Weelsoft problem

**Posty:** 4 · przez **Baxx** 24 Gru 2012, 18:14

Jak w temacie Kaspersky Rescue Disk 10 nie pomogl, mam jeszcze pytanie czy ten wirus blokuje dostep do internetu? Chodzi mi o to czy nawet jesli mam podlaczony kabel od internetu to jest "ograniczenie lacznosci". Dodaje logi

**Posty:** 4765 · przez **ordynat** 24 Gru 2012, 18:37

1) Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [Client Server Runtime Process] C:\Documents and Settings\Iwan\Dane aplikacji\System32\csrss.exe File not found
O4 - HKLM..\Run: [DrvIcon] C:\Program Files\Vista Drive Icon\DrvIcon.exe File not found
O4 - HKLM..\Run: [facemoods] C:\Program Files\facemoods.com\facemoods\1.4.8.1\facemoodssrv.exe (facemoods.com)
O4 - HKLM..\Run: [Host-process Windows (Rundll32.exe)] C:\Documents and Settings\Iwan\Dane aplikacji\rundll32.exe File not found
O4 - HKLM..\Run: [PrzyspieszKomputer] C:\Program Files\Przyspiesz Komputer\przyspieszkomputer.exe File not found
O4 - HKLM..\Run: [Service Host Process for Windows] C:\Documents and Settings\Iwan\Dane aplikacji\svchost.exe File not found
O4 - HKCU..\Run: [Client Server Runtime Process] C:\Documents and Settings\Iwan\Dane aplikacji\System32\csrss.exe File not found
O4 - HKCU..\Run: [Host-process Windows (Rundll32.exe)] C:\Documents and Settings\Iwan\Dane aplikacji\rundll32.exe File not found
O4 - HKCU..\Run: [Service Host Process for Windows] C:\Documents and Settings\Iwan\Dane aplikacji\svchost.exe File not found

:Files
C:\WINDOWS\tasks\At*.job
C:\Documents and Settings\All Users\Dane aplikacji\dsgsdgdsgdsgw.pad
C:\Documents and Settings\Iwan\Menu Start\Programy\Autostart\runctf.lnk

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.

2) Użyj >Adw-cleaner (aby pobrać kliknij na dużą zieloną strzałkę po prawej).
Kliknij w nim Usuń
Pokaż raport z niego C:\AdwCleaner[S1].txt

3) Zrób nowy log z OTL.
.

**Posty:** 4 · przez **Baxx** 24 Gru 2012, 19:30

Oto pliki

**Posty:** 4765 · przez **ordynat** 24 Gru 2012, 21:04

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
MOD - [2012-10-03 13:25:42 | 000,188,760 | ---- | M] () -- C:\Program Files\IB Updater\ExtensionUpdaterService.exe
SRV - [2012-10-03 13:25:42 | 000,188,760 | ---- | M] () [Auto | Running] -- C:\Program Files\IB Updater\ExtensionUpdaterService.exe -- (IB Updater Updater)
IE - HKCU\..\SearchScopes\{3B7E3660-5179-4DAA-9141-97F08487DEBC}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=7C398BEA-9197-49A5-979D-079B9F73DCA1&apn_sauid=0AC42EF4-B461-4F60-97AA-918B95D495FB
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultenginename,S: S", "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.order.1,S: S", "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine,S: S", "Search the web (Babylon)"
FF - prefs.js..extensions.enabledAddons: ffxtlbr%40incredibar.com:1.5.0
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=7C398BEA-9197-49A5-979D-079B9F73DCA1&apn_ptnrs=9M&apn_sauid=0AC42EF4-B461-4F60-97AA-918B95D495FB&apn_dtid=OSJ000&&q="
FF - prefs.js..keyword.URL,h: h", "http://search.babylon.com/?babsrc=KW_def&AF=100581&q="
[2012-11-07 18:29:14 | 000,000,000 | ---D | M] (ST-Polska Community Toolbar) -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}
[2011-04-30 21:02:01 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com
[2012-10-11 15:06:51 | 000,000,000 | ---D | M] (incredibar.com) -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbr@incredibar.com
[2012-02-05 18:41:48 | 000,000,000 | ---D | M] (Softonic Toolbar) -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com
[2012-08-04 19:41:30 | 000,002,299 | ---- | M] () -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\searchplugins\askcom.xml
[2011-07-11 19:04:02 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\searchplugins\startsear.xml
[2010-03-28 17:56:18 | 000,002,035 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fcmdSrchFxt.xml
[2012-10-11 15:06:43 | 001,008,496 | ---- | C] () -- C:\WINDOWS\System32\dmwu.exe
[2012-10-11 15:06:43 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\ImHttpComm.dll

