Wirus Ukash

[skoku92 (Maakolol)]

Witam, jako już któryś z kolei proszę o pomoc z rozprawieniem się tym wirusem. Sam niestety nie daje rady…

http://www.wklej.org/id/810546/

http://www.wklej.org/id/810547/

[Acorus]

Odinstaluj VshareComplete,Babylon toolbar on IE,express-files Toolbar,vShare.tv plugin 1.3.Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C} IE - HKLM…\URLSearchHook: {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.) IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C} IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C} IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\URLSearchHook: {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.) IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=5f … 83f939f&q={searchTerms} IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=109980&babsrc=SP_ss&mntrId=f8b072230000000000001c659d7d63d3 IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\SearchScopes{79C50760-CCC6-4923-A2F0-EF03B223113B}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3176921 IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?sr … 0&st=12&q={searchTerms}&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C} IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\SearchScopes{F593B7B9-740A-4D30-B485-F2F4021AE727}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=308877F3-E104-4A87-BD5B-299B6A99643E&apn_sauid=4121249D-8DF3-48CB-9EE4-2646F8AC88D1 FF - prefs.js…browser.search.defaultengine: “Ask.com” FF - prefs.js…browser.search.defaultenginename: “Search the web (Babylon)” FF - prefs.js…browser.search.defaultthis.engineName: “express-files Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…browser.startup.homepage: “http://search.conduit.com/?ctid=CT3176921&SearchSource=13” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=2&q=” FF - prefs.js…sweetim.toolbar.previous.browser.search.selectedEngine: “Web Search” FF - prefs.js…browser.startup.homepage: “http://startsear.ch/?aff=1&cf=5fde05f6-1616-11e1-924e-1c75083f939f” [2011-11-23 23:02:32 | 000,000,000 | —D | M] (VshareComplete - Speed up your search with your personal search suggestions tool) – C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions{3697b17c-b572-4862-a5e6-7f922c0f3403} [2012-07-16 23:43:13 | 000,000,000 | —D | M] (express-files Community Toolbar) – C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions{88ac3cb6-596b-4217-964c-b6757ef9602d} [2012-03-01 16:33:20 | 000,000,000 | —D | M] (Babylon) – C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions\ffxtlbr@babylon.com [2012-04-27 14:07:29 | 000,002,331 | ---- | M] () – C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\askcom.xml [2012-03-27 18:32:16 | 000,000,929 | ---- | M] () – C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\conduit.xml [2011-07-11 20:04:02 | 000,000,633 | ---- | M] () – C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\startsear.xml [2012-01-31 00:34:18 | 000,003,915 | ---- | M] () – C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\SweetIM Search.xml [2012-06-29 08:42:07 | 000,003,915 | ---- | M] () – C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\sweetim.xml O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\Toolbar\WebBrowser: (express-files Toolbar) - {88AC3CB6-596B-4217-964C-B6757EF9602D} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.) O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\Run: [WinSyncMetastore] C:\Users\Maciek\AppData\Local\Microsoft\Windows\824\WinSyncMetastore.exe () O4 - HKU.DEFAULT…\RunOnce: [] File not found O4 - HKU\S-1-5-18…\RunOnce: [] File not found O4 - HKU\S-1-5-19…\RunOnce: [] File not found O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [] File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found [2012-08-14 09:10:29 | 000,000,000 | —D | C] – C:\Users\Maciek\AppData\Roaming\hellomoto [2012-07-28 19:18:22 | 000,000,000 | —D | C] – C:\ProgramData\uxtwlyoetzjokyp [2012-07-28 19:18:23 | 000,000,051 | ---- | M] () – C:\ProgramData\xppnedmjlqspjvx [2012-08-13 15:16:31 | 000,001,060 | ---- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1799577974-3061418218-2982351228-1001Core.job [2012-08-14 08:53:06 | 000,001,082 | ---- | M] () – C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1799577974-3061418218-2982351228-1001UA.job :Files C:\Users\Maciek\AppData\Local\Microsoft\Windows\824 :Commands [emptytemp]

Kliknij Wykonaj skrypt.

Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

[skoku92 (Maakolol)]

coś takiego wyszło

http://wklej.org/id/810588/

http://wklej.org/id/810590/

[Acorus]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL FF - prefs.js…browser.startup.homepage: “http://search.conduit.com/?ctid=CT3176921&SearchSource=13” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=2&q=” CHR - Extension: VshareComplete plugin for chrome = C:\Users\Maciek\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfienamagdnkekbbbocojppncdambda\1.1_0\ O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001…\Toolbar\WebBrowser: (no name) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found. O4 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1000…\RunOnce: [] File not found O4 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1000…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.

Wyłącz i włącz przywracanie systemu.

http://www.searchengines.pl/Czyszczenie … 41981.html

Zainstaluj aktualizacje do programow wskazanych przez Security Check

analiza-dezynfekcja-zestaw-narzedzi-nieingerencyjnych-t485632.html jako out of date.

Przeskanuj programem Dr.WEB CureIt http://www.dobreprogramy.pl/Dr.WEB-Cure … 12976.html

[skoku92 (Maakolol)]

wielkie dzieki