Live Security Platinum

[Malina]

Dzień dobry,

Proszę o pomoc w usunięciu Live Security Platinum.

SO: Windows Vista 32b.

 

Załączam wyniki z preskanu Gmera, nie udało mi się wykonać pełnego skanowania. Załączam też raport z Rootrepeala.

 

 

Results of screen317's Security Check version 0.99.43

Windows Vista Service Pack 2 x86 (UAC is enabled)

Internet Explorer 9

``````````````Antivirus/Firewall Check:``````````````

Windows Security Center service is not running! This report may not be accurate!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Java™ 6 Update 21

Java version out of Date!

Adobe Flash Player 10 Flash Player out of Date!

Adobe Flash Player 10.3.183.11 Flash Player out of Date!

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox 13.0.1 Firefox out of Date!

Google Chrome 20.0.1132.47

Google Chrome 20.0.1132.57

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: %

````````````````````End of Log``````````````````````

OTL.Txt

Extras.Txt

gmerpreskan.txt

RootRepeal report.txt

[Landuss]

RootRepeal to narzędzie już jakiś czas nie rozwijane i proszę w niego nie korzystać. Niestety oprócz Live Security Platinum jest tutaj ZeroAccess. Wykonaj log dodatkowy.

 

Uruchom SystemLook i w oknie wklej:

 

:reg
HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
 
:filefind
services.exe

 

Klik w Look. Przedstaw wynikowy skan.

[Malina]

Przepraszam za późną odpowiedź i dziękuję za instrukcje.

 

SystemLook 30.07.11 by jpshortstuff

Log created at 18:22 on 01/08/2012 by Właściciel

Administrator - Elevation successful

 

========== reg ==========

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

 

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Users\Właściciel\AppData\Local\{4a393a98-1aba-aa1d-4ffc-890076756680}\n."

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="%systemroot%\system32\wbem\wbemess.dll"

"ThreadingModel"="Both"

 

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shell32.dll"

"ThreadingModel"="Apartment"

 

 

========== filefind ==========

 

Searching for "services.exe"

C:\Windows\System32\services.exe --a---- 279552 bytes [09:39 28/04/2010] [06:27 11/04/2009] 8737764F4FD36D6808EE80578409C843

C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6001.18000_none_cf5fc067cd49010a\services.exe --a---- 279040 bytes [02:25 21/01/2008] [02:25 21/01/2008] 2B336AB6286D6C81FA02CBAB914E3C6C

C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe --a---- 279552 bytes [09:39 28/04/2010] [06:27 11/04/2009] D4E6D91C1349B7BFB3599A6ADA56851B

 

-= EOF =-

[Landuss]

1. Start > w polu szukania wpisz cmd > z prawokliku uruchom jako Administrator i wklep:

 

reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f

 

2. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
IE - HKU\S-1-5-21-2115098301-1110792441-1770362851-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\InprocServer32 File not found
IE - HKU\S-1-5-21-2115098301-1110792441-1770362851-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=110482&mntrId=4264f351000000000000001a80e1d725"
IE - HKU\S-1-5-21-2115098301-1110792441-1770362851-1000\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = "http://websearch.ask.com/redirect?client=ie&tb=VD&o=14778&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=VX&apn_dtid=&apn_uid=83650F05-D4B9-4D2D-B619-0C00C20F3ABA&apn_sauid=6A8C83A8-AD43-4A8A-98A5-8BB8C22CD67E"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaulturl: "http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=14149"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_ss&affID=110482&mntrId=4264f351000000000000001a80e1d725"
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..extensions.enabledItems: adapter@babylontc.com:1.0.0.1
FF - prefs.js..extensions.enabledItems: ffxtlbr@babylon.com:1.1.3
FF - prefs.js..extensions.enabledItems: gencrawler@some.com:2.0
[2011-04-26 19:19:36 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Właściciel\AppData\Roaming\mozilla\Firefox\Profiles\lzchn1p0.default\extensions\ffxtlbr@babylon.com
[2010-10-03 02:58:34 | 000,000,000 | ---D | M] (vShare Plugin) -- C:\Users\Właściciel\AppData\Roaming\mozilla\Firefox\Profiles\lzchn1p0.default\extensions\vshare@toolbar
[2011-03-17 23:05:24 | 000,001,583 | ---- | M] () -- C:\Users\Właściciel\AppData\Roaming\Mozilla\Firefox\Profiles\lzchn1p0.default\searchplugins\web-search.xml
[2011-04-26 19:19:57 | 000,000,000 | ---D | M] ("Babylon Spelling and Proofreading") -- C:\Program Files\Mozilla Firefox\extensions\adapter@babylontc.com
[2012-02-18 23:35:52 | 000,002,288 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll File not found
O2 - BHO: (Babylon IE plugin) - {9CFACCB6-2F3F-4177-94EA-0D2B72D384C1} - C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll File not found
O2 - BHO: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll File not found
O3 - HKLM\..\Toolbar: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O3 - HKU\S-1-5-21-2115098301-1110792441-1770362851-1000\..\Toolbar\WebBrowser: (VDownloader Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll File not found
O4 - HKLM..\Run: [babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart File not found
O4 - HKLM..\Run: [babylonToolbar] "C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.5\BabylonToolbarsrv.exe" /md I File not found
 
:Files
C:\Windows\System32\%APPDATA%
C:\Users\Właściciel\AppData\Local\Temp*.html
C:\ProgramData\036DFF61EF776338151C34082F3B6FDA
C:\Windows\Installer\{4a393a98-1aba-aa1d-4ffc-890076756680}
C:\Users\Właściciel\AppData\Local\{4a393a98-1aba-aa1d-4ffc-890076756680}
C:\Users\Właściciel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum
 
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

3. Uruchom AdwCleaner z opcji Delete

 

4. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras), z SystemLook oraz z Farbar Service Scanner (zaznacz wszystko do skanowania)

Edytowane 4 Września 2012 przez picasso
4.09.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso