kowcyk

Również i mnie dopadło to dziadostwo (czy jakoś w ostatnich dniach zaczęło ono jeszcze bardziej złośliwe być??) Niby mogę korzystać z internetu ale cały czas mi świeci kamerka, niedawno laptop zaczął do mnie mówić w jakimś dziwnym języku, oczywiście po próbie uruchomienia menedżera procesów każdorazowo jest on automatycznie zamykany ... Wklejam logi z OTL'a i liczę na pomoc.. OTL.Txt Extras.Txt

wykrył mi Kaspersky znowu tego 2012-09-08 19:33:29 Detected: Email-Worm.Win32.Brontok.q C:\Marcin\Gry\CS\CS.exe

Okej, zrobione - teraz w procesach nie mam już w ogóle lsass, services i winlogon... Załączam logi i czekam na dalsze wskazówki. 09082012_173224.txt OTL.Txt

robić to już nie z poziomu trybu awaryjnego? Czy koniecznym jednak jest uruchomienie tego trybu?

ehh, przez przypadek kliknąłem w jakiś folder w który nie powinienem chyba kliknąć, bo pokazywało mi że usunęło to: All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Bron-Spizaetus deleted successfully. C:\Windows\ShellNew\RakyatKelaparan.exe moved successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Tok-Cirrhatus deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Tok-Cirrhatus-2520 deleted successfully. C:\Users\Marcin\AppData\Local\br6063on.exe moved successfully. C:\Users\Marcin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif moved successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoFolderOptions deleted successfully. Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools deleted successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:"C:\Windows\KesenjanganSosial.exe" deleted successfully. C:\Windows\KesenjanganSosial.exe moved successfully. ========== FILES ========== C:\windows\SysWow64\cmd-brontok.exe moved successfully. C:\Users\Marcin\AppData\Local\csrss.exe moved successfully. C:\Users\Marcin\AppData\Local\inetinfo.exe moved successfully. C:\Users\Marcin\AppData\Local\lsass.exe moved successfully. C:\Users\Marcin\AppData\Local\services.exe moved successfully. C:\Users\Marcin\AppData\Local\smss.exe moved successfully. C:\Users\Marcin\AppData\Local\svchost.exe moved successfully. C:\Users\Marcin\AppData\Local\winlogon.exe moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-1 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-11 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-13 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-14 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-15 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-17 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-18 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-19 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-2 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-20 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-21 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-24 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-25 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-27 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-28 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-29 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-3 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-30 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-4 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-5 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-6 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-7 folder moved successfully. C:\Users\Marcin\AppData\Local\Bron.tok-17-8 folder moved successfully. C:\Users\Marcin\AppData\Local\JunkAtx.bin moved successfully. C:\Users\Marcin\Documents\Documents.exe moved successfully. C:\Users\Marcin\AppData\Roaming\mozilla\firefox\profiles\pms3dzvo.default\searchplugins\startsear.xml moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 56468 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Marcin ->Temp folder emptied: 728434633 bytes ->Temporary Internet Files folder emptied: 53312631 bytes ->Java cache emptied: 49698719 bytes ->FireFox cache emptied: 77488142 bytes ->Google Chrome cache emptied: 421981358 bytes ->Flash cache emptied: 73472 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 113610617 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 68099 bytes RecycleBin emptied: 11884266 bytes Total Files Cleaned = 1 389,00 mb OTL by OldTimer - Version 3.2.61.2 log created on 09082012_162922 Files\Folders moved on Reboot... C:\Users\Marcin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot... a potem zrobiłem od nowa w OTL skanowanie i... Na dodatek zdublowało mi się lsass.exe, services.exe i winlogon.exe... Extras.Txt OTL.Txt AdwCleanerS1.txt

Wczoraj w godzinach popołudniowych (sam do końca nie wiem, co ja wtedy takiego musiałem ściągnąć) utworzył mi się w folderze ze zdjęciami plik about.Brontok.A , co jakiś czas uruchamia mi się sam, czytałem już tutaj że jest to jakiś złośliwy robak, chciałbym prosić o pomoc w jego usunięciu, załączam logi z OTL'a. Edit: Dodałem Extras i biorę się do roboty. OTL.Txt Extras.Txt