"Komputer został zablokowany.." problem z ukash

[bartek1877]

Tak jak w temacie mam ten sam problem co wiekszoscbardzo prosze o pomoc zalanczam logi.

OTL.Txt

Extras.Txt

[Landuss]

Trochę pocięty ten twój system (modyfikowany) i nie jest to normalny XP.

 

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

 

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\UIUSYS.SYS -- (UIUSys)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = "http://home.sweetim.com/?crg=3.1010000&st=12&barid={81D38632-8A80-4E26-83C0-6DB384683C74}"
IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={81D38632-8A80-4E26-83C0-6DB384683C74}"
IE - HKCU\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847}
IE - HKCU\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={81D38632-8A80-4E26-83C0-6DB384683C74}"
FF - prefs.js..browser.search.defaultenginename: "SweetIM Search"
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {EEE6C35B-6118-11DC-9C72-001320C79847} - No CLSID value found.
O4 - HKLM..\Run: [uzqcqotttzgcras] C:\Documents and Settings\All Users\Dane aplikacji\uzqcqott.exe ()
O4 - HKCU..\Run: [uzqcqotttzgcras] C:\Documents and Settings\All Users\Dane aplikacji\uzqcqott.exe (
 
:Files
C:\Documents and Settings\JA\ms.exe
C:\Documents and Settings\All Users\Dane aplikacji\lfcavhhy.exe
C:\Documents and Settings\All Users\Dane aplikacji\uyqsltdt.exe
C:\Documents and Settings\All Users\Dane aplikacji\ndjamozy.exe
C:\Documents and Settings\All Users\Dane aplikacji\lsmvxszpaipsnlc
C:\Documents and Settings\All Users\Dane aplikacji\fcmowscyoudnbbo
 
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CiSvc]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv]
"Start"=dword:00000004
 
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

 

Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras)

[bartek1877]

cos takiego wyszlo

 

 

All processes killed

========== OTL ==========

Service UIUSys stopped successfully!

Service UIUSys deleted successfully!

File system32\DRIVERS\UIUSYS.SYS not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C360-6118-11DC-9C72-001320C79847}\ not found.

Prefs.js: "SweetIM Search" removed from browser.search.defaultenginename

Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EEE6C35B-6118-11DC-9C72-001320C79847} deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847}\ not found.

Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\uzqcqotttzgcras deleted successfully.

C:\Documents and Settings\All Users\Dane aplikacji\uzqcqott.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uzqcqotttzgcras deleted successfully.

File C:\Documents and Settings\All Users\Dane aplikacji\uzqcqott.exe ( not found.

========== FILES ==========

C:\Documents and Settings\JA\ms.exe moved successfully.

C:\Documents and Settings\All Users\Dane aplikacji\lfcavhhy.exe moved successfully.

C:\Documents and Settings\All Users\Dane aplikacji\uyqsltdt.exe moved successfully.

C:\Documents and Settings\All Users\Dane aplikacji\ndjamozy.exe moved successfully.

C:\Documents and Settings\All Users\Dane aplikacji\lsmvxszpaipsnlc moved successfully.

C:\Documents and Settings\All Users\Dane aplikacji\fcmowscyoudnbbo folder moved successfully.

========== REGISTRY ==========

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UPS\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srservice\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\seclogon\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ERSvc\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CiSvc\\"Start"|dword:00000004 /E : value set successfully!

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ClipSrv\\"Start"|dword:00000004 /E : value set successfully!

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

User: JA

->Temp folder emptied: 616425777 bytes

->Temporary Internet Files folder emptied: 1600361 bytes

->FireFox cache emptied: 896085333 bytes

->Google Chrome cache emptied: 6439487 bytes

->Flash cache emptied: 55373 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2100541 bytes

%systemroot%\System32 .tmp files removed: 2596 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 2941354 bytes

RecycleBin emptied: 4822021550 bytes

 

Total Files Cleaned = 6 054,00 mb

 

 

OTL by OldTimer - Version 3.2.54.0 log created on 07192012_111145

 

Files\Folders moved on Reboot...

 

PendingFileRenameOperations files...

 

Registry entries deleted on Reboot...

[Landuss]

To jest log z usuwania a miałeś zrobić nowy ze skanu, pisałem:

 

Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowy log z OTL (bez extras)

Edytowane 21 Sierpnia 2012 przez picasso
21.08.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso