Wirus UKASH - jak się pozbyć ?

[gala888]

Proszę o pomoc w usunięciu Ukash'a.
Załączam logi z OTL
OTL:
http://www.wklej.org/id/802928/
Extras:
http://www.wklej.org/id/802929/

[Acorus]

Odinstaluj Browsers Protector,DAEMON Tools Toolbar,McAfee Security Scan Plus,Norton Security Scan,V9 HomeTool.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\XDva383.sys -- (XDva383)
DRV - File not found [Kernel | On_Demand | Stopped] -- F:\gry\Dark Stars Network\Season 6\MuGuard\llck.sys -- (LLRING0)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://search.my-tools-app.com/?babsrc= ... id=9853&q={searchTerms}
IE - HKU\.DEFAULT\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found
IE - HKU\S-1-5-18\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found.
O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found.
O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [vlhhsdrgwprydaw] C:\Documents and Settings\All Users\Dane aplikacji\vlhhsdrg.exe (MiTAC)
O4 - HKU\.DEFAULT..\Run: [vlhhsdrgwprydaw] C:\Documents and Settings\All Users\Dane aplikacji\vlhhsdrg.exe (MiTAC)
O4 - HKU\S-1-5-18..\Run: [vlhhsdrgwprydaw] C:\Documents and Settings\All Users\Dane aplikacji\vlhhsdrg.exe (MiTAC)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found
O4 - HKU\S-1-5-21-1960408961-299502267-1801674531-500..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found
[2012-08-02 11:55:46 | 000,078,336 | ---- | C] (MiTAC) -- C:\Documents and Settings\All Users\Dane aplikacji\vlhhsdrg.exe
[2012-08-02 11:55:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\uybpaqzowokxkwr
[2012-08-02 11:55:47 | 000,000,051 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\xqtktvxtobpcjxz
[2012-08-02 11:55:24 | 000,078,336 | ---- | M] (MiTAC) -- C:\Documents and Settings\All Users\Dane aplikacji\vlhhsdrg.exe

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.
Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).
Pokaż nowy log OTL.txt oraz raport z usuwania.

[gala888]

Dzięki za pomoc
OTL:
http://wklej.org/id/803018/
Raport:
http://wklej.org/id/803020/

[Acorus]

Wyłącz przeglądarki.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = pl.v9.com/idg/idg_1333997691_971406
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=91ef191a- ... 1bfcb1335b
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No CLSID value found
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\URLSearchHook: {EEE6C35D-6118-11DC-9C72-001320C79847} - No CLSID value found
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=91 ... cb1335b&q={searchTerms}
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://search.my-tools-app.com/?babsrc= ... id=9853&q={searchTerms}
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredimail.com/mb68/?search={searchTerms}&loc=search_box&u=92541458151551319
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{D55C1262-5DD8-407B-B108-EC9ED2CE8B89}: "URL" = http://search.babylon.com/web/{searchTerms}?babsrc=browsersearch&AF=15627
IE - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={AFA87E28-B05B-4679-9DDF-EEE2E6635D25}
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Free Lunch Design Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1708250&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "MyTools"
FF - prefs.js..browser.search.selectedEngine: "SweetIM Search"
FF - prefs.js..browser.startup.homepage: "http://home.sweetim.com/?st=1"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT1708250&SearchSource=2&q="
FF - prefs.js..browser.startup.homepage: "http://startsear.ch/?aff=1&cf=91ef191a-8718-11e1-97fc-001bfcb1335b"
[2012-07-16 10:17:41 | 000,000,000 | ---D | M] (IncrediMail MediaBar 2 Community Toolbar) -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}
[2012-02-27 18:35:28 | 000,000,000 | ---D | M] (SweetIM Toolbar for Firefox) -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\{EEE6C361-6118-11DC-9C72-001320C79847}
[2011-05-04 08:42:22 | 000,000,000 | ---D | M] (cacaoweb) -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\cacaoweb@cacaoweb.org
[2011-09-28 13:34:57 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\DTToolbar@toolbarnet.com
[2011-09-28 13:35:01 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\engine@conduit.com
[2012-06-12 16:04:15 | 000,000,000 | ---D | M] (MyTools extension) -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\extensions\info@my-tools-app.com
[2012-07-15 13:37:06 | 000,000,937 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\conduit.xml
[2011-02-18 19:27:24 | 000,002,059 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\daemon-search.xml
[2011-09-05 21:28:50 | 000,002,207 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\MyStart Search.xml
[2012-02-15 17:39:21 | 000,000,544 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\MyTools.xml
[2012-04-15 18:32:38 | 000,000,792 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\startsear.xml
[2012-05-16 20:45:26 | 000,004,089 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\sweetim.xml
[2012-04-22 17:08:10 | 000,001,565 | ---- | M] () -- C:\Documents and Settings\Galik\Dane aplikacji\Mozilla\Firefox\Profiles\slziuhk1.default\searchplugins\web-search.xml
O2 - BHO: (MyTools Class) - {C3A44133-7EAD-434C-AC9E-7F1DA176BA8C} - C:\Program Files\MyTools\mytools.dll (MyTools)
O3 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found.
O3 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003..\Run: [cacaoweb] "C:\Program Files\cacaoweb\cacaoweb.exe" -noplayer File not found
O4 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003..\Run: [PCSpeedUp] "C:\Program Files\Przyspiesz Komputer\PCSpeedUp.exe" File not found
O4 - HKU\S-1-5-21-1960408961-299502267-1801674531-1003..\Run: [TorrentEasy_85055be0345f1623f74f0c28e2843781d49a250b] "F:\TorrentEasy-prince-of-persia-the-two-thrones-dvd-iso.exe" File not found

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.Wyłącz i włącz przywracanie systemu.
http://www.searchengines.pl/Czyszczenie ... 41981.html
Wyłącz i włącz przywracanie systemu.
http://www.searchengines.pl/Czyszczenie ... 41981.html
Zainstaluj aktualizacje do programow wskazanych przez Security Check
analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html jako out of date.

[gala888]

Zrobione Jeszcze raz wielkie dzięki