Live Security Platinum

[pablo92 (Pawelsroka)]

Witam mam problem oczywiście z usunięciem tego wirusa.

Blokuje mi wszystkie narzędzia.

wklejam Extracts

http://wklejto.pl/128774

i OTL

http://www.wklejto.pl/128775

proszę o pomoc

[Atis]

W panelu sterowania odinstaluj My Global Search Bar.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | System | Stopped] – C:\WINDOWS\system32\drivers\SBREdrv.sys – (SBRE) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=10&cf=56b6a4a8 … 1d7d40add6 IE - HKLM…\SearchScopes{0D59EF27-CBCE-4658-9809-30ADDA0598E8}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=56 … d40add6&q={searchTerms} IE - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\SearchScopes{0D59EF27-CBCE-4658-9809-30ADDA0598E8}: “URL” = http://startsear.ch/?aff=2&src=sp&cf=56 … d40add6&q={searchTerms} IE - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\SearchScopes{43D63785-61CC-4A25-AACC-F00CA31F6C0F}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091 IE - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\SearchScopes{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: “URL” = http://startsear.ch/?aff=10&src=sp&cf=5 … d40add6&q={searchTerms} [2012-01-02 11:48:42 | 000,083,456 | ---- | M] (StartSearch ) – C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [EXPLORER.EXE] C:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [Microsoft Windows System] C:\Documents and Settings\Paweł\P-7-78-8964-9648-3874\windll.exe () O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [mvwoccm] C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\ljjfkl.exe () O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [steam] “C:\Program Files\Steam\Steam.exe” -silent File not found O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [wsctf.exe] wsctf.exe File not found O4 - HKU.DEFAULT…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found O4 - HKU\S-1-5-18…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found O4 - HKU\S-1-5-19…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found O4 - HKU\S-1-5-20…\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 File not found O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\RunOnce: [F4D55F3E0001767C69304BCC0CDF108C] C:\Documents and Settings\All Users\Dane aplikacji\F4D55F3E0001767C69304BCC0CDF108C\F4D55F3E0001767C69304BCC0CDF108C.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\20Dollars2Surf.lnk = File not found O20 - HKLM Winlogon: UserInit - (EXPLORER.EXE) - C:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) [2012-07-11 09:20:39 | 000,000,000 | —D | C] – C:\Documents and Settings\Paweł\Menu Start\Programy\Live Security Platinum [2012-07-11 09:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\F4D55F3E0001767C69304BCC0CDF108C [2012-06-27 11:34:30 | 000,000,000 | —D | C] – C:\Documents and Settings\Paweł\P-7-78-8964-9648-3874 [2012-07-11 17:24:35 | 000,145,412 | R-S- | M] () – C:\Documents and Settings\Paweł\Menu Start\Programy\Autostart\jwyxw.exe [2012-06-19 22:29:23 | 000,145,412 | R-S- | M] () – C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\ljjfkl.exe [2011-08-08 14:43:55 | 000,060,304 | ---- | C] () – C:\Documents and Settings\Paweł\g2mdlhlpx.exe :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “Shell”=“explorer.exe” [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [resethosts] [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

[pablo92 (Pawelsroka)]

wklejam OTL

http://wklejto.pl/128787

i raport :

http://www.wklejto.pl/128788

[Atis]

Do okna Własne opcje skanowania / skrypt wklej:

:OTL O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [duedug] C:\Documents and Settings\Paweł\duedug.exe () O4 - HKU\S-1-5-21-1202660629-492894223-1417001333-1003…\Run: [wsctf.exe] wsctf.exe File not found [2012-07-12 21:48:41 | 000,225,280 | ---- | C] (My Global Search) – C:\Program Files\Uninstall My Global Search Bar.dll [2012-07-11 09:17:07 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Dane aplikacji\F4D55F3E0001767C69304BCC0CDF108C [2012-07-12 10:42:15 | 000,001,316 | ---- | C] () – C:\Documents and Settings\Paweł\Pulpit\Live Security Platinum.lnk [2012-07-12 12:57:31 | 000,049,152 | RHS- | C] () – C:\Documents and Settings\Paweł\duedug.exe :Files C:\Documents and Settings\Paweł*.exe :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “Userinit”=“C:\WINDOWS\system32\userinit.exe,” [HKEY_USERS\S-1-5-21-1202660629-492894223-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Run] “EXPLORER.EXE”=- :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.