Cyberprzestępczość wirus

**Posty:** 3 · przez **sylkasp** 17 Lis 2012, 14:54

mam ten sam problem co wiele innych proszę o pomoc przesyłam pliki w zalączniku... a teraz jestem na trybie awaryjnym.

**Posty:** 4765 · przez **ordynat** 17 Lis 2012, 15:45

1) Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
IE - HKLM\..\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}: "URL" = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=pfNWoNtITBioI86QGX3BzA&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
IE - HKLM\..\SearchScopes\{C9333C23-6DCA-4787-B128-AA28C303B7C9}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcmnbie7-pl-pl
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=19993&babsrc=SP_ss&mntrId=63cb40010000000000000022646b3c30
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=NRO&o=101913&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=EW&apn_dtid=YYYYYYYYPL&apn_uid=5B573B7E-7F0C-432D-A570-1FC5FE28E960&apn_sauid=B708BCCC-DCA1-4DAA-B6D2-7EC32F6E6F98
IE - HKCU\..\SearchScopes\{56256A51-B582-467e-B8D4-7786EDA79AE0}: "URL" = http://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=GRfox000&fl=0&ptb=pfNWoNtITBioI86QGX3BzA&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&st=sb&searchfor={searchTerms}
IE - HKCU\..\SearchScopes\{C9333C23-6DCA-4787-B128-AA28C303B7C9}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcmnbie7-pl-pl
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_Prot"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..extensions.enabledAddons: toolbar@ask.com:3.15.1.100013
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.15.1.22229
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.2.0
FF - prefs.js..extensions.enabledItems: info@bflix.info:5.0
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=NRO&o=101913&locale=en_UK&apn_uid=5B573B7E-7F0C-432D-A570-1FC5FE28E960&apn_ptnrs=EW&apn_sauid=B708BCCC-DCA1-4DAA-B6D2-7EC32F6E6F98&apn_dtid=YYYYYYYYPL&&q="
[2012-03-04 13:48:19 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Sylwia\AppData\Roaming\mozilla\Firefox\Profiles\sysh4bjo.default\extensions\ffxtlbr@babylon.com
[2012-03-04 13:48:02 | 000,000,000 | ---D | M] (TheBflix) -- C:\Users\Sylwia\AppData\Roaming\mozilla\Firefox\Profiles\sysh4bjo.default\extensions\info@bflix.info
[2012-06-09 07:21:52 | 000,000,000 | ---D | M] ("Nero Toolbar") -- C:\Users\Sylwia\AppData\Roaming\mozilla\Firefox\Profiles\sysh4bjo.default\extensions\toolbar@ask.com
[2012-11-17 10:11:01 | 000,002,577 | ---- | M] () -- C:\Users\Sylwia\AppData\Roaming\mozilla\firefox\profiles\sysh4bjo.default\searchplugins\askcom.xml
[2010-10-16 21:16:03 | 000,009,941 | ---- | M] () -- C:\Users\Sylwia\AppData\Roaming\mozilla\firefox\profiles\sysh4bjo.default\searchplugins\mywebsearch.xml
O2 - BHO: (TheBflix Class) - {69352F13-7C0D-4871-BDC6-8B0913486E99} - C:\ProgramData\TheBflix\bhoclass.dll (Injector)
O2 - BHO: (AOL Toolbar BHO) - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.
O2 - BHO: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O3 - HKCU\..\Toolbar\WebBrowser: (Nero Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (AOL Toolbar) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll (AOL LLC)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKCU..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h File not found
O4 - HKCU..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent File not found
O4 - HKCU..\Run: [Erambea] C:\Users\Sylwia\AppData\Roaming\Udtil\nota.exe (Saa69Soft ©)
O4 - HKCU..\Run: [explorer] C:\windows\system32\explorer.exe File not found
O4 - HKCU..\Run: [Explorer.exe] C:\Users\Sylwia\AppData\Roaming\Explorer.exe\windows.exe.exe ()
O4 - HKCU..\Run: [PopCap] C:\Users\Sylwia\AppData\Roaming\CB4001\CB4001.exe (www.Qemu80286.com)
O4 - HKCU..\Run: [Start hide inside slow] "C:\ProgramData\that real bin.f8jrox" File not found
O4 - HKCU..\Run: [stupid pure] "C:\ProgramData\32 Vc Vc.11i2t" File not found
O4 - HKCU..\Run: [Tok-Cirrhatus] File not found
O4 - HKCU..\Run: [Tok-Cirrhatus-2355] C:\Users\Sylwia\AppData\Local\br5733on.exe ()
O4 - HKCU..\Run: [Windows System Devices Manager] c:\users\public\csrss.exe ()
O4 - Startup: C:\Users\Sylwia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk = C:\ProgramData\lsass.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Sylwia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif ()
F3 - HKCU WinNT: Load - (C:\Users\Sylwia\AppData\Local\Temp\{11112~1.EXE) - File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Java Plug-in 1.6.0_06)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\smss.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\services.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\lsass.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\inetinfo.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\Documents\Documents.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\csrss.exe
[2012-11-05 18:45:21 | 000,044,401 | ---- | M] () -- C:\Users\Sylwia\AppData\Local\br5733on.exe
[2012-11-17 09:45:53 | 000,012,393 | ---- | C] () -- C:\Users\Sylwia\AppData\Local\Update.16.Bron.Tok.bin
[2012-11-17 09:30:47 | 000,012,393 | ---- | C] () -- C:\Users\Sylwia\AppData\Local\Bron.tok.A16.em.bin
[2012-03-09 13:27:24 | 000,016,400 | ---- | C] () -- C:\ProgramData\32 Vc Vc.11i2t
[2012-03-09 13:05:24 | 000,323,600 | ---- | C] () -- C:\ProgramData\32 Vc Vc.dl9xouj
[2012-03-09 12:43:11 | 000,299,024 | ---- | C] () -- C:\ProgramData\32 Vc Vc.phnzn
[2012-03-09 12:21:20 | 000,126,992 | ---- | C] () -- C:\ProgramData\32 Vc Vc.ou3h9
[2012-03-09 11:59:23 | 000,008,208 | ---- | C] () -- C:\ProgramData\32 Vc Vc.zrwj5
[2012-03-09 11:37:33 | 000,372,752 | ---- | C] () -- C:\ProgramData\32 Vc Vc.j1966
[2012-03-09 11:15:38 | 000,294,928 | ---- | C] () -- C:\ProgramData\32 Vc Vc.9jrg8kg
[2012-03-09 10:53:47 | 000,323,600 | ---- | C] () -- C:\ProgramData\32 Vc Vc.wbjc5p
[2012-03-09 10:31:56 | 000,167,952 | ---- | C] () -- C:\ProgramData\32 Vc Vc.e92mncg
[2012-03-09 10:09:59 | 000,393,232 | ---- | C] () -- C:\ProgramData\32 Vc Vc.s24v8v
[2012-03-09 09:48:09 | 000,106,512 | ---- | C] () -- C:\ProgramData\32 Vc Vc.cijk7gq
[2012-03-09 09:26:15 | 000,172,048 | ---- | C] () -- C:\ProgramData\32 Vc Vc.ubmfmai
[2012-03-09 08:37:48 | 000,102,416 | ---- | C] () -- C:\ProgramData\32 Vc Vc.am1z3
[2012-03-09 08:15:56 | 000,294,928 | ---- | C] () -- C:\ProgramData\32 Vc Vc.15nbd
[2012-03-09 07:53:55 | 000,233,488 | ---- | C] () -- C:\ProgramData\32 Vc Vc.jdxmw
[2012-03-09 07:32:00 | 000,180,240 | ---- | C] () -- C:\ProgramData\32 Vc Vc.tyv0uj
[2012-03-08 21:04:16 | 000,143,376 | ---- | C] () -- C:\ProgramData\32 Vc Vc.pu6ff
[2012-03-08 20:42:07 | 000,049,168 | ---- | C] () -- C:\ProgramData\32 Vc Vc.mkxxu
[2009-12-17 12:36:08 | 000,319,504 | ---- | C] () -- C:\ProgramData\32 Vc Vc.c1uog
[2009-12-17 12:36:08 | 000,167,952 | ---- | C] () -- C:\ProgramData\32 Vc Vc.hb7k1av
[2009-12-14 11:48:11 | 000,184,336 | ---- | C] () -- C:\ProgramData\32 Vc Vc.26icsbi
[2009-11-30 16:32:57 | 000,266,256 | ---- | C] () -- C:\ProgramData\32 Vc Vc.yfe8z

:Files
G:\RECYCLER
G:\QAUoYA.EXe
H:\zEazEm.EXE
C:\ProgramData\lsass.exe
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Sylwia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ctfmon.lnk

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

2) Użyj >Adw-cleaner. Kliknij w nim Delete
Pokaż raport z niego C:\AdwCleaner[S1].txt

3) Użyj > MBAM http://www.programosy.pl/program,malwarebytes-anti-malware.html
Na końcu kliknij na Usuń zaznaczone.
Podaj z tego raport.

4) Zainstaluj nowszą, bezpieczniejszą wersję Javy:
>http://java.com/pl/download/windows_xpi.jsp?locale=pl
Przy instalacji usuń zaznaczenie przy "Install the AskToolbar ..."

**Posty:** 3 · przez **sylkasp** 17 Lis 2012, 17:09

ok wklejam załączniki coś dalej mam zrobić ?

**Posty:** 4765 · przez **ordynat** 17 Lis 2012, 17:21

Jeszcze raz wyłącz i włącz komputer - może System się obudzi.
Jeśli nie, to spróbuj ratować przy pomocy płytki instalacyjnej.
Może się uda, choć chyba System był już za bardzo zniszczony przez infekcje.
.

**Posty:** 3 · przez **sylkasp** 17 Lis 2012, 18:06

wklejam załączniki, wszystko jest już chyba dobrze

Dziękuję Ci BARDZOOO za pomoc

**Posty:** 4765 · przez **ordynat** 17 Lis 2012, 18:25

Wszystko dobre, co się dobrze kończy.
W Adw-Cleaner kliknij na przycisk Uninstall
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.
.