HEUR: trojan-downloader.Script.Generic

Madzia23uk · 5 Kwiecień 2014 18:25

Witam od wczoraj mam problem z komputerem,kaspersky blokuje stronki.ponizej podaje raporty z OTL. Niestety jestem zielona na ten temat wiec mam nadzieje ze bedzie mozliwe uzyskanie pomocy.Z gory dziekuje

http://www.wklej.org/id/1323604/

http://www.wklej.org/id/1323607/

Atis · 5 Kwiecień 2014 19:13

Odinstaluj SpyHunter.

Pobierz i uruchom AdwCleaner Kliknij Szukaj i później Usuń.

Pobierz Farbar Recovery Scan Tool 64-Bit Version

Uruchom FRST i kliknij Scan. Pokaż raport FRST, Addition i Shortcut.

Madzia23uk · 5 Kwiecień 2014 21:13

http://www.wklej.org/id/1323787/

http://www.wklej.org/id/1323795/

http://www.wklej.org/id/1323796/

pierwszy link jest z ADWcleaner

Atis · 5 Kwiecień 2014 21:26

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

() C:\Program Files (x86)\Video-SaverStf\video-saver_wd.exe
HKU\.DEFAULT\...\Policies\system: [WallpaperStyle] 2
HKU\S-1-5-21-2413070642-2844141848-1195215395-1000\...\Policies\system: [WallpaperStyle] 2
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {77E6A8B2-D0F1-487D-848D-36DC6AC7F46F} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
Toolbar: HKLM - No Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll No File
Toolbar: HKLM-x32 - No Name - !{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKLM-x32 - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File
FF Extension: Ask New Tabs - C:\Users\madzia\AppData\Roaming\Mozilla\Firefox\Profiles\8wlszfd6.default\Extensions\{3B2DA2DC-4EC3-5DD6-9D09-DD9E7CC6038C} [2014-04-04]
FF Extension: Video-Saver - C:\Program Files (x86)\Video-SaverStf\158.xpi [2014-04-05]
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKLM-x32\...\Chrome\Extension: [ippenodjaoidmkkfdlmdhofiebnpjddb] - C:\Program Files (x86)\BrowseSmart\ippenodjaoidmkkfdlmdhofiebnpjddb.crx [2013-02-28]
R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X]
S3 cleanhlp; \??\C:\Program Files (x86)\Ashampoo\Ashampoo Anti-Virus\cleanhlp64.sys [X]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S1 F06DEFF2-5B9C-490D-910F-35D3A91196222; \??\C:\Program Files (x86)\Music Toolbar\Datamngr\x64\setmgrc1.cfg [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
C:\Users\madzia\Desktop\Malwarebytes-AntiMalware(13117).exe
C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
C:\Program Files\Enigma Software Group
C:\Program Files (x86)\Video-SaverStf
C:\Users\madzia\AppData\Local\AnyProtectScannerSetup.exe
C:\Users\madzia\AppData\Local\nsoC90D.tmp
C:\ProgramData\3A237
C:\Users\madzia\AppData\Local\imeshmusicboxtoolbar181
C:\Users\Public\AlexaNSISPlugin.2596.dll
C:\Users\madzia\AppData\Local\Temp\*.exe
C:\Users\madzia\AppData\Local\Temp\*.dll
Task: {35996042-2E4C-469D-9050-5FFB6EF3CFEA} - System32\Tasks\Video-Saver_wd => C:\Program Files (x86)\Video-SaverStf\video-saver_wd.exe [2014-04-05] ()
Task: {6BDB679E-2A3F-4FF5-867D-34E01B53E9A3} - System32\Tasks\{790798B5-25EE-46BF-9EEE-6EE77D49F375} => Firefox.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {6D417B17-E1D8-474C-91D7-A31496F42608} - System32\Tasks\{67FBE760-070F-4A2F-8E57-A8FC23E2FF58} => Firefox.exe 
Task: {6ED8A9D0-DB1A-40CD-8011-0F3FB42F4571} - System32\Tasks\{C5804746-66EA-40DC-A823-655BBB00FEE4} => Firefox.exe 
Task: {CA43A4FF-9195-45E9-B201-55575DF0F9D2} - \MySearchDial No Task File
Task: C:\Windows\Tasks\Video-Saver_wd.job => C:\Program Files (x86)\Video-SaverStf\video-saver_wd.exe
Shortcut: C:\Users\madzia\Desktop\skroty\Torch.lnk -> C:\Users\madzia\AppData\Local\Torch\Application\torch.exe (No File)
Shortcut: C:\Users\madzia\Desktop\skroty\Youtube.lnk -> C:\Users\madzia\AppData\Local\Torch\Application\torch.exe (No File)
Shortcut: C:\Users\madzia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\iLivid.lnk -> C:\Users\madzia\AppData\Local\iLivid\iLivid.exe (No File)
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\iLivid" /f
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.