Złamanie prawa polskiego i blokada komputera - Wirus

[Wojciech]

Witam,

jak w temacie zablokowane mi komputer z informacją,że złamałem prawo polskie. Bardzo proszę o pomoc.

Pozdrawiam

OTL.Txt

Extras.Txt

[Landuss]

1. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
IE:64bit: - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = "http://search.bearshare.com//web?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}"
IE - HKLM\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = "http://startsear.ch/?aff=1&src=sp&cf=56de2afa-f440-11e0-a05e-20cf30c3d508&q={searchTerms}"
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = "http://search.bearshare.com//web?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}"
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = "http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}"
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253"
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&q={searchTerms}"
IE - HKCU\..\URLSearchHook: {51a86bb3-6602-4c85-92a5-130ee4864f13} - No CLSID value found
IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found
IE - HKCU\..\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/?q={searchTerms}&affID=110819&tt=190712_ctrl_2912_8&babsrc=SP_ss&mntrId=2e2fe33900000000000020cf30c3d508"
IE - HKCU\..\SearchScopes\{932E953F-432A-4314-8829-66DD2378433D}: "URL" = "http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=F5E49D57-5245-4D0A-AE19-7C6530FF0100&apn_sauid=9379DE1D-10CE-4685-A046-AD5945E64B71"
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = "http://startsear.ch/?aff=1&src=sp&cf=56de2afa-f440-11e0-a05e-20cf30c3d508&q={searchTerms}"
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD22}: "URL" = "http://search.bearshare.com//web?src=ieb&appid=20&systemid=2&sr=0&q={searchTerms}"
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = "http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}"
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253"
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&q={searchTerms}"
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "uTorrentControl2 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT3072253&SearchSource=13"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q="
[2012-06-04 22:47:14 | 000,002,331 | ---- | M] () -- C:\Users\Użytkownik\AppData\Roaming\Mozilla\Firefox\Profiles\6oedq62b.default\searchplugins\askcom.xml
[2012-04-18 00:39:24 | 000,000,935 | ---- | M] () -- C:\Users\Użytkownik\AppData\Roaming\Mozilla\Firefox\Profiles\6oedq62b.default\searchplugins\conduit.xml
[2011-10-01 09:34:36 | 000,002,505 | ---- | M] () -- C:\Users\Użytkownik\AppData\Roaming\Mozilla\Firefox\Profiles\6oedq62b.default\searchplugins\SearchResults.xml
[2011-07-11 20:04:02 | 000,000,633 | ---- | M] () -- C:\Users\Użytkownik\AppData\Roaming\Mozilla\Firefox\Profiles\6oedq62b.default\searchplugins\startsear.xml
[2012-07-23 00:49:43 | 000,002,361 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2010-09-14 14:48:25 | 000,002,506 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2011-10-01 09:34:36 | 000,002,505 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml
O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - !{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{B922D405-6D13-4A2B-AE89-08A030DA4402} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No CLSID value found.
O3 - HKLM\..\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\bsdtxmltbpi.dll File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {51A86BB3-6602-4C85-92A5-130EE4864F13} - No CLSID value found.
O4:64bit: - HKLM..\Run: [etMonitor] C:\Windows\etMon.exe File not found
O4 - HKLM..\Run: []  File not found
O4 - HKCU..\Run: [themecpl] C:\Users\Użytkownik\AppData\Local\Microsoft\Windows\1756\themecpl.exe ()
 
:Files
C:\Users\Użytkownik\AppData\Roaming\hellomoto
C:\Users\Użytkownik\AppData\Local\Microsoft\Windows\1756
 
:Reg
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

2. Przez Panel sterowania odinstaluj: Ask Toolbar

 

Otwórz Firefox i w Dodatkach odmontuj: Babylon / uTorrentControl2 Community Toolbar / uTorrentBar Community Toolbar

 

Otwórz Google Chrome i wejdź do Opcji, w Rozszerzeniach odmontuj vshare plugin

 

3. Uruchom AdwCleaner z opcji Delete

 

4. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras)

Edytowane 6 Września 2012 przez picasso
6.09.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso