Zablokowany system

[john12012]

Prosze o pomoc stalo mi sie to samo ale nie wiem jak to naprawic ?

Extras.Txt

OTL.Txt

[picasso]

1. Uruchom OTL i w sekcji Własne opcje skanowania / skrypt wklej:

 

:OTL
O4 - HKLM..\Run: [Anti-Blaxx Manager] C:\Program Files\Anti-Blaxx 1.18\Anti-Blaxx.exe File not found
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [wincredprovider] C:\Documents and Settings\xp\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\129\wincredprovider.exe ()
O4 - HKLM..\Run: [Windows Media HelpSvc] C:\WINDOWS\system32\wmpsh64.exe File not found
O4 - HKU\S-1-5-21-606747145-448539723-1177238915-1003..\Run: [Microsoft Windows Manager] C:\Documents and Settings\xp\M-10-6897-8685-3464\winmgr.exe ()
O4 - HKU\S-1-5-21-606747145-448539723-1177238915-1003..\Run: [Mjjicrtuuuhgujig ddd Manager] C:\Documents and Settings\xp\M-10-8f8668f-88h-555h5\windoga.exe ()
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&crg=3.1010000.10011&st=1&barid={0F900A5E-A051-11E1-B2BF-002522BF68CF}&q={searchTerms}&barid={0F900A5E-A051-11E1-B2BF-002522BF68CF}" 
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = "http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=cf1c8d2b-d949-44cf-843c-0bc177c63c3e&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57}: "URL" = "http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=PL&install_date=20120704&user_guid=B145FD72EB0A4EE98AFE6FF1800B8C00&machine_id=4aea76840dea8234fe1009d831d925c1&browser=IE&os=win&os_version=5.1-x86-SP3&iesrc={referrer:source}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = "http://search.babylon.com/?q={searchTerms}&affID=110819&tt=010712_1&babsrc=SP_ss&mntrId=845dd756000000000000002522bf68cf"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = "http://www.daemon-search.com/search?q={searchTerms}"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = "http://mystart.incredibar.com/mb161/?search={searchTerms}&loc=IB_DS&a=6R8vSfN9NZ&i=26"
IE - HKU\S-1-5-21-606747145-448539723-1177238915-1003\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = "http://search.sweetim.com/search.asp?src=6&crg=3.1010000.10011&st=1&barid={0F900A5E-A051-11E1-B2BF-002522BF68CF}&q={searchTerms}&barid={0F900A5E-A051-11E1-B2BF-002522BF68CF}"
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | Auto | Stopped] -- C:\DOCUME~1\xp\USTAWI~1\Temp\3019.sys -- (3019)
 
:Files
C:\Documents and Settings\xp\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows\129
C:\Documents and Settings\xp\M-10-8f8668f-88h-555h5
C:\Documents and Settings\xp\M-10-8f8f86-88h-555h5
C:\Documents and Settings\xp\M-10-6897-8685-3464
C:\Documents and Settings\xp\Dane aplikacji\hellomoto
C:\Documents and Settings\xp\Dane aplikacji\wincfg32.sys
C:\Documents and Settings\xp\Dane aplikacji\OpenCandy
C:\Documents and Settings\xp\Dane aplikacji\Mozilla\Firefox\Profiles\i371whr4.default\extensions\staged
C:\Program Files\mozilla firefox\searchplugins\babylon.xml
netsh firewall reset /C
 
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
"Start Page Restore"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
 
:Commands
[emptytemp]

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Klik w Wykonaj skrypt. System zostanie zrestartowany (i odblokowany), otworzy się log z wynikami usuwania.

 

2. Odinstaluj adware:

- Przez Panel sterowania: Babylon toolbar on IE, BabylonObjectInstaller, BrowserCompanion, Giant Savings, Incredibar Toolbar on IE, Linkury Smartbar, Softonic toolbar on IE and Chrome, StartNow Toolbar, SweetIM for Messenger 3.6, SweetPacks Toolbar for Internet Explorer 4.6, Web Assistant 2.0.0.445, Yontoo 1.10.02.

- W Firefox w Dodatkach powtórz deinstalacje Babylon, Browser Companion Helper, Giant Savings, Linkury Smartbar, incredibar.com, StartNow Toolbar, Web Assistant, Yontoo.

 

3. Uruchom AdwCleaner i zastosuj Delete. Z tego działania powstanie log na dysku C.

 

4. Wygeneruj nowy log OTL z opcji Skanuj (już bez Extras). Dołącz log z usuwania OTL z punktu 1 oraz AdwCleaner z punktu 3.

 

 

 

.

Edytowane 16 Września 2012 przez picasso
16.09.2012 - Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso