Weelsof policja PC1

[wilczur]

Witam, 2 laptopy zostały zainfekowane weelsofem. Rozdzielam je na 2 osobne tematy na forum.

 

Na pierwszym usunąłem plik exe wirusa za pomocą bootowalnego linuxa, jednak nie startuje w nim powłoka explorera, nie widać pulpitu ani menu start. Moge wywołać explorera tylko z poziomu managera zadań lecz nie startuje powłoka tylko samo okno exlorera (tak jak po wejściu w moj komputer)

 

Załączony skan OTL

 

 

Edit, explorerem juz sobie poradziłem tak więc można zamknąć temat

Extras.Txt

OTL.Txt

[picasso]

Edit, explorerem juz sobie poradziłem tak więc można zamknąć temat

 

Z tym "zamknięciem" to się nie śpiesz. Po pierwsze: wpisy explorer.exe to nie wszystko co od infekcji "policyjnej" oraz działa tu trojan ZeroAccess. Po drugie: burdel w przeglądarkach, adware jeszcze trzeba usunąć. Ilość zastraszająca.

 

1. Start > w polu szukania wpisz regedit > z prawokliku skasuj klucz:

 

HKEY_CURRENT_USER\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}

 

Zresetuj system, by odładować ZeroAccess z pamięci.

 

2. Przez Panel sterowania odinstaluj adware 50 FREE MP3s +1 Free Audiobook!, 1ClickDownloader, ADDICT-THING, Ask Toolbar, AVG Security Toolbar, Babylon toolbar on IE, Browse2save, BrowserCompanion, Dealio Toolbar v6.6, DirectDownloader, FoxTab FLV Player, FoxTab PDF Creator, FTDownloader, Funmoods, iLivid, Incredibar Toolbar on IE and Chrome, Optimizer Pro v3.0, Softonic toolbar on IE, Softonic Toolbar Updater, Search Assistant MocaFlix 1.66, StartNow Toolbar, SweetIM for Messenger 3.6, SweetPacks Toolbar for Internet Explorer 4.5, TheBflix, Update Manager for SweetPacks 1.0, uTorrentBar Toolbar, VideoDownloadConverter Toolbar, Web Assistant 2.0.0.485, Web Optimizer, Yontoo 1.10.02, YourFileDownloader. Usuń też wątpliwy Dll-Files Fixer, Uniblue SpeedUpMyPC.

 

3. Wyczyść Firefox: menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox.

 

4. Uruchom OTL i w sekcji Własne opcje skanowania / skrypt wklej:

 

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://searchfunmoods.com/?f=1&a=nv1&ir=nv1&cd=2XzuyEtN2Y1L1QzuyB0AyBzytDyD0AyB0A0CtA0ByC0DzytCtN0D0Tzu0CtAyDtDtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1602198999"
IE:64bit: - HKLM\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = "http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=nv1&ir=nv1&cd=2XzuyEtN2Y1L1QzuyB0AyBzytDyD0AyB0A0CtA0ByC0DzytCtN0D0Tzu0CtAyDtDtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1602198999"
IE - HKLM\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = "http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=nv1&ir=nv1&cd=2XzuyEtN2Y1L1QzuyB0AyBzytDyD0AyB0A0CtA0ByC0DzytCtN0D0Tzu0CtAyDtDtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1602198999"
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = "http://websearch.just-browse.info/?l=1&q={searchTerms}"
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=18&q={searchTerms}&barid={79EC76CF-9C4B-11E1-BEEA-402CF42469D5}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://isearch.babylon.com/?q={searchTerms}&affID=116632&tl=gkn487600&babsrc=SP_ss&mntrId=423e6d91000000000000402cf438c15f"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{70BA3E6B-1059-2266-0B2C-40E4A85231B8}: "URL" = "http://www.ddlstart.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=750&product_id=872&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.5.0&install_country=PL&install_date=20120717&user_guid=0401A7C1820A4BE99D280AB08C5398D8&machine_id=03a6ee44e44a58366ccbb0fa14035f7f&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{7F15C74E-7E71-4260-A7E3-1D706938A14D}: "URL" = "http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=616163&p={searchTerms}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = "https://isearch.avg.com/search?cid={BE67BAE6-A6C2-4607-B5C6-3BF79C07BFCC}&mid=9f9b05cfa4f1462d88ed791614ad6076-ebd58b056c5d18503b3a7d24240404407a839c21&lang=pl&ds=xn011&pr=sa&d=2012-09-08 07:21:20&v=12.2.0.5&sap=dsp&q={searchTerms}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = "http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=nv1&ir=nv1&cd=2XzuyEtN2Y1L1QzuyB0AyBzytDyD0AyB0A0CtA0ByC0DzytCtN0D0Tzu0CtAyDtDtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1602198999"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = "http://websearch.just-browse.info/?l=1&q={searchTerms}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = "http://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6OyFr0tyjS&i=26"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{DB6BBC42-ECEC-4584-9A49-31C0EF8CA31E}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{ED1DF8B7-62A3-4C27-A69A-CB5525CF83C6}: "URL" = "http://search.aol.pl/aol/search?s_it=tb50winamp&q={searchTerms}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&st=2&q={searchTerms}&barid={79EC76CF-9C4B-11E1-BEEA-402CF42469D5}"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\SearchScopes\{F67E0F87-69E2-48A6-81AE-C668394A1CBA}: "URL" = "http://search.softonic.com/MON00006/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=504"
IE - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\URLSearchHook: {93a3111f-4f74-4ed8-895e-d9708497629e} - No CLSID value found
O3 - HKU\S-1-5-21-1184120399-3153701421-1720054441-1001\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O8:64bit: - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found
O8:64bit: - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files (x86)\Media Finder\hook.html File not found
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\MenuExt.html ()
FF - HKLM\Software\MozillaPlugins\@VideoDownloadConverter_4z.com/Plugin: C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin\NP4zStub.dll (MindSpark)
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012-09-14 07:54:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012-09-14 07:54:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\4zffxtbr@VideoDownloadConverter_4z.com: C:\Program Files (x86)\VideoDownloadConverter_4z\bar\1.bin [2012-09-29 20:41:04 | 000,000,000 | ---D | M]
 
:Files
C:\Users\patryk\AppData\Local\{edb94f7a-576a-bf97-4b65-39fc03b448f3}
C:\ProgramData\lsass.exe
C:\ProgramData\dsgsdgdsgdsgw.pad
C:\ProgramData\dsgsdgdsgdsgw.js
C:\ProgramData\dsgsdgdsgdsgw.reg
C:\ProgramData\dsgsdgdsgdsgw.bat
C:\Windows\tasks\DLL-Files.Com Fixer_Updates.job
C:\Windows\tasks\DLL-Files.Com Fixer_MONTHLY.job
C:\Windows\tasks\SpeedUpMyPC.job
C:\Users\patryk\AppData\Roaming\Media Finder
C:\Users\patryk\AppData\Roaming\SendSpace
C:\Users\patryk\AppData\Local\funmoods-speeddial_sf.crx
C:\Users\patryk\AppData\Local\funmoods.crx
C:\Program Files (x86)\Mozilla Firefox\extensions\{5ddeb737-082c-48fb-8c06-aa4b38d61e5f}
C:\Program Files (x86)\Mozilla Firefox\extensions\ffxtlbr@babylon.com
C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
C:\user.js
rd /s /q C:\found.000 /C
rd /s /q "C:\Kaspersky Rescue Disk 10.0" /C
netsh advfirewall reset /C
 
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"=-
"Start Page"="about:blank"
"Start Page Restore"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Main]
"Default_Page_URL"=-
"Start Page"="about:blank"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Klik w Wykonaj skrypt. Zatwierdź restart systemu.

 

5. Uruchom AdwCleaner i zastosuj Usuń. Na dysku C powstanie log z usuwania.

 

6. Zrób nowy log OTL z opcji Skanuj (już bez Extras) oraz Farbar Service Scanner. Dołącz log utworzony przez AdwCleaner.

 

 

 

.

Edytowane 18 Lutego 2013 przez picasso
18.02.2013 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso