Jak usunąć Live Security Platinum?

[prokoxik (Pablo 114)]

OTL : http://wklej.org/id/799974/

Extras : http://wklej.org/id/799975/

[Atis]

Odinstaluj:

AutocompletePro

Babylon toolbar on IE

MediaBar

Facemoods Toolbar

LiveVDO plugin

Softonic-Polska Toolbar

1. Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – System32\Drivers\wpdusb.sys – (WpdUsb) DRV - File not found [Kernel | On_Demand | Stopped] – C:\WINDOWS\gdrv.sys – (gdrv) DRV - [2011-02-21 20:31:39 | 000,052,096 | ---- | M] () [Kernel | Boot | Stopped] – C:\WINDOWS\system32\drivers\scbouyjwqn.sys – (xhcsunkgay) IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=51 … ec56aad&q={searchTerms} IE - HKCU…\SearchScopes{043C5167-00BB-4324-AF7E-62013FAEDACF}: “URL” = http://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp IE - HKCU…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=iron&s={searchTerms}&f=4 IE - HKCU…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search/web?q={searchTerms} IE - HKCU…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=51 … ec56aad&q={searchTerms} IE - HKCU…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/red … 685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20111010162349703&tb_oid=03-01-2011&tb_mrud=10-10-2011 IE - HKCU…\SearchScopes{F63FF8B1-E6DE-450D-98CE-D6D65776443B}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2790392 FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Web Search” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q=” [2012-05-16 06:45:49 | 000,000,000 | —D | M] (“Winamp Toolbar”) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2012-07-18 05:59:56 | 000,000,000 | —D | M] (BitTorrentBar Community Toolbar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\extensions{88c7f2aa-f93f-432c-8f0e-b7d85967a527} [2011-04-25 21:58:21 | 000,000,000 | —D | M] (Battlefield Play4Free) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\extensions\battlefieldplay4free@ea.com [2012-03-26 15:49:56 | 000,000,000 | —D | M] (vShare) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\extensions\vshare@toolbar [2011-10-10 18:24:21 | 000,002,354 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\searchplugins\aol-web-search.xml [2011-10-31 19:55:35 | 000,000,863 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\searchplugins\conduit.xml [2012-01-19 00:11:22 | 000,000,792 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\searchplugins\startsear.xml [2011-04-30 16:41:02 | 000,001,583 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\601jsz42.default\searchplugins\web-search.xml [2011-10-27 15:45:50 | 000,083,456 | ---- | M] (LiveVDO ) – C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll [2011-12-27 10:51:20 | 000,002,310 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml [2010-09-14 14:41:12 | 000,002,506 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml [2011-03-19 15:20:08 | 000,002,047 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrch.xml O2 - BHO: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll File not found O3 - HKLM…\Toolbar: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll File not found O3 - HKCU…\Toolbar\WebBrowser: (vShare Toolbar) - {043C5167-00BB-4324-AF7E-62013FAEDACF} - C:\Program Files\vShare\vshare_toolbar.dll File not found O4 - HKLM…\Run: [hpqSRMon] File not found O4 - HKCU…\Run: [AdobeBridge] File not found O4 - HKCU…\Run: [ALLUpdate] “C:\Program Files\ALLPlayer\ALLUpdate.exe” “sleep” File not found O4 - HKCU…\Run: [bitComet] “D:\Program Files\BitComet\BitComet.exe” /tray File not found O4 - HKCU…\Run: [bitTorrent] “C:\Program Files\BitTorrent\BitTorrent.exe” /MINIMIZED File not found O4 - HKCU…\Run: [DAEMON Tools Lite] “C:\Program Files\DAEMON Tools Lite\daemon.exe” -autorun File not found O4 - HKCU…\Run: [King_ar] C:\WINDOWS\system32\arking.exe () O4 - HKCU…\Run: [NVIDIA driver monitor] c:\windows\nvsvc32.exe File not found O4 - HKCU…\RunOnce: [036DFF85000D22070303F30781CB3EF3] C:\Documents and Settings\All Users\Dane aplikacji\036DFF85000D22070303F30781CB3EF3\036DFF85000D22070303F30781CB3EF3.exe () O20 - HKLM Winlogon: TaskMan - (C:\Documents and Settings\user\Dane aplikacji\juzjf.exe) - File not found O20 - Winlogon\Notify\mdhcp32: DllName - (mdhcp32.dll) - C:\WINDOWS\System32\mdhcp32.dll () [2012-07-29 16:26:41 | 000,000,016 | ---- | M] () – C:\WINDOWS\System32\crt.dat [2012-07-29 16:08:23 | 000,130,048 | RHS- | M] () – C:\WINDOWS\System32\arking0.dll [2012-01-23 19:02:27 | 000,297,209 | ---- | C] () – C:\WINDOWS\System32\shimg.dll [2012-01-23 19:02:24 | 000,050,688 | ---- | C] () – C:\WINDOWS\System32\mdhcp32.dll [2011-02-08 17:09:42 | 000,130,048 | RHS- | C] () – C:\WINDOWS\System32\arking1.dll [2011-02-07 20:13:08 | 000,196,608 | RHS- | C] () – C:\WINDOWS\System32\arking.exe [2011-02-07 20:13:08 | 000,130,048 | RHS- | C] () – C:\WINDOWS\System32\arking0.dll [2011-02-06 22:59:55 | 000,184,887 | ---- | C] () – C:\WINDOWS\System32\drivers\str.sys [2011-02-06 22:59:55 | 000,052,096 | ---- | C] () – C:\WINDOWS\System32\drivers\scbouyjwqn.sys :Files C:\Documents and Settings\All Users\Dane aplikacji\036DFF85000D22070303F30781CB3EF3 :Reg [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.

2. Wklej i kliknij Skanuj:

HKEY_CURRENT_USER\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} /s HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1} /s C:*.* D:*.* /md5start services.exe /md5stop

Pokaż ten log.

3. Pobierz i uruchom Farbar Service Scanner

Zaznacz wszystkie pozycje i kliknij Scan.

Pokaż ten raport.

[prokoxik (Pablo 114)]

Wszystko juz O dzięki wielkie!! ; )

[Atis]

System nadal jest zainfekowany.

Następnym razem nie zakładaj tematu jeśli nie masz zamiaru stosować się do instrukcji.