Komputer został zablokowany z powodu naruszenia praw Polski.

[sejanus]

Witam,

 

mam problem z ta infekcja..

 

Przesylam logi:

 

OTL http://www.wklej.org/id/792065/

EXTRAS http://www.wklej.org/id/792067/

 

Bardzo prosze o pomoc.

[Landuss]

1. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://startsear.ch/?aff=2&cf=708245c4-1b91-11e1-8401-0025228d0c8c"
IE - HKLM\..\SearchScopes,DefaultScope = {AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
IE - HKLM\..\SearchScopes\{82177AEB-7169-4987-BEB4-D05A2BAE0D27}: "URL" =: "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050:"
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = :"http://search.sweetim.com/search.asp?src=6&q={searchTerms}:"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://search.conduit.com?SearchSource=10&ctid=CT2269050"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/web/{searchTerms}?babsrc=SP_ss&affID=100395&mntrId=ecb252650000000000000025228d0c8c"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{34561F82-D007-4C3C-9173-286041BEB176}: "URL" = "http://websearch.ask.com/redirect?client=ie&tb=NRO&o=101913&src=crm&q={searchTerms}&locale=&apn_ptnrs=EW&apn_dtid=YYYYYYYYPL&apn_uid=CFAEE7A6-A000-4435-93EF-45EFE9E3F29A&apn_sauid=17E9FA5B-4C74-4A50-BD21-F9B1DBAD9612"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{82177AEB-7169-4987-BEB4-D05A2BAE0D27}: "URL" = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = "http://www.daemon-search.com/search/web?q={searchTerms}"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}: "URL" = "http://startsear.ch/?aff=2&src=sp&cf=708245c4-1b91-11e1-8401-0025228d0c8c&q={searchTerms}"
IE - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&q={searchTerms}"
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Plasmoo"
FF - prefs.js..browser.search.defaultthis.engineName: "Plasmoo"
FF - prefs.js..browser.search.defaulturl: "http://plasmoo.com/index.htm?SearchMashine=true&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Plasmoo"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2269050&SearchSource=13"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Search the web (Babylon)"
FF - prefs.js..browser.startup.homepage: "http://search.babylon.com/?babsrc=HP_ss&affID=100395&mntrId=ecb252650000000000000025228d0c8c"
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "http://search.babylon.com/?babsrc=adbartrp&affID=100395&mntrId=ecb252650000000000000025228d0c8c&q="
[2011-07-26 19:19:58 | 000,002,333 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\askcom.xml
[2011-09-27 13:49:34 | 000,000,931 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\conduit.xml
[2011-04-21 22:21:54 | 000,002,059 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\daemon-search.xml
[2011-04-28 19:42:58 | 000,001,975 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\plasmoo.xml
[2011-07-11 20:04:02 | 000,000,633 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\startsear.xml
[2011-09-04 17:25:56 | 000,003,915 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\SweetIM Search.xml
[2011-09-04 17:26:30 | 000,003,915 | ---- | M] () -- C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\el9qseqt.default\searchplugins\sweetim.xml
[2011-10-27 15:45:50 | 000,083,456 | ---- | M] (LiveVDO ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2011-09-04 17:38:03 | 000,002,288 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O4:64bit: - HKLM..\Run: [VIAAUD] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VIAAUD.exe File not found
O4 - HKLM..\Run: []  File not found
O4 - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000..\Run: [ASRockIES]  File not found
O4 - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000..\Run: [ASRockOCTuner]  File not found
O4 - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000..\Run: [WSDPrintProxy] C:\Users\admin\AppData\Local\Microsoft\Windows\813\WSDPrintProxy.exe ()
O4 - HKU\S-1-5-21-3329462286-3825599418-2333581751-1000..\Run: [zASRockInstantBoot]  File not found
 
:Files
C:\Users\admin\AppData\Roaming\hellomoto
C:\Users\admin\AppData\Local\Microsoft\Windows\813
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

2. Przez Panel sterowania odinstaluj: Ask Toolbar / SweetIM Toolbar for Internet Explorer 4.2 / Babylon toolbar on IE / Conduit Engine / DAEMON Tools Toolbar / DVDVideoSoftTB Toolbar / LiveVDO plugin 1.3 / XfireXO Toolbar / StartSearchToolBar / Splashtop Connect IE

 

Otwórz Firefox i w Dodatkach odmontuj: XfireXO / DVDVideoSoftTB Community Toolbar / SweetIM Toolbar for Firefox / DAEMON Tools Toolbar / Babylon / Nero Toolbar

 

3. Uruchom AdwCleaner z opcji Delete

 

4. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras)

Edytowane 18 Sierpnia 2012 przez picasso
18.08.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso