CyberPolicja Wirus

[Pakovsky]

Witam, bardzo prosze o pomoc w sprawie wirusa "cyberpolicji", ktory kaze mi zaplacic 300 zl ;oo

 

Pozdrawiam i z gory dziekuje

OTL.Txt

Extras.Txt

[picasso]

Przypomnę zasady działu: KLIK. Tu jest zabronione "odświeżanie" przez przypominanie. Jest wyraźnie napisane, by cierpliwie czekać na swoją kolej. Są tu tylko dwie osoby autoryzowane do pomocy, mamy ogromną ilość tematów do przetworzenia oraz prywatne życie.

 

Prócz infekcji "cyberpolicyjnej" są tu ślady po robaka Brontok, a także masz uszkodzone ścieżki folderów powłoki, co oznajmia ten kuriozalny zestaw ścieżek z raportu:

 

 

 

O4 - Startup: C:\Documents and Settings\All Users\Dane aplikacji [2012-11-20 06:24:26 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Dokumenty [2012-11-01 19:52:51 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\All Users\DRM [2012-04-17 17:46:27 | 000,000,000 | -HSD | M]

O4 - Startup: C:\Documents and Settings\All Users\Menu Start [2012-02-06 08:15:08 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\All Users\Pulpit [2012-11-20 06:37:44 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\All Users\Szablony [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\All Users\Ulubione [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\Cookies [2012-02-06 07:57:33 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Default User\Dane aplikacji [2012-02-06 08:48:07 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Menu Start [2012-02-06 08:48:07 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Default User\Moje dokumenty [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\NetHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Default User\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Default User\PrintHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Pulpit [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\Recent [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\SendTo [2012-02-06 07:55:08 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Szablony [2012-02-06 07:52:49 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Default User\Ulubione [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Default User\Ustawienia lokalne [2012-02-06 08:48:07 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\LocalService\Cookies [2012-02-06 07:58:36 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\LocalService\Dane aplikacji [2012-02-12 14:03:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\LocalService\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\LocalService\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\LocalService\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\LocalService\Ustawienia lokalne [2012-02-06 07:58:35 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\.gstreamer-0.10 [2012-08-25 12:39:29 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Cookies [2012-11-20 06:29:35 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Dane aplikacji [2012-11-20 17:21:17 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Menu Start [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Moje dokumenty [2012-11-20 11:27:50 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\NetHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Mojżesz\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Mojżesz\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Mojżesz\PrintHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Pulpit [2012-11-20 10:22:01 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Recent [2012-11-20 06:29:35 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\SendTo [2012-11-15 14:11:06 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Szablony [2012-02-06 07:52:49 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Ulubione [2012-08-20 17:30:02 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Mojżesz\Ustawienia lokalne [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\NetworkService\Cookies [2012-02-06 08:33:58 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\NetworkService\Dane aplikacji [2012-02-06 08:40:30 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\NetworkService\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\NetworkService\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\NetworkService\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\NetworkService\Ustawienia lokalne [2012-02-06 07:58:26 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Pako\.gstreamer-0.10 [2012-11-13 20:51:20 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Pako\Cookies [2012-11-20 17:01:02 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Pako\Dane aplikacji [2012-10-09 14:57:28 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Pako\Menu Start [2012-02-06 08:48:07 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Pako\Moje dokumenty [2012-11-07 17:21:18 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Pako\NetHood [2012-03-24 22:25:18 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Pako\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\Pako\ntuser.dat ()

O4 - Startup: C:\Documents and Settings\Pako\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\Pako\PrintHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Pako\Pulpit [2012-11-04 09:19:25 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Pako\Recent [2012-11-18 19:39:38 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Pako\riotsGamesLogs [2012-07-10 19:33:44 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\Pako\SendTo [2012-05-18 19:00:42 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\Pako\Szablony [2012-11-01 19:52:51 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\Pako\Ulubione [2012-02-06 07:59:19 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\Pako\UserData [2012-11-08 17:57:19 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\Pako\Ustawienia lokalne [2012-07-03 16:39:37 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Contacts [2012-02-06 08:19:26 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Cookies [2012-02-06 07:57:33 | 000,000,000 | --SD | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Dane aplikacji [2012-02-06 08:48:07 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Menu Start [2012-02-06 08:48:07 | 000,000,000 | R--D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Moje dokumenty [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\NetHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\UpdatusUser\NTUSER.DAT ()

O4 - Startup: C:\Documents and Settings\UpdatusUser\ntuser.ini ()

O4 - Startup: C:\Documents and Settings\UpdatusUser\PrintHood [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Pulpit [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Recent [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Searches [2012-02-06 08:19:26 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\SendTo [2012-02-06 07:55:08 | 000,000,000 | RH-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Szablony [2012-02-06 07:52:49 | 000,000,000 | -H-D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Ulubione [2012-02-06 08:48:07 | 000,000,000 | ---D | M]

O4 - Startup: C:\Documents and Settings\UpdatusUser\Ustawienia lokalne [2012-02-06 08:48:07 | 000,000,000 | -H-D | M]

 

 

 

Zanim przejdę do usuwania infekcji, w pierwszej kolejności to musi być naprawione, bo oglądamy teraz złe środowisko. Proszę o dodatkowy skan. Uruchom SystemLook i w oknie wklej:

 

:reg
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

 

Klik w Look. Przedstaw wynikowy log.

 

 

 

.

Edytowane 19 Grudnia 2012 przez picasso
19.12.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso