Zainfekowany komputer 1.exe

krasnal01 · 1 Marzec 2013 11:08

http://www.wklej.org/id/969270/

http://www.wklej.org/id/969272/

Acorus · 1 Marzec 2013 11:29

Odinstaluj Spybot - Search & Destroy,DAEMON Tools Toolbar,QuickStores-Toolbar 1.1.0,Skaner on-line mks_vir,vShare.tv plugin 1.3.Użyj AdwCleaner http://general-changelog-team.fr/fr/dow … adwcleaner z funkcji Usuń

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\Drivers\VcommMgr.sys – (VcommMgr) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\VComm.sys – (VComm) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwhid.sys – (btwhid) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btwdndis.sys – (BTWDNDIS) DRV - File not found [Kernel | Boot | Stopped] – System32\Drivers\BTHidMgr.sys – (BTHidMgr) DRV - File not found [Kernel | Boot | Stopped] – System32\Drivers\vbtenum.sys – (BTHidEnum) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btport.sys – (BTDriver) DRV - File not found [Kernel | On_Demand | Stopped] – System32\Drivers\btcusb.sys – (Btcsrusb) DRV - File not found [Kernel | On_Demand | Stopped] – system32\drivers\btaudio.sys – (btaudio) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\btnetdrv.sys – (BT) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\BlueletSCOAudio.sys – (BlueletSCOAudio) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\blueletaudio.sys – (BlueletAudio) O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKU\S-1-5-21-861567501-1303643608-725345543-1003…\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O4 - HKU\S-1-5-21-861567501-1303643608-725345543-1003…\Run: [Microsoft DLL Registration] C:\Documents and Settings\Lukasz&Ania\Application Data\regsrv64.exe File not found O4 - HKU\S-1-5-21-861567501-1303643608-725345543-1003…\Run: [shockSticker] C:\Program Files\Shock Utility\ShockSticker\ShockSticker.exe File not found O4 - HKU\S-1-5-21-861567501-1303643608-725345543-1003…\Run: [WINSXS32] C:\Documents and Settings\Lukasz&Ania\Application Data\3.exe (FileZilla Project) [2013-03-01 11:15:28 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\4.exe [2013-03-01 11:15:27 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\3.exe [2013-03-01 11:15:22 | 000,003,639 | ---- | M] () – C:\Documents and Settings\Lukasz&Ania\Application Data\2.exe [2013-03-01 11:14:17 | 000,000,000 | -H-- | M] () – C:\Documents and Settings\Lukasz&Ania\Application Data\j7Aj8Lg66f66 :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

krasnal01 · 1 Marzec 2013 22:00

http://www.wklej.org/id/970441/

http://www.wklej.org/id/970442/

spandaupol · 2 Marzec 2013 08:24

krasnal01 , Zasady wklejania logów obowiazkowe-logi-t253052.html Proszę edytować posta i wkleić raporty zgodnie z ogłoszeniem.

Acorus · 5 Marzec 2013 11:58

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL IE - HKLM…\SearchScopes{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=87 … 9159c89&q={searchTerms} FF - prefs.js…extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.7.0190 O4 - HKCU…\Run: [WINSXS32] C:\Documents and Settings\Lukasz&Ania\Application Data\A.exe (FileZilla Project) [2013-03-02 17:31:40 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\2.exe [2013-03-01 22:49:06 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\B.exe [2013-03-01 22:49:02 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\A.exe [2013-03-01 22:42:11 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\12.exe [2013-03-01 22:42:10 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\11.exe [2013-03-01 11:53:48 | 000,330,752 | ---- | C] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\1.exe [2013-03-01 22:48:59 | 000,003,639 | ---- | M] () – C:\Documents and Settings\Lukasz&Ania\Application Data\9.exe [2013-03-01 22:48:09 | 000,000,000 | -H-- | M] () – C:\Documents and Settings\Lukasz&Ania\Application Data\j7Aj8Lg66f66 [2013-03-01 22:42:11 | 000,330,752 | ---- | M] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\12.exe [2013-03-01 22:42:10 | 000,330,752 | ---- | M] (FileZilla Project) – C:\Documents and Settings\Lukasz&Ania\Application Data\11.exe [2013-03-01 22:42:05 | 000,003,639 | ---- | M] () – C:\Documents and Settings\Lukasz&Ania\Application Data\F.exe [2013-03-01 11:23:17 | 109,902,456 | ---- | M] () – C:\Documents and Settings\Lukasz&Ania\Desktop\avira_free_antivirus_en.exe [2013-03-01 11:17:09 | 000,456,808 | ---- | M] () – C:\Documents and Settings\Lukasz&Ania\Desktop\Avira-Free-Antivirus(13119).exe :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.

