Agent.Teo trojan

ej prijatelji vidim uspjeli ste rijesiti problem kod tomedaja...moze li sad neko meni pomoci?

uspio sam zakaciti virus win32\sirefey.DA trojan i to mi pokazuje mi da je inficiran sljedeci fajl c:/windows/system32/drivers/csc.sys ....pokusao sam sa onim malware programima i uspio sam ga navodno obrisati iz karantene sto prije nije moglo ...koristim nod 32 antivirus i sad je bas kao sto je bilo kod tomedaja  ne moze se ukljuciti ona web opcija stalno je iskljucena...nadam se da sam objasnio kako treba posto se bas i ne razumijem u informaticke probleme....unaprijed hvala

evo posalo sam pp pa vidjecemo sta ce on reci... hvala

evo ih

http://speedy.sh/347XQ/RKreport.txt

http://speedy.sh/D9hcy/OTS.Txt

otvori OTS i ovo kopiraj u prazno polje

[Kill All Processes]

[Unregister Dlls]

[Win32 Services - Safe List]

YN -> (HitmanPro36CrusaderBoot) HitmanPro 3.6 Crusader (Boot) [Auto | Stopped] -> 

[Registry - Safe List]

< Internet Explorer Settings [HKEY_LOCAL_MACHINE\] > -> 

YN -> HKEY_LOCAL_MACHINE\: Search\\"SearchAssistant" -> http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=7e6b0d230000000000001c659dc2fdc4&tlver=1.4.19.19&ss=1&affID=17981

< Internet Explorer Settings [HKEY_CURRENT_USER\] > -> 

YN -> HKEY_CURRENT_USER\: Main\\"Start Page" -> http://search.babylon.com/?AF=100479&babsrc=HP_ss&mntrId=7e6b0d230000000000001c659dc2fdc4

YN -> HKEY_CURRENT_USER\: Main\\"Start Page Redirect Cache_TIMESTAMP" -> 9D 10 D4 B4 36 DE CB 01  [binary data]

< FireFox Settings [Prefs.js] > -> C:\Users\PC\AppData\Roaming\Mozilla\FireFox\Profiles\el7zylip.default\prefs.js

YN -> extensions.enabledItems -> engine@conduit.com:3.3.3.2

YN -> extensions.enabledItems -> ffxtlbr@babylon.com:1.1.3

< FireFox SearchPlugins [User Folders] > -> 

YY ->  conduit.xml -> C:\Users\PC\AppData\Roaming\Mozilla\FireFox\Profiles\el7zylip.default\searchplugins\conduit.xml

< HOSTS File > ([2012.07.21 13:58:30 | 000,000,808 | ---- | M] - 22 lines) -> C:\Windows\System32\drivers\etc\hosts

YN -> Reset Hosts -> 

< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

YY -> {D4027C7F-154A-4066-A1AD-4243D8127440} [HKLM] -> C:\Program Files\Ask.com\GenericAskToolbar.dll [Ask Toolbar]

< Internet Explorer ToolBars [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\

YN -> WebBrowser\\"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]

YY -> WebBrowser\\"{D4027C7F-154A-4066-A1AD-4243D8127440}" [HKLM] -> C:\Program Files\Ask.com\GenericAskToolbar.dll [Ask Toolbar]

< Internet Explorer Menu Extensions [HKEY_CURRENT_USER\] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\

YN -> Free YouTube to MP3 Converter -> [C:\Users\PC\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm]

< SSODL [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad

YN -> "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" [HKLM] -> Reg Error: Key error. [WebCheck]

[Registry - Additional Scans - Safe List]

< SafeBoot-Minimal Settings > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\

YN -> SirefefRemover -> Reg Error: Value error.

[Files/Folders - Created Within 30 Days]

NY ->  9 C:\Users\PC\Desktop\*.tmp files -> C:\Users\PC\Desktop\*.tmp

NY ->  3 C:\Windows\*.tmp files -> C:\Windows\*.tmp

NY ->  16 C:\Users\PC\Documents\*.tmp files -> C:\Users\PC\Documents\*.tmp

[Files/Folders - Modified Within 30 Days]

NY ->  9 C:\Users\PC\Desktop\*.tmp files -> C:\Users\PC\Desktop\*.tmp

NY ->  3 C:\Windows\*.tmp files -> C:\Windows\*.tmp

NY ->  16 C:\Users\PC\Documents\*.tmp files -> C:\Users\PC\Documents\*.tmp

[Custom Scans]

YY ->  Babylon -> C:\ProgramData\Application Data\Babylon

YY ->  Trymedia -> C:\ProgramData\Application Data\Trymedia

NY ->  splashscreen.dll -> C:\ProgramData\Application Data\Application Data\Application Data\Adobe\CS5\jre\bin\splashscreen.dll

NY ->  ssv.dll -> C:\ProgramData\Application Data\Application Data\Application Data\Adobe\CS5\jre\bin\ssv.dll

NY ->  sunmscapi.dll -> C:\ProgramData\Application Data\Application Data\Application Data\Adobe\CS5\jre\bin\sunmscapi.dll

[Alternate Data Streams]

NY -> @Alternate Data Stream - 114 bytes -> C:\ProgramData\Application Data\Temp:F6C0CA66

NY -> @Alternate Data Stream - 114 bytes -> C:\ProgramData\Temp:F6C0CA66

[Purity]

[Empty Temp Folders]

[EmptyFlash]

[EmptyJava]

[Reboot]

skini tdsskiller i spremi na desktop

-pokreni program i ak zatraži restart dozvoli

-log se obično nalazi u C:/ i izhleda otprilike ovako

C:\TDSSKiller.2.4.7_23.07.2010_15.31.43_log.txt

skini farbar service scaner i spremi na desktop

-sve označi i klik na scan

-log kopiraj

aswMBR ne pokazuje znakove infekcije (osim jednog locked , anjega ćemo provjeriti s tdsskillerom)

http://speedy.sh/NV9x3/mpssvc.rar

skini ovaj file i raspakiraj ga na desktop

desni klik mišem na mpssvc.reg i klik na merge

-restart

ponovo pokreni FSS i log kopiraj

skini sharedaccess.reg i raspakiraj na desktop

-desni klik mišem na .reg i klik na merge

-restrat

nakon restarta skini windows repair tool ,

-pokreni program , klik na startup repairs

-ovo označi 

Reset registry permissions

Repair WMI

Repair Windows Firewall.

Remove Policies Set By Infections

Repair Winsock & DNS Cache

Repair hosts

označi restart system when finished

klik na start

nakon ovog javi kako je

pokreni onda onaj repair

nakon repaira još ćemo nešto provjeriti

skini system look i spremi na desktop

otvori program i ovo kopiraj u prazno polje

:filefind

csc.sys

klik na look

log kopiraj

isto tako ćeš uraditi novi FSS

možeš izbrisati sve alate koje smo koristili

otvori OTS i klik na Clean Up

nakon toga

1.sini OTL i spremi na desktop

-otvori program i ovo kopiraj u prazno polje

:files

C:\Windows\System32\drivers\csc.sys|C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7600.16385_none_9e1e9f0abd3adf87\csc.sys /replace

rd /s /q C:\$Recycle.bin

echo y|chkdsk c: /f /c

:Commands

[purity]

[resethosts]

[emptytemp]

[CREATERESTOREPOINT]

[Reboot]

klik na RUN FIX

-log koji dobiješ kopiraj

nakn ovog koraka bi trealo biti sve ok

javi kako sad računalo radi

dakle, sad je samo problem u velikoj potrošnji RAM-a ?

o kojem se procesu radi ?

otvori OTL i klik na quick scan, ne trebaš ništa dodatno kopirati...

kad OTL završi izbacit će dva loga OTL.txt i Extras.txt

kopiraj te logove, vidit ćemo možda extras.txt ukaže na problem

izbriši 

Hitman Pro 3.5

SpyHunter

hitman pro ti radi sigrno probleme

Error - 23.7.2012 13:11:02 | Computer Name = PC-PC | Source = Service Control Manager | ID = 7000

Description = The HitmanPro 3.6 Crusader (Boot) service failed to start due to the

 following error:   %%2

ubrzo se javim s OTL skriptom

pogledaj i dr.web, a i spyboot search and destroy, imaš previše zaštitnih programa, sigurno je i to jedan od razloga velike potrošnje

desni klik mišem na ikonicu OTL >odaberi run as administrator

kad se otvori OTL, ovo kopiraj u prazno polje

:services

esgiguard

dwshd

:OTL

SRV - File not found [Auto | Stopped] -- C:\Users\PC\Downloads\HitmanPro36.exe /crusader:boot -- (HitmanPro36CrusaderBoot) HitmanPro 3.6 Crusader (Boot)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)

DRV - File not found [Kernel | Disabled | Unknown] -- C:\Windows\System32\drivers\dwshd.sys -- (dwshd)

DRV - File not found [Kernel | On_Demand | Unknown] --  -- (.csc)

IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1066435

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=100479&babsrc=SP_ss&mntrId=7e6b0d230000000000001c659dc2fdc4

IE - HKCU\..\SearchScopes\{1F096B29-E9DA-4D64-8D63-936BE7762CC5}: "URL" = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=7e6b0d230000000000001c659dc2fdc4&tlver=1.4.19.19&ss=1&affID=17981

IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1066435

[2012.07.22 01:08:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hitman Pro 3.5

[2012.07.22 01:08:37 | 000,000,000 | ---D | C] -- C:\Program Files\Hitman Pro 3.5

[2012.07.22 01:08:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Hitman Pro

[2012.07.22 01:03:29 | 000,012,872 | ---- | C] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe

[2012.07.22 00:41:30 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro

[2012.07.21 13:22:39 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group

[2012.07.21 02:22:13 | 000,000,000 | ---D | C] -- C:\Users\PC\Doctor Web

[2012.07.21 01:51:32 | 000,000,000 | ---D | C] -- C:\Users\PC\AppData\Roaming\QuickScan

[2012.07.21 01:46:28 | 000,000,000 | ---D | C] -- C:\ProgramData\SecTaskMan

[2012.07.22 01:09:54 | 000,023,624 | ---- | M] () -- C:\Windows\System32\drivers\hitmanpro35.sys

[2012.07.22 01:08:38 | 000,001,906 | ---- | M] () -- C:\Users\Public\Desktop\Hitman Pro 3.5.lnk

[2012.07.22 01:03:29 | 000,012,872 | ---- | M] (SurfRight B.V.) -- C:\Windows\System32\bootdelete.exe

[2012.07.22 01:03:29 | 000,002,142 | ---- | M] () -- C:\Windows\System32\.crusader

[2012.07.22 00:18:05 | 000,000,012 | ---- | M] () -- C:\spyhunter.fix

[2012.07.21 10:42:20 | 000,000,000 | ---D | M] -- C:\Users\PC\AppData\Roaming\QuickScan

[C:\Windows\$NtUninstallKB48814$] ->  -> Unknown point type

:files

rmdir C:\Windows\$NtUninstallKB48814$ /c

C:\Windows\$NtUninstallKB48814$

:Commands

[purity]

[Reboot]

klik na RUN FIX

-log koji dobiješ kopiraj

kako je sad ?

kako računalo radi ?

možeš izbrisati sve alate koje smo koristili

otvori OTL i klik na Clean Up

ako što i ostan , samo s mišem povuci u smeće