Добре дошли!

Добре дошли в нашите форуми, пълни с полезна информация. Имате проблем с компютъра или телефона си? Публикувайте нова тема и ще намерите решение на всичките си проблеми. Общувайте свободно и открийте безброй нови приятели.

Моля, регистрирайте се за да публикувате тема и да получите пълен достъп до всички функции.

Скайп вирус

Последователи

11 юли 201016 г.

OTL.Txt Extras.Txt

Моя случай сякаш е значително по-тежък. Изглежда че вируса е подобрен до такава степен, че предотвратява използването на всякакъв антивирус - тръгнаха само Hitman и Combofix, но не успяха да се справят с него. Преди минути се опитах да създам тема в този форум, и вируса ми затвори браузъра Сега като по чудо успях. Инсталацията на всякакви антивируси, както и влизане в safe mode са невъзможни. Преди да хвана въпросния вирус, разполагах с AVG, но вируса ми го затри.

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

11 юли 201016 г.

Здравейте!Наистина при вас случая е по сериозен....в момента анализирам лога от ОТL ..моля бъдете търпелив..!

Стартирайте OTL.exe и copy/paste под колонката "Custom Scans/Fixes" въведете текст от карето:

==>> копирайте скрипта 1 към 1, както и двете точки преди първия ред на скрипта!

:OTL

PRC - [2010.07.11 16:04:02 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\system32\zsmmhfwtqfseemfzzusjg.exe

PRC - [2010.07.11 15:12:14 | 00,327,680 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Temp\xciublo.exe

O4 - HKLM..\Run: [mszmufjt] E:\WINDOWS\System32\wkzukdphzjrytwkz.exe ()

O4 - HKLM..\Run: [oangulvlbjpuno] E:\Documents and Settings\Galya Petkova\Local Settings\Temp\dsievpcvoziqmqfvr.exe ()

O4 - HKU\S-1-5-21-1060284298-1417001333-1801674531-1004..\Run: [mszmufjt] E:\Documents and Settings\Galya Petkova\Local Settings\Temp\xogextidylwgekbtrkg.exe ()

O4 - HKU\S-1-5-21-1060284298-1417001333-1801674531-1004..\Run: [rakalzgtglo] E:\WINDOWS\System32\wkzukdphzjrytwkz.exe ()

O4 - HKLM..\RunOnce: [dksgpbgrc] E:\WINDOWS\System32\wkzukdphzjrytwkz.exe ()

O4 - HKLM..\RunOnce: [nykcpfodszeia] E:\Documents and Settings\Galya Petkova\Local Settings\Temp\mctqidrlfrbkhmctqi.exe ()

O4 - HKU\S-1-5-21-1060284298-1417001333-1801674531-1004..\RunOnce: [dksgpbgrc] E:\Documents and Settings\Galya Petkova\Local Settings\Temp\kcvuolbxthtedkcvuolb.exe ()

O4 - HKU\S-1-5-21-1060284298-1417001333-1801674531-1004..\RunOnce: [oyjambjxlrvy] E:\WINDOWS\System32\mctqidrlfrbkhmctqi.exe ()

O4 - Startup: E:\Documents and Settings\Default User\Start Menu\Programs\Startup\Startup.pif ()

O4 - Startup: E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Startup.pif ()

O4 - Startup: E:\Documents and Settings\Galya Petkova\Start Menu\Programs\Startup\Startup.pif ()

O4 - Startup: E:\Documents and Settings\Administrator.AVE\Start Menu\Programs\Startup\Startup.pif ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: wencmzfrdh = kcvuolbxthtedkcvuolb.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: xciublo = E:\DOCUME~1\GALYAP~1\LOCALS~1\Temp\wkzukdphzjrytwkz.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O7 - HKU\S-1-5-21-1060284298-1417001333-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 1

O16 - DPF: {CAFEEFAC-0015-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_05-windows-i586.cab (Reg Error: Key error.)

O16 - DPF: Microsoft XML Parser for Java file://E:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O33 - MountPoints2\##Ani#C\Shell - "" = AutoRun

O33 - MountPoints2\##Ani#C\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\##Ani#C\Shell\AutoRun\command - "" = P:\e.cmd -- File not found

O33 - MountPoints2\##Ani#C\Shell\explore\Command - "" = P:\e.cmd -- File not found

O33 - MountPoints2\##Ani#C\Shell\open\Command - "" = P:\e.cmd -- File not found

O33 - MountPoints2\##Ani#D\Shell - "" = AutoRun

O33 - MountPoints2\##Ani#D\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\##Ani#D\Shell\AutoRun\command - "" = O:\e.cmd -- File not found

O33 - MountPoints2\##Ani#D\Shell\explore\Command - "" = O:\e.cmd -- File not found

O33 - MountPoints2\##Ani#D\Shell\open\Command - "" = O:\e.cmd -- File not found

O33 - MountPoints2\{1b79b3c8-f682-11dd-bed9-0050fce54973}\Shell\AutoRun\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found

O33 - MountPoints2\{1b79b3c8-f682-11dd-bed9-0050fce54973}\Shell\open\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found

O33 - MountPoints2\{578534e0-7779-11df-802f-0050fce54973}\Shell\AutoRun\command - "" = I:\rakalzgtglo.bat -- File not found

O33 - MountPoints2\{578534e0-7779-11df-802f-0050fce54973}\Shell\explore\Command - "" = E:\WINDOWS\System32\.dll -- [2007.11.05 12:02:52 | 00,036,864 | ---- | M] (Datecs Ltd)

O33 - MountPoints2\{578534e0-7779-11df-802f-0050fce54973}\Shell\open\Command - "" = I:\nykcpfodszeia.bat -- File not found

O33 - MountPoints2\{6ab96e40-e189-11de-bf97-0050fce54973}\Shell - "" = AutoRun

O33 - MountPoints2\{6ab96e40-e189-11de-bf97-0050fce54973}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{88262866-bfbf-11dd-bea5-0050fce54973}\Shell - "" = AutoRun

O33 - MountPoints2\{88262866-bfbf-11dd-bea5-0050fce54973}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{b631248a-c6b9-11dd-beb0-0050fce54973}\Shell\AutoRun\command - "" = G:\e.cmd -- File not found

O33 - MountPoints2\{b631248a-c6b9-11dd-beb0-0050fce54973}\Shell\explore\Command - "" = G:\e.cmd -- File not found

O33 - MountPoints2\{b631248a-c6b9-11dd-beb0-0050fce54973}\Shell\open\Command - "" = G:\e.cmd -- File not found

O33 - MountPoints2\{b631248b-c6b9-11dd-beb0-0050fce54973}\Shell\AutoRun\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\msnmsngr.exe -- File not found

O33 - MountPoints2\{b631248b-c6b9-11dd-beb0-0050fce54973}\Shell\open\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\msnmsngr.exe -- File not found

O33 - MountPoints2\{d1dd47ac-6719-11df-bffe-0050fce54973}\Shell - "" = AutoRun

O33 - MountPoints2\{d1dd47ac-6719-11df-bffe-0050fce54973}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\auto\command - "" = H:\Knight.exe -- File not found

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\explore\command - "" = H:\Knight.exe -- File not found

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\find\command - "" = H:\Knight.exe -- File not found

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\install\command - "" = H:\Knight.exe -- File not found

O33 - MountPoints2\{f22712c4-35ff-11dd-ab84-0050fce54973}\Shell\open\command - "" = H:\Knight.exe -- File not found

O33 - MountPoints2\{fa559a2e-61ae-11da-be66-0050fce54973}\Shell\AutoRun\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found

O33 - MountPoints2\{fa559a2e-61ae-11da-be66-0050fce54973}\Shell\open\command - "" = G:\RESTORE\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\zsmmhfwtqfseemfzzusjg.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\xogextidylwgekbtrkg.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\wkzukdphzjrytwkz.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\qkfgcbtrpftghqkfgcbtrp.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\mctqidrlfrbkhmctqi.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\kcvuolbxthtedkcvuolb.exe

[2010.07.11 16:21:42 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\dsievpcvoziqmqfvr.exe

[2010.07.11 16:21:38 | 00,002,408 | -H-- | M] () -- E:\WINDOWS\System32\resmbtevmvcicerfzogrizipvpresmbtevmvc.cer

[2010.07.11 16:21:38 | 00,002,408 | -H-- | M] () -- E:\WINDOWS\resmbtevmvcicerfzogrizipvpresmbtevmvc.cer

[2010.07.11 16:21:38 | 00,002,408 | -H-- | M] () -- E:\Program Files\resmbtevmvcicerfzogrizipvpresmbtevmvc.cer

[2010.07.11 16:21:38 | 00,002,408 | -H-- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\resmbtevmvcicerfzogrizipvpresmbtevmvc.cer

[2010.07.11 16:21:38 | 00,000,280 | -H-- | M] () -- E:\WINDOWS\zcgqvdelsrokumptdiqryfebxhz.gqv

[2010.07.11 16:21:38 | 00,000,280 | -H-- | M] () -- E:\WINDOWS\System32\zcgqvdelsrokumptdiqryfebxhz.gqv

[2010.07.11 16:21:38 | 00,000,280 | -H-- | M] () -- E:\Program Files\zcgqvdelsrokumptdiqryfebxhz.gqv

[2010.07.11 16:21:38 | 00,000,280 | -H-- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\zcgqvdelsrokumptdiqryfebxhz.gqv

[2010.07.11 16:20:56 | 00,000,316 | -H-- | M] () -- E:\WINDOWS\System32\mctqidrlfrbkhmctqidrlfrbkhmctqidrlfrbkhm.tqi

[2010.07.11 16:20:56 | 00,000,316 | -H-- | M] () -- E:\WINDOWS\mctqidrlfrbkhmctqidrlfrbkhmctqidrlfrbkhm.tqi

[2010.07.11 16:20:56 | 00,000,316 | -H-- | M] () -- E:\Program Files\mctqidrlfrbkhmctqidrlfrbkhmctqidrlfrbkhm.tqi

[2010.07.11 16:20:56 | 00,000,316 | -H-- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\mctqidrlfrbkhmctqidrlfrbkhmctqidrlfrbkhm.tqi

[2010.07.11 16:05:16 | 00,000,821 | RHS- | M] () -- E:\autorun.inf

[2010.07.11 16:04:30 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\qkfgcbtrpftghqkfgcbtrp.exe

[2010.07.11 16:04:28 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\xogextidylwgekbtrkg.exe

[2010.07.11 16:04:28 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\mctqidrlfrbkhmctqi.exe

[2010.07.11 16:04:28 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\kcvuolbxthtedkcvuolb.exe

[2010.07.11 16:04:28 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\dsievpcvoziqmqfvr.exe

[2010.07.11 16:04:26 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\wkzukdphzjrytwkz.exe

[2010.07.11 16:04:02 | 00,577,536 | RHS- | M] () -- E:\WINDOWS\System32\zsmmhfwtqfseemfzzusjg.exe

[2010.07.11 15:39:50 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Desktop\Desktop.pif

[2010.07.11 15:39:26 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\All Users\Desktop\Desktop.pif

[2010.07.11 15:16:36 | 00,577,536 | ---- | M] () -- E:\WINDOWS\System32\system32.exe

[2010.07.11 15:13:02 | 00,000,203 | -H-- | M] () -- E:\WINDOWS\xogextidylwgekbtrkgvqlyjtrxogextidylwgekb.rkg

[2010.07.11 15:13:02 | 00,000,203 | -H-- | M] () -- E:\WINDOWS\System32\xogextidylwgekbtrkgvqlyjtrxogextidylwgekb.rkg

[2010.07.11 15:13:02 | 00,000,203 | -H-- | M] () -- E:\Program Files\xogextidylwgekbtrkgvqlyjtrxogextidylwgekb.rkg

[2010.07.11 15:13:02 | 00,000,203 | -H-- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\xogextidylwgekbtrkgvqlyjtrxogextidylwgekb.rkg

[2010.07.11 14:31:02 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Application Data\Application Data.exe

[2010.07.11 14:30:32 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\Application Data.exe

[2010.07.11 14:30:24 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\All Users\Documents\Documents.exe

[2010.07.11 14:30:16 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Startup.pif

[2010.07.11 14:29:58 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\All Users\Users.exe

[2010.07.11 14:29:58 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\All Users\Application Data\Application Data.exe

[2010.07.11 13:07:00 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Start Menu\Programs\Startup\Startup.pif

[2010.07.10 13:11:50 | 00,577,536 | ---- | M] () -- E:\WINDOWS\tasks\Tasks.scr

[2010.07.10 13:09:30 | 00,577,536 | ---- | M] () -- E:\WINDOWS\System\system.bat

[2010.07.10 13:08:06 | 00,577,536 | ---- | M] () -- E:\WINDOWS\System32\dllcache\dllcache.exe

[2010.07.10 13:07:36 | 00,577,536 | ---- | M] () -- E:\WINDOWS\System32\drivers\drivers.exe

[2010.07.10 13:07:02 | 00,577,536 | ---- | M] () -- E:\WINDOWS\WINDOWS.pif

[2010.07.10 13:06:34 | 00,577,536 | ---- | M] () -- E:\E.bat

[2010.07.09 22:15:38 | 00,577,536 | ---- | M] () -- E:\Program Files\Files.exe

[2010.07.09 22:15:38 | 00,577,536 | ---- | M] () -- E:\Program Files\Common Files\Files.exe

[2010.07.09 22:05:42 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\My Documents\Documents.exe

[2010.07.09 22:04:02 | 00,577,536 | ---- | M] () -- E:\Documents and Settings\Galya Petkova\Petkova.bat

[2010.07.09 15:39:38 | 00,004,248 | -H-- | M] () -- E:\WINDOWS\wkzukdphzjrytwkzukdphzjrytwkzukdphzjry.wkz

[2010.07.09 15:39:38 | 00,004,248 | -H-- | M] () -- E:\WINDOWS\System32\wkzukdphzjrytwkzukdphzjrytwkzukdphzjry.wkz

[2010.07.09 15:39:38 | 00,004,248 | -H-- | M] () -- E:\Program Files\wkzukdphzjrytwkzukdphzjrytwkzukdphzjry.wkz

[2010.07.09 15:39:38 | 00,004,248 | -H-- | M] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\wkzukdphzjrytwkzukdphzjrytwkzukdphzjry.wkz

[2010.07.11 16:05:15 | 00,000,821 | RHS- | C] () -- E:\autorun.inf

[2010.07.11 15:39:49 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\Galya Petkova\Desktop\Desktop.pif

[2010.07.11 15:39:25 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\All Users\Desktop\Desktop.pif

[2010.07.11 15:16:43 | 00,577,536 | ---- | C] () -- E:\WINDOWS\Fonts\Fonts.exe

[2010.07.11 15:16:34 | 00,577,536 | ---- | C] () -- E:\WINDOWS\System32\system32.exe

[2010.07.11 14:31:00 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\Galya Petkova\Application Data\Application Data.exe

[2010.07.11 14:30:30 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\Galya Petkova\Local Settings\Application Data\Application Data.exe

[2010.07.11 14:30:23 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\All Users\Documents\Documents.exe

[2010.07.11 14:30:15 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\All Users\Start Menu\Programs\Startup\Startup.pif

[2010.07.11 14:29:56 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\All Users\Users.exe

[2010.07.11 14:29:56 | 00,577,536 | ---- | C] () -- E:\Documents and Settings\All Users\Application Data\Application Data.exe

:files

E:\WINDOWS\system32\zsmmhfwtqfseemfzzusjg.exe

E:\Documents and Settings\Galya Petkova\Local Settings\Temp\xciublo.exe

E:\FOUND.009

E:\FOUND.008

E:\FOUND.007

E:\Documents and Settings\Galya Petkova\Desktop\*.tmp

E:\Recycled

:Commands

[emptytemp]

[emptyflash]

[purity]

[resethosts]

[reboot]

След като въведете скрипта от цитата по-горе натиснете бутона, маркиран в червено:

Ще се създаде лог файл. Копирайте и поставете съдържанието на този файл в следващия си коментар.

Освен това ще ви помоля да архивирате папката C:\_OTL и да я качите на http://www.zippyshare.com/ и публикувайте линка тук..!

11 юли 201016 г.

Автор

Въпросната папка се намира в E:/ понеже Win-a е инсталиран там. Преименувах 07112010_183030.log на 07112010_183030.txt защото във форума не е разешен log формат.

Log Файла:

07112010_183030.txt

icotonev

HJT Team

Пол:Мъж
Град:гр.Ямбол
Интереси:Malware Removal, Security Analyst, Malware Hunters,Trusted Helper

11 юли 201016 г.

Благодаря!Продължаваме...:

Изтеглете Malwarebytes' Anti-Malware от тук

Кликнете два пъти върху mbam-setup.exe за да инсталирате програмата.

* Уверете се, че има отметки на Update Malwarebytes' Anti-Malware и Launch Malwarebytes' Anti-Malware, след това кликнете на Finish.
* Ако има намерени по-нови обновления, тя ще ги изтегли и инсталира.
* Стартирайте програмата и изберете "Perform Full Scan", след това кликнете на Scan.
* Сканирането ще отнеме малко време, затова моля бъдете търпеливи.
* Когато сканирането завърши, кликнете на OK, след това Show Results, за да видите резултата.
* Уверете се, че на всички редове има отметки, и кликнете Remove Selected.
* Когато всичко бъде премахнато, логът ще бъде отворен в Notepad. Копирайте лога и го публикувайте в следващия си коментар в темата.

Бележка: Ако MalwareBytes' Anti-Malware се затрудни в премахването на откритите вируси/заплахи, той ще поиска да рестартира компютъра Ви и по време на рестартирането да премахне проблемните вируси/заплахи. Ако бъдете попитани, потвърдете че желаете вашия компютър да бъде рестартиран.

Изтеглете: ESET Online Scanner
Стартирайте esetsmartinstaller_enu.exe
Сложете отметка на YES, I accept the Terms of Use и изберете Start
Скенерът ще започне да изтегля компонентите, които са му необходими.
Уверете се, че има отметки на следните редове, включително и тези от менюто Advanced Settings:

Remove found threats
Scan archives
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth technology

Накрая изберете Start
Скенерът ще започне да изтегля последните дефиниции.
След, като сканирането завърши, изберете Finish.
Отидете в папката: C:\Program Files\ESET\ESET Online Scanner и отворете файла log.txt. Копирайте съдържанието му и го поставете в следващия си коментар.