Renos.JM

[szymonSKC]

Hej, mam problem z wirusem Renos.JM. Wyskakują mi różne okienka w internecie, i co chwile eset pokazuje ten wirus, nie daje rady go usunąć. Proszę o pomoc. Logi z OTL w załączniku.

log.txt

[picasso]

Nie podałeś wyników z ESET gdzie on widzi infekcję. Log z OTL nieprawidłowo wykonany na ustawieniach z innego forum + brakuje fragmentu Extras (nie przestawiłeś "Rejestr - skan dodatkowy" na "Użyj filtrowania").

 

---

Infekcja jest dość rozbudowana i być może jest tu także rootkit w MBR, a te trojany widoczne w OTL to tylko "osłonka".

 

1. Uruchom OTL i w sekcji Własne opcje skanowania / skrypt wklej:

 

:OTL
DRV:64bit: - [2011-05-18 16:02:53 | 000,109,568 | -H-- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\cmdlhost.sys -- (cmdlhost.sys)
DRV - [2011-06-06 17:00:41 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\qxibmtcb.sys -- (qxibmtcb)
DRV - [2011-06-06 15:00:40 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\gofijnvm.sys -- (gofijnvm)
DRV - [2011-06-06 13:00:39 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\dsxgmplr.sys -- (dsxgmplr)
DRV - [2011-06-06 11:00:39 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\cdbmqqfs.sys -- (cdbmqqfs)
DRV - [2011-06-06 09:00:36 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\qfzgjblj.sys -- (qfzgjblj)
DRV - [2011-06-05 23:47:13 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\fjtkxazf.sys -- (fjtkxazf)
DRV - [2011-06-05 21:47:10 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\gqdxojjc.sys -- (gqdxojjc)
DRV - [2011-06-05 19:47:09 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\pqzmnvra.sys -- (pqzmnvra)
DRV - [2011-06-05 17:47:06 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\jcbvfild.sys -- (jcbvfild)
DRV - [2011-06-05 15:47:05 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\gogrwdkv.sys -- (gogrwdkv)
DRV - [2011-06-05 13:47:04 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\mndiwnuh.sys -- (mndiwnuh)
DRV - [2011-06-05 11:47:03 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\uisqnfyr.sys -- (uisqnfyr)
DRV - [2011-06-05 09:46:57 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\qrciljog.sys -- (qrciljog)
DRV - [2011-06-05 00:26:05 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\njlzhazp.sys -- (njlzhazp)
DRV - [2011-06-04 22:26:04 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\zrmxkdat.sys -- (zrmxkdat)
DRV - [2011-06-04 20:26:03 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\hjjmqqkr.sys -- (hjjmqqkr)
DRV - [2011-06-04 18:26:03 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\hnfjwrbo.sys -- (hnfjwrbo)
DRV - [2011-06-04 16:26:01 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\bfntwunz.sys -- (bfntwunz)
DRV - [2011-06-04 14:26:00 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\uoqqsofx.sys -- (uoqqsofx)
DRV - [2011-06-04 12:25:56 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\vncfrccn.sys -- (vncfrccn)
DRV - [2011-06-04 10:25:54 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\mrrdwjpn.sys -- (mrrdwjpn)
DRV - [2011-06-03 23:28:26 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\girqphco.sys -- (girqphco)
DRV - [2011-06-03 21:28:25 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\wqushxvi.sys -- (wqushxvi)
DRV - [2011-06-03 19:28:23 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\znbsepre.sys -- (znbsepre)
DRV - [2011-06-03 17:28:22 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\qoibsvbb.sys -- (qoibsvbb)
DRV - [2011-06-03 15:28:21 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\nareuchu.sys -- (nareuchu)
DRV - [2011-06-03 13:28:21 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\idbzufjx.sys -- (idbzufjx)
DRV - [2011-06-03 11:28:19 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\fnknuafu.sys -- (fnknuafu)
DRV - [2011-06-03 09:28:18 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ycnbtroq.sys -- (ycnbtroq)
DRV - [2011-06-02 23:05:48 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ndnplbvn.sys -- (ndnplbvn)
DRV - [2011-06-02 21:05:47 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ojntjcen.sys -- (ojntjcen)
DRV - [2011-06-02 19:05:45 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\zcwrepmc.sys -- (zcwrepmc)
DRV - [2011-06-02 17:05:43 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\jindpvse.sys -- (jindpvse)
DRV - [2011-06-02 15:05:42 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\fcuvaeon.sys -- (fcuvaeon)
DRV - [2011-06-02 13:05:41 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\vnjfuorg.sys -- (vnjfuorg)
DRV - [2011-06-02 11:05:40 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\xcifsskg.sys -- (xcifsskg)
DRV - [2011-06-02 09:05:37 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\brbsnfxr.sys -- (brbsnfxr)
DRV - [2011-06-01 21:51:38 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\jqurntog.sys -- (jqurntog)
DRV - [2011-06-01 19:51:38 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\tqimtwbo.sys -- (tqimtwbo)
DRV - [2011-06-01 17:51:34 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\hczdkfdr.sys -- (hczdkfdr)
DRV - [2011-06-01 15:51:31 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\reujuuri.sys -- (reujuuri)
DRV - [2011-06-01 13:51:30 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\bsvlawga.sys -- (bsvlawga)
DRV - [2011-06-01 11:51:29 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ffmbnckl.sys -- (ffmbnckl)
DRV - [2011-06-01 09:51:28 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\voqdcsxj.sys -- (voqdcsxj)
DRV - [2011-06-01 07:51:26 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\erivdugr.sys -- (erivdugr)
DRV - [2011-05-31 12:15:24 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\oieaqiqb.sys -- (oieaqiqb)
DRV - [2011-05-30 21:28:57 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ncnbwsiw.sys -- (ncnbwsiw)
DRV - [2011-05-30 19:28:56 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\xjmdbjjs.sys -- (xjmdbjjs)
DRV - [2011-05-30 17:28:55 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\bcjcqjtz.sys -- (bcjcqjtz)
DRV - [2011-05-30 15:28:51 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ffrhcfrp.sys -- (ffrhcfrp)
DRV - [2011-05-30 13:28:47 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ddgokfuo.sys -- (ddgokfuo)
DRV - [2011-05-30 11:28:46 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\eievtjnc.sys -- (eievtjnc)
DRV - [2011-05-30 09:28:45 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\rnhlwuqz.sys -- (rnhlwuqz)
DRV - [2011-05-30 05:28:12 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ciofxebv.sys -- (ciofxebv)
DRV - [2011-05-30 00:41:24 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\fowuhzze.sys -- (fowuhzze)
DRV - [2011-05-29 22:41:23 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\zcivfiry.sys -- (zcivfiry)
DRV - [2011-05-29 20:41:22 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\dfjucnsz.sys -- (dfjucnsz)
DRV - [2011-05-29 18:41:21 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\hcrlvcmn.sys -- (hcrlvcmn)
DRV - [2011-05-29 16:41:20 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\qqglkxim.sys -- (qqglkxim)
DRV - [2011-05-29 14:41:19 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\xrbsttpt.sys -- (xrbsttpt)
DRV - [2011-05-29 12:41:18 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\urjurmju.sys -- (urjurmju)
DRV - [2011-05-29 10:41:17 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\cdkvbovq.sys -- (cdkvbovq)
DRV - [2011-05-29 08:41:15 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\eoquenfk.sys -- (eoquenfk)
DRV - [2011-05-29 01:16:17 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\lcdstcrr.sys -- (lcdstcrr)
DRV - [2011-05-28 22:10:02 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\nnbgivno.sys -- (nnbgivno)
DRV - [2011-05-28 20:10:01 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\nrmfdcvl.sys -- (nrmfdcvl)
DRV - [2011-05-28 18:09:57 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\cejrfunz.sys -- (cejrfunz)
DRV - [2011-05-28 16:09:56 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\edwgracx.sys -- (edwgracx)
DRV - [2011-05-28 14:09:55 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\bojrcfog.sys -- (bojrcfog)
DRV - [2011-05-28 12:09:54 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ocazujri.sys -- (ocazujri)
DRV - [2011-05-28 10:09:53 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\tjvqbdsh.sys -- (tjvqbdsh)
DRV - [2011-05-28 08:09:48 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\cijqzffg.sys -- (cijqzffg)
DRV - [2011-05-27 23:34:08 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\unziezpi.sys -- (unziezpi)
DRV - [2011-05-27 21:34:07 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ahpvinav.sys -- (ahpvinav)
DRV - [2011-05-27 19:34:06 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\zsyjgovu.sys -- (zsyjgovu)
DRV - [2011-05-27 17:34:05 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ffttmpjj.sys -- (ffttmpjj)
DRV - [2011-05-27 15:34:01 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\konxqnir.sys -- (konxqnir)
DRV - [2011-05-27 13:33:58 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\bruvbbyr.sys -- (bruvbbyr)
DRV - [2011-05-27 10:39:01 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\jcfzlxzs.sys -- (jcfzlxzs)
DRV - [2011-05-27 07:29:59 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\mdzpdoqd.sys -- (mdzpdoqd)
DRV - [2011-05-26 20:15:22 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\vrjnsfop.sys -- (vrjnsfop)
DRV - [2011-05-26 18:15:20 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\rirmqbqf.sys -- (rirmqbqf)
DRV - [2011-05-26 15:48:44 | 000,002,417 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysWow64\drivers\ronscerh.sys -- (ronscerh)
SRV - [2011-06-12 16:35:54 | 000,803,840 | ---- | M] () [Auto | Stopped] -- c:\Windows\SysWOW64\wztglpci.dll -- (vdqeknpv)
NetSvcs: vdqeknpv - c:\Windows\SysWOW64\wztglpci.dll ()
O2 - BHO: () - {00000000-0000-0000-0000-000000000000} - c:\Windows\SysWOW64\wztglpci.dll ()
O4 - HKLM..\Run: [Microsoft Driver Setup] C:\Windows\aadrive32.exe ()
O4 - HKCU..\Run: []  File not found
O4 - HKCU..\Run: [{1C257B7B-6217-E07B-804A-59201CDE5B59}]  File not found
O4 - HKCU..\Run: [{ECF127D6-5D96-4375-37B9-DE0454141EF5}]  File not found
O4 - HKCU..\Run: [12CFG214-K641-12SF-N85P] C:\RECYCLER\S-1-5-21-0243936033-3052116371-381863308-1811\vsbntlo.exe ()
O4 - HKCU..\Run: [4ECYTQ9SIC] C:\Users\sjskc\AppData\Local\Temp\Sbk.exe (Simon Tatham)
O4 - HKCU..\Run: [NtWqIVLZEWZU] C:\Users\sjskc\AppData\Local\Temp\Sbl.exe (Simon Tatham)
O4 - HKCU..\Run: [RGSC]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Microsoft Driver Setup = C:\Windows\aadrive32.exe ()
O20 - HKLM Winlogon: UserInit - (C:\Users\sjskc\AppData\Roaming\svchost.exe) - C:\Users\sjskc\AppData\Roaming\svchost.exe (The OpenSSL Project, "http://www.openssl.org/")
 
:Files
RECYCLER /alldrives
C:\Windows\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
C:\Windows\tasks\{BBAEAEAF-1275-40e2-BD6C-BC8F88BD114A}.job
C:\Windows\tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job
C:\Users\sjskc\AppData\Roaming\*.exe
C:\Users\sjskc\AppData\Roaming\Okuv
C:\Users\sjskc\AppData\Roaming\Hygyos
C:\Users\sjskc\AppData\Roaming\Ynira
C:\Users\sjskc\AppData\Roaming\Guky
C:\Users\sjskc\AppData\Roaming\Ymri
C:\Users\sjskc\AppData\Roaming\Doax
C:\Users\sjskc\AppData\Roaming\Yzli
C:\Users\sjskc\AppData\Roaming\Urex
C:\Users\sjskc\AppData\Roaming\Vobi
C:\Users\sjskc\AppData\Roaming\Luibem
C:\Users\sjskc\AppData\Roaming\xtrbahgyspouprkwxy2rwjmiobd1qii22
C:\Users\sjskc\AppData\Roaming\xpvhjdviwoa3guaxfwi3gaiyuytkivno2
C:\Users\sjskc\AppData\Roaming\x3lyfxvubl32ae2xbrixadlqdmqyfbqn2
C:\Users\sjskc\AppData\Roaming\xsbv1tvphylqstfxhizfyqgl1n1lfy2t2
C:\Users\sjskc\AppData\Roaming\xjpi2iuhqo2zmyugwytno2xcpgpwgyyw2
C:\Users\sjskc\AppData\Roaming\x1rn1dlnhnl3gyokbjubdamjhivzha322
C:\Users\sjskc\AppData\Roaming\xdvjeag1arkzrxgbyfiip22jiqtxlbaq2
C:\ProgramData\nG41901EoAlM41901
C:\ProgramData\common.data
C:\Windows\Scezua.exe
C:\Windows\SysWow64\hjeltyrq.dat
C:\Windows\SysWow64\srrmgoxg.dat
C:\Windows\SysWow64\ewhwblus.dat
 
:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\]
 
:Commands
[emptyflash]
[emptytemp]

Rozpocznij usuwanie przyciskiem Wykonaj skrypt. System powinien zrestartować, a po restarcie zostanie podany log z usuwania.

 

2. Deinstalacja śmieci sponsoringowych oraz zbędników:

 

• W aplecie deinstalacji programów usuń adware DAEMON Tools Toolbar + Free Lunch Design Toolbar. Możesz też odmontować zbędnik Akamai NetSession Interface.
  
• W Menedżerze rozszerzeń Firefox usuń rozszerzenia: Conduit Engine, DAEMON Tools Toolbar, Free Lunch Design Community Toolbar, vShare.
  

3. Po wykonaniu wszystkich powyższych zadań generujesz następujące logi:

 

• OTL opcją Skanuj. Proszę skonfigurować program jak jest podane w naszym przyklejonym, czyli wszystkie sekcje ustawione na Użyj filtrowania, nic nie wklejać w oknie. Wynikowo mają powstać dwa logi.
  
• Raport z Kaspersky TDSSKiller. Przy jakichkolwiek wynikach nie podejmuj akcji i ustaw wszystko na Skip.
  

Do oceny trzy powyższe raporty plus log uzyskany z usuwania OTL w punkcie 1.

 

 

 

 

 

.

Edytowane 25 Lipca 2011 przez picasso
25.07.2011 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso