Gość: login aname
IP: *.adsl.inetia.pl
06.08.11, 14:03
system win7 64 bit
po wejsciu na strone pewnego bloga pojawil sie komunikat o wykryciu trojana i wymog zainstalowania windows security 2012. Nie mozna bylo odpalic przegladarki internetowej (Opera, IE)
Zainstalowany Microsoft Security Essentials w dalszym ciagu nie moze wykonac skanu systemu.
Po przeskanowaniu Malwerbytes znalazl to:
Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 2
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
c:\Users\Nowy\AppData\Local\fot.exe (Trojan.FakeAlert) -> 2908 -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4152422558 (Trojan.FakeAlert) -> Value: 4152422558 -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\.exe\shell\open\command\(default) (Hijack.ExeFile) -> Value: (default) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\(default) (Hijack.StartMenuInternet) -> Bad: ("C:\Users\Nowy\AppData\Local\fot.exe" -a "C:\Program Files (x86)\Internet Explorer\iexplore.exe") Good: (iexplore.exe) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\exefile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("C:\Users\Nowy\AppData\Local\fot.exe" -a "%1" %*) Good: ("%1" %*) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\Users\Nowy\AppData\Local\fot.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\Users\Nowy\AppData\Local\xtq.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Dr.Web CureIt nie znalazl nic zarowno po szybkim jak i pelnym skanowaniu.
Oto log OTL
wklej.org/id/572880/
