UKASH pomocy!

mustang30000 · 19 Lipiec 2012 21:57

Padłem ofiarą z tego co widzę dosyć częstego wirusa, który blokuje pulpit i głosi, że policja zablokowała mi komputer.

Proszę o pomoc w jego usunięciu

Atis · 19 Lipiec 2012 22:13

Do okna Własne opcje skanowania / skrypt wklej:

:OTL SRV - File not found [Auto | Stopped] – f:\Program Files\KALiNKOsoft\Pinnacle Game Profiler\pinnacle_updater.exe – (PinnacleUpdateSvc) SRV - File not found [On_Demand | Stopped] – C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe – (NMIndexingService) IE - HKU\S-1-5-21-1202660629-963894560-839522115-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://domredi.com/1/ IE - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\URLSearchHook: {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No CLSID value found IE - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\URLSearchHook: {F3FEE66E-E034-436a-86E4-9690573BEE8A} - No CLSID value found [2012-07-19 23:49:12 | 000,000,000 | —D | M] (IncrediMail MediaBar 2 Community Toolbar) – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\Mozilla\Firefox\Profiles\g8dcm4nl.default\extensions{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} [2011-11-12 22:22:02 | 000,000,000 | —D | M] (DealPly) – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\Mozilla\Firefox\Profiles\g8dcm4nl.default\extensions{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} O3 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Toolbar\ShellBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found. O3 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Toolbar\WebBrowser: (no name) - {687578B9-7132-4A7A-80E4-30EE31099E03} - No CLSID value found. O3 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Toolbar\WebBrowser: (no name) - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No CLSID value found. O4 - HKLM…\Run: [verclsid] C:\Documents and Settings\X\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\3843\verclsid.exe File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [] File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [EXPLORER.EXE] C:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [incrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [Microsoft Windows System] C:\Documents and Settings\Wera.DOM-0EEC5B84B09\P-7-78-8964-9648-3874\windll.exe File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [muvclyn] C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Ustawienia lokalne\Dane aplikacji\ljhsth.exe File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [sony PC Companion] “C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe” /Background File not found O4 - HKU\S-1-5-21-1202660629-963894560-839522115-1006…\Run: [wsctf.exe] wsctf.exe File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (EXPLORER.EXE) - C:\WINDOWS\System32\EXPLORER.EXE (Microsoft Corporation) [2012-07-13 09:50:07 | 000,036,864 | RHS- | C] (Microsoft Corporation) – C:\WINDOWS\System32\EXPLORER.EXE [2011-08-23 16:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Dane aplikacji\Babylon [2011-08-23 22:06:07 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera\Dane aplikacji\BabylonToolbar [2011-07-16 16:38:04 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera\Dane aplikacji\Search Settings [2011-10-22 19:34:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\BabylonToolbar [2012-07-11 18:11:34 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\PriceGong [2012-05-18 21:55:38 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\Search Settings [2012-06-19 07:21:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\Dane aplikacji\wtxpcom [2012-07-04 17:55:35 | 000,000,000 | —D | C] – C:\Documents and Settings\Wera.DOM-0EEC5B84B09\P-7-78-8964-9648-3874 :Files C:\Documents and Settings\All Users\Dane aplikacji\F4D561EA00042FBD5A4A472C8DB91C90 C:\Documents and Settings\All Users\Dane aplikacji\F4D561EA000081F95A4A472C8DB91C90 :Reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] “Shell”=“explorer.exe” [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

mustang30000 · 19 Lipiec 2012 22:22

raport: http://www.wklejto.pl/129319

OTL: http://www.wklejto.pl/129320

Atis · 19 Lipiec 2012 22:32

Wklej i kliknij Wykonaj skrypt:

Uruchom OTL i kliknij Sprzątanie.

Wyłącz i ponownie włącz przywracanie systemu:

http://support.microsoft.com/kb/310405/pl

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date