Wirus ukash

[skoku92]

Witam, jako już któryś z kolei proszę o pomoc z rozprawieniem się tym wirusem. Sam niestety nie daje rady...
http://www.wklej.org/id/810546/
http://www.wklej.org/id/810547/

[defacto19]

Uruchom OTL i w sekcji (Własne opcje skanowania/Skrypt) wklej:

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C}
IE - HKLM\..\URLSearchHook: {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C}
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=12&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C}
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\URLSearchHook: {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=5fde05f6-1616-11e1-924e-1c75083f939f&q={searchTerms}
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=109980&babsrc=SP_ss&mntrId=f8b072230000000000001c659d7d63d3
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\SearchScopes\{79C50760-CCC6-4923-A2F0-EF03B223113B}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3176921
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=12&q={searchTerms}&barid={323BE5AE-E73F-4E64-9714-BFE6EBDEA25C}
IE - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\SearchScopes\{F593B7B9-740A-4D30-B485-F2F4021AE727}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=308877F3-E104-4A87-BD5B-299B6A99643E&apn_sauid=4121249D-8DF3-48CB-9EE4-2646F8AC88D1
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "express-files Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT3176921&SearchSource=13"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT3176921&SearchSource=2&q="
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "http://startsear.ch/?aff=1&cf=5fde05f6-1616-11e1-924e-1c75083f939f"
[2011-11-23 23:02:32 | 000,000,000 | ---D | M] (VshareComplete - Speed up your search with your personal search suggestions tool) -- C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions\{3697b17c-b572-4862-a5e6-7f922c0f3403}
[2012-07-16 23:43:13 | 000,000,000 | ---D | M] (express-files Community Toolbar) -- C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions\{88ac3cb6-596b-4217-964c-b6757ef9602d}
[2012-03-01 16:33:20 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Maciek\AppData\Roaming\mozilla\Firefox\Profiles\ahi04tii.default\extensions\ffxtlbr@babylon.com
[2012-04-27 14:07:29 | 000,002,331 | ---- | M] () -- C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\askcom.xml
[2012-03-27 18:32:16 | 000,000,929 | ---- | M] () -- C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\conduit.xml
[2011-07-11 20:04:02 | 000,000,633 | ---- | M] () -- C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\startsear.xml
[2012-01-31 00:34:18 | 000,003,915 | ---- | M] () -- C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\SweetIM Search.xml
[2012-06-29 08:42:07 | 000,003,915 | ---- | M] () -- C:\Users\Maciek\AppData\Roaming\Mozilla\Firefox\Profiles\ahi04tii.default\searchplugins\sweetim.xml
[2011-10-03 11:14:54 | 000,083,456 | ---- | M] (vShare.tv ) -- C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll
[2012-04-10 18:37:35 | 000,002,313 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O2 - BHO: (express-files Toolbar) - {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKLM\..\Toolbar: (express-files Toolbar) - {88ac3cb6-596b-4217-964c-b6757ef9602d} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\Toolbar\WebBrowser: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\Toolbar\WebBrowser: (express-files Toolbar) - {88AC3CB6-596B-4217-964C-B6757EF9602D} - C:\Program Files (x86)\express-files\prxtbexpr.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-1799577974-3061418218-2982351228-1001..\Run: [WinSyncMetastore] C:\Users\Maciek\AppData\Local\Microsoft\Windows\824\WinSyncMetastore.exe ()
O4 - HKU\.DEFAULT..\RunOnce: [] File not found
O4 - HKU\S-1-5-18..\RunOnce: [] File not found
O4 - HKU\S-1-5-19..\RunOnce: [] File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [] File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O33 - MountPoints2\{04766b78-bc56-11e1-9734-1c75083f939f}\Shell - "" = AutoRun
O33 - MountPoints2\{04766b78-bc56-11e1-9734-1c75083f939f}\Shell\AutoRun\command - "" = G:\NokiaPCIA_Autorun.exe

:Files
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1799577974-3061418218-2982351228-1001Core.job
\Packard Bell Registration - Reminder Recall task.job
C:\Users\Maciek\AppData\Local\Microsoft\Windows\824
C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
C:\Windows\tasks\Adobe Flash Player Updater.job
C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
C:\Users\Maciek\AppData\Roaming\VshareComplete
C:\ProgramData\McAfeeC:\ProgramData\HitmanPro
C:\Users\Maciek\AppData\Roaming\hellomoto
C:\Users\Maciek\AppData\Roaming\Babylon
C:\ProgramData\uxtwlyoetzjokyp
C:\Windows\SysWow64\vp6vfw.dll
C:\ProgramData\xppnedmjlqspjvx

:Commands
[emptytemp]

Kliknij wykonaj skrypt. Zatwierdź restart komputera (System zostanie odblokowany) Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, i kliknij skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania.