Ukash - zablokowany komputer

[RDR]

Witam, mam identyczny problem jak mój poprzednik.
Przesyłam w załączniku log'a z OTL'a i Malwarebytes Anti-Malware. Mam nadzieję, że znajdzie się jakaś dobra dusza, która pomoże mi się tego pozbyć.

[wojtas]

brak drugiego loga z OTL, proszę dołączyć
Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE:64bit: - HKLM\..\SearchScopes\{26D0B1F1-F5C7-4908-94A4-6C9F2C247C45}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE - HKLM\..\SearchScopes\{26D0B1F1-F5C7-4908-94A4-6C9F2C247C45}: "URL" = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=8086ca4b000000000000904ce520bba0
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=110819&babsrc=SP_ss&mntrId=8086ca4b000000000000904ce520bba0
IE - HKCU\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb139/?search={searchTerms}&loc=IB_DS&a=6R8yRRw4q6&i=26
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA
O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found
O4 - HKLM..\Run: [DigidesignMMERefresh] C:\Program Files (x86)\Digidesign\Drivers\MMERefresh.exe File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre6\bin\jusched.exe" File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Owner\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [vyoanigobjyfkmw] C:\ProgramData\vyoanigo.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office12\EXCEL.EXE/3000 File not found
[2012-07-23 12:46:56 | 000,000,000 | ---D | C] -- C:\ProgramData\qliivzowbereriv
[2012-07-13 16:54:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2012-07-13 16:54:09 | 000,000,000 | ---D | C] -- C:\Users\Owner\AppData\Roaming\Babylon
[2012-07-13 15:28:16 | 000,000,000 | ---D | C] -- C:\ProgramData\OptimizerPro
[2012-07-13 15:28:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012-07-23 12:46:58 | 000,000,051 | ---- | M] () -- C:\ProgramData\tdazkembtrwfqjd
[2012-07-23 12:46:52 | 000,053,248 | ---- | M] () -- C:\ProgramData\vyoanigo.exe
[2012-07-13 16:54:31 | 000,001,944 | ---- | M] () -- C:\user.js
[2012-07-11 22:55:12 | 000,001,056 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-4274899312-4216934835-390277703-1000Core1cd5fa777339f06.job
[2012-07-17 16:32:25 | 000,011,621 | ---- | C] () -- C:\Users\Owner\AppData\Local\recently-used.xbel
@Alternate Data Stream - 960 bytes -> C:\Users\Owner\AppData\Local\Temp:4YeuvHFdlPPD67KtgGTkt4bDn
@Alternate Data Stream - 135 bytes -> C:\ProgramData\Temp:5A775C3F
@Alternate Data Stream - 1236 bytes -> C:\ProgramData\Microsoft:oMxtTknbtgphvU3BzP7NUx
@Alternate Data Stream - 1208 bytes -> C:\ProgramData\Microsoft:NVw4Zo44x6c1HrvyaKbsveu2dwV
@Alternate Data Stream - 1201 bytes -> C:\ProgramData\Microsoft:Xoh9aEuGmy3Gc5FZb5W6laF1oZ
@Alternate Data Stream - 1121 bytes -> C:\ProgramData\Microsoft:jRwUbC7N357GeNqSdWlZ
@Alternate Data Stream - 1052 bytes -> C:\Users\Owner\AppData\Local\Temp:VSbvnR42cHt3dWpMkKoJqy
@Alternate Data Stream - 1027 bytes -> C:\Users\Owner\AppData\Local\8Mn62vFuTJn:wlsxZ1xhni4e6cyFsqT7Q7

:Files
C:\Users\Owner\AppData\Local\Temp*.html

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Użyj AdwCleaner i kliknij w nim Delete (w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator)
Pokaż raport z niego


Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).