Wirusa - zamiana stron na ihavenet.com

juras22 · 27 Wrzesień 2013 09:05

Witam, mam problem z wirusem który ciągle zamienia strony na ihavenet.com i inne dziwne. Bardzo proszę o pomoc.

Atis · 27 Wrzesień 2013 09:59

Pobierz i uruchom AdwCleaner Kliknij Scan i później Clean.

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKU\S-1-5-21-620396149-3707142125-2982465656-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=112185 … af787d918a IE - HKU\S-1-5-21-620396149-3707142125-2982465656-1000…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=112185&tt=300912_TORP_4012_6&babsrc=SP_ss&mntrId=6cb9ad33000000000000deaf787d918a IE - HKU\S-1-5-21-620396149-3707142125-2982465656-1000…\SearchScopes{B32E5123-5F9C-4280-8D6E-0017AE42206E}: “URL” = http://websearch.ask.com/redirect?clien … &src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=278AF4A2-8F98-4C02-A4D9-D6E6500F1C7D&apn_sauid=DC19D2C2-9F7F-43AE-9657-85324998699A FF - prefs.js…browser.search.order.1: “Search the web (Babylon)” FF - prefs.js…keyword.URL: “http://search.babylon.com/?affID=112185&tt=300912_TORP_4012_6&babsrc=KW_ss&mntrId=6cb9ad33000000000000deaf787d918a&q=” [2012-09-12 12:32:52 | 000,002,299 | ---- | M] () – C:\Users\Juras\AppData\Roaming\mozilla\firefox\profiles\va4756jf.default\searchplugins\askcom.xml [2012-10-01 15:54:42 | 000,002,361 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml O4 - HKLM…\Run: [] File not found O4 - HKU\S-1-5-21-620396149-3707142125-2982465656-1000…\Run: [AYOURPKQZ] C:\Users\Juras\AppData\Roaming\d3dx9_30Q.dll () O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-620396149-3707142125-2982465656-1009…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinsta … s-i586.cab (Reg Error: Key error.) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Reg Error: Key error.) O16:64bit: - DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta … s-i586.cab (Reg Error: Key error.) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinsta … s-i586.cab (Reg Error: Key error.) [2012-06-25 20:00:25 | 000,442,368 | ---- | C] () – C:\Users\Juras\AppData\Local\eafokjunr.exe @Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences :Commands [emptytemp]

Kliknij Wykonaj skrypt i zatwierdź restart.

Pokaż raport z usuwania i nowy log Skanuj.