pomocy Live Security Platinum-Wirus

[belveder666]

Zlapalem wyzej wymieniony wirus, malwarebytes niepotrafi go usunąć... proszę więc o pomoc

 

 

SystemLook 30.07.11 by jpshortstuff

Log created at 19:34 on 01/08/2012 by Magda

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Users\Magda\AppData\Local\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}\n."

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="%systemroot%\system32\wbem\wbemess.dll"

"ThreadingModel"="Both"

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shell32.dll"

"ThreadingModel"="Apartment"

 

 

========== filefind ==========

 

Searching for "services.exe"

C:\Windows\System32\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 014A9CB92514E27C0107614DF764BC06

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe --a---- 328704 bytes [23:19 13/07/2009] [01:39 14/07/2009] 24ACB7E5BE595468E3B9AA488B9B4FCB

 

-= EOF =-

OTL.Txt

Extras.Txt

[Landuss]

1. Start > w polu szukania wpisz cmd > z prawokliku Uruchom jako Administrator > wklej komendę:

 

sfc /scanfile=C:\Windows\System32\services.exe

 

Zresetuj system.

 

2. Start > w polu szukania wpisz cmd > z prawokliku Uruchom jako Administrator > wklej komendę

 

reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f

 

3. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = "http://search.phpnuke.org/?lang=en&q={searchTerms}"
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://search.phpnuke.org/?lang=en"
IE - HKLM\..\SearchScopes\{0AC87C9B-5E22-4FA9-A98D-A25541A72A1E}: "URL" = "http://search.phpnuke.org/?lang=en&q={searchTerms}"
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050"
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = "http://search.phpnuke.org/?lang=en&q={searchTerms}"
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://search.conduit.com?SearchSource=10&ctid=CT2269050"
IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No CLSID value found
IE - HKCU\..\SearchScopes\{0AC87C9B-5E22-4FA9-A98D-A25541A72A1E}: "URL" = "http://search.phpnuke.org/?lang=en&q={searchTerms}"
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050"
[2012/07/18 08:49:34 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Users\Magda\AppData\Roaming\mozilla\Firefox\Profiles\jia5z1jw.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
[2012/07/16 10:49:36 | 000,000,000 | ---D | M] (DVDVideoSoftTB) -- C:\Users\Magda\AppData\Roaming\mozilla\Firefox\Profiles\jia5z1jw.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2012/02/26 08:09:31 | 000,000,000 | ---D | M] (PriceGong) -- C:\Users\Magda\AppData\Roaming\mozilla\Firefox\Profiles\jia5z1jw.default\extensions\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}
[2012/02/26 08:09:28 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Users\Magda\AppData\Roaming\mozilla\Firefox\Profiles\jia5z1jw.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O4 - HKCU..\RunOnce: [7531CC9200505F32207603F64F147CE7] C:\ProgramData\7531CC9200505F32207603F64F147CE7\7531CC9200505F32207603F64F147CE7.exe ()
 
:Files
C:\ProgramData\7531CC9200505F32207603F64F147CE7
C:\Windows\Installer\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}
C:\Users\Magda\AppData\Local\{f6463ed5-56b8-9e8a-cfea-6766bc3cf3a7}
 
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

4. Przez Panel sterowania odinstaluj: BS Player Toolbar / PriceGong 2.5.4 / SweetPacks Toolbar for Internet Explorer 4.4

 

5. Uruchom AdwCleaner z opcji Delete

 

6. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras), z SystemLook oraz z Farbar Service Scanner (zaznacz wszystko do skanowania)

Edytowane 4 Września 2012 przez picasso
4.09.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso