Ukash virus

[Pelee (Pele 97)]

Witam . Wczoraj wieczorem złapałem virusa Ukash. Jak usunac te dziadostwo OTL http://www26.zippyshare.com/v/99606597/file.html

[Acorus]

Odinstaluj Babylon Toolbar,facemoods Toolbar,Winamp Toolbar,Incredibar Toolbar.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL SRV - [2012-02-23 00:50:31 | 000,111,632 | ---- | M] (TMRG, Inc.) [Auto | Stopped] – C:\Program Files (x86)\RelevantKnowledge\rlservice.exe – (RelevantKnowledge) IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={E0698E19-E6CF-482C-A4B7-9C4DC5D005AE} IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKLM…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.) IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={E0698E19-E6CF-482C-A4B7-9C4DC5D005AE} IE - HKLM…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/red … 685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120614131807601&tb_oid=14-06-2012&tb_mrud=14-06-2012 IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.v9.com/idg/idg_1327265463_145649 IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={E0698E19-E6CF-482C-A4B7-9C4DC5D005AE} IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.) IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=3212_8&babsrc=SP_ss&mntrId=10cc67550000000000009439e578aa8f IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{2fa28606-de77-4029-af96-b231e3b8f827}: “URL” = http://eu.ask.com/web?q={searchterms}&l=dis&o=CPNTDF IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{C2B86BB8-85B7-441A-8841-6350521DB1BE}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=0F4F1A8B-1999-4A8C-8821-05A58E87AAD6&apn_sauid=93F9464D-2C23-4804-801D-64DDAC1F2617 IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: “URL” = http://mystart.incredibar.com/mb165/?search={searchTerms}&loc=IB_DS&a=6PQAxPuUtL&i=26 IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={E0698E19-E6CF-482C-A4B7-9C4DC5D005AE} IE - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/red … 685&query={searchTerms}&invocationType=tb50-ie-winamp-chromesbox-en-us&tb_uuid=20120614131807601&tb_oid=14-06-2012&tb_mrud=14-06-2012 FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\{3C5F0F00-683D-4847-89C8-E7AF64FD1CFB}: C:\Program Files (x86)\RelevantKnowledge [2012-08-06 11:04:40 | 000,000,000 | —D | M] CHR - Extension: RelevantKnowledge = C:\Users\Pele Girl\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0\ O3 - HKLM…\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.6.4.6\BabylonToolbarTlbr.dll (Babylon Ltd.) O3 - HKLM…\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM…\Toolbar: (facemoods Toolbar) - {DB4E9724-F518-4dfd-9C7C-78B52103CAB9} - C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodsTlbr.dll (facemoods.com) O3 - HKLM…\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files (x86)\Winamp Toolbar\winamptb.dll (AOL Inc.) O3 - HKLM…\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.) O3 - HKLM…\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD) O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKLM…\Run: [facemoods] C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.11\facemoodssrv.exe (facemoods.com) O4 - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\Run: [Microsoft Windows Manager] C:\Users\Pele Girl\M-10-6897-8685-3464\winmgr.exe () O4 - HKU\S-1-5-21-4209286470-2973691065-2542745175-1001…\Run: [RDReminder] File not found [2012-08-06 21:10:11 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge [2012-08-06 20:19:32 | 000,000,000 | —D | C] – C:\Users\Pele Girl\AppData\Roaming\hellomoto [2012-08-06 21:31:20 | 000,005,245 | ---- | M] () – C:\user.js [2012-07-31 01:38:49 | 000,000,456 | -H-- | M] () – C:\Windows\tasks\Norton Security Scan for Pele Girl.job :Commands [emptytemp] [resrthosts]

Kliknij Wykonaj skrypt.

Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

[Pelee (Pele 97)]

Nadal mam tego wirusa o to mój OTL tak jak mówiłeś

http://www57.zippyshare.com/v/14511265/file.html

[Acorus]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4:64bit: - HKLM…\Run: [RstrtMgr] C:\Users\Pele Girl\AppData\Local\Microsoft\Windows\194\RstrtMgr.exe () [2012-08-03 17:21:58 | 000,000,000 | RHSD | C] – C:\Users\Pele Girl\M-10-6897-8685-3464 [2012-08-07 17:02:22 | 000,001,210 | ---- | M] () – C:\prefs.js [2012-08-01 22:15:29 | 000,000,300 | ---- | M] () – C:\Windows\tasks\DLL-files.com Fixer_UPDATES.job :Files C:\Users\Pele Girl\AppData\Local\Microsoft\Windows\194 :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.Użyj AdwCleaner http://general-changelog-team.fr/outils/289-adwcleaner z funkcji Delete(w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator).

Wyłącz i włącz przywracanie systemu.

http://www.searchengines.pl/Czyszczenie … 41981.html

Zainstaluj aktualizacje do programow wskazanych przez Security Check

analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html jako out of date.

[Pelee (Pele 97)]

Zrobiłem tak jak w instrukcji i podziałało nie mam juz virusa . Dziekuje Bardzo Piwo Się należy . Temat do zamkniecia