Wirus UKASH

[Nowik92]

OTL : http://www.wklej.org/id/811022/

Extras : http://www.wklej.org/id/811024/

[Atis]

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchya.com/?s=0&a=foxtab&c … =226212913 IE:64bit: - HKLM…\SearchScopes{30F5AB16-9F1E-4E99-93F2-ECB9ABB0EC12}: “URL” = http://www.searchya.com/?q={searchTerms}&s=1&a=foxtab&chnl=ft-100&cd=2XzuyEtN2Y1L1QzutDtDtC0F0CyC0EzyzzzyzytDzz0D0FtCtN0D0Tzu0CtBtByBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=226212913 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchya.com/?s=0&a=foxtab&c … =226212913 IE - HKLM…\SearchScopes{30F5AB16-9F1E-4E99-93F2-ECB9ABB0EC12}: “URL” = http://www.searchya.com/?q={searchTerms}&s=1&a=foxtab&chnl=ft-100&cd=2XzuyEtN2Y1L1QzutDtDtC0F0CyC0EzyzzzyzytDzz0D0FtCtN0D0Tzu0CtBtByBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=226212913 IE - HKU\S-1-5-21-2723606837-3964975266-2330715485-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = http://search.babylon.com/?affID=112555 … 1fc6e98990 IE - HKU\S-1-5-21-2723606837-3964975266-2330715485-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchya.com/?s=0&a=foxtab&c … =226212913 IE - HKU\S-1-5-21-2723606837-3964975266-2330715485-1001…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=112555&tt=2912_5&babsrc=SP_ss&mntrId=92a58df1000000000000001fc6e98990 IE - HKU\S-1-5-21-2723606837-3964975266-2330715485-1001…\SearchScopes{30F5AB16-9F1E-4E99-93F2-ECB9ABB0EC12}: “URL” = http://www.searchya.com/?q={searchTerms}&s=1&a=foxtab&chnl=ft-100&cd=2XzuyEtN2Y1L1QzutDtDtC0F0CyC0EzyzzzyzytDzz0D0FtCtN0D0Tzu0CtBtByBtN1L2XzutBtFtCtFtCtFtAtCtB&cr=226212913 FF - prefs.js…browser.search.defaultenginename: “Search” FF - prefs.js…browser.search.selectedEngine: “Search” [2012-08-14 19:52:16 | 000,002,335 | ---- | M] () – C:\Users\Nowik\AppData\Roaming\Mozilla\Firefox\Profiles\yrhq20st.default\searchplugins\Search.xml [2012-07-16 20:35:39 | 000,002,349 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml O4:64bit: - HKLM…\Run: [TRACERT] C:\Users\Nowik\AppData\Local\Microsoft\Windows\4454\TRACERT.exe () [2012-08-14 02:30:36 | 000,000,000 | —D | C] – C:\Users\Nowik\AppData\Roaming\hellomoto [2012-07-31 19:24:49 | 000,000,000 | —D | C] – C:\Qoobox [2012-07-16 20:35:16 | 000,000,000 | —D | C] – C:\Users\Nowik\AppData\Local\Babylon [2012-08-14 19:51:39 | 000,000,000 | —D | C] – C:\Program Files (x86)\SearchYa! [2012-07-16 20:35:16 | 000,000,000 | —D | C] – C:\ProgramData\Babylon [2012-07-16 20:35:15 | 000,000,000 | —D | C] – C:\Users\Nowik\AppData\Roaming\Babylon :Files C:\Users\Nowik\AppData\Local\Microsoft\Windows\4454 :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.

[Nowik92]

Raport : http://www.wklej.org/id/811037/

Nowy log : http://www.wklej.org/id/811038/

[Atis]

Uruchom OTL i kliknij Sprzątanie.

Usuń stare punkty przywracania:

Aby usunąć wszystkie punkty przywracania

Uruchom SecurityCheck i aktualizuj programy oznaczone jako Out of date