Ukash - zablokowany komputer

[noowaq (Lukass11)]

Witam.

Komputer został zablokowany. Wyświetla się jedynie informacja o konieczności dokonania wpłaty celem odblokowania.

Uruchomiłem komputer w trybie awaryjnym i wykonałem logi.

BArdzo proszę o pomoc i z góry dziękuję.

http://wklej.org/id/797621/

http://wklej.org/id/797622/

[Atis]

Odinstaluj:

McAfee Security Scan Plus

Ask Toolbar

Ask Toolbar Updater

AutocompletePro

RelevantRelevantKnowledge

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=10 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1098640 IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=10&q={searchTerms} IE - HKLM…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/sli … 685&query={searchTerms}&invocationType=tb50winampie7 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=10 IE - HKCU…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=vsl&s={searchTerms}&f=4 IE - HKCU…\SearchScopes{8A5228D7-942D-4CA4-8045-57D9644312A6}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=YYYYYYYYPL&apn_uid=8364B5D1-1AE0-491E-84AC-BF48E829EAA7&apn_sauid=30392B0D-2650-4A68-900D-C76F9E410657 IE - HKCU…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search/web?q={searchTerms} IE - HKCU…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1098640 IE - HKCU…\SearchScopes{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: “URL” = http://mystart.incredimail.com/english/?search={searchTerms}&loc=search_box_fs IE - HKCU…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=10&q={searchTerms} IE - HKCU…\SearchScopes{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: “URL” = http://slirsredirect.search.aol.com/sli … 685&query={searchTerms}&invocationType=tb50winampie7 FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “SweetIM Search” FF - prefs.js…browser.search.defaultthis.engineName: “free-downloads.net Customized Web Search” FF - prefs.js…browser.search.order.1: “Ask.com” FF - prefs.js…browser.search.selectedEngine: “SweetIM Search” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&q=” FF - prefs.js…sweetim.toolbar.previous.browser.search.defaultenginename: “Ask.com” FF - prefs.js…sweetim.toolbar.previous.browser.search.selectedEngine: “Ask.com” [2012-07-16 14:33:20 | 000,000,000 | —D | M] (free-downloads.net Community Toolbar) – C:\Users\cyron\AppData\Roaming\mozilla\Firefox\Profiles\zeqigltt.default\extensions{ecdee021-0d17-467f-a1ff-c7a115230949} [2011-10-16 00:04:58 | 000,000,000 | —D | M] (Vividas player plugin) – C:\Users\cyron\AppData\Roaming\mozilla\Firefox\Profiles\zeqigltt.default\extensions\player@vividas.com [2012-04-20 15:52:39 | 000,002,580 | ---- | M] () – C:\Users\cyron\AppData\Roaming\Mozilla\Firefox\Profiles\zeqigltt.default\searchplugins\askcom.xml [2010-01-20 13:16:28 | 000,000,939 | ---- | M] () – C:\Users\cyron\AppData\Roaming\Mozilla\Firefox\Profiles\zeqigltt.default\searchplugins\conduit.xml [2011-06-09 20:32:58 | 000,002,059 | ---- | M] () – C:\Users\cyron\AppData\Roaming\Mozilla\Firefox\Profiles\zeqigltt.default\searchplugins\daemon-search.xml [2011-10-19 12:36:11 | 000,000,000 | —D | M] (RelevantKnowledge) – C:\PROGRAM FILES (X86)\RELEVANTKNOWLEDGE [2010-05-23 13:31:09 | 000,000,000 | —D | M] (“AutocompletePro - Your handy search suggestions tool”) – C:\PROGRAM FILES (X86)\AUTOCOMPLETEPRO\SUPPORT@PREDICTAD.COM [2011-03-04 17:38:30 | 000,002,046 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\fcmdSrchvsl.xml O3 - HKLM…\Toolbar: (no name) - - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found. O3 - HKCU…\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found. O4 - HKLM…\Run: [] File not found O4 - HKLM…\Run: [pdfSaver3] File not found O4 - HKLM…\Run: [WinampAgent] “C:\Program Files (x86)\Winamp\winampa.exe” File not found O4 - HKCU…\Run: [EA Core] “C:\Program Files (x86)\Electronic Arts\EADM\Core.exe” -silent File not found O4 - HKCU…\Run: [Komunikator] C:\Program Files (x86)\Tlen.pl\tlen.exe File not found O4 - HKCU…\Run: [RpcEpMap] C:\Users\cyron\AppData\Local\Microsoft\Windows\3696\RpcEpMap.exe () [2012-07-23 22:01:08 | 000,000,000 | —D | C] – C:\Users\cyron\AppData\Roaming\hellomoto [2010-03-19 19:38:59 | 000,000,640 | ---- | C] () – C:\Users\cyron\AppData\Roaming\wklnhst.dat [2011-07-31 18:07:08 | 000,106,191 | ---- | C] () – C:\Users\cyron\0.4539179957890003.exe [2011-07-31 18:07:07 | 000,149,327 | ---- | C] () – C:\Users\cyron\0.13171361074113397.exe [2011-07-31 18:07:07 | 000,119,671 | ---- | C] () – C:\Users\cyron\0.1808522611256036.exe [2011-07-31 18:07:07 | 000,118,323 | ---- | C] () – C:\Users\cyron\0.5513077241123682.exe [2011-07-31 18:07:06 | 000,181,679 | ---- | C] () – C:\Users\cyron\0.6468182710975221.exe [2011-07-21 16:39:23 | 000,000,000 | ---- | C] () – C:\Users\cyron\AppData\Local{F3D850EE-3678-42F0-9D30-45B89D399A49} :Files C:\Users\cyron\AppData\Local\Microsoft\Windows\3696 :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

[noowaq (Lukass11)]

Nie można usunąć programu Ask Toolbar. Reszta usunięta.

Komputer po uruchomieniu działa normalnie. Bardzo dziękuję za pomoc.

Czy coś należy jeszcze teraz wykonać aby nie powtórzyło się to.

http://wklej.org/id/797717/

http://wklej.org/id/797718/

[Atis]

Wklej i kliknij Wykonaj skrypt:

:OTL O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O3:64bit: - HKLM…\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found O3 - HKLM…\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM…\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask) O4 - HKCU…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found @Alternate Data Stream - 24 bytes -> C:\Windows:FA9F16AF1C7EEDA8 :Files C:\Program Files (x86)\Ask.com :Reg [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{86D4B82A-ABED-442A-BE86-96357B70F4FE}] [-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall{79A765E1-C399-405B-85AF-466F52E918B0}]

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date

Dysk przeskanuj Malwarebytes-AntiMalware.

Podczas instalacji kliknij Odrzuć żeby zainstalować tylko darmowy skaner.

http://www.dobreprogramy.pl/Malwarebyte … 13117.html

[noowaq (Lukass11)]

Dziękuję bardzo za pomoc.

Temat zamknięty.