Win64/Sathurbot - problemy z usunięciem

[qulet]

wirus to win64/sathurtbot NOD32 nie daje rady....

Addition.txt

Extras.Txt

FRST.txt

OTL.Txt

win8.1.txt

[picasso]

Na temat używanych narzędzi:

- ComboFix - do czytania dlaczego nie jest to narzędzie domowego użytku: KLIK

- SpyHunter to program wątpliwej reputacji, który stosuje naciski reklamodawcze, by go zainstalować, a okazuje się że należy uiszczać opłaty. Z daleka od niego.

 

 

Sathurbot jest ładowany metodą ShellIconOverlayIdentifiers (wszczepienie do explorer.exe), antywirusy zwykle mają problem z usunięciem. Dodatkowo w systemie są ślady innych infekcji, w tym adware. Akcja:

 

1. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
ShellIconOverlayIdentifiers: [1SecureIconsProvider] -> {FC9D8189-520A-4417-AED7-9EAC810C6FBA} => C:\ProgramData\Microsoft\Secure\Icons\SecureIconsProvider.dll ()
HKU\S-1-5-21-1945458797-3222738139-3082091542-1001\...\Run: [ubrmedia] => regsvr32.exe C:\Users\Marek\AppData\Local\Ubrmedia\uspDevNetM24.dll 
HKU\S-1-5-21-1945458797-3222738139-3082091542-1001\...\Command Processor: "C:\Users\Marek\AppData\Roaming\Microsoft\Windows\IEUpdate\FlashPlayerApp.exe" 
Task: {044EABD2-1F9E-4488-89EA-8C1AB6D2FB50} - System32\Tasks\temp_384d0f0d-cb30-4fd7-8aaf-247ba66c370f-2 => C:\Users\Marek\AppData\Local\Temp\nss1616.tmp\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-2.exe 
Task: {07E56D64-AA9C-4D59-B5DA-90D40A7A0D1C} - System32\Tasks\temp_3e42890a-afa6-437f-a0a6-92b4499535bd-2 => C:\Users\Marek\AppData\Local\Temp\nsj28E5.tmp\3e42890a-afa6-437f-a0a6-92b4499535bd-2.exe 
Task: {0F068341-F9C2-4142-B668-6857BE072966} - System32\Tasks\temp_5860a4a6-3bf8-4ecd-b747-a98b890310a7-7 => C:\Program Files (x86)\Torntv V9.0\Torntv V9.0-nova.exe 
Task: {189B8409-28DB-4AFE-9EC1-41E36B7D8611} - System32\Tasks\3e42890a-afa6-437f-a0a6-92b4499535bd-11 => C:\Program Files (x86)\Total-1.8\3e42890a-afa6-437f-a0a6-92b4499535bd-11.exe
Task: {2D60F39D-83E8-4A88-9FAC-56409DF7178B} - System32\Tasks\5860a4a6-3bf8-4ecd-b747-a98b890310a7-4 => C:\Program Files (x86)\Torntv V9.0\5860a4a6-3bf8-4ecd-b747-a98b890310a7-4.exe 
Task: {2EB746E1-2258-40DE-9667-AD434640397A} - System32\Tasks\temp_d0605fba-a5ed-40e9-a885-aa967c0f117d-6 => C:\Program Files (x86)\TheTorntv V10\d0605fba-a5ed-40e9-a885-aa967c0f117d-6.exe 
Task: {489C609E-59FF-4F5C-A312-8C11E17B6B09} - System32\Tasks\MJ => C:\Users\Marek\AppData\Roaming\MJ.exe 
Task: {54EE5254-6C39-4C7F-9D74-A6967A8F0E82} - System32\Tasks\temp_5860a4a6-3bf8-4ecd-b747-a98b890310a7-2 => C:\Users\Marek\AppData\Local\Temp\nsn9A91.tmp\5860a4a6-3bf8-4ecd-b747-a98b890310a7-2.exe 
Task: {759B5800-DAAA-4298-BDCA-1D52E7C044C2} - System32\Tasks\GPUP => C:\Program Files (x86)\GetPrivate\gpup.exe
Task: {79C5ECA1-00AD-4509-B98F-6655EBB9F628} - System32\Tasks\LVOSUX => C:\Users\Marek\AppData\Roaming\LVOSUX.exe 
Task: {7D1A5466-1002-4E88-A035-B080FF14AB3E} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe 
Task: {7D424699-BFC1-4B63-B840-EC791ED91094} - System32\Tasks\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-11 => C:\Program Files (x86)\Total-1.8\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-11.exe
Task: {8EFCF1CA-C5D6-4717-87EB-3D9CA9E1641D} - System32\Tasks\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-6 => C:\Program Files (x86)\Total-1.8\Total-1.8-novainstaller.exe
Task: {9018D495-73F4-4CB1-9434-FE9068C1DDC2} - \temp_Torntv V6.0-enabler No Task File 
Task: {9B401F3A-79E8-4F23-BE95-EF2E9EFEE271} - System32\Tasks\temp_3e42890a-afa6-437f-a0a6-92b4499535bd-6 => C:\Program Files (x86)\Total-1.8\3e42890a-afa6-437f-a0a6-92b4499535bd-6.exe
Task: {A4F3D85A-4FED-4C37-B15D-E9905030EA96} - System32\Tasks\5860a4a6-3bf8-4ecd-b747-a98b890310a7-6 => C:\Program Files (x86)\Torntv V9.0\Torntv V9.0-novainstaller.exe 
Task: {B0EEBE0D-30A2-4137-98DC-90FD99163E7C} - System32\Tasks\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-1 => C:\Program Files (x86)\Total-1.8\Total-1.8-codedownloader.exe
Task: {BCCB6299-2F63-4ADA-A65E-76DC6978B77F} - System32\Tasks\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-3 => C:\Program Files (x86)\Total-1.8\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-3.exe
Task: {BD2C8204-6940-454D-B928-5539E19D3632} - \Torntv V6.0-firefoxinstaller No Task File 
Task: {C4B61EE0-D178-4F8F-AECF-752F388CFE1A} - System32\Tasks\d0605fba-a5ed-40e9-a885-aa967c0f117d-7 => C:\Program Files (x86)\TheTorntv V10\d0605fba-a5ed-40e9-a885-aa967c0f117d-7.exe 
Task: {C5487414-7E8D-47DE-9E04-114A97A83C04} - System32\Tasks\temp_384d0f0d-cb30-4fd7-8aaf-247ba66c370f-7 => C:\Program Files (x86)\Total-1.8\Total-1.8-nova.exe
Task: {D80A644C-6CCC-447B-842C-BDCD19D8C962} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe
Task: {DE05B422-7EB1-4B1D-9863-3D4C83F43DED} - System32\Tasks\ZJ => C:\Users\Marek\AppData\Roaming\ZJ.exe 
Task: {DEBAAA6F-BE4B-4BD7-BB3A-B0742FBCDE18} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe
Task: {E02906DB-FADA-4180-AE0C-AEDE24C5FC7B} - \Torntv V6.0-updater No Task File 
Task: {E916A8F7-F3D1-473F-A2A5-0AED5AB57E74} - \Torntv V6.0-enabler No Task File 
Task: {F3D3394E-537D-4BC5-B60D-A19C1A82208A} - System32\Tasks\384d0f0d-cb30-4fd7-8aaf-247ba66c370f-7 => C:\Program Files (x86)\Total-1.8\Total-1.8-nova.exe
Task: {F9DECE2A-EBD4-4F04-A793-60F349F69AF6} - System32\Tasks\BDKKXJM => C:\Users\Marek\AppData\Roaming\BDKKXJM.exe 
Task: C:\WINDOWS\Tasks\BDKKXJM.job => C:\Users\Marek\AppData\Roaming\BDKKXJM.exe 
Task: C:\WINDOWS\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe 
Task: C:\WINDOWS\Tasks\LVOSUX.job => C:\Users\Marek\AppData\Roaming\LVOSUX.exe 
Task: C:\WINDOWS\Tasks\MJ.job => C:\Users\Marek\AppData\Roaming\MJ.exe 
Task: C:\WINDOWS\Tasks\ZJ.job => C:\Users\Marek\AppData\Roaming\ZJ.exe 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=166
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKU\S-1-5-21-1945458797-3222738139-3082091542-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1414270443&from=cor&uid=WDCXWD2500BEVT-35ZCT0_WD-WXE908CJ8860J8860"
C:\Program Files\GridinSoft Trojan Killer
C:\Program Files (x86)\GetPrivate
C:\Program Files (x86)\Mozilla Firefox
C:\Program Files (x86)\Temp
C:\Program Files (x86)\Torntv V9.0
C:\Program Files (x86)\Total-1.8
C:\Program Files (x86)\VLC Player GPU+
C:\ProgramData\GridinSoft
C:\ProgramData\MFAData
C:\ProgramData\Microsoft\Secure
C:\ProgramData\NCOTEMP
C:\ProgramData\Norton
C:\ProgramData\TEMP
C:\Users\Marek\AppData\Local\Avg2015
C:\Users\Marek\AppData\Local\ESET
C:\Users\Marek\AppData\Local\MFAData
C:\Users\Marek\AppData\Local\Mozilla
C:\Users\Marek\AppData\Local\NPE
C:\Users\Marek\AppData\Local\Ubrmedia
C:\Users\Marek\AppData\Roaming\*.exe
C:\Users\Marek\AppData\Roaming\Microsoft\Windows\IEUpdate
C:\Users\Marek\AppData\Roaming\Mozilla
C:\WINDOWS\System32\Tasks\Norton Identity Safe
C:\sh4_service.log
C:\spyhunter.log
C:\shldr.mbr
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKCU\Software\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
CMD: type C:\ComboFix.txt
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. Zrób nowy log FRST z opcji Scan, zaznacz pola Addition i Shortcut, by powstały trzy logi. Dołącz też plik fixlog.txt.

 

 

 

 

.