Worm Rebhip.A i może coś jeszcze

scaza · 14 Październik 2012 10:13

Witam

Mam antywirusa essentiala win7x64 , essential bez przerwy wyrzuca mi że ten robal Rebhip.A jest zagrożeniem i chciałbym go się pozbyć. Nie wiem też czemu , czy też coś innego nie złapałem, bo z chomikboxa nie mogę nic dodać na chomika

Dzięki za pomoc

OTL: http://www.wklej.org/id/847027/

Leon1 · 15 Październik 2012 17:21

OTL w oknie Custom Scans-Fixes (własne opcje skanowania/skrypt)wklej następujący skrypt:

:OTL MOD - [2012-10-14 10:57:22 | 000,323,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\winamp.lng MOD - [2012-10-14 10:57:22 | 000,161,792 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\vis_milk2.lng MOD - [2012-10-14 10:57:22 | 000,087,552 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\vis_avs.lng MOD - [2012-10-14 10:57:22 | 000,045,056 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_wifi.lng MOD - [2012-10-14 10:57:22 | 000,014,848 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_wm.lng MOD - [2012-10-14 10:57:22 | 000,007,680 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\vis_nsfs.lng MOD - [2012-10-14 10:57:22 | 000,006,144 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\tagz.lng MOD - [2012-10-14 10:57:22 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\winampa.lng MOD - [2012-10-14 10:57:21 | 000,066,560 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\burnlib.lng MOD - [2012-10-14 10:57:21 | 000,054,272 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_local.lng MOD - [2012-10-14 10:57:21 | 000,047,616 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_disc.lng MOD - [2012-10-14 10:57:21 | 000,046,592 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_pmp.lng MOD - [2012-10-14 10:57:21 | 000,040,960 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_jumpex.lng MOD - [2012-10-14 10:57:21 | 000,036,864 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ombrowser.lng MOD - [2012-10-14 10:57:21 | 000,022,528 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_mp3.lng MOD - [2012-10-14 10:57:21 | 000,022,016 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_ff.lng MOD - [2012-10-14 10:57:21 | 000,021,504 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_ml.lng MOD - [2012-10-14 10:57:21 | 000,020,992 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_midi.lng MOD - [2012-10-14 10:57:21 | 000,018,432 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_mod.lng MOD - [2012-10-14 10:57:21 | 000,016,896 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\out_ds.lng MOD - [2012-10-14 10:57:21 | 000,014,336 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_wire.lng MOD - [2012-10-14 10:57:21 | 000,014,336 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_online.lng MOD - [2012-10-14 10:57:21 | 000,013,312 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_playlists.lng MOD - [2012-10-14 10:57:21 | 000,013,312 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_cdda.lng MOD - [2012-10-14 10:57:21 | 000,012,800 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_plg.lng MOD - [2012-10-14 10:57:21 | 000,012,800 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\dsp_sps.lng MOD - [2012-10-14 10:57:21 | 000,011,264 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_vorbis.lng MOD - [2012-10-14 10:57:21 | 000,011,264 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_nsv.lng MOD - [2012-10-14 10:57:21 | 000,011,264 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_hotkeys.lng MOD - [2012-10-14 10:57:21 | 000,011,264 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\auth.lng MOD - [2012-10-14 10:57:21 | 000,010,752 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_usb.lng MOD - [2012-10-14 10:57:21 | 000,010,752 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_android.lng MOD - [2012-10-14 10:57:21 | 000,009,216 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_downloads.lng MOD - [2012-10-14 10:57:21 | 000,008,704 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_history.lng MOD - [2012-10-14 10:57:21 | 000,008,192 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_transcode.lng MOD - [2012-10-14 10:57:21 | 000,008,192 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_devices.lng MOD - [2012-10-14 10:57:21 | 000,007,680 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_tray.lng MOD - [2012-10-14 10:57:21 | 000,007,168 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\out_wave.lng MOD - [2012-10-14 10:57:21 | 000,007,168 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_autotag.lng MOD - [2012-10-14 10:57:21 | 000,007,168 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_dshow.lng MOD - [2012-10-14 10:57:21 | 000,007,168 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_orgler.lng MOD - [2012-10-14 10:57:21 | 000,007,168 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\gen_crasher.lng MOD - [2012-10-14 10:57:21 | 000,006,656 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_ipod.lng MOD - [2012-10-14 10:57:21 | 000,006,656 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\enc_fhgaac.lng MOD - [2012-10-14 10:57:21 | 000,006,144 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\out_disk.lng MOD - [2012-10-14 10:57:21 | 000,006,144 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_flac.lng MOD - [2012-10-14 10:57:21 | 000,006,144 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\enc_wma.lng MOD - [2012-10-14 10:57:21 | 000,005,632 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_rg.lng MOD - [2012-10-14 10:57:21 | 000,005,632 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_wave.lng MOD - [2012-10-14 10:57:21 | 000,005,632 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\enc_lame.lng MOD - [2012-10-14 10:57:21 | 000,005,120 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_impex.lng MOD - [2012-10-14 10:57:21 | 000,005,120 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_bookmarks.lng MOD - [2012-10-14 10:57:21 | 000,005,120 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_avi.lng MOD - [2012-10-14 10:57:21 | 000,004,608 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_activesync.lng MOD - [2012-10-14 10:57:21 | 000,004,608 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_mp4.lng MOD - [2012-10-14 10:57:21 | 000,004,608 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_mkv.lng MOD - [2012-10-14 10:57:21 | 000,004,096 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_p4s.lng MOD - [2012-10-14 10:57:21 | 000,004,096 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_orb.lng MOD - [2012-10-14 10:57:21 | 000,004,096 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\enc_wav.lng MOD - [2012-10-14 10:57:21 | 000,004,096 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\enc_flac.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\pmp_njb.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_nowplaying.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\ml_addons.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_swf.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_linein.lng MOD - [2012-10-14 10:57:21 | 000,003,584 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\in_flv.lng MOD - [2012-10-14 10:57:21 | 000,003,072 | ---- | M] () – C:\Users\Damian\AppData\Local\Temp\WLZBBB0.tmp\playlist.lng IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med … m=fft&uid=ďż˝5ďż˝ďż˝ďż˝ďż˝-)_~ďż˝@ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝&ts=1348390577 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med … m=fft&uid=ďż˝5ďż˝ďż˝ďż˝ďż˝-)_~ďż˝@ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝&ts=1348390577 IE - HKU\S-1-5-21-144805859-2219087630-3865369261-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=b&utm_med … m=fft&uid=ďż˝5ďż˝ďż˝ďż˝ďż˝-)_~ďż˝@ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝&ts=1348390577 IE - HKU\S-1-5-21-144805859-2219087630-3865369261-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.v9.com/?utm_source=b&utm_med … m=fft&uid=ďż˝5ďż˝ďż˝ďż˝ďż˝-)_~ďż˝@ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝&ts=1348390577 IE - HKU\S-1-5-21-144805859-2219087630-3865369261-1001…\SearchScopes{33BB0A4E-99AF-4226-BDF6-49120163DE86}: “URL” = http://search.v9.com/web/?q={searchTerms} FF - prefs.js…browser.search.defaultenginename: “v9” FF - prefs.js…browser.search.order.1: “v9” FF - prefs.js…browser.search.selectedEngine: “v9” FF - prefs.js…browser.startup.homepage: “http://www.v9.com/?utm_source=b&utm_medium=fft&from=fft&uid=ďż˝5ďż˝ďż˝ďż˝ďż˝-)_~ďż˝@ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝ďż˝&ts=1348390577” [2012-09-23 10:56:33 | 000,000,402 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\v9.xml O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [HKLM] C:\Windows\root\system32.exe () O4 - HKU\S-1-5-21-144805859-2219087630-3865369261-1001…\Run: [AdobeBridge] File not found O4 - HKU\S-1-5-21-144805859-2219087630-3865369261-1001…\Run: [HKCU] C:\Windows\root\system32.exe () O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\root\system32.exe () O7 - HKU\S-1-5-21-144805859-2219087630-3865369261-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\Windows\root\system32.exe () [2012-09-23 10:56:32 | 000,000,000 | —D | C] – C:\Program Files (x86)\v9Soft [2012-10-14 11:40:03 | 000,000,930 | ---- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job [2012-10-14 02:00:00 | 000,000,360 | ---- | M] () – C:\Windows\tasks\Quark Updater.job [2012-09-27 16:46:46 | 000,024,972 | ---- | M] () – C:\Users\Damian\Desktop\cc_20120927_164634.reg :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [RESETHOSTS] [emptytemp]

Kliknij w Run Fix (Wykonaj scrypt). Zatwierdź restart komputera.

Pokaż log z usuwania.

potem nowy log OTL robiony opcją Run Scan (Skanuj)