Komputer zablokowany - Kod Ukash

[Hotspur77 (Mateusz Sierek)]

Witam,

Zablokowany komputer z powodu kodu UKASH.

Komputer odpala się tylko w trybie awaryjnym. W normalnym trybie komputer jest blokowany.

Metody poprzez wpisanie kodu Ukash nie działają nie próbowałem jeszcze użycia ComboFix

Zalaczam ponisze logi wykonane w trybie awaryjnym.

Proszę o pomoc.

z góry Dziękuje.

OTL: http://www.wklej.org/id/795079/

Extras: http://www.wklej.org/id/795074/

[Atis]

Odinstaluj Facemoods Toolbar.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKLM…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=9b … 8e47a72&q={searchTerms} IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1605787 IE - HKLM…\SearchScopes{CA92C241-D10F-49B0-B1C0-6998632D6F3A}: “URL” = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\URLSearchHook: {fcbf663e-8530-46f8-a880-ac5abe9d2b23} - No CLSID value found IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{043C5167-00BB-4324-AF7E-62013FAEDACF}: “URL” = http://vshare.toolbarhome.com/search.aspx?q={searchTerms}&srch=dsp IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=ironto&s={searchTerms}&f=4 IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=9b … 8e47a72&q={searchTerms} IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{332AB3CF-F561-45A5-B770-653E5015EA52}: “URL” = http://search.babylon.com/?q={searchTerms}&AF=100482&babsrc=SP_ss&mntrId=a21d88c3000000000000002618e47a72 IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: “URL” = http://startsear.ch/?aff=1&q={searchTerms} IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search/web?q={searchTerms} IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1605787 IE - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\SearchScopes{CA92C241-D10F-49B0-B1C0-6998632D6F3A}: “URL” = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} FF - prefs.js…browser.search.defaultengine: “Web Search” FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.defaultthis.engineName: “mobilewitch Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1605787&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…extensions.enabledItems: vshare@toolbar:1.0.0 FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1605787&SearchSource=2&q=” [2012-03-27 17:04:49 | 000,000,000 | —D | M] (vShare) – C:\Users\Mateusz\AppData\Roaming\mozilla\Firefox\Profiles\a2vffaoh.default\extensions\vshare@toolbar [2010-09-14 14:48:25 | 000,002,506 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\BearShareWebSearch.xml [2011-07-31 15:50:28 | 000,000,925 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\conduit.xml [2011-08-02 13:14:50 | 000,002,059 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\daemon-search.xml [2010-05-06 11:36:12 | 000,000,259 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\Search.xml [2012-03-27 17:04:54 | 000,001,565 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\web-search.xml [2012-02-11 21:20:49 | 000,000,792 | ---- | M] () – C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\a2vffaoh.default\searchplugins\startsear.xml O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - Reg Error: Value error. File not found O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\ProgramData\Gadu-Gadu 10_userdata\ggbho.2.dll File not found O3:64bit: - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3:64bit: - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM…\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - Reg Error: Value error. File not found O3:64bit: - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKLM…\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - Reg Error: Value error. File not found O3 - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [iuewoxcnitqkoum] C:\ProgramData\iuewoxcn.exe () O4 - HKLM…\Run: [NPSStartup] File not found O4 - HKU\S-1-5-21-3706919986-3857113351-2545037965-1000…\Run: [iuewoxcnitqkoum] C:\ProgramData\iuewoxcn.exe () O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll) - File not found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll) - File not found [2012-07-21 13:41:54 | 000,000,051 | ---- | M] () – C:\ProgramData\kduvlpiaafokurt [2012-07-21 13:41:33 | 000,057,344 | ---- | M] () – C:\ProgramData\iuewoxcn.exe :Files C:\Users\Mateusz\AppData\Roaming*.exe :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

[Hotspur77 (Mateusz Sierek)]

OTL: http://www.wklej.org/id/795224/

Extras: http://www.wklej.org/id/795225/

niestety nie mam raportu z usuwania

komputer uruchamia się normalnie