Wirus ukash jak się tego pozbyć?

[szczur41]

Witam. Ja również panłem ofiarom tego draństwa.Niestety nie jestem specjalistą w tej dziedzinie więc proszę o pomoc.

[defacto19]

Przez Panel sterowania odinstaluj:

Softonic-Polska Toolbar
vShare.tv plugin 1.3
MyAshampoo Toolbar
Conduit Engine

:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\VcommMgr.sys -- (VcommMgr)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\VComm.sys -- (VComm)
DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\szczur\AppData\Local\Temp\pxlyqpow.sys -- (pxlyqpow)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\IvtBtBus.sys -- (IvtBtBUs)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV - File not found [Kernel | Boot | Stopped] -- System32\Drivers\BtHidBus.sys -- (BtHidBus)
DRV - File not found [Kernel | On_Demand | Stopped] -- System32\Drivers\btcusb.sys -- (Btcsrusb)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\btnetdrv.sys -- (BT)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1
IE - HKLM\..\URLSearchHook: {1192a62b-4dbc-4d1f-b54e-d820a1be76be} - No CLSID value found
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{3B36E8D2-A253-4B78-A297-2C49F32C3705}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - No CLSID value found
IE - HKCU\..\URLSearchHook: {c86eb8a9-ccc2-4b6c-b75d-73576ed591bf} - C:\Program Files\Softonic-Polska\tbSoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=STT&o=102866&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=5N&apn_dtid=YYYYYYYYPL&apn_uid=4078FDC8-43F4-4FF6-9CE2-5FC916139A35&apn_sauid=8FEED645-5A14-4924-B550-A158D93D3DF1
IE - HKCU\..\SearchScopes\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411}: "URL" = http://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=66020
IE - HKCU\..\SearchScopes\{3B36E8D2-A253-4B78-A297-2C49F32C3705}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://startsear.ch/?aff=1&src=sp&cf=3aa90fe1-07d7-11e1-b3c8-d1fa1fd13a1b&q={searchTerms}
IE - HKCU\..\SearchScopes\{C04B7D22-5AEC-4561-8F49-27F6269208F6}: "URL" = http://toolbar.inbox.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=80114&lng=en
O2 - BHO: (AC-Pro) - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Program Files\AutocompletePro\AutocompletePro.dll File not found
O3 - HKLM\..\Toolbar: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found.
O4 - HKCU..\Run: [whhelper] C:\Users\szczur\AppData\Local\Microsoft\Windows\2631\whhelper.exe ()
[2012-09-18 18:11:28 | 000,000,000 | ---D | C] -- C:\Users\szczur\AppData\Roaming\Raohba
[2012-09-18 18:11:27 | 000,000,000 | ---D | C] -- C:\Users\szczur\AppData\Roaming\Issidu
[2012-09-18 18:11:27 | 000,000,000 | ---D | C] -- C:\Users\szczur\AppData\Roaming\Heroyk
@Alternate Data Stream - 138 bytes -> C:\ProgramData\TEMP:B2836CDB
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMP:DFC5A2B2

:Files
C:\Users\szczur\AppData\Local\Microsoft\Windows\2631
C:\Users\szczur\AppData\Roaming\hellomoto
C:\Users\szczur\AppData\Local\Temp*.html

:Commands
[emptytemp]

Kliknij wykonaj skrypt. Zatwierdź restart komputera.

Uruchom Adwcleaner z opcji Delete.

Uruchom OTL ponownie, tym razem wybierz opcję Skanuj. Pokaż nowy log z OTL oraz raport z Adwcleaner.