Live Security Platinum

peyton101 · 8 Sierpień 2012 09:41

Cześć złapałam tego wirusa i mam duży problem z jego usunięciem.

Logi OTL:

otl.txt.

http://www.wklejto.pl/130692

extras.txt.

http://www.wklejto.pl/130694

Z góry wielkie dzięki za pomoc.

Atis · 8 Sierpień 2012 10:10

Uruchom cmd.exe jako administrator:

Jak uruchomić polecenie z pełnymi uprawnieniami?

Wklej i zatwierdź enterem:

Zrestartuj system.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL DRV - File not found [Kernel | On_Demand | Stopped] – -- (Tosrfcom) DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive) IE - HKU\S-1-5-21-115018365-3727657250-2811590568-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://findgala.com/?&uid=5689&q={searchTerms} [2011-12-28 12:33:56 | 000,000,000 | —D | M] (Babylon) – C:\Users\Asia\AppData\Roaming\mozilla\Firefox\Profiles\nu3kh46v.default\extensions\ffxtlbr@babylon.com [2011-12-25 17:07:21 | 000,000,000 | —D | M] (Vividas player plugin) – C:\Users\Asia\AppData\Roaming\mozilla\Firefox\Profiles\nu3kh46v.default\extensions\player@vividas.com [2012-03-27 10:58:06 | 000,001,210 | ---- | M] () – C:\Users\Asia\AppData\Roaming\Mozilla\Firefox\Profiles\nu3kh46v.default\searchplugins\search.xml [2011-12-28 10:31:42 | 000,002,310 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\babylon.xml O3 - HKU\S-1-5-21-115018365-3727657250-2811590568-1000…\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKU\S-1-5-21-115018365-3727657250-2811590568-1000…\Run: [spotify Web Helper] C:\Users\Asia\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe () O4 - HKU\S-1-5-21-115018365-3727657250-2811590568-1000…\RunOnce: [036E192F0007EDFE0261FA4E2F3B6FDA] C:\ProgramData\036E192F0007EDFE0261FA4E2F3B6FDA\036E192F0007EDFE0261FA4E2F3B6FDA.exe () [2012-08-06 14:39:14 | 000,000,000 | —D | C] – C:\Users\Asia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Live Security Platinum [2012-07-02 16:51:23 | 027,876,183 | ---- | C] () – C:\ProgramData\iHEGlH3O.exe [2012-08-04 11:54:38 | 000,000,000 | —D | M] – C:\Users\Asia\AppData\Roaming\Spotify [2011-12-28 10:30:42 | 000,000,000 | —D | M] – C:\Users\Asia\AppData\Roaming\Babylon @Alternate Data Stream - 1320 bytes -> C:\Users\Asia\AppData\Local\Temp:gAArmDqdsw5eVpO0e3V5ikL @Alternate Data Stream - 1296 bytes -> C:\Program Files\Common Files\microsoft shared:3EJ9Bm5xvHDkCYQiu @Alternate Data Stream - 1242 bytes -> C:\Program Files\Common Files\microsoft shared:DrhykF2mn5WCPrcb1tY2CAKX88xm @Alternate Data Stream - 1240 bytes -> C:\ProgramData\Microsoft:InsKENTNHq3EKCTcQyT2xuqKs @Alternate Data Stream - 1210 bytes -> C:\ProgramData\Microsoft:9u6n6ZhflBPCkMOKDqapZ @Alternate Data Stream - 1185 bytes -> C:\Users\Asia\AppData\Local\Temp:NrA5E1KpQV4a9yIHIXdJgwT1 :Files C:\Windows\Installer{fa7f0bed-67f7-566b-f781-8bab547b4d63} C:\Users\Asia\AppData\Local{fa7f0bed-67f7-566b-f781-8bab547b4d63} C:\ProgramData\036E192F0007EDFE0261FA4E2F3B6FDA :Reg [-HKEY_USERS\S-1-5-21-115018365-3727657250-2811590568-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Live Security Platinum] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania.