Wirus win32 rungbu.a

jarek24_24 · 29 Grudzień 2009 15:09

spybotem znalazło mi wirusa win32 rungbu.a.Ok skasowałem go ale on i tak się pojawia od nowa

logi z HJT

http://wklej.to/T9qG

SR

http://wklej.org/id/250090/

deFco247 · 29 Grudzień 2009 15:47

Wstaw log z OTL

Przestawiasz w nim Processes i Modules na All oraz wklejasz w dolne białe okienko Custom Scans/Fixes :

Klikasz Run Scan.

jarek24_24 · 31 Grudzień 2009 09:57

Proszę o to log z OTL

http://wklej.org/id/251887/

deFco247 · 31 Grudzień 2009 10:02

W białe dolne okno Custom Scans/Fixes w OTL wklej:

:Processes Explorer.EXE :OTL [2009-06-06 15:46:12 | 00,002,395 | ---- | M] () – C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\9q6nqiqt.default\searchplugins\daemon-search.xml O3 - HKCU…\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O4 - HKLM…\Run: [KernelFaultCheck] File not found O4 - HKCU…\Run: [cdoosoft] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\herss.exe File not found O32 - AutoRun File - [2009-12-30 20:06:33 | 00,000,061 | RHS- | M] () - C:\autorun.inf – [NTFS] O32 - AutoRun File - [2009-12-30 20:06:33 | 00,000,061 | RHS- | M] () - D:\autorun.inf – [NTFS] O32 - AutoRun File - [2009-12-30 20:06:33 | 00,000,061 | RHS- | M] () - E:\autorun.inf – [NTFS] O33 - MountPoints2{20b2a17a-f54a-11de-9cdc-000e504a39cd}\Shell\AutoRun\command - “” = H:\w9uxx92.exe – File not found O33 - MountPoints2{20b2a17a-f54a-11de-9cdc-000e504a39cd}\Shell\open\Command - “” = H:\w9uxx92.exe – File not found O33 - MountPoints2{59c182e6-d1f4-11dd-aba1-000e504a39cd}\Shell - “” = AutoRun O33 - MountPoints2{59c182e6-d1f4-11dd-aba1-000e504a39cd}\Shell\AutoRun\command - “” = G:\AutoRun.exe – [2002-08-08 10:19:00 | 00,036,864 | R— | M] () O33 - MountPoints2{6aa1d340-d369-11dd-aba7-df3b3ec581a1}\Shell\AutoRun\command - “” = H:\u16sqrqn.exe – File not found O33 - MountPoints2{6aa1d340-d369-11dd-aba7-df3b3ec581a1}\Shell\open\Command - “” = H:\u16sqrqn.exe – File not found O33 - MountPoints2{84c2b998-7162-11de-ae62-000e504a39cd}\Shell - “” = AutoRun O33 - MountPoints2{84c2b998-7162-11de-ae62-000e504a39cd}\Shell\AutoRun\command - “” = G:\AutoRun.exe – [2002-08-08 10:19:00 | 00,036,864 | R— | M] () O33 - MountPoints2{88a05a1c-b4d5-11de-9c02-806d6172696f}\Shell\AutoRun\command - “” = H:\hjvjte.exe – File not found O33 - MountPoints2{88a05a1c-b4d5-11de-9c02-806d6172696f}\Shell\open\Command - “” = H:\hjvjte.exe – File not found O33 - MountPoints2{d42828de-d773-11dd-abc3-000e504a39cd}\Shell\AutoRun\command - “” = H:\mbdm.exe – File not found O33 - MountPoints2{d42828de-d773-11dd-abc3-000e504a39cd}\Shell\open\Command - “” = H:\mbdm.exe – File not found O33 - MountPoints2{ff2e2d33-d1ec-11dd-aba0-000e504a39cd}\Shell - “” = AutoRun O33 - MountPoints2{ff2e2d33-d1ec-11dd-aba0-000e504a39cd}\Shell\AutoRun\command - “” = I:\LaunchU3.exe – File not found O33 - MountPoints2{ff2e2d34-d1ec-11dd-aba0-000e504a39cd}\Shell\AutoRun\command - “” = J:\3exi.exe – File not found O33 - MountPoints2{ff2e2d34-d1ec-11dd-aba0-000e504a39cd}\Shell\open\Command - “” = J:\3exi.exe – File not found :Files C:\1a1dndah.exe C:\2id9.exe C:\2sm66r.exe C:\3exi.exe C:\3n8awsyg.exe C:\6ruaqx.exe C:\9b9w3.exe C:\a2g21.exe C:\b00ijwpu.exe C:\cs6phv6d.exe C:\curqp.exe C:\eexyv.exe C:\g12g.exe C:\gcq6.exe C:\hjvjte.exe C:\i9bwjpqc.exe C:\k0maw.exe C:\k8jc.exe C:\l61yyp.exe C:\lphfa.exe C:\mbdm.exe C:\mbvd.exe C:\mje12tni.exe C:\ngp8l.exe C:\nqdymj.exe C:\nx.exe C:\nymdik.exe C:\pbudsara.exe C:\q3kku.exe C:\q93fi6kf.exe C:\se12ydam.exe C:\srgo.exe C:\t8g.exe C:\u16sqrqn.exe C:\v1cbvsmq.exe C:\vb0hsoay.exe C:\vlvtdflx.exe C:\wisf1.exe C:\wu1n.exe C:\ycvvj.exe D:\1a1dndah.exe D:\2id9.exe D:\2sm66r.exe D:\3exi.exe D:\3n8awsyg.exe D:\6ruaqx.exe D:\9b9w3.exe D:\a2g21.exe D:\b00ijwpu.exe D:\cs6phv6d.exe D:\curqp.exe D:\eexyv.exe D:\g12g.exe D:\gcq6.exe D:\hjvjte.exe D:\i9bwjpqc.exe D:\k0maw.exe D:\k8jc.exe D:\l61yyp.exe D:\lphfa.exe D:\mbdm.exe D:\mbvd.exe D:\mje12tni.exe D:\ngp8l.exe D:\nqdymj.exe D:\nx.exe D:\nymdik.exe D:\pbudsara.exe D:\q3kku.exe D:\q93fi6kf.exe D:\se12ydam.exe D:\srgo.exe D:\t8g.exe D:\u16sqrqn.exe D:\v1cbvsmq.exe D:\vb0hsoay.exe D:\vlvtdflx.exe D:\wisf1.exe D:\wu1n.exe D:\ycvvj.exe E:\1a1dndah.exe E:\2id9.exe E:\2sm66r.exe E:\3exi.exe E:\3n8awsyg.exe E:\6ruaqx.exe E:\9b9w3.exe E:\a2g21.exe E:\b00ijwpu.exe E:\cs6phv6d.exe E:\curqp.exe E:\eexyv.exe E:\g12g.exe E:\gcq6.exe E:\hjvjte.exe E:\i9bwjpqc.exe E:\k0maw.exe E:\k8jc.exe E:\l61yyp.exe E:\lphfa.exe E:\mbdm.exe E:\mbvd.exe E:\mje12tni.exe E:\ngp8l.exe E:\nqdymj.exe E:\nx.exe E:\nymdik.exe E:\pbudsara.exe E:\q3kku.exe E:\q93fi6kf.exe E:\se12ydam.exe E:\srgo.exe E:\t8g.exe E:\u16sqrqn.exe E:\v1cbvsmq.exe E:\vb0hsoay.exe E:\vlvtdflx.exe E:\wisf1.exe E:\wu1n.exe E:\ycvvj.exe :Commands [emptytemp] [start explorer]

Run Fix. Restart, jeśli będzie potrzebny.

Potem log z usuwania oraz nowy log robiony opcją Run Scan.

jarek24_24 · 31 Grudzień 2009 13:37

Log z usuwania

http://wklej.org/id/252013/

Nowy log

http://wklej.org/id/252017/

Leon1 · 31 Grudzień 2009 13:52

OTL w oknie Custom Scans-Fixes wklej następujący skrypt:

Kliknij w Run Fix. Zatwierdź restart komputera.

Wylecz pendriva lub kartę pamięci http://www.softpedia.com/get/Security/S … Tool.shtml

Flash Disinfector http://www.searchengines.pl/index.php?s … ntry369724

lub format

Pobierz CCleaner http://www.filehippo.com/download_ccleaner/

przeskanuj nim i wyczyść rejestr.

zrób optymalizacje uruchamiania

http://cybertrash.netarteria.pl/cyber/i … 378.0.html

W OTL kilknij CleanUp

Wyłącz I włącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

przeskanuj obszar Mój komputer http://www.kaspersky.pl/virusscanner.html gdy będą wirusy pokaż raport

lub

Dr.WEB CureIt! http://www.dobreprogramy.pl/DrWEB-CureI … 12976.html