:Files
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pbiamblgmkgbcgbcgejjgebalncpmhnp

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

**Posty:** 4 · przez **Baxx** 25 Gru 2012, 00:20

Kolejne logi, przepraszam ze tak wklejam ale nie dalo rady wrzucic rozszerzenia "log"
Raport z usuwania skryptem:

All processes killed
========== OTL ==========
Service IB Updater Updater stopped successfully!
Service IB Updater Updater deleted successfully!
C:\Program Files\IB Updater\ExtensionUpdaterService.exe moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{3B7E3660-5179-4DAA-9141-97F08487DEBC}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3B7E3660-5179-4DAA-9141-97F08487DEBC}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: S", "Search the web (Babylon)" removed from browser.search.defaultenginename,S
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: S", "Search the web (Babylon)" removed from browser.search.order.1,S
Prefs.js: S", "Search the web (Babylon)" removed from browser.search.selectedEngine,S
Prefs.js: ffxtlbr%40incredibar.com:1.5.0 removed from extensions.enabledAddons
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=&locale=&apn_uid=7C398BEA-9197-49A5-979D-079B9F73DCA1&apn_ptnrs=9M&apn_sauid=0AC42EF4-B461-4F60-97AA-918B95D495FB&apn_dtid=OSJ000&&q=" removed from keyword.URL
Prefs.js: h", "http://search.babylon.com/?babsrc=KW_def&AF=100581&q=" removed from keyword.URL,h
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\searchplugin folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\Plugins folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\modules folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\META-INF folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\defaults folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\components folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}\chrome folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\searchplugin folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\META-INF folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\lib folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\DualPackage folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\defaults folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\components folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com\chrome folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\engine@conduit.com folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbr@incredibar.com\content\imgs\flgs folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbr@incredibar.com\content\imgs folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbr@incredibar.com\content folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbr@incredibar.com folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com\defaults\preferences folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com\defaults folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com\content\imgs\flgs folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com\content\imgs folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com\content folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\extensions\ffxtlbra@softonic.com folder moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\searchplugins\askcom.xml moved successfully.
C:\Documents and Settings\Iwan\Dane aplikacji\Mozilla\Firefox\Profiles\g1lb6rhy.default\searchplugins\startsear.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrchFxt.xml moved successfully.
C:\WINDOWS\system32\dmwu.exe moved successfully.
C:\WINDOWS\system32\ImHttpComm.dll moved successfully.
========== FILES ==========
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0\plugins folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle\1.3.332.1_0 folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mkndcbhcgphcfkkddanakjiepeknbgle folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.533_0\resources folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.533_0\libraries folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.533_0 folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pbiamblgmkgbcgbcgejjgebalncpmhnp\1.3_0 folder moved successfully.
C:\Documents and Settings\Iwan\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pbiamblgmkgbcgbcgejjgebalncpmhnp folder moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: a
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

**Posty:** 4765 · przez **ordynat** 25 Gru 2012, 00:46

Wg mnie - jest OK.
W Adw-Cleaner kliknij na przycisk Odinstaluj
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną
.

**Posty:** 4 · przez **Baxx** 31 Gru 2012, 16:54

Przepraszam ze pisze dopiero teraz, chcialem podziekowac wszystko dziala jak nalezy. PROFESJONALISTA :]

Kto jest na forum