Jak mozna doprowadzic system do takiego stanu?
Odinstaluj:
SweetIM Toolbar for Internet Explorer 3.6
Burn4Free Toolbar
myBabylon_English Toolbar
PageRage Toolbar
Trojan Remover 6.7.1
Do aktualizacji:
Java(TM) 6 Update 20
Adobe Reader 9.1 - Polish
Zrob skan pelny skan przy pomocy mbam oraz cureit.
Uzyj Combofix i daj log z niego.
Uzyj USBFix, opcja Vaccinate.
Wykonaj skrypt w OTL:
:OTL
SRV - File not found [Auto | Stopped] -- -- (Registry Helper Service)
SRV - File not found [Auto | Stopped] -- -- (MyWebSearchService)
SRV - File not found [Auto | Stopped] -- -- (avg9wd)
SRV - File not found [Auto | Stopped] -- -- (avg9emc)
SRV - [2010-07-23 21:29:06 | 000,057,608 | ---- | M] () [Auto | Stopped] -- C:\Documents and Settings\All Users\Dane aplikacji\ResultDns\resultdns111.exe -- (ResultDns Service)
SRV - [2010-06-04 18:16:46 | 000,061,712 | ---- | M] () [Auto | Stopped] -- C:\Documents and Settings\All Users\Dane aplikacji\SpaceQuery\spacequery131.exe -- (SpaceQuery Service)
SRV - [2007-07-20 21:34:25 | 000,340,480 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.5.0\svchost.exe -- (srvbtcclient)
SRV - [2007-07-19 23:29:41 | 000,483,328 | ---- | M] () [Auto | Running] -- C:\WINDOWS\update.2\svchost.exe -- (srviecheck)
SRV - [2007-07-19 23:27:59 | 000,232,960 | ---- | M] () [Auto | Running] -- C:\WINDOWS\sysdriver32.exe -- (srvsysdriver32)
SRV - [2007-07-19 23:15:58 | 001,147,392 | -H-- | M] () [Auto | Running] -- C:\WINDOWS\update.1\svchost.exe -- (wxpdrivers)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
http://www.tangosearch.com/?useie5=1&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://home.sweetim.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
http://search.conduit.com?SearchSource=10&ctid=CT2418376 IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Value error. File not found
IE - HKCU\..\URLSearchHook: {00A6FAF6-072E-44cf-8957-5838F569A31D} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll (SweetIM Technologies Ltd.)
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56667
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "PageRage Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2418376&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.facebook.com/?ref=hp"
FF - prefs.js..extensions.enabledItems: support(_at_)burn4free-toolbar.com:1.0
FF - prefs.js..extensions.enabledItems: DTToolbar(_at_)toolbarnet.com:1.1.1.0014
FF - prefs.js..extensions.enabledItems: m3ffxtbr(_at_)mywebsearch.com:1.1
FF - prefs.js..keyword.URL: "http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZRfox000&ptb=lYWug5hNFLjw88KMzCjh0A&psa=&ind=2010031716&ptnrS=ZRfox000&si=&st=kwd&n=77cea664&searchfor="
FF - prefs.js..network.proxy.autoconfig_url: "http://www.seriale.ath.cx/ogladaj"
FF - prefs.js..network.proxy.backup.ftp: "212.182.64.86"
FF - prefs.js..network.proxy.backup.ftp_port: 3128
FF - prefs.js..network.proxy.backup.gopher: "212.182.64.86"
FF - prefs.js..network.proxy.backup.gopher_port: 3128
FF - prefs.js..network.proxy.backup.socks: "212.182.64.86"
FF - prefs.js..network.proxy.backup.socks_port: 3128
FF - prefs.js..network.proxy.backup.ssl: "212.182.64.86"
FF - prefs.js..network.proxy.backup.ssl_port: 3128
FF - prefs.js..network.proxy.ftp: "194.11.24.156"
FF - prefs.js..network.proxy.ftp_port: 3128
FF - prefs.js..network.proxy.gopher: "194.11.24.156"
FF - prefs.js..network.proxy.gopher_port: 3128
FF - prefs.js..network.proxy.http: "194.11.24.156"
FF - prefs.js..network.proxy.http_port: 3128
FF - prefs.js..network.proxy.no_proxies_on: ""
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "194.11.24.156"
FF - prefs.js..network.proxy.socks_port: 3128
FF - prefs.js..network.proxy.ssl: "194.11.24.156"
FF - prefs.js..network.proxy.ssl_port: 3128
FF - prefs.js..network.proxy.type: 1
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "YouTube"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/home"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "chrome://browser-region/locale/region.properties"
