Ukash pomocy

[owsik1988]

Witam mam problem z wirusem ukash proszę o pomoc
http://www.wklejto.pl/130754 OTL
http://wklejto.pl/130758Extras

[wojtas]

Proszę wkleić logi na forum w formie załączników lub na www.wklej.org

[owsik1988]

Proszę o to załączniki. Czekam na pomoc. Z góry dziękuje

[wojtas]

odinstaluj DAEMON Tools Toolbar, Softonic English Toolbar, uTorrentControl2 Toolbar, ConduitEngine oraz Spybot - Search & Destroy


Użyj AdwCleaner i kliknij w nim Delete (w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator)
Pokaż raport z niego


Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
SRV - File not found [Auto | Stopped] -- C:\Program Files\Spybot -- (SBSDWSCService)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\XDva375.sys -- (XDva375)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Damian\AppData\Local\Temp\catchme.sys -- (catchme)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=2&cf=76244c86-421c-11e1-8f31-002454105af9
IE - HKLM\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\prxtbSof0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
IE - HKLM\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=76244c86-421c-11e1-8f31-002454105af9&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT3072253
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {930f1200-f5f1-4870-bac6-e233ec8e7023} - C:\Program Files\Softonic_English\prxtbSof0.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=76244c86-421c-11e1-8f31-002454105af9&q={searchTerms}
IE - HKCU\..\SearchScopes\{30D3F78F-6A48-4005-82E7-778B7E6F4ED3}: "URL" = http://search.babylon.com/?q={searchTerms}&AF=100482&babsrc=SP_ss&mntrId=c06007570000000000000026b6330a65
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
IE - HKCU\..\SearchScopes\{EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C}: "URL" = http://slirsredirect.search.aol.com/redirector/sredir?sredir=2685&query={searchTerms}&invocationType=tb50-ie-winamp-
FF - prefs.js..browser.search.defaultenginename: "Web Search..."
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Search"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.2.0185
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2790392&q="
[2012-07-17 13:41:29 | 000,000,000 | ---D | M] (uTorrentControl2 Community Toolbar) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\i1887ss4.default\extensions\{687578b9-7132-4a7a-80e4-30ee31099e03}
[2012-07-17 16:34:51 | 000,000,000 | ---D | M] (BitTorrentBar Community Toolbar) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\i1887ss4.default\extensions\{88c7f2aa-f93f-432c-8f0e-b7d85967a527}
[2012-06-10 22:28:58 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\i1887ss4.default\extensions\DTToolbar@toolbarnet.com
O8 - Extra context menu item: ????3?? - Reg Error: Value error. File not found
O8 - Extra context menu item: ????3?????? - Reg Error: Value error. File not found
O8 - Extra context menu item: ŢĹéÄöá?3ů»? - Reg Error: Value error. File not found
O8 - Extra context menu item: ŢĹéÄöá?3ů»?îďÝ»?ďČ - Reg Error: Value error. File not found
O4 - HKCU..\Run: [shdztdpqtarucxu] C:\ProgramData\shdztdpq.exe ()
O4 - HKCU..\Run: [Tjsksd] C:\Users\Damian\AppData\Roaming\Tjsksd.exe (IORISOFT)
O4 - HKCU..\Run: [AdobeReader] C:\Users\Damian\AppData\Roaming\Microsoft\Windows\reader_sl.exe ()
[2012-08-08 15:59:27 | 000,000,000 | ---D | C] -- C:\ProgramData\nknzlitytjkvlpl
[2012-08-08 15:59:27 | 000,000,051 | ---- | M] () -- C:\ProgramData\oktgevlnlujuqax
[2012-08-08 15:59:21 | 000,061,440 | ---- | M] () -- C:\ProgramData\shdztdpq.exe
[2012-08-08 11:39:00 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012-08-07 21:27:01 | 000,001,082 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2940293867-578583823-1431221202-1003UA.job
[2012-08-07 18:27:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-2940293867-578583823-1431221202-1003Core.job
[2012-08-06 15:49:58 | 000,000,438 | -H-- | M] () -- C:\Windows\tasks\Norton Security Scan for Damian.job
[2012-08-08 15:59:27 | 000,061,440 | ---- | C] () -- C:\ProgramData\shdztdpq.exe
[2012-08-08 15:59:24 | 000,000,051 | ---- | C] () -- C:\ProgramData\oktgevlnlujuqax
[2012-08-05 19:00:01 | 000,000,274 | ---- | C] () -- C:\Windows\tasks\RMAutoUpdate.job
[2012-08-02 07:38:31 | 000,000,276 | ---- | C] () -- C:\Windows\tasks\RMSchedule.job
[2011-08-14 23:34:31 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\563A.exe
[2011-08-14 18:26:27 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\F1EC.exe
[2011-08-12 22:54:53 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\713E.exe
[2011-08-12 22:53:41 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\54E7.exe
[2011-08-01 15:00:02 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\2E06.exe
[2011-08-01 14:44:56 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\5B59.exe
[2011-08-01 14:44:52 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\4A0A.exe
[2011-08-01 12:27:31 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\2AE6.exe
[2011-07-31 22:22:37 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\D78C.exe
[2011-07-31 22:15:07 | 000,000,385 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\F8DE.exe
[2011-07-31 16:21:15 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\78CA.exe
[2011-07-28 23:46:46 | 000,000,193 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\DEFC.exe
[2011-07-26 15:09:24 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\99FF.exe
[2011-07-26 14:20:34 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\83F0.exe
[2011-07-19 12:45:45 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\AC4B.exe
[2011-07-19 12:41:56 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\2C71.exe
[2011-07-19 12:41:46 | 000,000,028 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\6D6.exe
@Alternate Data Stream - 98 bytes -> C:\ProgramData\Temp:D1B5B4F1
@Alternate Data Stream - 971 bytes -> C:\ProgramData:$SS_DESCRIPTOR_SBXNV9VVGV1BFPVHRP275D836HNTHKP9KTLWJMHFSVF7JBCVPJGV

:Files
C:\Users\Damian\AppData\Roaming\*.exe

:Commands
[resethosts]
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).