Wirus z żądaniem zapłaty

**Posty:** 6 · przez **mikelt** 04 Gru 2012, 03:01

Witam.
Dopadł mnie wirus żądający zapłaty za odblokowanie komputera. System działa normalnie tylko w trybie awaryjnym. Proszę o pomoc.
Pozdrawiam.

**Posty:** 4765 · przez **ordynat** 04 Gru 2012, 07:43

Infekcję masz od 6 października a dopiero teraz zgłaszasz się po pomoc?
1) Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:Files
C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\Users\Michal\wgsdgsdgdsgsd.exe
C:\Users\Michal\AppData\Roaming\stplpfhevfcucfammws.exe
O4 - HKU\S-1-5-21-3572107890-3359430255-813988367-1000..\Run: [stplpfhevfcucfammws] C:\Users\Michal\AppData\Roaming\stplpfhevfcucfammws.exe (Microsoft Corporation)

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=2&cf=5283190f-dd7e-11e0-834b-00241dd2b9c7
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=5283190f-dd7e-11e0-834b-00241dd2b9c7&q={searchTerms}
IE - HKU\S-1-5-21-3572107890-3359430255-813988367-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=5283190f-dd7e-11e0-834b-00241dd2b9c7&q={searchTerms}
IE - HKU\S-1-5-21-3572107890-3359430255-813988367-1000\..\SearchScopes\{2B1B5B16-320A-4DEE-94B5-34C378B21045}: "URL" = http://startsear.ch/?aff=1&q={searchTerms}
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Michal\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll File not found
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.)
O4 - HKLM..\Run: [KiesTrayAgent] F:\Programy\Kies\KiesTrayAgent.exe File not found
O4 - HKU\S-1-5-21-3572107890-3359430255-813988367-1000..\Run: [ALLUpdate] "F:\Programy\OpenSubtitlesPlayer\ALLUpdate.exe" "sleep" File not found
O4 - HKU\S-1-5-21-3572107890-3359430255-813988367-1000..\Run: [Facebook Update] "C:\Users\Michal\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

2) Użyj >Adw-cleaner. Kliknij w nim Delete
Pokaż raport z niego C:\AdwCleaner[S1].txt

3) Zainstaluj nowszą, bezpieczniejszą wersję Javy:
>http://java.com/pl/download/windows_xpi.jsp?locale=pl
Przy instalacji usuń zaznaczenie przy "Install the AskToolbar ..."
.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **mikelt** 04 Gru 2012, 18:13

Od 6 października? oO nie miałem nawet pojęcia. System wydawał się działać normalnie, a AV nic nie wykrywał.

Kod: Zaznacz wszystko: All processes killed ========== FILES ========== C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk moved successfully. C:\ProgramData\dsgsdgdsgdsgw.pad moved successfully. C:\Users\Michal\wgsdgsdgdsgsd.exe moved successfully. C:\Users\Michal\AppData\Roaming\stplpfhevfcucfammws.exe moved successfully. File\Folder O4 - HKU\S-1-5-21-3572107890-3359430255-813988367-1000..\Run: [stplpfhevfcucfammws] C:\Users\Michal\AppData\Roaming\stplpfhevfcucfammws.exe (Microsoft Corporation) not found. ========== OTL ========== HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry key HKEY_USERS\S-1-5-21-3572107890-3359430255-813988367-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found. Registry key HKEY_USERS\S-1-5-21-3572107890-3359430255-813988367-1000\Software\Microsoft\Internet Explorer\SearchScopes\{2B1B5B16-320A-4DEE-94B5-34C378B21045}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2B1B5B16-320A-4DEE-94B5-34C378B21045}\ not found. Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}\ deleted successfully. C:\Program Files (x86)\StartSearch plugin\ssBarLcher.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KiesTrayAgent deleted successfully. Registry value HKEY_USERS\S-1-5-21-3572107890-3359430255-813988367-1000\Software\Microsoft\Windows\CurrentVersion\Run\\ALLUpdate deleted successfully. Registry value HKEY_USERS\S-1-5-21-3572107890-3359430255-813988367-1000\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully. Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found. Starting removal of ActiveX control {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA}\ not found. Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Basia ->Temp folder emptied: 11929 bytes ->Temporary Internet Files folder emptied: 596939 bytes ->Flash cache emptied: 0 bytes User: Darek ->Temp folder emptied: 196370 bytes ->Temporary Internet Files folder emptied: 91400587 bytes ->Java cache emptied: 0 bytes ->Flash cache emptied: 456 bytes User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Malwina ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->Opera cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Michal ->Temp folder emptied: 202678610 bytes ->Temporary Internet Files folder emptied: 28712671 bytes ->Java cache emptied: 121269 bytes ->Google Chrome cache emptied: 13496445 bytes ->Opera cache emptied: 51622172 bytes ->Flash cache emptied: 542 bytes User: Public User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 76910582 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50534 bytes RecycleBin emptied: 241301 bytes Total Files Cleaned = 444,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 12042012_163908 Files\Folders moved on Reboot... C:\Users\Michal\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot...

**Posty:** 4765 · przez **ordynat** 04 Gru 2012, 18:40

Jest już prawie dobrze.
Usuniemy jeszcze jeden klucz infekcji:
Do Notatnika wklej:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_USERS\S-1-5-21-3572107890-3359430255-813988367-1000\software\microsoft\windows\currentversion\run] "stplpfhevfcucfammws"=-

Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).

Potem kończymy:
W Adw-Cleaner kliknij na przycisk Uninstall
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.
.

**Posty:** 6 · przez **mikelt** 04 Gru 2012, 18:48

Wszystko w porządku.
Wielkie dzięki za pomoc