdgsdgdsgsd.exe :Files biriprg.exe /alldrives autorun.inf /alldrives :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters] “ServiceDll”=hex(2):"%SystemRoot%\system32\wbem\WMIsvc.dll" [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

Wklej do OTL i kliknij Skanuj :

C:*.* D:*.* E:*.* F:*.*

Pokaż ten log.

[pomios]

raport z usuwania http://wklej.org/id/927316/

zaraz dam edit ze skanu dysków.

http://wklej.org/id/927324/

dzięki wielkie za pomoc! od razu lepiej wszystko chodzi

[Atis]

Wklej do OTL i kliknij Wykonaj skrypt:

:OTL DRV - [2012-12-08 16:32:26 | 000,026,984 | ---- | M] (AVG Technologies) [Kernel | System | Running] – C:\WINDOWS\system32\drivers\avgtpx86.sys – (avgtp) IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=hp FF - prefs.js…browser.search.defaultenginename: “AVG Secure Search” FF - prefs.js…browser.search.selectedEngine: “AVG Secure Search” FF - prefs.js…browser.startup.homepage: “http://isearch.avg.com/?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=hp” FF - prefs.js…keyword.URL: “http://isearch.avg.com/search?cid={0C0978B9-CB6A-4810-84D4-0897158D4C98}&mid=a422e73a775747d0b104d15680f5c157-8bac2643e4f10dc9e9ecb9d2b3da2b2f549b1492〈=pl&ds=xn011&pr=sa&d=2012-12-08 16:32:41&v=13.2.0.4&sap=ku&q=” :Files C:\AdwCleaner*.txt :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @=""

Uruchom OTL i kliknij Sprzątanie.

Wyłącz i ponownie włącz przywracanie systemu:

http://support.microsoft.com/kb/310405/pl

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

Dysk przeskanuj Malwarebytes Anti-Malware

Podczas instalacji usuń zaznaczenie przy Uruchom okres testowy Malwarebytes Anti-Malware PRO.

http://wstaw.org/m/2012/12/29/2012-12-29_005346.png

Dodatkowo była infekcja z pendrive.

Zabezpiecz się przed infekcją z USB (linki bezpośrednie): Panda USB Vaccine

Uruchom program i kliknij Vaccinate.