Live platinum security

ZAJAZD · 1 Sierpnia 2012

Witam !

Nie uważny użytkownik k\mojego komputera wpuścił mi ten programik czytałem trochę i załączam logi z OTL.

Bardzo proszę o pomoc.

Pozdrawiam

Extras.Txt

OTL.Txt

Landuss · 1 Sierpnia 2012

Uruchom SystemLook, w oknie wklej:

:reg
HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /s
 
:filefind
services.exe

Klik w Look. Przedstaw wynikowy raport.

ZAJAZD · 1 Sierpnia 2012

Podaje raport wynikowy :

SystemLook 30.07.11 by jpshortstuff

Log created at 13:17 on 01/08/2012 by Drew-kon Spzoo

Administrator - Elevation successful

========== reg ==========

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

(No values found)

[HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32]

"ThreadingModel"="Both"

@="C:\Documents and Settings\Drew-kon Spzoo\Ustawienia lokalne\Dane aplikacji\{4737ff4a-5e86-037f-eba4-e52926e4223e}\n."

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}]

@="Microsoft WBEM New Event Subsystem"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32]

@="C:\WINDOWS\system32\wbem\wbemess.dll"

"ThreadingModel"="Both"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}]

@="MruPidlList"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

@="%SystemRoot%\system32\shdocvw.dll"

"ThreadingModel"="Apartment"

========== filefind ==========

Searching for "services.exe"

C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe --a---- 111104 bytes [11:00 04/02/2012] [09:55 09/02/2009] 245A46964D7F534E1D20563ACF215E80

C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe --a---- 111104 bytes [11:00 04/02/2012] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe --a---- 111104 bytes [11:00 04/02/2012] [11:19 09/02/2009] 8816E60BF654353E8E0D35ED98875445

C:\WINDOWS\$NtServicePackUninstall$\services.exe -----c- 111104 bytes [09:52 07/02/2012] [10:10 09/02/2009] ED4E5391100287B9EABF8F2CF4B42235

C:\WINDOWS\$NtUninstallKB956572$\services.exe -----c- 109056 bytes [10:17 07/02/2012] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\$NtUninstallKB956572_0$\services.exe -----c- 108544 bytes [02:06 05/02/2012] [12:00 29/10/2007] 3DA8D964D2CC12EF8E8C342471A37917

C:\WINDOWS\ServicePackFiles\i386\services.exe ------- 109056 bytes [17:21 14/04/2008] [17:21 14/04/2008] 3E3AE424E27C4CEFE4CAB368C7B570EA

C:\WINDOWS\system32\services.exe --a---- 111104 bytes [12:00 29/10/2007] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

C:\WINDOWS\system32\dllcache\services.exe -----c- 111104 bytes [11:00 04/02/2012] [11:25 09/02/2009] 02A467E27AF55F7064C5B251E587315F

-= EOF =-

Landuss · 2 Sierpnia 2012

1. Start > Uruchom > cmd i wklep:

reg delete HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1} /f

2. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://search.babylon.com/?babsrc=HP_Prot"
IE - HKCU\..\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57}: "URL" = "http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=PL&install_date=20120208&user_guid=735FE05FF4B245F0A864C4E37B0DFE71&machine_id=d61c019e0abf1ce64c9572c02218db99&browser=IE&os=win&os_version=5.1-x86-SP3&iesrc={referrer:source}"
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/?q={searchTerms}&affID=110819&tt=100512_1_&babsrc=SP_ss&mntrId=9898a85d000000000000001d7de7f9f5"
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentControl2 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=110819&tt=100512_1_&babsrc=KW_ss&mntrId=9898a85d000000000000001d7de7f9f5&q="
[2012-05-26 01:56:28 | 000,000,000 | ---D | M] (Yontoo) -- C:\Documents and Settings\Drew-kon Spzoo\Dane aplikacji\Mozilla\Firefox\Profiles\50i2c8z2.default\extensions\plugin@yontoo.com
[2012-01-12 02:09:00 | 000,000,935 | ---- | M] () -- C:\Documents and Settings\Drew-kon Spzoo\Dane aplikacji\Mozilla\Firefox\Profiles\50i2c8z2.default\searchplugins\conduit.xml
[2012-05-26 02:05:28 | 000,002,060 | ---- | M] () -- C:\Documents and Settings\Drew-kon Spzoo\Dane aplikacji\Mozilla\Firefox\Profiles\50i2c8z2.default\searchplugins\softonic.xml
[2012-05-26 01:56:26 | 000,002,352 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (no name) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - No CLSID value found.
O33 - MountPoints2\{bdebd5a8-523e-11e1-b574-001d7de7f9f5}\Shell\AuToPlAY\cOMmaNd - "" = mcmm.pif
O33 - MountPoints2\{bdebd5a8-523e-11e1-b574-001d7de7f9f5}\Shell\AutoRun\command - "" = mcmm.pif
O33 - MountPoints2\{bdebd5a8-523e-11e1-b574-001d7de7f9f5}\Shell\Explore\coMmaNd - "" = mcmm.pif
O33 - MountPoints2\{bdebd5a8-523e-11e1-b574-001d7de7f9f5}\Shell\oPeN\COmmanD - "" = mcmm.pif
 
:Files
C:\Documents and Settings\All Users\Dane aplikacji\036DFF98E371F822B0B6A16081CB3EF3
C:\WINDOWS\Installer\{4737ff4a-5e86-037f-eba4-e52926e4223e}
C:\Documents and Settings\Drew-kon Spzoo\Ustawienia lokalne\Dane aplikacji\{4737ff4a-5e86-037f-eba4-e52926e4223e}
 
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

3. Przez Panel sterowania odinstaluj: Babylon toolbar on IE

4. Uruchom AdwCleaner z opcji Delete

5. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras) oraz z SystemLook.

ZAJAZD · 2 Sierpnia 2012

Przesyłam logi z OTL'a i SystemLook'a po wykonaniu instrukcji :

SystemLook 30.07.11 by jpshortstuff

Log created at 13:00 on 02/08/2012 by Drew-kon Spzoo