Live Security Platinum - jak go usunąć?

[weer4 (Wer Kuznik)]

Witam. Bardzo proszę o pomoc w pozbyciu się tego wirusa.

Oto link: http://wklej.org/id/791295/

[Atis]

Po restarcie w normalnym trybie odinstaluj:

Giant Savings

Babylon toolbar

Free Lunch Design Toolbar

Complitly

Ask Toolbar

Funmoods Toolbar

SweetPacks Toolbar for Internet Explorer

McAfee Security Scan

Dodatkowo usuń na liście rozszerzeń Chrome:

http://support.google.com/chrome/bin/an … wer=113907

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.funmoods.com/?f=1&a=abnew1 … 1269151903 IE:64bit: - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=abnew1&chnl=abnew1&cd=2XzutAtN2Y1L1Qzu0CzztD0A0AzytDtBtAtB0C0C0ByCtBtCtN0D0TzutBtDtCtBtDyDtAtC&cr=1269151903 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={5DFB7AC4-2598-4616-AEA5-FC45625B1442} IE - HKLM…\SearchScopes{0C5ED28C-359C-EB35-CBB1-0C0CDD52B9E4}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250 IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=abnew1&chnl=abnew1&cd=2XzutAtN2Y1L1Qzu0CzztD0A0AzytDtBtAtB0C0C0ByCtBtCtN0D0TzutBtDtCtBtDyDtAtC&cr=1269151903 IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={5DFB7AC4-2598-4616-AEA5-FC45625B1442} IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = http://search.babylon.com/?babsrc=HP_Prot IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://domredi.com/1/ IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=171011_prot~171011_prot&babsrc=SP_ss_cr&mntrId=32f1b621000000000000c417fe362cfe IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\SearchScopes{54FFA589-4FD7-4E0D-BB73-DD53FD6BE831}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=^AAU&apn_dtid=^YYYYYY^YY^PL&apn_uid=6A4544CD-68B3-4155-A4D0-6BF14CBBE0FB&apn_sauid=961A68D0-A888-46AD-A5FE-EAEB28DB43DE IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\SearchScopes{77E60F5A-07BA-4D26-B709-2AA502F460AB}: “URL” = http://start.funmoods.com/results.php?f=4&a=ironto&q={searchTerms} IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1708250 IE - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={5DFB7AC4-2598-4616-AEA5-FC45625B1442} O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\Run: [Microsoft Windows System] C:\Users\usr\P-7-78-8964-9648-3874\windll.exe File not found O4 - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\Run: [tcdryuy] C:\Users\usr\AppData\Local\spoigd.exe () O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-3137477124-1928334088-4272359126-1000…\RunOnce: [0C1D1734000175925FCE6E76F875F002] C:\ProgramData\0C1D1734000175925FCE6E76F875F002\0C1D1734000175925FCE6E76F875F002.exe () O4 - Startup: C:\Users\usr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qdeat.exe () [2012-07-16 00:24:28 | 000,000,000 | —D | C] – C:\ProgramData\0C1D1734000175925FCE6E76F875F002 [2012-07-10 20:45:55 | 000,000,000 | —D | C] – C:\Users\usr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum [2012-07-10 20:41:52 | 000,000,000 | —D | C] – C:\ProgramData\F4D561EA0000352803F47AD8B4EB2367 [2012-07-02 18:22:50 | 000,000,000 | —D | C] – C:\Users\usr\AppData\Roaming\BabylonToolbar [2012-06-19 23:50:41 | 000,000,000 | —D | C] – C:\Users\usr\AppData\Roaming\QuickStoresToolbar [2012-07-10 20:45:55 | 000,001,100 | ---- | M] () – C:\Users\usr\Live Security Platinum.lnk [2012-07-02 18:22:37 | 000,003,122 | ---- | M] () – C:\user.js [2012-06-19 23:44:21 | 000,145,412 | R-S- | M] () – C:\Users\usr\AppData\Local\spoigd.exe [2012-06-19 23:44:21 | 000,145,412 | R-S- | M] () – C:\Users\usr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qdeat.exe [2012-02-16 21:50:08 | 000,000,000 | —D | M] – C:\Users\usr\AppData\Roaming\Babylon [2012-07-02 18:22:50 | 000,000,000 | —D | M] – C:\Users\usr\AppData\Roaming\BabylonToolbar [2012-06-19 23:54:24 | 000,000,000 | —D | M] – C:\Users\usr\AppData\Roaming\QuickStoresToolbar :Files C:\ProgramData*.tmp :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.