Problem z wirusem sukoku

[krusoder]

Witam prosiłbym o pomoc w usunięciu tego wirusa, od pewnego czasu wyskakują mi i innym użytkownikom tego komputera pop-upy z traviana i erotyczne, jeśli korzystają z Firefoxa lub IE.
Log z OTL:
http://wklej.org/id/171604/
Z góry dziękuję za każdą pomoc

[mateo8898]

W OTL wklej:

:OTL
PRC - [2007-06-13 15:23:49 | 01,034,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2009-09-03 10:04:16 | 00,086,016 | ---- | M] () -- C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stbappHelper.exe
PRC - [2009-09-03 10:03:15 | 00,630,784 | ---- | M] () -- C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stbapp.exe
SRV - File not found -- -- (hpdj [Auto | Stopped])
SRV - [2009-09-22 23:28:10 | 00,054,760 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\Sukoku\sukoku119.exe -- (Sukoku Service [Auto | Stopped])
IE - HKU\S-1-5-21-1060284298-688789844-1343024091-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.theprizeday.com/today.php
FF - prefs.js..browser.search.defaultthis.engineName: "4shared Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "4shared Web Search"
FF - prefs.js..browser.startup.homepage: "http://search.conduit.com/?ctid=CT2233703&SearchSource=13"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2233703&SearchSource=2&q="
FF - HKLM\software\mozilla\Firefox\extensions\\{872A1C39-DF0B-4c8b-AD84-12BA24A3B781}: C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\FFToolbar [2009-09-13 20:37:28 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{2224E955-00E9-4613-A844-CE69FCCAAE91}: C:\Program Files\Internet Saving Optimizer\3.8.1.4690\FF [2009-09-13 20:37:45 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC}: C:\Program Files\Media Access Startup\2.0.0.1050\FF [2009-09-13 20:37:51 | 00,000,000 | ---D | M]
[2009-09-28 19:28:53 | 00,002,381 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\sukoku119.xml
O1 - Hosts: 127.0.0.1 bin.errorprotector.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 br.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 cdn.winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 de.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 de.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.cdn.winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.systemdoctor.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.winantispyware.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.windrivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 download.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 dynamique.drivecleaner.com ## added by CiD
O1 - Hosts: 127.0.0.1 errorprotector.com ## added by CiD
O1 - Hosts: 127.0.0.1 errorsafe.com ## added by CiD
O1 - Hosts: 127.0.0.1 es.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 fr.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 fr.winfixer.com ## added by CiD
O2 - BHO: (Media Access Startup) - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\2.0.0.1050\HPIEAddOn.dll ()
O2 - BHO: (NP Helper Class) - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.8.1.4690\NPIEAddOn.dll ()
O2 - BHO: (System Search Dispatcher) - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - C:\Program Files\System Search Dispatcher\1.4.3.1040\ssd.dll ()
O3 - HKLM\..\Toolbar: (_) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stb0.dll ()
O3 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004\..\Toolbar\WebBrowser: (no name) - {09EC805C-CB2E-4D53-B0D3-A75A428B81C7} - No CLSID value found.
O3 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004\..\Toolbar\WebBrowser: (_) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stb0.dll ()
O4 - HKLM..\Run: [NWEReboot] File not found
O4 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004..\Run: [DashCast] C:\DOCUME~1\MICHA~1\DANEAP~1\PLUSSE~1\Bash Log.exe File not found
O4 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004..\Run: [Power2GoExpress] D:\CyberLink\Power2Go\Power2GoExpress.exe File not found
O4 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004..\Run: [SmileyApp] C:\Program Files\DoubleD\GamingHarbor Toolbar\4.2.5.24020\stbapp.exe ()
O4 - HKU\S-1-5-21-1060284298-688789844-1343024091-1004..\Run: [Stefan] D:\Stefan\Stefan.exe File not found
O33 - MountPoints2\{163158f0-27d2-11dc-88c9-0026540ddfd2}\Shell\AutoRun\command - "" = xsia.bat
O33 - MountPoints2\{163158f0-27d2-11dc-88c9-0026540ddfd2}\Shell\open\Command - "" = xsia.bat

