[log] avast szaleje, win32:rootkit-gen [rtk], win32:patched-

[wszwszwsz]

Witam, mam problem z
Win32:Rootkit-gen [Rtk]
oraz
Win32:Patched-HN[trj]

tak przynajmiej rozpoznaje je avast
Przy uruchomieniu kilkakrotnie wyswietla mi sie ze avast znalazl wirusa i oczywiscie nie moze sobie z tym poradzic, jak narazie nie zaowazylem negatywnej pracy tych insektow i trojanow.
Przyklady:
Plik: C:\q93fi6kf.exe
Nazwa pasożyta Win32:Rootkit-gen [Rtk],
Plik: D:\q93fi6kf.exe
Nazwa pasożyta Win32:Rootkit-gen [Rtk],
Plik: E:\q93fi6kf.exe
Nazwa pasożyta Win32:Rootkit-gen [Rtk]

Typ pasożyta Rootkit
Log z OTL(OTL.Txt)
http://www.wklej.org/id/212738/
Log z OTL (z zaznaczonymi opcjami LOP chech, Purity Check, Use Company Name Whitelist i Scan All users)
http://www.wklej.org/id/212752/
i z pliku Extras
http://www.wklej.org/id/212741/
Prosze o pomoc

[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-484763869-1644491937-682003330-1003..\Run: [cdoosoft] C:\Documents and Settings\Vegeta\Ustawienia lokalne\Temp\herss.exe ()
O32 - AutoRun File - [2009-11-22 15:51:14 | 00,000,063 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-03-21 18:37:26 | 00,000,000 | ---D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-03-21 18:37:26 | 00,000,000 | ---D | M] - E:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{4747bfad-d4de-11de-9c65-0016e665ee80}\Shell\AutoRun\command - "" = H:\cj3k.exe -- File not found
O33 - MountPoints2\{4747bfad-d4de-11de-9c65-0016e665ee80}\Shell\open\Command - "" = H:\cj3k.exe -- File not found

:Files
C:\0qw6vege.exe
C:\q93fi6kf.exe
d:\0qw6vege.exe
d:\q93fi6kf.exe
e:\0qw6vege.exe
e:\q93fi6kf.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

Autor postu otrzymał pochwałę

[wszwszwsz]

Raport z czyszczenia kompa:

Kod: Zaznacz wszystko

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Registry value HKEY_USERS\S-1-5-21-484763869-1644491937-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Run\\cdoosoft deleted successfully.
File C:\Documents and Settings\Vegeta\Ustawienia lokalne\Temp\herss.exe not found.
C:\autorun.inf moved successfully.
File  not found.
File  not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4747bfad-d4de-11de-9c65-0016e665ee80}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4747bfad-d4de-11de-9c65-0016e665ee80}\ not found.
File H:\cj3k.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4747bfad-d4de-11de-9c65-0016e665ee80}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4747bfad-d4de-11de-9c65-0016e665ee80}\ not found.
File H:\cj3k.exe not found.
========== FILES ==========
C:\0qw6vege.exe moved successfully.
File\Folder C:\q93fi6kf.exe not found.
d:\0qw6vege.exe moved successfully.
File\Folder d:\q93fi6kf.exe not found.
e:\0qw6vege.exe moved successfully.
File\Folder e:\q93fi6kf.exe not found.
========== REGISTRY ==========
Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully!
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 65984 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Vegeta
->Temp folder emptied: 47284049 bytes
->Temporary Internet Files folder emptied: 7601000 bytes
->Java cache emptied: 13689500 bytes
->Opera cache emptied: 45950829 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114584 bytes
%systemroot%\System32 .tmp files removed: 2596 bytes
Windows Temp folder emptied: 98410 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 111,49 mb


OTL by OldTimer - Version 3.1.6.3 log created on 11222009_161915

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


Log OTL:
http://www.wklej.org/id/212780/
Wygląda na to ze pomoglo. WIELKE dzieki za pomoc:))

[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - AutoRun File - [2009-03-21 18:37:26 | 00,000,000 | ---D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-03-21 18:37:26 | 00,000,000 | ---D | M] - E:\autorun.inf -- [ NTFS ]

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .


1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu