ukash - wirus

[ochir]

Witam

postąpiłem zgodnie ze wskazówkami i wysyłam pliki z prośbą o pomoc.

 

Pozdrawiam

 

Irek

Extras.Txt

OTL.Txt

[Landuss]

1. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
SRV - File not found [Auto | Stopped] -- C:\DOCUME~1\WLASCI~1\LOCALS~1\Temp\DAT18.tmp.exe -- (zlyzbiklb)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\ztceonjpeka7.sys -- (ztceonjpeka7)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\zsyfkkpkspidu5.sys -- (zsyfkkpkspidu5)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\zryohvftyjgk5.sys -- (zryohvftyjgk5)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\ctnrawxn.sys -- (ctnrawxn)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\WLASCI~1\LOCALS~1\Temp\catchme.sys -- (catchme)
IE - HKLM\..\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - No CLSID value found
IE - HKU\S-1-5-21-299502267-651377827-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://search.babylon.com/?AF=100482&babsrc=HP_ss&mntrId=6ce388ac000000000000001a6b016501"
IE - HKU\S-1-5-21-299502267-651377827-682003330-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/?q={searchTerms}&AF=100482&babsrc=SP_ss&mntrId=6ce388ac000000000000001a6b016501"
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..extensions.enabledItems: vshare@toolbar:1.0.0
FF - prefs.js..keyword.URL: "http://vshare.toolbarhome.com/search.aspx?srch=ku&q="
[2010-05-01 10:08:15 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Wlasciciel\Application Data\mozilla\Firefox\Profiles\d836to60.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2012-03-27 21:23:40 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\Wlasciciel\Application Data\mozilla\Firefox\Profiles\d836to60.default\extensions\vshare@toolbar
[2009-03-01 14:02:47 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\Wlasciciel\Application Data\Mozilla\Firefox\Profiles\d836to60.default\searchplugins\daemon-search.xml
[2010-11-08 15:27:40 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\Wlasciciel\Application Data\Mozilla\Firefox\Profiles\d836to60.default\searchplugins\web-search.xml
[2010-07-05 16:19:57 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Wlasciciel\Application Data\Mozilla\Firefox\Profiles\d836to60.default\searchplugins\winamp-search.xml
[2012-01-12 23:06:42 | 000,002,310 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
O3 - HKU\S-1-5-21-299502267-651377827-682003330-1003\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll File not found
O4 - HKU\.DEFAULT..\Run: [hxkhbjiggrkpmgf] C:\Documents and Settings\All Users\Application Data\hxkhbjig.exe (Arima Computer Corporation)
O4 - HKU\S-1-5-18..\Run: [hxkhbjiggrkpmgf] C:\Documents and Settings\All Users\Application Data\hxkhbjig.exe (Arima Computer Corporation)
 
:Files
C:\Documents and Settings\All Users\Application Data\gkepjaqogmdotce
C:\Documents and Settings\All Users\Application Data\jcagcfotyditszm
 
:Reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_USERS\S-1-5-21-299502267-651377827-682003330-1003\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

2. Przez Panel sterowania odinstaluj: DAEMON Tools Toolbar / Winamp Toolbar

 

3. Uruchom AdwCleaner z opcji Delete

 

4. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras)

Edytowane 4 Września 2012 przez picasso
4.09.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso