Ukash błagam o pomoc

usta · 12 Lipiec 2012 18:58

Jak widzę nie jestem sam z tym problemem co robić ?

Skany:

http://www.wklej.org/id/789346/

Atis · 12 Lipiec 2012 19:14

W panelu sterowania odinstaluj:

ToggleEN Toolbar

Conduit Engine

Softonic-Eng7 Toolbar

SFT_Polska Toolbar

CrimeCraft Toolbar

uTorrentBar Toolbar

Ask Toolbar

free-downloads.net Toolbar

Do okna Własne opcje skanowania / skrypt wklej:

:OTL FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultthis.engineName: “SFT_Polska Customized Web Search” FF - prefs.js…extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.7.0190 FF - prefs.js…extensions.enabledItems: engine@conduit.com:3.3.3.2 FF - prefs.js…extensions.enabledItems: ffxtlbr@babylon.com:1.1.9 FF - prefs.js…sweetim.toolbar.previous.browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3031817&SearchSource=3&q={searchTerms}” [2012/01/09 14:02:16 | 000,000,000 | —D | M] (ToggleEN Community Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{038cb5c7-48ea-4af9-94e0-a1646542e62b} [2012/02/12 20:15:20 | 000,000,000 | —D | M] (Softonic-Eng7 Community Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} [2012/01/09 14:02:15 | 000,000,000 | —D | M] (SFT_Polska Community Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{5c5b9468-d672-4eb7-b52f-b5afabf28c5b} [2012/05/18 18:42:03 | 000,000,000 | —D | M] (CrimeCraft Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{B262B0F7-982C-4e38-AD2B-F24A0E8A15C8} [2012/02/12 20:15:20 | 000,000,000 | —D | M] (uTorrentBar Community Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} [2012/01/09 14:02:13 | 000,000,000 | —D | M] (free-downloads.net Community Toolbar) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{ecdee021-0d17-467f-a1ff-c7a115230949} [2011/10/31 16:16:08 | 000,000,000 | —D | M] (“DAEMON Tools Toolbar”) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions\DTToolbar@toolbarnet.com [2011/04/04 09:38:38 | 000,000,000 | —D | M] (Conduit Engine) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions\engine@conduit.com [2011/10/30 02:18:45 | 000,000,000 | —D | M] (Babylon) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions\ffxtlbr@babylon.com [2012/04/21 16:44:03 | 000,002,580 | ---- | M] () – C:\Users\florek\AppData\Roaming\Mozilla\Firefox\Profiles\nqfv7m55.default\searchplugins\askcom.xml [2011/08/04 09:31:04 | 000,000,923 | ---- | M] () – C:\Users\florek\AppData\Roaming\Mozilla\Firefox\Profiles\nqfv7m55.default\searchplugins\conduit.xml [2010/07/08 15:22:09 | 000,002,059 | ---- | M] () – C:\Users\florek\AppData\Roaming\Mozilla\Firefox\Profiles\nqfv7m55.default\searchplugins\daemon-search.xml [2012/07/10 21:29:11 | 000,003,948 | ---- | M] () – C:\Users\florek\AppData\Roaming\Mozilla\Firefox\Profiles\nqfv7m55.default\searchplugins\sweetim.xml O4:64bit: - HKLM…\Run: [setwallpaper] c:\programdata\SetWallpaper.cmd File not found O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [xfbkqbkbnhpyvwr] C:\ProgramData\xfbkqbkb.exe () O4 - HKCU…\Run: [HOMM2GOLD.exe] C:\Users\florek\DOWNLO~1\HOMM2G~2.EXE /r File not found O4 - HKCU…\Run: [PlayNC Launcher] File not found O4 - HKCU…\Run: [xfbkqbkbnhpyvwr] C:\ProgramData\xfbkqbkb.exe () [2012/07/12 17:22:52 | 000,000,000 | —D | C] – C:\ProgramData\ssvsyosjncibgsq [2012/07/12 17:22:53 | 000,000,051 | ---- | M] () – C:\ProgramData\zkrnrtqoftrcbtu [2012/07/12 17:22:42 | 000,065,536 | ---- | M] () – C:\Users\florek\0.4754589781400784.exe :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

usta · 12 Lipiec 2012 19:56

Wygląda na to że pomogło.

Raport z usuwania jest pusty.

http://www.wklej.org/id/789404/ to nowy skan

Dziękuję pięknie =D>

Atis · 12 Lipiec 2012 20:15

Odinstaluj DAEMON Tools Toolbar.

Wklej i kliknij Wykonaj skrypt:

:OTL IE - HKLM…\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - SOFTWARE\Classes\CLSID{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\InprocServer32 File not found IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=10&q={searchTerms} IE - HKCU…\URLSearchHook: {038cb5c7-48ea-4af9-94e0-a1646542e62b} - No CLSID value found IE - HKCU…\URLSearchHook: {414b6d9d-4a95-4e8d-b5b1-149dd2d93bb3} - No CLSID value found IE - HKCU…\URLSearchHook: {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No CLSID value found IE - HKCU…\URLSearchHook: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - SOFTWARE\Classes\CLSID{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}\InprocServer32 File not found IE - HKCU…\SearchScopes{07D625D5-B222-4059-900A-4BEDD3E53BF8}: “URL” = http://websearch.ask.com/redirect?clien … src=crm&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYPL&apn_uid=B0D6A257-DF10-4F5E-930F-DB02B8731349&apn_sauid=23793C0B-2F2E-4364-A1C3-1D4F515FAE52 IE - HKCU…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=1101316&mntrId=80b877840000000000001a4bd6321a15 IE - HKCU…\SearchScopes{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}: “URL” = http://www.mystart.com/results.php?pr=p … &ent=ch&q={searchTerms} IE - HKCU…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search/web?q={searchTerms} IE - HKCU…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 IE - HKCU…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=10&q={searchTerms} :OTL IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyServer” = 178.63.148.56:80 FF - prefs.js…extensions.enabledItems: ffxtlbr@babylon.com:1.1.9 FF - prefs.js…extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.7.0190 [2011/10/31 16:16:08 | 000,000,000 | —D | M] (“DAEMON Tools Toolbar”) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions\DTToolbar@toolbarnet.com [2012/07/12 21:30:30 | 000,000,000 | —D | M] (Babylon) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions\ffxtlbr@babylon.com [2011/10/30 02:18:38 | 000,002,289 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml [2011/08/04 21:26:48 | 000,002,284 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\search.xml O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll File not found O2 - BHO: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll File not found O3:64bit: - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {038CB5C7-48EA-4AF9-94E0-A1646542E62B} - No CLSID value found. O3:64bit: - HKCU…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll () O3 - HKCU…\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU…\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files (x86)\uTorrentBar\tbuTor.dll File not found

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

Dysk przeskanuj Malwarebytes-AntiMalware.

Podczas instalacji kliknij Odrzuć żeby zainstalować tylko darmowy skaner.

http://www.dobreprogramy.pl/Malwarebyte … 13117.html

usta · 12 Sierpień 2012 07:21

Znowu mnie dopadło.Atis mistrzu pomożesz?

http://www.wklej.org/id/809181/

Atis · 12 Sierpień 2012 08:25

Do okna Własne opcje skanowania / skrypt wklej:

:OTL [2012-07-20 10:43:41 | 000,000,000 | —D | M] (uTorrentControl2) – C:\Users\florek\AppData\Roaming\mozilla\Firefox\Profiles\nqfv7m55.default\extensions{687578b9-7132-4a7a-80e4-30ee31099e03} O4 - HKCU…\Run: [wizxegpuipyneim] C:\ProgramData\wizxegpu.exe () [2012-08-12 01:31:39 | 000,000,000 | —D | C] – C:\ProgramData\jfnrmrjgiorctez [2012-08-12 01:31:40 | 000,000,051 | ---- | M] () – C:\ProgramData\irpsdsltuhsxixv [2012-08-12 01:31:32 | 000,057,344 | ---- | M] () – C:\ProgramData\wizxegpu.exe [2012-08-12 01:31:32 | 000,057,344 | ---- | M] () – C:\Users\florek\0.7579153151963864.exe [2012-08-11 11:16:33 | 000,000,404 | -H-- | M] () – C:\Windows\tasks\Norton Security Scan for florek.job [2011-10-30 02:18:36 | 000,000,000 | —D | M] – C:\Users\florek\AppData\Roaming\Babylon :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania

2 Odinstaluj uTorrentControl2 Toolbar

Pobierz AdwCleaner

Zamknij przeglądarkę internetową.

Uruchom AdwCleaner i kliknij Delete

Pokaż nowy log Skanuj

usta · 12 Sierpień 2012 08:56

http://www.wklej.org/id/809228/

http://www.wklej.org/id/809231/

Atis · 12 Sierpień 2012 09:30

Wklej i kliknij Wykonaj skrypt:

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Poza tym miałeś aktualizować programy, a nadal widzę starą wersję IE.

usta · 12 Sierpień 2012 09:50

Dziękuję za pomoc a co do IE to wole firefoxa i nie wiem jakim cudem to się u mnie znalazło.

Jesteś wielki może byś polecił jakieś dobrego anty wirusa nie koniecznie za free ?

Atis · 12 Sierpień 2012 10:17

IE jest pośrednio wykorzystywany przez inne programy i dlatego najlepiej aktualizować ten program.

Zobacz na forum jaka plaga tego prostego trojana i żaden antywirus nie potrafi tego zablokować.

Nie polecam żadnego programu antywirusowego.