Wirus ukash

[Memento]

Witam,

Dziś mój komputer został zablokowany przez wirus Ukash.
Proszę o pomoc z tym wirusem.
Załączam logi z OTL

[wojtas]

odinstaluj:
pdfforge Toolbar v4.6
"4shared.com Toolbar" = 4shared.com Toolbar
"AOL Toolbar" = Pasek narzędzi AOL 5.0
"BabylonToolbar" = Babylon toolbar on IE
"conduitEngine" = Conduit Engine
"Softonic-Polska Toolbar" = Softonic-Polska Toolbar

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2530240
IE - HKLM\..\SearchScopes\{E2958F71-2B50-4864-811E-2F39556414E9}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl
IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?crg=3.1010000&st=10
IE - HKLM\..\URLSearchHook: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files (x86)\4shared.com\prxtb4sh0.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files (x86)\Softonic-Polska\prxtbSof0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://search.babylon.com/?q={searchTerms}&affID=111434&tt=190712_n_mont_3012_7&babsrc=SP_ss&mntrId=28776bb00000000000000ceee6add646
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{15D8D847-E04E-4E4D-99D9-E671D8FEED73}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&type=302398&p={searchTerms}
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2530240
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{E2958F71-2B50-4864-811E-2F39556414E9}: "URL" = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=1602&query={searchTerms}&invocationType=tb50hpcnnbie7-pl-pl
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&crg=3.1010000&st=10&q={searchTerms}
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?affID=111434&tt=190712_n_mont_3012_7&babsrc=HP_ss&mntrId=28776bb00000000000000ceee6add646
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\URLSearchHook: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - C:\Program Files (x86)\4shared.com\prxtb4sh0.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1148529421-600695141-3798627157-1000\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files (x86)\Softonic-Polska\prxtbSof0.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.defaultthis.engineName: "Softonic-Polska Customized Web Search"
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..extensions.enabledAddons: ffxtlbr@babylon.com:1.5.0
FF - prefs.js..extensions.enabledAddons: pdfforge@mybrowserbar.com:4.6
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.3
FF - prefs.js..extensions.enabledItems: {09ec805c-cb2e-4d53-b0d3-a75a428b81c7}:3.2.5.2
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2530240&q="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "BearShare Web Search"
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2530240&SearchSource=3&q={searchTerms}"
[2012-08-21 23:52:13 | 000,000,000 | ---D | M] (4shared.com Community Toolbar) -- C:\Users\Olka\AppData\Roaming\mozilla\Firefox\Profiles\bhhso8o0.default\extensions\{09ec805c-cb2e-4d53-b0d3-a75a428b81c7}
[2012-08-21 23:52:14 | 000,000,000 | ---D | M] (ST-Polska Community Toolbar) -- C:\Users\Olka\AppData\Roaming\mozilla\Firefox\Profiles\bhhso8o0.default\extensions\{c86eb8a9-ccc2-4b6c-b75d-73576ed591bf}
[2010-05-12 16:58:15 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\Olka\AppData\Roaming\mozilla\Firefox\Profiles\bhhso8o0.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
[2012-07-23 13:28:15 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Olka\AppData\Roaming\mozilla\Firefox\Profiles\bhhso8o0.default\extensions\ffxtlbr@babylon.com
[2009-12-11 22:42:51 | 001,897,274 | ---- | M] () (No name found) -- C:\Users\Olka\AppData\Roaming\mozilla\firefox\profiles\bhhso8o0.default\extensions\{9f94fab0-58a2-11dd-ae16-0800200c9a66}\chrome\tmp-1.xpi
[2010-03-28 11:04:34 | 000,002,476 | ---- | M] () -- C:\Users\Olka\AppData\Roaming\mozilla\firefox\profiles\bhhso8o0.default\searchplugins\BearShareWebSearch.xml
[2010-12-08 15:49:56 | 000,000,933 | ---- | M] () -- C:\Users\Olka\AppData\Roaming\mozilla\firefox\profiles\bhhso8o0.default\searchplugins\conduit.xml
[2012-07-10 13:46:05 | 000,003,948 | ---- | M] () -- C:\Users\Olka\AppData\Roaming\mozilla\firefox\profiles\bhhso8o0.default\searchplugins\sweetim.xml
[2011-08-22 23:29:40 | 000,000,000 | ---D | M] (pdfforge Toolbar) -- C:\PROGRAM FILES (X86)\PDFFORGE TOOLBAR\FF
[2012-07-23 13:27:43 | 000,002,363 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2010-03-28 11:04:34 | 000,002,476 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\BearShareWebSearch.xml
O2 - BHO: (no name) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No CLSID value found.
O2 - BHO: (no name) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - No CLSID value found.
O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-1148529421-600695141-3798627157-1000..\Run: [plnlvkqvjhtryqi] C:\ProgramData\plnlvkqv.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
[2012-09-29 18:44:32 | 000,000,000 | ---D | C] -- C:\ProgramData\sobnhlidjwagrit
[2012-09-29 18:44:33 | 000,078,032 | ---- | M] () -- C:\ProgramData\tgdsuaagxpzpkdh
[2012-09-29 18:42:29 | 000,072,704 | ---- | M] () -- C:\ProgramData\plnlvkqv.exe
[2012-09-29 18:42:29 | 000,072,704 | ---- | M] () -- C:\Users\Olka\ms.exe

:Files
C:\Users\Olka\AppData\Local\Temp*.html
C:\Program Files (x86)\Common Files\Spigot\Search Settings

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Użyj AdwCleaner i kliknij w nim Delete (w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator)
Pokaż raport z niego

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzyła się po restarcie).