Ajutor devirusare

Salutare,

am un laptop relativ vechi cu specificatii slabe si cu windows xp,sp3 pe el . Recent dupa ce am facut prostia de a baga un stick virusat in el nu mai puteam accesa niciun fel de site antivirus si mergea si mai greu calculatorul. Am instalat eset, Avast si nu mi-au gasit niciun virus . Am mai instalat malware-anti malware si a gasit cateva probleme si le-a rezolvat dar tot se misca lent calculatorul . Am mai instalat si combo-fix l-am lasat sa ruleze 20 minute dupa care se cam blocase si a trebuie sa-l inchid fortat ceea ce am inteles ca nu-i bine . Ce sa fac pentru a repune laptopul pe picioare (IBM R40) si eventual dupaia sa ma ajutati sa mai renunt din procesele din task manager care nu-mi sunt utile pentru a maximiza viteza.
Trebuie sa instalez OTcleanit cumva ?

Multumesc

Buna.
Pentru inceput poateaza un Log HiJackThis.
http://forum.softped...4/#entry8588576

Logfile of Trend Micro HiJackThis v2.0.4
Scan saved at 02:34:58, on 1/3/2013
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\Program Files\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTAgent.exe" -autorun
O4 - Startup: Regie.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Programe\Office14\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://D:\Programe\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} (Bitdefender QuickScan Control) - http://quickscan.bit...m/qsax/qsax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{1371230B-BE67-4BEE-A633-9340A520C742}: NameServer = 141.85.0.81 141.85.0.82
O17 - HKLM\System\CS1\Services\Tcpip\..\{1371230B-BE67-4BEE-A633-9340A520C742}: NameServer = 141.85.0.81 141.85.0.82
O18 - Filter hijack: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Lenovo PM Service (IBMPMSVC) - Lenovo. - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\system32\S24EvMon.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 4526 bytes

Buna.

In HijackThis bifeaza si da fix la:

Quote

Descarca AdwCleaner by Xplode pe Desktop.
Dublu click pe AdwCleaner.exe pentru al rula.
Click pe Search.
Asteapta sa termine de cautat.
Dupa click pe Delete.
Un fisier log se va deschide dupa ce va termina de scanat.
Posteaza continutul lui aici.
Logul se gaseste in C:\AdwCleaner[Sn].txt (n este un numar).

# Adwcleaner v2.112 - Logfile created 01/03/2013 at 03:29:17
# Updated 10/02/2013 by Xplode
# Operating system : Microsoft Windows XP Service Pack 3 (32 bits)
# User : abc - ABC-1A5B334F023
# Boot Mode : Normal
# Running from : D:\Downloads\adwcleaner0.exe
# Option [Delete]

***** [Services] *****

***** [Files / Folders] *****
Folder Deleted : C:\Program Files\Protected Search
***** [Registry] *****
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
***** [Internet Browsers] *****
-\\ Internet Explorer v6.0.2900.5512
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Default_Page_URL] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls - Tabs] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Start Page] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Start Default_Page_URL] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=42972&tid=3482&st=bs&q= --> hxxp://www.google.com
Replaced : [HKCU\Software\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=42972&tid=3482&st=bs&q= --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Start Page] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Start Default_Page_URL] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Bar] = hxxp://search.certified-toolbar.com?si=42972&tid=3482&st=bs&q= --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Search - Search Page] = hxxp://search.certified-toolbar.com?si=42972&tid=3482&st=bs&q= --> hxxp://www.google.com
Replaced : [HKLM\SOFTWARE\Microsoft\Internet Explorer\Main - Start Default_Page_URL] = hxxp://search.certified-toolbar.com/nff2/ --> hxxp://www.google.com
-\\ Google Chrome v24.0.1312.57
File : C:\Documents and Settings\abc\Local Settings\Application Data\Google\Chrome\User Data\Default\Preferences
[OK] File is clean.
*************************
AdwCleaner[R1].txt - [2654 octets] - [03/01/2013 03:26:02]
AdwCleaner[R2].txt - [2714 octets] - [03/01/2013 03:28:56]
AdwCleaner[S1].txt - [2912 octets] - [03/01/2013 03:29:17]
########## EOF - C:\AdwCleaner[S1].txt - [2972 octets] ##########


1.Parca merge mai bine dar totusi poate ma mai poti ajuta sa elimin din procesele nenecesare care imi mananca din putinii rami. Logg-ul zice ca este bine acuma ?
2. In C:\ am ComboFix cu o iconita de my computer si am inteles ca trebuie sa scap de ea si trebuie un anumit program. Asa este ?

Edited by mercenar123, 22 February 2013 - 23:20.

 mercenar123, on 22 februarie 2013 - 23:18, said:

Ai rulat ComboFix?

"Am mai instalat si combo-fix l-am lasat sa ruleze 20 minute dupa care se cam blocase si a trebuie sa-l inchid fortat ceea ce am inteles ca nu-i bine" si am inteles ca trebuie sters cu un program otcleanit . Asa este ?

Am atasat toate procesele care imi ruleaza si sa-mi spui te rog cum pot sa raman doar cu cele esentiale si  cum sa le opresc pe restu pentru totdeauna

Edited by mercenar123, 23 February 2013 - 02:21.

 mercenar123, on 23 februarie 2013 - 02:06, said:

Nu e bine!

Descarca din nou: ComboFix si salveaza-l pe Desktop.
Apoi asigura-te ca ai inchis toate programele care ruleaza (Yahoo Messenger, Mozila Firefox, etc) si ruleaza ComboFix.
Te va intreba daca sa inceapa sa curete sistemul. Confirma cu Yes de fiecare data.
Nu-l opri in timp ce scaneaza si dezinfecteaza sistemul. E posibil ca in timpul rularii lui desktop-ul sa dispara, dar nu te ingrijora.
La sfarsit va afisa rezultatele scanarii.
Salveaza acel fisier si posteaza continutul AICI.

Edited by MhG_40, 23 February 2013 - 02:19.

Rulează deja de 30 minute și nu pare sa se oprească. Menționez ca are un stick bagat în laptop, dar dacă îl las așa cred a tine pana mâine. Nu-mi aduc aminte sa fi trebuit sa dau YES. A făcut un backup și dupaia mi-a deschis o linie de comanda și zice ca scanează și ca în mod normal termina în 10 minute

Edited by mercenar123, 23 February 2013 - 02:51.

Depinde de sistem.
Pote dura si jumatate de ora, sau mai bine.

L-am lasat sa ruleze 8 ore si tot in acelasi stadiu a ramas. A trebuit sa-l inchid fortat pentru a 3-a oara in total . Ce e de facut ?

Intre timp am mai observat si urmatoarea problema care se aseamana mult cu comportamentul unui virus (zic eu) : cand sunt conectat la internet prin conexiunea broadband "x" daca apas din nou pe iconita "x" ca sa vad si eu detaliile conexiuni (ip-uri / pachete trimise) imi apare pe mijlocul ecranului petru o fractiune de secunda ca si cand ar incerca sa se conecteze, desi e deja conectat si dupa aceea dispare fara sa mai apara nimic .

Am dat un restart si acuma merge .

Edited by mercenar123, 23 February 2013 - 14:04.

Descarca si SALVEAZA pe Desktop, RogueKiller .
Inchide toate programele care ruleaza.
Scoate tot din porturile USB(Memory Stick, Hard Extern).
Dublu click pe RogueKiller.exe, pentru a rula.
Asteapta pana Prescan-ul a terminat.
Click pe "Scan".
Asteapta pana ce in Status box apare "Scan Finished".
Click pe "Report" si copy/paste aici.

Ignura punctul 3 din imagine.
[ http://s9.postimage.org/q04cnvji7/image.jpg - Pentru incarcare in pagina (embed) Click aici ]

RogueKiller V8.5.2 [Feb 23 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : abc [Admin rights]
Mode : Scan -- Date : 01/03/2013 19:02:12
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 7 ¤¤¤
[DNS] HKLM\[...]\ControlSet001\Services\Tcpip\Interfaces\{1371230B-BE67-4BEE-A633-9340A520C742} : NameServer (141.85.0.81 141.85.0.82) -> FOUND
[HJPOL] HKCU\[...]\System : disableregistrytools (0) -> FOUND
[HJ] HKLM\[...]\SystemRestore : DisableSR (1) -> FOUND
[HJ] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> FOUND
[HJ] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> FOUND
[HJ] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\WINDOWS\system32\drivers\etc\hosts
127.0.0.1    localhost

¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: IC25N040ATMR04-0 +++++
--- User ---
[MBR] c23450a870607c35228bdf689c5d4af8
[BSP] cee8a398186f408973e77fc81169d6f2 : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 7168 Mo
1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 14681520 | Size: 27921 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_01032013_02d1902.txt >>
RKreport[1]_S_01032013_02d1902.txt


Din ce-mi dau seama sunt si unele erori pentru ca eu am dezactivat activarea de la lipsa firewall-ului / anti-virus si tot eu am dezactivat si sistem restore deoarece mi se parea inutil si ma enerveaza ca acum de fiecare data cand pornesc calculatorul ma tine 2 secunde in zona de recovery.

Edited by mercenar123, 23 February 2013 - 14:45.

Ruleaza din nou RogueKiller.
Dupa Scan bifeaza

Quote

Celelalte le debifezi.
Apasa Delete.
Dupa FixDNS si Raport.

RogueKiller V8.5.2 [Feb 23 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo...13-roguekiller/
Website : http://tigzy.geeksto...roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : abc [Admin rights]
Mode : DNSFix -- Date : 01/03/2013 19:29:48
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 0 ¤¤¤
¤¤¤ Driver : [LOADED] ¤¤¤
Finished : << RKreport[8]_DN_01032013_02d1929.txt >>
RKreport[1]_S_01032013_02d1902.txt ; RKreport[2]_D_01032013_02d1915.txt ; RKreport[3]_S_01032013_02d1916.txt ; RKreport[4]_DN_01032013_02d1916.txt ; RKreport[5]_S_01032013_02d1917.txt ;
RKreport[6]_S_01032013_02d1927.txt ; RKreport[7]_D_01032013_02d1928.txt ; RKreport[8]_DN_01032013_02d1929.txt

Edited by mercenar123, 23 February 2013 - 15:11.

Scaneaza cu Malwarebytes Anti-Malware.
http://forum.softped.../#entry10021155

Inainte sa scanez cu Mbam dupa ce am resetat calculatorul am observat ca nu mai am conexiunea la internet. A disparut pur si simplu din network connections si nu ma mai pot conecta la internet. Am incercat sa fac o retea noua si dau -> Connect to the internet -> Set up manually -> si nu pot sa mai aleg Connect to a broadband connection (pppoe) si ma obliga sa aleg a 3a varianta ca nu-mi este buna deloc. De la RogueKiller trebuie sa fie.

Local are conection si conexiunea de wireless au ramas . Singura care a disparut este cea cu care ma conectam la internet

Partea buna este ca merge binisor exact ca inainte de a lua virusii

Edited by mercenar123, 23 February 2013 - 18:50.