Trojan ukash -"policja"

[argos34]

Zakładam, że wszystkim forumowiczom znany już jest wirus, które podając sie za policje wymuzsa na nas zapłacenie 500zł. Niestety ten wirus dopadł również mnie. Próbowalem paru swoich sposobów jak antyvirusy itd itd nie pomagalo wiec daje tutaj moje logi i błagam pomóżcie mi pilnie potrzebuje ponownie normalnie działającego komputera!
http://wklej.org/id/797734/ <---Extras
http://wklej.org/id/797735/ <---OTL

Dodano Dzisiaj, 22:30:
OTL jest za duzy zeby go dac w załączniku wiec zostaje jedynie to wklej.org

[wojtas]

odinstaluj : Ask Toolbar, pdfforge Toolbar v4.6, DAEMON Tools Toolbar, MyAshampoo Toolbar

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyA0.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://search.bearshare.com/ [binary data]
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyA0.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\SearchScopes,DefaultScope = {44566DC2-AF38-415B-8924-2CDE05514676}
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}: "URL" = http://search.bearshare.com/web?src=ieb&q={searchTerms}
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search?q={searchTerms}
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..extensions.enabledItems: pdfforge@mybrowserbar.com:4.6
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.8.0191
FF - prefs.js..extensions.enabledItems: wtxpcom@mybrowserbar.com:4.6
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: toolbar@ask.com:3.14.0.100010
[2012-07-17 16:42:40 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\Artur\AppData\Roaming\mozilla\Firefox\Profiles\k0qn38kr.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010-04-30 13:27:14 | 000,000,000 | ---D | M] (MediaBar) -- C:\Users\Artur\AppData\Roaming\mozilla\Firefox\Profiles\k0qn38kr.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
[2011-08-17 22:44:37 | 000,000,000 | ---D | M] ("DAEMON Tools Toolbar") -- C:\Users\Artur\AppData\Roaming\mozilla\Firefox\Profiles\k0qn38kr.default\extensions\DTToolbar@toolbarnet.com
[2011-07-13 20:59:31 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Artur\AppData\Roaming\mozilla\Firefox\Profiles\k0qn38kr.default\extensions\engine@conduit.com
[2012-02-02 13:03:11 | 000,000,000 | ---D | M] ("Ask Toolbar") -- C:\Users\Artur\AppData\Roaming\mozilla\Firefox\Profiles\k0qn38kr.default\extensions\toolbar@ask.com
[2010-03-28 11:04:34 | 000,002,476 | ---- | M] () -- C:\Users\Artur\AppData\Roaming\Mozilla\Firefox\Profiles\k0qn38kr.default\searchplugins\BearShareWebSearch.xml
[2010-09-08 09:12:57 | 000,002,055 | ---- | M] () -- C:\Users\Artur\AppData\Roaming\Mozilla\Firefox\Profiles\k0qn38kr.default\searchplugins\daemon-search.xml
O2 - BHO: (Reg Error: Value error.) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - Reg Error: Value error. File not found
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyA0.dll (Conduit Ltd.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (Reg Error: Value error.) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - Reg Error: Value error. File not found
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files (x86)\MyAshampoo\prxtbMyA0.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files (x86)\pdfforge Toolbar\IE\4.6\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKCU\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files (x86)\MyAshampoo\prxtbMyA0.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnUpdater] C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
O4 - HKLM..\Run: [oiqqhtzbbifsovz] C:\ProgramData\oiqqhtzb.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files (x86)\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKCU..\Run: [PlayNC Launcher] File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
[2012-07-25 18:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\nvkylkhjbhyrvru
[2012-07-25 18:14:43 | 000,000,051 | ---- | M] () -- C:\ProgramData\qngpepfotudsusc
[2012-07-25 18:14:23 | 000,061,440 | ---- | M] () -- C:\ProgramData\oiqqhtzb.exe
[2012-07-25 18:14:23 | 000,061,440 | ---- | M] () -- C:\Users\Artur\0.3250102944739163.exe
[2012-07-25 18:14:41 | 000,061,440 | ---- | C] () -- C:\ProgramData\oiqqhtzb.exe

:Files
C:\Program Files (x86)\Common Files\Spigot\Search Settings
C:\Users\Artur\AppData\Local\Temp*.html

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

:Commands
[emptytemp]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Użyj AdwCleaner i kliknij w nim Delete (w przypadku Visty/Windows7 uruchom z prawokliku jako Administrator)
Pokaż raport z niego

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).