Kolumb489
11 Lipiec 2013 20:07
#1
Witam antyvirus wykrył mi dwa wirusy na komputerze: Win32 Toolbar i Win32 Downloader niestety żadnego z nich nie dał rady usunąć. Zwracam się więc z uprzejmą prośbą o pomoc.
Wrzucam logi z hijackthis
Logfile of Trend Micro HijackThis v2.0.5 Scan saved at 21:54:16, on 11/07/2013 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) FIREFOX: 22.0 (pl) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Programy\Bezpieczeństwo\AVAST Software\AvastSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Dokan\DokanLibrary\mounter.exe C:\Program Files\LogMeIn Hamachi\hamachi-2.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Programy\Malwarebytes’ Anti-Malware\mbamscheduler.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\svchost.exe C:\Programy\D-Tools\daemon.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\RTHDCPL.EXE C:\Programy\Bezpieczeństwo\AVAST Software\avastUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Programy\Net\Mozilla Firefox\firefox.exe E:\Instalki\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.b1.org/?bsrc=hmior&chid=c167991 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-search.com/?affID=1218 … 6F65FD368B R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Programy\Net\BitComet\tools\BitCometBHO_1.5.4.11.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programy\Bezpieczenstwo\AVAST Software\aswWebRepIE.dll (file missing) O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programy\Bezpieczenstwo\AVAST Software\aswWebRepIE.dll (file missing) O4 - HKLM…\Run: [startCCC] “C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe” MSRun O4 - HKLM…\Run: [sunJavaUpdateSched] “C:\Program Files\Common Files\Java\Java Update\jusched.exe” O4 - HKLM…\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime O4 - HKLM…\Run: [DAEMON Tools-1033] “C:\Programy\D-Tools\daemon.exe” -lang 1033 O4 - HKLM…\Run: [GrooveMonitor] “C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe” O4 - HKLM…\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM…\Run: [avast] “C:\Programy\Bezpieczenstwo\AVAST Software\avastUI.exe” /nogui O4 - HKLM…\Run: [LogMeIn Hamachi Ui] “C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe” --auto-start O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [AQQ] C:\Programy\KOMUNI~1\AQQ\WAPSTE~1\AQQ.exe O4 - HKUS\S-1-5-18…\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,4,N (User ‘SYSTEM’) O4 - HKUS\S-1-5-18…\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User ‘SYSTEM’) O4 - HKUS.DEFAULT…\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,4,N (User ‘Default user’) O8 - Extra context menu item: &P&obierz &za pomocą BitComet - res://C:\Programy\Net\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://C:\Programy\Net\BitComet\BitComet.exe/AddAllLink.htm O9 - Extra button: Wyolij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra ‘Tools’ menuitem: Wyolij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Programy\Net\BitComet\tools\BitCometBHO_1.5.4.11.dll/206 (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll ,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} (Java Plug-in 1.6.0_22) - O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Modu3 wstepnego 3adowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii sk3adników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: AppleChargerSrv - Unknown owner - C:\WINDOWS\system32\AppleChargerSrv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Programy\Bezpieczenstwo\AVAST Software\AvastSvc.exe (file missing) O23 - Service: DokanMounter - Unknown owner - C:\Program Files\Dokan\DokanLibrary\mounter.exe O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe O23 - Service: LogMeIn Hamachi Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Programy\Malwarebytes’ Anti-Malware\mbamscheduler.exe O23 - Service: MBAMService - Malwarebytes Corporation - C:\Programy\Malwarebytes’ Anti-Malware\mbamservice.exe O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Programy\Komunikacja\Skype\Updater\Updater.exe – End of file - 7708 bytes
Atis
11 Lipiec 2013 20:54
#2
Atis
12 Lipiec 2013 11:21
#4
Uruchom AdwCleaner i kliknij Usuń.
Pokaż nowy log z OTL.
Atis
12 Lipiec 2013 13:33
#6
Kliknij Usuń (Delete) w AdwCleaner i wyraź zgodę na restart.
Później pokaż nowy log.
Atis
12 Lipiec 2013 14:15
#8
Do okna Własne opcje skanowania / skrypt wklej:
:OTL DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\system32\PCAMPR5.SYS – (PCAMPR5) DRV - File not found [Kernel | On_Demand | Stopped] – H:\INSTALL\GMSIPCI.SYS – (GMSIPCI) DRV - File not found [Kernel | On_Demand | Stopped] – F:\ZMIENN~1\TEMP\catchme.sys – (catchme) [2013/06/06 22:07:57 | 000,006,470 | ---- | M] () – C:\Documents and Settings\Administrator.XXX-CB2229522EB\Dane aplikacji\Mozilla\Firefox\Profiles\21dnnvoa.default\searchplugins\babylon.xml [2013/06/06 22:08:15 | 000,001,294 | ---- | M] () – C:\Documents and Settings\Administrator.XXX-CB2229522EB\Dane aplikacji\Mozilla\Firefox\Profiles\21dnnvoa.default\searchplugins\delta.xml O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.) [2013/07/11 20:09:17 | 000,000,000 | --SD | C] – C:\ComboFix [2013/07/11 08:34:52 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator.XXX-CB2229522EB\Dane aplikacji\B1Toolbar [2013/06/06 22:07:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator.XXX-CB2229522EB\Dane aplikacji\Babylon [2012/10/31 19:40:02 | 000,000,000 | —D | M] – C:\Documents and Settings\Administrator.XXX-CB2229522EB\Dane aplikacji\EurekaLog :Commands [emptytemp]
Kliknij Wykonaj skrypt (Run Fix) i zatwierdź restart.
Pokaż raport z usuwania i nowy log Skanuj.
Atis
12 Lipiec 2013 15:09
#10
Wklej i kliknij Wykonaj skrypt:
Uruchom OTL i kliknij Sprzątanie.
Wyłącz i ponownie włącz przywracanie systemu:
http://support.microsoft.com/kb/310405/pl
Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date
Kolumb489
12 Lipiec 2013 16:53
#11
Zrobiłem wszystko jak napisaliście ale komputer dalej nie działa tak jak wcześniej.