Ukash na windowsie

**Posty:** 50 · przez **debiska** 14 Sie 2012, 14:53

Witam.
Windows 7 Home Premium 64bit
Proszę o pomoc w usunięciu tego wirusa.

Logi kontrolne.

**Posty:** 205 · przez **defacto19** 14 Sie 2012, 15:38

Odinstaluj:
Google Toolbar for Internet Explorer
StartSearch Toolbar 1.3
vShare.tv plugin 1.3
Browsers Protector
Ask Toolbar

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt) wklej:

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e&q={searchTerms}
IE - HKLM\..\SearchScopes\{94247FD8-92EA-466B-95C0-B994AEA857A5}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e&q={searchTerms}
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://startsear.ch/?aff=1&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57}: "URL" = http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=PL&install_date=20120515&user_guid=C030CF46FAC4422D972D38B8A13942BC&machine_id=e28f8822f34f3cbed22971f591100ee0&browser=IE&os=win&os_version=6.1-x64-SP0&iesrc={referrer:source}
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e&q={searchTerms}
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{128CB4F9-2DF3-438E-884C-0C6B7D9B6A2A}: "URL" = http://search.softonic.com/MON00084/tb_v1?q={searchTerms}&SearchSource=4&cc=
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{94247FD8-92EA-466B-95C0-B994AEA857A5}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{C741AC61-F221-4554-B9AC-5626718B350A}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=1028E4B7-F1BE-4353-8BB3-A11B591C2CCA&apn_sauid=852D466A-85FF-4529-BAD6-12A5381564EC
IE - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\SearchScopes\{CC2A6678-B65E-4424-BDD3-0DDBF24DB513}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e&q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: "http://search.softonic.com/MON00084/tb_v1?SearchSource=13&cc="
FF - prefs.js..keyword.URL: "http://startsear.ch/?aff=1&src=sp&cf=0c27f4b5-fb3e-11e0-9575-74f06dc5ca1e&q="
[2012-05-15 21:59:06 | 000,000,000 | ---D | M] (StartNow Toolbar) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\teadogsq.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}
[2012-07-17 14:12:37 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\teadogsq.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2012-05-16 18:02:14 | 000,000,000 | ---D | M] (softonic.com) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\teadogsq.default\extensions\ffxtlbra@softonic.com
[2012-07-06 11:19:34 | 000,000,000 | ---D | M] (Ask Toolbar) -- C:\Users\Darek\AppData\Roaming\mozilla\Firefox\Profiles\teadogsq.default\extensions\toolbar@ask.com
[2012-07-06 11:19:34 | 000,002,299 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\teadogsq.default\searchplugins\askcom.xml
[2012-07-16 23:06:52 | 000,000,925 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\teadogsq.default\searchplugins\conduit.xml
[2012-05-16 17:37:02 | 000,002,060 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\teadogsq.default\searchplugins\softonic.xml
[2012-04-24 22:23:02 | 000,000,792 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\teadogsq.default\searchplugins\startsear.xml
[2012-05-15 21:59:02 | 000,001,390 | ---- | M] () -- C:\Users\Darek\AppData\Roaming\Mozilla\Firefox\Profiles\teadogsq.default\searchplugins\yahoo-zugo.xml
[2012-01-02 11:48:42 | 000,083,456 | ---- | M] (StartSearch ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [Setwallpaper] c:\programdata\SetWallpaper.cmd File not found
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [SessionLogon] C:\ExpressGateUtil\SessionLogon.exe File not found
O4 - HKLM..\Run: [VAWinAgent] C:\ExpressGateUtil\VAWinAgent.exe ()
O4 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001..\Run: [] File not found
O4 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001..\Run: [Mjjicrtuuuhguig ddd Manager] C:\Users\Darek\M-10-876858-88h-555h5\winraz.exe ()
O4 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001..\Run: [uTorrent] "C:\Program Files (x86)\uTorrent\uTorrent.exe" /MINIMIZED File not found
O4 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001..\Run: [Wwanpref] C:\Users\Darek\AppData\Local\Microsoft\Windows\2806\Wwanpref.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8:64bit: - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: &Verzenden naar OneNote - res://C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&xporteren naar Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000 File not found
O33 - MountPoints2\{4d660c4c-aa72-11e1-9b5e-74f06dc5ca1e}\Shell - "" = AutoRun
O33 - MountPoints2\{4d660c4c-aa72-11e1-9b5e-74f06dc5ca1e}\Shell\AutoRun\command - "" = E:\KODAK_Software_Downloader.exe
O33 - MountPoints2\{71f66033-0c9d-11e1-9ca0-74f06dc5ca1e}\Shell - "" = AutoRun
O33 - MountPoints2\{71f66033-0c9d-11e1-9ca0-74f06dc5ca1e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b5be44ea-d988-11e0-b458-74f06dc5ca1e}\Shell - "" = AutoRun
O33 - MountPoints2\{b5be44ea-d988-11e0-b458-74f06dc5ca1e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{b5be44f8-d988-11e0-b458-74f06dc5ca1e}\Shell - "" = AutoRun
O33 - MountPoints2\{b5be44f8-d988-11e0-b458-74f06dc5ca1e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{e4429ad2-0f50-11e1-95ab-74f06dc5ca1e}\Shell - "" = AutoRun
O33 - MountPoints2\{e4429ad2-0f50-11e1-95ab-74f06dc5ca1e}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe

:Files
C:\Users\Darek\AppData\Local\Microsoft\Windows\2806
C:\Users\Darek\AppData\Roaming\hellomoto
C:\Users\Darek\M-10-876858-88h-555h5
C:\Users\Darek\M-10-8754-86589-55555
C:\Users\Darek\M-10-6897-8685-3464

:Commands
[emptytemp]

Kliknij wykonaj skrypt. Zatwierdź restart komputera (System zostanie odblokowany) Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, i kliknij skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania.

**Posty:** 50 · przez **debiska** 14 Sie 2012, 16:22

Komputer odblokowany.
Logi:

**Posty:** 205 · przez **defacto19** 14 Sie 2012, 16:46

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt) wklej:

:OTL
PRC - [2012-05-04 15:43:20 | 001,561,768 | ---- | M] (Ask) -- C:\Program Files (x86)\Ask.com\Updater\Updater.exe
O2 - BHO: (StartNow Toolbar Helper) - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll ()
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll File not found
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (StartNow Toolbar) - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll ()
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll File not found
O3 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll File not found
O4:64bit: - HKLM..\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKU\S-1-5-21-1470251364-4289173545-4285870321-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKLM..\Run: [Browsers Protector] C:\Program Files (x86)\Browsers Protector\regmon32.exe ()
[2012-08-14 16:06:16 | 000,001,058 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012-08-14 09:39:00 | 000,001,062 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

:Commands
[emptytemp]

Kliknij wykonaj skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie, i przedstaw go na forum.

**Posty:** 50 · przez **debiska** 14 Sie 2012, 17:03

Wykonano.

**Posty:** 205 · przez **defacto19** 14 Sie 2012, 17:34

Uruchom OTL i użyj opcji sprzątanie.

Zastosuj Adwcleaner -> http://general-changelog-team.fr/en/tools/15-adwcleaner z opcji Delete.
(Po ponownym uruchomieniu komputera uruchom program raz jeszcze i kliknij na przycisk Uninstall)

Zainstaluj aktualizacje do programow wskazanych przez Security Check -> http://screen317.spywareinfoforum.org/
jako out of date.

Przeczyść dysk i rejestr CCleaner'em -> http://www.piriform.com/ccleaner/download/standard

Autor postu otrzymał pochwałę