Wirus Ukash

Aroo27 · 17 Sierpień 2012 20:56

Bardzo proszę o pomoc w usunięciu “Ukash’a”.

OTL:

http://www.wklej.org/hash/259c0d5e930/

EXTRAS:

http://www.wklej.org/hash/0061afddf51/

Wielkie dzięki za pomoc, mogę dodać, że wcześniej tuż po wystąpieniu wirusa system skanowałem programem “HitmanPro36”. Jednak nic on nie pomógł.

Atis · 17 Sierpień 2012 21:08

Do okna Własne opcje skanowania / skrypt wklej:

:OTL SRV - File not found [On_Demand | Stopped] – C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe – (ACDaemon) DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\mcdbus.sys – (mcdbus) IE - HKLM…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4&hl={language}&src=chrm IE - HKLM…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 IE - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - No CLSID value found IE - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\SearchScopes{0D7562AE-8EF6-416d-A838-AB665251703A}: “URL” = http://start.facemoods.com/?a=ppcb&s={searchTerms}&f=4 IE - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\SearchScopes{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: “URL” = http://www.daemon-search.com/search?q={searchTerms} IE - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\SearchScopes{afdbddaa-5d3f-42ee-b79c-185a7020515b}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 FF - prefs.js…browser.search.defaultthis.engineName: “uTorrentControl2 Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}” FF - prefs.js…extensions.enabledItems: toolbar@ask.com:3.11.3.15590 FF - prefs.js…extensions.enabledItems: ffxtlbr@Facemoods.com:1.2.1 [2012-04-18 00:39:24 | 000,000,935 | ---- | M] () – C:\Users\Wróbel\AppData\Roaming\Mozilla\Firefox\Profiles\1h5v38in.default\searchplugins\conduit.xml [2010-03-03 15:51:20 | 000,002,055 | ---- | M] () – C:\Users\Wróbel\AppData\Roaming\Mozilla\Firefox\Profiles\1h5v38in.default\searchplugins\daemon-search.xml [2010-10-26 17:57:38 | 000,002,036 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\fcmdSrchppcb.xml O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found. O3 - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKU\S-1-5-21-1215052716-2708122977-15993345-1000…\Run: [agutzzhgajusckw] C:\ProgramData\agutzzhg.exe (Hyundai) [2012-08-17 21:19:28 | 000,091,136 | ---- | C] (Hyundai) – C:\ProgramData\agutzzhg.exe [2012-08-17 21:19:28 | 000,000,000 | —D | C] – C:\ProgramData\ftovrmnuaydfvav [2012-08-17 21:19:07 | 000,091,136 | ---- | C] (Hyundai) – C:\Users\Wróbel\ms.exe [2012-08-17 21:19:28 | 000,000,051 | ---- | M] () – C:\ProgramData\gdkwyzlzenwsgpl [2012-08-16 21:00:00 | 000,000,364 | ---- | M] () – C:\Windows\tasks\RegTask.job [2012-01-03 16:00:09 | 000,000,000 | RHSD | M] – C:\Users\Wróbel\AppData\Roaming\install :Files C:\Users\Wróbel\AppData\Local\Temp*.html :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.