Aartemis - problem z usunięciem / logi

Dla specjalistów Bezpieczeństwo
#1

Witam, mam problem z usunięciem strony startowej Aartemis, oraz jej składników.

Usuwałem wpisy z przeglądarek (Mozilla, Opera), ale to nie pomogło.

Skanowałem dysk OTL,Gmer, AdwCleaner oraz Mbam’em.

 

Sami zobaczcie logi,może coś znajdziecie:

 

OTL:  http://www.wklej.eu/index.php?id=e034f18c5c

          http://www.wklej.eu/index.php?id=d32293977e

 

 

Mbam:  http://www.wklej.eu/index.php?id=730a4642ff

 

Gmer: http://www.wklej.eu/index.php?id=668a1afc81

#2

Usuń to co znalazł Mbam.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
IE - HKU\S-1-5-21-913316975-2384098725-1935142382-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE - HKU\S-1-5-21-913316975-2384098725-1935142382-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://aartemis.com/?type=hpts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTS
IE - HKU\S-1-5-21-913316975-2384098725-1935142382-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www.searchgol.com/?q={searchTerms}babsrc=SP_ssmntrId=308368A3C4A663FEaffID=124742tsp=5022
IE - HKU\S-1-5-21-913316975-2384098725-1935142382-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=dsts=1388577617from=wpcuid=TOSHIBAXMK5065GSXN_11RJSGJTSXX11RJSGJTSq={searchTerms}
[2013-12-25 08:59:21 | 000,000,000 | ---D | C] -- C:\Users\Mariola\.android
[2013-12-25 08:59:10 | 000,000,000 | ---D | C] -- C:\Users\Mariola\AppData\Roaming\newnext.me
[2013-12-25 08:59:09 | 000,000,000 | ---D | C] -- C:\Users\Mariola\AppData\Local\genienext
[2014-01-05 10:29:58 | 000,000,364 | ---- | M] () -- C:\Windows\tasks\AmiUpdXp.job
[2014-01-01 12:59:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Optimizer Pro
[2014-01-01 12:56:24 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2013-12-25 11:21:50 | 000,000,000 | ---D | C] -- C:\AdwCleaner

:Commands
[emptytemp]

Kliknij Wykonaj skrypt.

#3

ok dzięki, strona startowa znikła, czy z czyszczenia to wszystko czy wkleić jeszcze logi ??