Skocz do zawartości
WAŻNE - Użytkownicy uprawnieni do pomocy
WAŻNE - Zakładanie tematu: obowiązkowe logi
Nadchodzące zmiany w logowaniu

Problem z Live Security Platinum

ziomek1223334444

Rekomendowane odpowiedzi

Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
picasso

picasso

Opublikowano
Opublikowano

W systemie jest gorszy trojan ZeroAccess. Wymagany skan dodatkowy na punkty ładowania. Uruchom SystemLook x64 i w oknie wklej:

 

:reg
HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
 
:filefind
services.exe

 

Klik w Look i przedstaw raport końcowy.

 

 

 

.

Odnośnik do komentarza
ziomek1223334444

ziomek1223334444

Opublikowano
  • Autor
Opublikowano

proszę o pomoc :)

 

SystemLook 30.07.11 by jpshortstuff

Log created at 14:57 on 24/07/2012 by EsKi

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Users\EsKi\AppData\Local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\n."

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="\\.\globalroot\systemroot\Installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\n."

"ThreadingModel"="Both"

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shell32.dll"

"ThreadingModel"="Apartment"

 

 

========== filefind ==========

 

Searching for "services.exe"

C:\Windows\System32\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 24ACB7E5BE595468E3B9AA488B9B4FCB

 

-= EOF =-

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

1. Otwórz Notatnik i wklej w nim:

 

reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f
reg add HKLM\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32 /ve /t REG_EXPAND_SZ /d %%systemroot%%\system32\wbem\wbemess.dll /f
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe, /f
reg delete "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v adecap /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RegistryWm /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce /v 7531CC9200084B4CBE02832DE56C34C7 /f
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\policies\Explorer /v HideSCAHealth /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /v HideSCAHealth /f
reg delete HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /v HideSCAHealth /f
reg delete HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer /v HideSCAHealth /f
reg delete "HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Fortress 2012" /f
reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Uninstall\Smart Fortress 2012" /f
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}" /f
reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}" /f
reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}" /f
reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}" /f
reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d about:blank /f
reg delete HKCU\Software\Classes\.exe /f
reg delete HKU\S-1-5-18\Software\Classes\.exe /f
reg delete HKU\.DEFAULT\Software\Classes\.exe /f

 

Z menu Notatnika > Plik > Zapisz jako > Ustaw rozszerzenie na Wszystkie pliki > Zapisz jako FIX.BAT

 

Plik umieść wprost na C:\.

 

2. Uruchom BlitzBlank i w karcie Script wklej:

 

DeleteFolder:


C:\Windows\Installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}


C:\Users\EsKi\AppData\Local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}


C:\ProgramData\7531CC9200084B4CBE02832DE56C34C7


C:\ProgramData\7531CC9200084B4CBE02832D4F147CE7


"C:\Users\EsKi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum"


C:\Users\EsKi\AppData\Roaming\3CDB1


C:\Users\EsKi\AppData\Roaming\B1D97


"C:\Users\mateusz 2\AppData\Roaming\3CDB1"


"C:\Users\mateusz 2\AppData\Roaming\B1D97"


 


DeleteFile:


"C:\Users\EsKi\Desktop\Live Security Platinum.lnk"


"C:\Users\EsKi\AppData\Roaming\Mozilla\Firefox\Profiles\lwxim9n8.default\searchplugins\startsear.xml"


 


Execute: 


C:\fix.bat

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Klik w Execute Now. Zatwierdź restart komputera. Przed ekranem z logo Windows powinien pojawić się ekran z działaniami BlitzBlank. Finalnie BlitzBlank wygeneruje na dysku C log.

 

3. Uruchom GrantPerms x64 i w oknie wklej:

 

C:\Windows\system32\drivers\etc\hosts

 

Klik w Unlock. Po tym zresetuj plik HOSTS do postaci domyślnej za pomocą automatycznego narzędzia Fix-it z artykułu: KB972034.

 

4. Odinstaluj adware DAEMON Tools Toolbar, Download Updater (AOL LLC), Winamp Toolbar oraz LiveVDO plugin 1.3 (nośnik adware). Uruchom AdwCleaner i zastosuj Delete. Z tego działania powstanie log na dysku C.

 

5. Wygeneruj nowy log OTL z opcji Skanuj (już bez Extras), Farbar Service Scanner (wszystkie opcje zaznaczone) oraz SystemLook na warunki:

 

:reg


HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s

 

Dołącz log z usuwania BlitzBlank z punktu 2 oraz AdwCleaner z punktu 4.

 

 

 

.

Odnośnik do komentarza
ziomek1223334444

ziomek1223334444

Opublikowano
  • Autor
Opublikowano

prosze :) i dziekuje serdecznie za dotychczasową pomoc

 

 

BlitzBlank 1.0.0.32

 

File/Registry Modification Engine native application

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\windows\installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\windows\installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\@", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\windows\installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\L", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\windows\installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\U", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\users\eski\appdata\local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\@", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\L", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\U", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\7531cc9200084b4cbe02832de56c34c7", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\programdata\7531cc9200084b4cbe02832de56c34c7\7531CC9200084B4CBE02832DE56C34C7", destinationFile = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\programdata\7531cc9200084b4cbe02832de56c34c7\7531CC9200084B4CBE02832DE56C34C7.ico", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\programdata\7531cc9200084b4cbe02832d4f147ce7", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\programdata\7531cc9200084b4cbe02832d4f147ce7\7531CC9200084B4CBE02832D4F147CE7", destinationFile = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\programdata\7531cc9200084b4cbe02832d4f147ce7\7531CC9200084B4CBE02832D4F147CE7.ico", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\roaming\microsoft\windows\start menu\programs\live security platinum", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\users\eski\appdata\roaming\microsoft\windows\start menu\programs\live security platinum\Live Security Platinum.lnk", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\roaming\3cdb1", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\users\eski\appdata\roaming\3cdb1\1D97.CDB", destinationFile = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\eski\appdata\roaming\b1d97", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\mateusz 2\appdata\roaming\3cdb1", destinationDirectory = "(null)", replaceWithDummy = 0

MoveDirectoryOnReboot: sourceDirectory = "\??\c:\users\mateusz 2\appdata\roaming\b1d97", destinationDirectory = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\users\eski\desktop\live security platinum.lnk", destinationFile = "(null)", replaceWithDummy = 0

MoveFileOnReboot: sourceFile = "\??\c:\users\eski\appdata\roaming\mozilla\firefox\profiles\lwxim9n8.default\searchplugins\startsear.xml", destinationFile = "(null)", replaceWithDummy = 0

LaunchOnReboot: launchName = "\fix.bat", commandLine = "c:\fix.bat"

OpenDriver: ZwLoadDriver(\Registry\Machine\System\CurrentControlSet\Services\blzblk) failed: status = c0000428

LaunchOnReboot: OpenDriver failed: status = c0000428

 

 

SystemLook 30.07.11 by jpshortstuff

Log created at 19:21 on 25/07/2012 by EsKi

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Users\EsKi\AppData\Local\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\n."

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="\\.\globalroot\systemroot\Installer\{eba83402-f7ac-c7d4-13a3-025448e9c94d}\n."

"ThreadingModel"="Both"

 

 

-= EOF =-

AdwCleanerS1.txt

FSS.txt

OTL.Txt

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

1. FIX.BAT się nie wykonał, błąd w BlitzBlank. Z prawokliku na plik "Uruchom jako Administrator".

 

2. Uzupełnienie wyszczerbionych usług Centrum zabezpieczeń i Windows Defender. Otwórz Notatnik i wklej w nim:

 

Windows Registry Editor Version 5.00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc]
"DisplayName"="@%SystemRoot%\\System32\\wscsvc.dll,-200"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,4c,00,6f,00,63,00,61,00,6c,00,53,00,65,00,72,00,76,00,69,00,63,\
  00,65,00,4e,00,65,00,74,00,77,00,6f,00,72,00,6b,00,52,00,65,00,73,00,74,00,\
  72,00,69,00,63,00,74,00,65,00,64,00,00,00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%SystemRoot%\\System32\\wscsvc.dll,-201"
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,57,00,69,00,6e,00,\
  4d,00,67,00,6d,00,74,00,00,00,00,00
"ObjectName"="NT AUTHORITY\\LocalService"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,43,00,68,00,61,00,6e,00,67,00,65,00,4e,\
  00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,\
  67,00,65,00,00,00,53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,00,6e,\
  00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,\
  00,00,00,00
"DelayedAutoStart"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,c0,d4,01,00,01,00,00,00,e0,93,04,00,00,00,00,00,00,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\
  00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\
  77,00,73,00,63,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\wscsvc\Security]
"Security"=hex:01,00,14,80,c8,00,00,00,d4,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,98,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
  05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
  20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
  00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,\
  00,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,00,28,00,15,00,00,00,01,06,00,\
  00,00,00,00,05,50,00,00,00,49,59,9d,77,91,56,e5,55,dc,f4,e2,0e,a7,8b,eb,ca,\
  7b,42,13,56,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,\
  00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend]
"DisplayName"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-103"
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
  74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
  00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\
  6b,00,20,00,73,00,65,00,63,00,73,00,76,00,63,00,73,00,00,00
"Start"=dword:00000002
"Type"=dword:00000020
"Description"="@%ProgramFiles%\\Windows Defender\\MsMpRes.dll,-1176"
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00
"ObjectName"="LocalSystem"
"ServiceSidType"=dword:00000001
"RequiredPrivileges"=hex(7):53,00,65,00,49,00,6d,00,70,00,65,00,72,00,73,00,6f,\
  00,6e,00,61,00,74,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,\
  65,00,00,00,53,00,65,00,42,00,61,00,63,00,6b,00,75,00,70,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,52,00,65,00,73,00,\
  74,00,6f,00,72,00,65,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,\
  00,00,00,53,00,65,00,44,00,65,00,62,00,75,00,67,00,50,00,72,00,69,00,76,00,\
  69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,43,00,68,00,61,00,6e,00,67,\
  00,65,00,4e,00,6f,00,74,00,69,00,66,00,79,00,50,00,72,00,69,00,76,00,69,00,\
  6c,00,65,00,67,00,65,00,00,00,53,00,65,00,53,00,65,00,63,00,75,00,72,00,69,\
  00,74,00,79,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
  53,00,65,00,53,00,68,00,75,00,74,00,64,00,6f,00,77,00,6e,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,49,00,6e,00,63,00,\
  72,00,65,00,61,00,73,00,65,00,51,00,75,00,6f,00,74,00,61,00,50,00,72,00,69,\
  00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,53,00,65,00,41,00,73,00,73,00,\
  69,00,67,00,6e,00,50,00,72,00,69,00,6d,00,61,00,72,00,79,00,54,00,6f,00,6b,\
  00,65,00,6e,00,50,00,72,00,69,00,76,00,69,00,6c,00,65,00,67,00,65,00,00,00,\
  00,00
"DelayedAutoStart"=dword:00000001
"FailureActions"=hex:80,51,01,00,00,00,00,00,00,00,00,00,03,00,00,00,14,00,00,\
  00,01,00,00,00,60,ea,00,00,01,00,00,00,60,ea,00,00,00,00,00,00,00,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend\Parameters]
"ServiceDllUnloadOnStop"=dword:00000001
"ServiceDll"=hex(2):25,00,50,00,72,00,6f,00,67,00,72,00,61,00,6d,00,46,00,69,\
  00,6c,00,65,00,73,00,25,00,5c,00,57,00,69,00,6e,00,64,00,6f,00,77,00,73,00,\
  20,00,44,00,65,00,66,00,65,00,6e,00,64,00,65,00,72,00,5c,00,6d,00,70,00,73,\
  00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend\Security]
"Security"=hex:01,00,14,80,dc,00,00,00,e8,00,00,00,14,00,00,00,30,00,00,00,02,\
  00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
  00,00,02,00,ac,00,06,00,00,00,00,00,28,00,ff,01,0f,00,01,06,00,00,00,00,00,\
  05,50,00,00,00,b5,89,fb,38,19,84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,\
  00,0b,28,00,00,00,00,10,01,06,00,00,00,00,00,05,50,00,00,00,b5,89,fb,38,19,\
  84,c2,cb,5c,6c,23,6d,57,00,77,6e,c0,02,64,87,00,00,14,00,fd,01,02,00,01,01,\
  00,00,00,00,00,05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,\
  05,20,00,00,00,20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,\
  04,00,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,01,\
  01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend\TriggerInfo]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\WinDefend\TriggerInfo\0]
"Type"=dword:00000005
"Action"=dword:00000001
"GUID"=hex:e6,ca,9f,65,db,5b,a9,4d,b1,ff,ca,2a,17,8d,46,e0

 

Adnotacja dla innych czytających: import dopasowany do Windows 7.

 

Z menu Notatnika > Plik > Zapisz jako > Ustaw rozszerzenie na Wszystkie pliki > Zapisz jako FIX.REG > z prawokliku na plik Scal

 

3. Zresetuj system. Zrób nowe logi OTL z opcji Skanuj + SystemLook na te same warunki co w poście powyżej + Farbar Service Scanner.

 

 

 

 

.

Odnośnik do komentarza
ziomek1223334444

ziomek1223334444

Opublikowano
  • Autor
Opublikowano

prosze :)

 

SystemLook 30.07.11 by jpshortstuff

Log created at 13:21 on 26/07/2012 by EsKi

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(Unable to open key - key not found)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="%systemroot%\system32\wbem\wbemess.dll"

"ThreadingModel"="Both"

 

 

-= EOF =-

OTL.Txt

FSS.txt

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

Wszystko zrobione. Zmierzamy już do końca:

 

1. Reset pliku HOSTS nieudany, aktualnie brak w ogóle pliku:

 

Hosts file not found

 

Ręcznie zrekonstruuj plik. Włącz pokazywanie rozszerzeń: w Windows Explorer > Organizuj > Opcje folderów i wyszukiwania > Widok > odznacz Ukrywaj rozszerzenia znanych typów. Otwórz Notatnik i wklej w nim:

 

#	127.0.0.1       localhost
#	::1             localhost

 

Z menu Notatnika > Plik > Zapisz jako > Ustaw rozszerzenie na Wszystkie pliki > Zapisz pod nazwą hosts bez żadnego rozszerzenia

 

Plik wstaw do folderu C:\Windows\system32\drivers\etc.

 

2. Przez SHIFT+DEL skasuj te dwa pliki z dysku:

 

C:\Users\EsKi\uidsave.dat

C:\Windows\system32\sfc

 

3. W Google Chrome nadal widzę rozszerzenie LiveVDO plugin. Czy był problem z deinstalacją?

 

4. Porządki po narzędziach: w AdwCleaner uruchom opcję Uninstall, a pozostałe narzędzia / fiksy usuń ręcznie.

 

5. Wyczyść foldery Przywracania systemu: KLIK.

 

6. Wykonaj pełne (nie ekspresowe) skanowanie w Malwarebytes Anti-Malware. Jeśli coś wykryje, przedstaw raport.

 

 

.

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

1. Wyniki: wszystkie oznaczone jako Malware.Trace + Trojan.FakeMS to infekcje, PUP.BundleOffer.Downloader.S to instalator natury adware, Trojan.StartPage na instalatorze Virtual DJ pachnie fałszywym alarmem, PUM.Disabled.SecurityCenter to tylko powiadomienie o wyłączeniu alertów Centrum zabezpieczeń. Po usuwaniu MBAM na koniec ręcznie przez SHIFT+DEL skasuj cały katalog C:\ProgramData\Windows, gdyż takiego w systemie domyślnie nie ma, ponów czyszczenie folderów Przywracania systemu.

 

2. Podstawowe aktualizacje do przeprowadzenia: KLIK. Wyciąg z Twojej listy zainstalowanych pokazujący brak aktualizacji Windows (SP1+IE9) oraz wersje:

 

64bit- Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F86416020FF}" = Java™ 6 Update 20 (64-bit)
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin 64-bit (wtyczka dla Firefox/Opera)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java™ 6 Update 20
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{AC76BA86-7AD7-1033-7B44-A95000000001}" = Adobe Reader 9.5.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX (wtyczka dla IE) ----> odinstaluj
"Google Chrome" = Google Chrome 18.0.1025.168
"Mozilla Firefox 12.0 (x86 pl)" = Mozilla Firefox 12.0 (x86 pl)

 

3. Prewencyjna wymiana haseł logowania w serwisach.

 

.

Odnośnik do komentarza
Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...