Zablokowany komputer przez UKASH

sebszc · 17 Lipiec 2012 19:19

Witam,

Tak jak w temacie komputer został zablokowany przez wirus UKASH. Skorzystałem z programu OTL i proszę o analizę logów.

OLT

http://www.wklej.org/id/792519/

Extras

http://www.wklej.org/id/792516/

Z góry dzięki

Atis · 17 Lipiec 2012 19:58

Po wykonaniu skryptu odinstaluj:

Softonic Toolbar

uTorrentControl2 Toolbar

Babylon Toolbar

SweetPacks Toolbar for Internet Explore

Browsers Protector

Giant Savings

Yontoo

Contextual Tool Extrafind

Do okna Własne opcje skanowania / skrypt wklej:

:OTL IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com IE - HKLM…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?src=6&q={searchTerms} IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=2ec5c14e- … 27889e8801 IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\SearchScopes{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: “URL” = http://startsear.ch/?aff=1&src=sp&cf=2e … 89e8801&q={searchTerms} IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\SearchScopes{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: “URL” = http://search.babylon.com/?q={searchTerms}&affID=110819&tt=280612_8_&babsrc=SP_ss&mntrId=e0da49ea000000000000d027889e8801 IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\SearchScopes{2EC33912-A8FA-4BD5-ACE1-5106D694B089}: “URL” = http://search.softonic.com/MON00005/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=985 IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\SearchScopes{D0A60D9B-76FD-432C-9602-7D97BE488A8F}: “URL” = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 IE - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\SearchScopes{EEE6C360-6118-11DC-9C72-001320C79847}: “URL” = http://search.sweetim.com/search.asp?src=6&q={searchTerms} FF - prefs.js…browser.search.defaultenginename: “Web Search” FF - prefs.js…browser.search.defaultthis.engineName: “uTorrentControl2 Customized Web Search” FF - prefs.js…browser.search.defaulturl: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=3&q={searchTerms}” FF - prefs.js…browser.search.order.1: “Web Search” FF - prefs.js…browser.search.selectedEngine: “uTorrentControl2 Customized Web Search” FF - prefs.js…browser.startup.homepage: “http://search.conduit.com/?ctid=CT3072253&SearchSource=13” FF - prefs.js…keyword.URL: “http://search.conduit.com/ResultsExt.aspx?ctid=CT3072253&SearchSource=2&q=” [2012-06-29 12:37:59 | 000,000,000 | —D | M] (uTorrentControl2 Community Toolbar) – C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\ozb5efel.default\extensions{687578b9-7132-4a7a-80e4-30ee31099e03} [2012-06-29 12:32:46 | 000,000,000 | —D | M] (“Giant Savings”) – C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\ozb5efel.default\extensions\crossriderapp4479@crossrider.com [2012-05-14 14:42:52 | 000,000,000 | —D | M] (Babylon) – C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\ozb5efel.default\extensions\ffxtlbr@babylon.com [2012-06-11 20:29:04 | 000,000,000 | —D | M] (softonic.com) – C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\ozb5efel.default\extensions\ffxtlbra@softonic.com [2012-05-14 14:07:03 | 000,000,000 | —D | M] (Yontoo) – C:\Users\Paweł\AppData\Roaming\mozilla\Firefox\Profiles\ozb5efel.default\extensions\plugin@yontoo.com [2012-06-07 21:16:04 | 000,000,935 | ---- | M] () – C:\Users\Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\ozb5efel.default\searchplugins\conduit.xml [2012-06-11 20:28:30 | 000,002,060 | ---- | M] () – C:\Users\Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\ozb5efel.default\searchplugins\softonic.xml [2012-05-03 17:47:08 | 000,000,792 | ---- | M] () – C:\Users\Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\ozb5efel.default\searchplugins\startsear.xml [2012-05-08 18:01:01 | 000,003,915 | ---- | M] () – C:\Users\Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\ozb5efel.default\searchplugins\sweetim.xml [2012-01-02 11:48:42 | 000,083,456 | ---- | M] (StartSearch ) – C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll [2012-06-29 12:32:51 | 000,002,352 | ---- | M] () – C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml O3:64bit: - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O3 - HKLM…\Toolbar: (no name) - Locked - No CLSID value found. O4 - HKU\S-1-5-21-1569084167-1080080841-3581068429-1001…\Run: [hfxylpnjjvucmht] C:\ProgramData\hfxylpnj.exe () O4 - HKU\S-1-5-19…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20…\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found [2012-07-13 10:51:09 | 000,000,000 | —D | C] – C:\ProgramData\gsrgtgvrjqnbtdo [2012-07-13 10:51:12 | 000,000,051 | ---- | M] () – C:\ProgramData\jknxmltwfdscsaw [2012-07-13 10:51:05 | 000,049,152 | ---- | M] () – C:\ProgramData\hfxylpnj.exe [2012-07-13 10:51:05 | 000,049,152 | ---- | M] () – C:\Users\Paweł\0.004897628494321293.exe [2012-06-29 12:33:53 | 000,000,820 | ---- | M] () – C:\user.js [2012-05-13 18:39:22 | 000,000,000 | —D | M] – C:\Users\Paweł\AppData\Roaming\Babylon [2012-06-29 12:34:12 | 000,000,000 | —D | M] – C:\Users\Paweł\AppData\Roaming\BabylonToolbar :Commands [emptytemp]