.Przeskanuj progr.Malwarebytes Anti-Malware http://www.malwarebytes.org/products/malwarebytes_free

Przed skanowaniem wykonaj RĘCZNĄ AKTUALIZACJĘ BAZY SYGNATUR WIRUSÓW Malwarebytesa “Uruchom Malwarebytes, przejdź do zakładki Aktualizacja, Sprawdź aktualizacje.”

Zainstaluj aktualizacje do programow wskazanych przez Security Check

analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html jako out of date.

krasnal01 · 5 Marzec 2013 18:43

http://www.wklej.org/id/973426/

Dzięki bardzo

– Dodane 22.03.2013 (Pt) 16:03 –

Results of screen317’s Security Check version 0.99.61

Windows XP Service Pack 2 x86

Out of date service pack!!

Internet Explorer 8

Antivirus/Firewall Check:

WMI entry may not exist for antivirus; attempting automatic update.

Anti-malware/Other Utilities Check:

Malwarebytes Anti-Malware wersja 1.70.0.1100

Java 6 Update 25

Java version out of Date!

Adobe Flash Player 11.6.602.180

Adobe Reader 10.1.6 Adobe Reader out of Date!

Mozilla Firefox (3.6.25) Firefox out of Date!

Google Chrome 25.0.1364.152

Google Chrome 25.0.1364.172

Google Chrome plugins…

Process Check: objlist.exe by Laurent

Malwarebytes Anti-Malware mbamservice.exe

Malwarebytes Anti-Malware mbamgui.exe

Lukasz&Ania Desktop avast_free_antivirus_setup.exe

Malwarebytes’ Anti-Malware mbamscheduler.exe

LUKASZ~1 LOCALS~1 Temp _av_sfx.tm~59240c24-61f5-441b-95e1-2da0632d9e39\avast.setup

System Health check

Total Fragmentation on Drive C::

````````````````````End of Log``````````````````````

Acorus · 22 Marzec 2013 16:27

Instalacja Service Pack 3.

Odinstaluj:

Java 6 Update 25

Adobe Reader 10.1.6

Zainstaluj:

http://www.java.com/pl/download/windows_offline.jsp

Adobe Reader XI 11.0.0 http://ftp.adobe.com/pub/adobe/reader/w … _pl_PL.exe lub FoxitReader http://ninite.com/foxit/

Wszystko usunięte?

krasnal01 · 22 Marzec 2013 16:37

odinstalowane:

Java 6 Update 25

Adobe Reader 10.1.6

zainstalowane:

http://www.java.com/pl/download/windows_offline.jsp

Adobe Reader XI 11.0.0 http://ftp.adobe.com/pub/adobe/reader/w … _pl_PL.exe

– Dodane 22.03.2013 (Pt) 19:08 –

An internal error occurred / instalacja produktu Service Pack 3 nie została ukończona taki błąd wyskakuje

spandaupol · 23 Marzec 2013 08:15

Czy to co znalazł Malwarebytes zostało usunięte? Jeśli tak proszę odinstalować ten program.

http://support.microsoft.com/kb/949384/pl