Wirus Ukash - prośba o pomoc

Pojawił się niespodziewanie.

OLT

http://www.wklejto.pl/133639

Extras

http://www.wklejto.pl/133640

z góry Bóg zapłać za pomoc!

Poniżej przedstawiam instrukcję usuwania. Jeżeli chcesz zapisz ją albo wydrukuj, jeżeli nie jesteś biegły w komputerach.

  • [*:3suo85oq]Uruchom OTL 8a17003bc16f962f.jpg

Nowy log OTL

http://www.wklejto.pl/133643

Raport z usuwania OTL

All processes killed

========== OTL ==========

64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins@microsoft.com/GENUINE\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins@Apple.com/iTunes,version=\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins@microsoft.com/GENUINE\ deleted successfully.

C:\Users\MSz\AppData\Roaming\mozilla\firefox\profiles\xggyk1ix.default\searchplugins\search.xml moved successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Locked deleted successfully.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\Locked deleted successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\hlgpvqx deleted successfully.

C:\Users\MSz\AppData\Roaming\pngjhyndv_S.exe moved successfully.

64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell:C:\ProgramData\pngjhyndv_S deleted successfully.

C:\ProgramData\pngjhyndv_S.exe moved successfully.

File C:\Users\MSz\AppData\Roaming\pngjhyndv_S.exe not found.

C:\Users\MSz\AppData\Local\pngjhyndv_S.exe moved successfully.

File C:\ProgramData\pngjhyndv_S.exe not found.

C:\Users\MSz\uidsave.dat moved successfully.

ADS C:\ProgramData\Temp:5C270C64 deleted successfully.

========== REGISTRY ==========

Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\ deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Gość

->Temp folder emptied: 25061517 bytes

->Temporary Internet Files folder emptied: 984312 bytes

User: MSz

->Temp folder emptied: 354497082 bytes

->Temporary Internet Files folder emptied: 225268912 bytes

->Java cache emptied: 12270084 bytes

->FireFox cache emptied: 1167317960 bytes

->Flash cache emptied: 86493 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32 (64bit) .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 120424358 bytes

%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 776373 bytes

%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 755 bytes

%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 46426767 bytes

RecycleBin emptied: 313678833 bytes

Total Files Cleaned = 2,162.00 mb

OTL by OldTimer - Version 3.2.63.0 log created on 09182012_165234

Files\Folders moved on Reboot…

File move failed. C:\Users\Gość\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.

File move failed. C:\windows\temp_avast5_\Webshlock.txt scheduled to be moved on reboot.

C:\windows\temp\sqlite_7nhaRSMwXzXUIX2 moved successfully.

C:\windows\temp\sqlite_b9hWq9MaFSNCI2i moved successfully.

C:\windows\temp\sqlite_DG0qasgKo5V91NU moved successfully.

PendingFileRenameOperations files…

Registry entries deleted on Reboot…

Uruchom OTL. W okno Własne opcje skanowana / skrypt wklej (zaczynając od dwukropka)

Kliknij Wykonaj skrypt. Zgódź się na ponowne uruchomienie (restart).

Po wszystkim pokazujesz nowy log Skanuj i raport z usuwania OTL.