:Files
C:\Program Files\DoubleD
C:\Documents and Settings\All Users\Dane aplikacji\Sukoku\sukoku119.exe
C:\Program Files\Internet Saving Optimizer
C:\Program Files\Media Access Startup
C:\Program Files\mozilla firefox\searchplugins\sukoku119.xml
C:\Program Files\System Search Dispatcher
C:\Documents and Settings\All Users\Dane aplikacji\Sukoku
C:\Documents and Settings\Michał\Ustawienia lokalne\Dane aplikacji\_
C:\Documents and Settings\Michał\Ustawienia lokalne\Dane aplikacji\DoubleD
C:\Documents and Settings\Michał\Ustawienia lokalne\Dane aplikacji\Internet Saving Optimizer
C:\Documents and Settings\Michał\Ustawienia lokalne\Dane aplikacji\Media Access Startup
C:\Program Files\Sukoku
C:\WINDOWS\tasks\User_Feed_Synchronization-{4590E99C-1417-4F28-8596-E59EECDB55CC}.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-688789844-1343024091-1005UA.job
C:\WINDOWS\tasks\User_Feed_Synchronization-{CFB22A77-D38E-46B3-AA73-5440B382E012}.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-688789844-1343024091-1004UA.job
C:\WINDOWS\tasks\AF32EBB191D19CD9.job
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-688789844-1343024091-1005Core.job
C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1060284298-688789844-1343024091-1004Core.job

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]

:Commands
[emptytemp]
[start explorer]
[Reboot]

Klikasz Run Fix. Dajesz log z usuwania + nowy log z OTL + log z HijackThis

[krusoder]

log z usuwania:
http://wklej.org/id/171950/

nowy skan OTL:
http://wklej.org/id/171960/

log z HijackThis:
http://wklej.org/id/171961/

na razie wszystko ok dzięki bardzo

[mateo8898]

Uruchom HijackThis Do a system scan only w okienku programu pokaże się log zaznacz kratki przy podanych wpisach klikasz Fix checked

Kod: Zaznacz wszystko

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.theprizeday.com/today.php
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [V0220Mon.exe] C:\WINDOWS\V0220Mon.exe
O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Michał\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" /c

W OTL wklej:

:OTL
PRC - [2007-06-13 15:23:49 | 01,034,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
O1 - Hosts: 127.0.0.1 go.winantispyware.com ## added by CiD
O1 - Hosts: 127.0.0.1 go.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 hk.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 instlog.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 instlog.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 kb.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 secure.winantispam.com ## added by CiD
O1 - Hosts: 127.0.0.1 secure.winantispy.com ## added by CiD
O1 - Hosts: 127.0.0.1 secure.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 support.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 trial.updates.winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 ulog.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 utils.winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 utils.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 winantispyware.com ## added by CiD
O1 - Hosts: 127.0.0.1 winantivirus.com ## added by CiD
O1 - Hosts: 127.0.0.1 winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 winfixer2006.com ## added by CiD
O1 - Hosts: 127.0.0.1 winsoftware.com ## added by CiD
O1 - Hosts: 127.0.0.1 www.systemdoctor.com ## added by CiD
O1 - Hosts: 127.0.0.1 www.utils.winfixer.com ## added by CiD
O1 - Hosts: 127.0.0.1 www.winantispam.com ## added by CiD
O1 - Hosts: 127.0.0.1 www.winantispy.com ## added by CiD
O1 - Hosts: 127.0.0.1 www.winantispyware.com ## added by CiD
O4 - Startup: C:\Documents and Settings\Radek\Menu Start\Programy\Autostart\Registration Prince of Persia T2T.LNK = D:\Prince of Persia T2T\Support\Register\RegistrationReminder.exe File not found

:Commands
[emptytemp]
[start explorer]

Klikasz Run Fix. Dajesz log z usuwania + nowy log z OTL