FF - HKLM\Software\MozillaPlugins\@mywebsearch.com/Plugin: C:\Program Files\MyWebSearch\bar\6.bin\NPMyWebS.dll File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\m3ffxtbr@mywebsearch.com: C:\Program Files\MyWebSearch\bar\6.bin [2010-10-14 15:05:22 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{8A9386B4-E958-4c4c-ADF4-8F26DB3E4829}: C:\Program Files\PriceGong\2.0.0\FF
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\adparatus@adparatus.com: C:\Program Files\Adparatus\FF\2594\ [2010-06-02 23:37:52 | 000,000,000 | ---D | M]
[2010-08-31 01:02:48 | 000,000,000 | ---D | M] (PageRage Toolbar) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}
[2010-03-17 20:06:50 | 000,000,000 | ---D | M] (myBabylon English Toolbar) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2010-03-17 19:56:01 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2010-08-24 13:11:38 | 000,000,919 | ---- | M] () -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\searchplugins\conduit.xml
[2010-10-03 11:16:46 | 000,010,017 | ---- | M] () -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\searchplugins\mywebsearch.xml
[2010-03-17 19:55:58 | 000,003,915 | ---- | M] () -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\5e8ps5gl.default\searchplugins\sweetim.xml
[2010-06-02 23:35:16 | 000,000,000 | ---D | M] (SpaceQuery) -- C:\Program Files\Mozilla Firefox\extensions\{0A328249-98DF-476C-9D25-3853C961DAB9}
[2010-07-25 20:17:53 | 000,000,000 | ---D | M] (ResultDns) -- C:\Program Files\Mozilla Firefox\extensions\{1A615EA8-4C56-49EE-BE83-F9A264B79997}
[2010-03-03 22:29:56 | 000,000,000 | ---D | M] (Burn4Free Toolbar) -- C:\PROGRAM FILES\BURN4FREE TOOLBAR\V3.3.0.3\FIREFOX
[2010-10-14 15:05:22 | 000,000,000 | ---D | M] (My Web Search) -- C:\PROGRAM FILES\MYWEBSEARCH\BAR\6.BIN
[2010-06-09 21:45:18 | 000,002,226 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
O2 - BHO: (PriceGong Class) - {4D3F3F3A-0E4B-4085-9032-7D072072319A} - Reg Error: Value error. File not found
O2 - BHO: (Adparatus) - {8B2C7C9D-716D-4e9e-9358-B9C80A81B7ED} - C:\Program Files\Adparatus\Adparatus.dll ()
O2 - BHO: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O2 - BHO: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll (Conduit Ltd.)
O2 - BHO: (Burn4Free Toolbar Helper) - {D187A56B-A33F-4CBE-9D77-459FC0BAE012} - C:\Program Files\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll ()
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O2 - BHO: (SweetIM Toolbar Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll ()
O3 - HKLM\..\Toolbar: (PageRage Toolbar) - {9565115d-c7d6-46d3-bd63-b67b481a4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {B185D9BC-D8C8-43C0-9BE3-2CF7B0830303} - No CLSID value found.
O3 - HKLM\..\Toolbar: (myBabylon English Toolbar) - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyBa.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Burn4Free Toolbar) - {4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - C:\Program Files\Burn4Free Toolbar\v3.3.0.3\Burn4Free_Toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (PageRage Toolbar) - {9565115D-C7D6-46D3-BD63-B67B481A4368} - C:\Program Files\PageRage\tbPage.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (myBabylon English Toolbar) - {B2E293EE-FD7E-4C71-A714-5F4750D8D7B7} - C:\Program Files\myBabylon_English\tbmyBa.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - Reg Error: Value error. File not found
O3 - HKCU\..\Toolbar\WebBrowser: (SweetIM Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O4 - HKLM..\Run: [1142404.exe] C:\WINDOWS\TEMP\1142404.exe ()
O4 - HKLM..\Run: [3683148.exe] C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\3683148.exe ()
O4 - HKLM..\Run: [5487540.exe] C:\WINDOWS\TEMP\5487540.exe ()
O4 - HKLM..\Run: [9711213.exe] C:\WINDOWS\TEMP\9711213.exe ()
O4 - HKLM..\Run: [AVG9_TRAY] File not found
O4 - HKLM..\Run: [conhost] C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\conhost.exe ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe ()
O4 - HKLM..\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe ()
O4 - HKLM..\Run: [sysdriver32_.exe] C:\WINDOWS\sysdriver32_.exe ()
O4 - HKLM..\Run: [systemup] C:\WINDOWS\systemup.exe ()
O4 - HKLM..\Run: [tray_ico] File not found
O4 - HKLM..\Run: [tray_ico0] C:\WINDOWS\update.tray-12-0\svchost.exe ()
O4 - HKLM..\Run: [tray_ico1] File not found
O4 - HKLM..\Run: [tray_ico2] File not found
O4 - HKLM..\Run: [tray_ico3] File not found
O4 - HKLM..\Run: [tray_ico4] File not found
O4 - HKLM..\Run: [wxpdrv] C:\WINDOWS\services32.exe ()
O4 - Startup: C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\Key.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\system32\spoolv\tlnt32.exe
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: Policies = C:\WINDOWS\system32\spoolv\tlnt32.exe
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - File not found
O31 - SafeBoot: AlternateShell - services32.exe
O32 - AutoRun File - [2008-04-14 23:50:36 | 000,059,308 | RHS- | M] () - H:\autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{df66af40-dd43-11df-9a97-0016e63ef06f}\Shell - "" = AutoRun
O33 - MountPoints2\{df66af40-dd43-11df-9a97-0016e63ef06f}\Shell\AutoRun\command - "" = C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RuNdLl32.EXE .\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx,ahaezedrn
[2010-06-09 21:45:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\myBabylon_English
[2010-06-09 21:45:22 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit
[2010-06-09 21:45:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Conduit
[2010-06-02 23:37:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Menu Start\Programy\Adparatus
[2010-06-02 23:37:45 | 000,000,000 | ---D | C] -- C:\Program Files\Adparatus
[2010-06-02 23:35:12 | 000,000,000 | ---D | C] -- C:\Program Files\SpaceQuery
[2010-06-02 23:35:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\SpaceQuery
[2010-06-02 23:34:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\GabPath
[2010-03-07 23:43:40 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Toolbar
[2007-07-20 11:16:18 | 000,007,135 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\35FE.680
[2007-07-19 23:43:49 | 005,589,370 | ---- | C] () -- C:\WINDOWS\phoenix.rar
[2007-07-19 23:43:49 | 000,182,617 | ---- | C] () -- C:\WINDOWS\ufa.rar
[2007-07-19 23:43:48 | 001,075,284 | ---- | C] () -- C:\WINDOWS\rpcminer.rar
[2007-07-19 23:30:50 | 000,110,592 | ---- | C] () -- C:\WINDOWS\l1rezerv.exe
[2007-07-19 23:30:20 | 000,114,176 | ---- | C] () -- C:\WINDOWS\systemup.exe
[2007-07-19 23:30:08 | 000,000,734 | ---- | C] () -- C:\WINDOWS\System32\drivers\etc\hîsts
[2007-07-19 23:29:56 | 000,169,472 | ---- | C] () -- C:\WINDOWS\gbot111.exe
[2007-07-19 23:29:23 | 004,636,907 | ---- | C] () -- C:\WINDOWS\geoiplist
[2007-07-19 23:29:22 | 000,246,272 | ---- | C] () -- C:\WINDOWS\unrar.exe
[2007-07-19 23:29:21 | 000,904,792 | ---- | C] () -- C:\WINDOWS\geoiplist.rar
[2007-07-19 23:28:39 | 000,000,179 | ---- | C] () -- C:\WINDOWS\info1
[2007-07-19 23:28:37 | 000,000,000 | ---- | C] () -- C:\WINDOWS\loader2.exe_ok
[2007-07-19 23:28:27 | 000,232,960 | ---- | C] () -- C:\WINDOWS\sysdriver32_.exe
[2007-07-19 23:28:13 | 000,232,960 | ---- | C] () -- C:\WINDOWS\sysdriver32.exe
[2007-07-19 23:16:03 | 001,147,392 | ---- | C] () -- C:\WINDOWS\services32.exe
[2005-09-17 07:31:08 | 010,772,646 | -H-- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\logs.dat
[2004-08-04 00:44:02 | 000,162,793 | RHS- | C] () -- C:\WINDOWS\System32\sltdwiyw.dll
@Alternate Data Stream - 109397 bytes -> C:\WINDOWS\system32:twain32.dll
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3281:TCP" =-
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"E:\Programs\facebook-pic000934519.exe" =-
"E:\Programs\Flash-Player.exe" =-
"C:\WINDOWS\update.1\svchost.exe" =-
"C:\WINDOWS\services32.exe" =-
"C:\WINDOWS\update.tray-7-0\svchost.exe" =-
"C:\WINDOWS\update.2\svchost.exe" =-
:Files
C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\Key.exe
C:\WINDOWS\update.5.0\
C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\conhost.exe
C:\WINDOWS\l1rezerv.exe
C:\WINDOWS\systemup.exe
C:\WINDOWS\update.2\
C:\WINDOWS\sysdriver32_.exe
C:\WINDOWS\sysdriver32.exe
C:\WINDOWS\update.tray-12-0\
C:\WINDOWS\update.1\
:Commands
[resethosts]
[emptytemp]
Po wykonaniu daj nowy log z OTL, tylko tym razem NIC nie zmieniaj w OTL.
?
