Zamulanie procesów, wyskakujące strony - wirusy i trojany

janusz87 · 23 Czerwiec 2010 15:35

Witam,

mam problem z komputerem. Wyskakują nowe strony, przeglądarka prowadzi na strony na które nie klikałem. Procesy zamulają.

OTL

http://wklejto.pl/70790

Proszę o pomoc.

Lukasz6 · 23 Czerwiec 2010 15:49

W OTL w dolne okienko , Custom Scans/Fixes " wklej:

:OTL IE - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\URLSearchHook: {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com) FF - prefs.js…browser.search.defaultenginename: “Winamp Search” FF - prefs.js…browser.search.defaultthis.engineName: “Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=3&q=” FF - prefs.js…browser.search.order.1: “Crawler Search” FF - prefs.js…browser.search.param.yahoo-fr: “chr-greentree_ff&type=867034” FF - prefs.js…browser.search.selectedEngine: “ThePirateBay.org” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1460988&SearchSource=2&q=” [2010-03-04 05:03:07 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Users\krzysiek\AppData\Roaming\mozilla\Firefox\Profiles\in9hlv1p.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010-04-29 03:10:52 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Users\krzysiek\AppData\Roaming\mozilla\Firefox\Profiles\in9hlv1p.default\extensions{3112ca9c-de6d-4884-a869-9855de68056c} [2008-11-24 15:50:50 | 000,000,838 | ---- | M] () – C:\Users\krzysiek\AppData\Roaming\Mozilla\FireFox\Profiles\in9hlv1p.default\searchplugins\conduit.xml [2010-02-14 01:38:52 | 000,001,679 | ---- | M] () – C:\Users\krzysiek\AppData\Roaming\Mozilla\FireFox\Profiles\in9hlv1p.default\searchplugins\thepiratebayorg.xml [2010-03-04 06:37:38 | 000,001,244 | ---- | M] () – C:\Users\krzysiek\AppData\Roaming\Mozilla\FireFox\Profiles\in9hlv1p.default\searchplugins\winamp-search.xml [2007-07-26 13:05:16 | 000,001,329 | ---- | M] () – C:\Program Files\Mozilla Firefox\searchplugins\crawlersrch.xml O2 - BHO: () - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com) O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found. O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.) O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM…\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM…\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O3 - HKLM…\Toolbar: (Pasek &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com) O3 - HKLM…\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll () O3 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Toolbar\WebBrowser: (Pasek &Crawler) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com) O4 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Run: [LoadWatcher] File not found O4 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Run: [M5T8QL3YW3] C:\Users\krzysiek\AppData\Local\Temp\Urx.exe File not found O4 - HKU\S-1-5-21-93524741-3782643782-81679772-1000…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl … rashim.cab (Reg Error: Key error.) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\Program Files\Crawler\Toolbar\ctbr.dll (Crawler.com) H:\LaunchU3.exe – File not found O33 - MountPoints2{123cd7c8-6c82-11dd-85af-00f1d000f1d0}\Shell\AutoRun\command - “” = H:\LaunchU3.exe – File not found O33 - MountPoints2{1fc8bb98-5eb0-11de-83ae-8d6055d24751}\Shell\AutoRun\command - “” = H:\6phx.com – File not found O33 - MountPoints2{1fc8bb98-5eb0-11de-83ae-8d6055d24751}\Shell\open\Command - “” = H:\6phx.com – File not found G:\AutoRunCardDetector.exe – File not found :Files C:\Program Files\Crawler C:\Program Files\Winamp Toolbar C:\Program Files\Google\Google Toolbar C:\Program Files\Windows Live\Toolbar C:\Users\krzysiek\AppData\Local\TempkXi420.html C:\Users\krzysiek\AppData\Local\TemphGD420.html C:\Users\krzysiek\AppData\Local\TempkXi420.html C:\Users\krzysiek\AppData\Local\TemphGD420.html C:\Users\krzysiek\AppData\Local\TempJg7796.html C:\lqlurj.gqe :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [resethosts] [emptytemp]

Kliknij Run Fix. Zrestartuj komputer

Potem daj raport który wyskoczy po usuwaniu, oraz wykonaj nowy log OTLem

janusz87 · 23 Czerwiec 2010 19:42

raport:

http://wklejto.pl/70809

nowy log OTL:

http://wklejto.pl/70810

jessica · 23 Czerwiec 2010 20:07

Jeszcze nie wszystkie elementy tej infekcji SSHNAS zostały usunięte.

Uruchom OTL i w oknie Custom Scans/Fixes wklej to:

Kliknij w Run Fix. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

Następnie uruchom OTL ponownie, tym razem kliknij “Run Scan”.

Pokaż nowy log OTL.txt oraz raport z usuwania.

.