Police Central e-crime Unit u mnie

[Magik]

Tym razem mnie zaatakował Police Central e-crime unit.

Malwarbytes usunął dwa zainfekowane pliki, ale nie wiem czy to koniec.

OTL - http://wklej.to/w688l

Extras - http://wklej.to/Pgntb

Prosiłbym o sprawdzenie i ewentualną pomoc.

[Acorus]

Użyj AdwCleaner http://general-changelog-team.fr/outils/289-adwcleaner z funkcji Delete(w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator).

Odinstaluj Windows iLivid Toolbar.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL IE:64bit: - HKLM…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: “URL” = http://dts.search-results.com/sr?src=ie … 06&sr=0&q={searchTerms} IE - HKLM…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: “URL” = http://dts.search-results.com/sr?src=ie … 06&sr=0&q={searchTerms} IE - HKLM…\SearchScopes{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033 IE - HKU\S-1-5-21-470839478-3938190476-3271819239-1001…\URLSearchHook: {d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No CLSID value found IE - HKU\S-1-5-21-470839478-3938190476-3271819239-1001…\SearchScopes{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: “URL” = http://dts.search-results.com/sr?src=ie … 06&sr=0&q={searchTerms} IE - HKU\S-1-5-21-470839478-3938190476-3271819239-1001…\SearchScopes{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2481033 O2:64bit: - BHO: (no name) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - No CLSID value found. O2:64bit: - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\x64\BROWSE~1.DLL (Bandoo Media, inc) O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found. O2:64bit: - BHO: (Hotspot Shield Class) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll File not found O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\PROGRA~2\WI3C8A~1\Datamngr\BROWSE~1.DLL (Bandoo Media, inc) O2 - BHO: (KMPlayer Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WI3C8A~1\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM…\Toolbar: (KMPlayer Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM…\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O4:64bit: - HKLM…\Run: [] File not found O4 - HKLM…\Run: [DATAMNGR] C:\PROGRA~2\WI3C8A~1\Datamngr\DATAMN~1.EXE (Bandoo Media, inc) O4 - HKLM…\Run: [RiccoVPN] File not found O4 - HKU\S-1-5-21-470839478-3938190476-3271819239-1001…\Run: [RiccoVPN] C:\Program Files (x86)\RiccoVPN\RiccoVPN.exe -autorun File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-470839478-3938190476-3271819239-1002…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\x64\IEBHO.dll C:\windows\system32\nvinitx.dll) - File not found O20 - AppInit_DLLs: (C:\PROGRA~2\WI3C8A~1\Datamngr\datamngr.dll C:\PROGRA~2\WI3C8A~1\Datamngr\IEBHO.dll C:\windows\SysWOW64\nvinit.dll) - File not found [2012/10/18 15:27:46 | 083,023,306 | ---- | M] () – C:\ProgramData\erolpxei.pad :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.

Wyłącz i włącz przywracanie systemu.

http://www.searchengines.pl/Czyszczenie … 41981.html

Zainstaluj aktualizacje do programow wskazanych przez Security Check

analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html jako out of date.

[Magik]

Wszystko zrobione

OTL http://wklej.to/7uLlZ

[Acorus]

W porządku-czysto.

[Magik]

Dzięki serdeczne.