Ukash (logi do analizy)

[macieg3]

Witam!
znajomy przyszedł do mnie ze słynnym problemem "Ukash"
oto jego logi:
OTL:
http://wklej.to/HBUC0

Extras:
http://wklej.to/t9Klv

[bajbus]

Dorzuc jeszcze log z TDSSKiller http://www.instalki.pl/programy/downloa ... iller.html

[mateo8898]

1. Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=caea9fee-97c0-43dc-8919-9cf5a047ff25&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=caea9fee-97c0-43dc-8919-9cf5a047ff25&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=caea9fee-97c0-43dc-8919-9cf5a047ff25&affid=111583&searchtype=hp&babsrc=lnkry_nt
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=caea9fee-97c0-43dc-8919-9cf5a047ff25&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=PL&userid=caea9fee-97c0-43dc-8919-9cf5a047ff25&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\..\SearchScopes\{9A047AA4-507E-4AE7-852E-3ECA7AD97518}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}
IE - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\..\SearchScopes\{C6770BEE-8E35-4BAF-BA03-30B04C8EFE1E}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=FV&apn_dtid=YYYYYYYYPL&apn_uid=f721f787-8d6e-4795-83b9-72e45130b2d2&apn_sauid=4AA103A3-FFCE-4992-832D-4E9F90A7F991
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_1_102.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.0: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
O2 - BHO: (DownloadnSave Class) - {6ACF4C84-D490-C45E-A393-61D5D19EAEA5} - C:\ProgramData\DownloadnSave\bhoclass.dll File not found
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [Browser Infrastructure Helper] C:\Users\Kamil\AppData\Local\Smartbar\Application\Linkury.exe startup File not found
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [Microsoft Windows Manager] C:\Users\Kamil\M-10-6897-8685-3464\winmgr.exe ()
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [Mjjicrtugug ddd Manager] C:\Users\Kamil\M-10-8754-86589-55555\windogz.exe ()
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [Mjjicrtuuuhgug ddd Manager] C:\Users\Kamil\M-10-8754-86589h-555h5\winhora.exe ()
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [Mjjicujuurtuiigug ddd Manager] C:\Users\Kamil\M-10-8754-86589-55555\uughgu.exe ()
O4 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000..\Run: [SensApi] C:\Users\Kamil\AppData\Local\Microsoft\Windows\4386\SensApi.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O8:64bit: - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
[2012-08-07 19:53:49 | 000,000,000 | RHSD | C] -- C:\Users\Kamil\M-10-876858-88h-555h5
[2012-08-07 18:27:51 | 000,000,000 | RHSD | C] -- C:\Users\Kamil\M-10-8754-86589h-555h5
[2012-08-06 20:22:17 | 000,000,000 | ---D | C] -- C:\Users\Kamil\AppData\Roaming\hellomoto
[2012-08-23 11:14:57 | 000,000,372 | -H-- | M] () -- C:\Windows\tasks\OptimizerProUpdaterLogonTask.job
[2012-08-23 11:14:56 | 000,000,352 | -H-- | M] () -- C:\Windows\tasks\OptimizerProUpdaterRefreshTask.job

:Reg
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IPLA!"=-
"Optimizer Pro"=-

:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Dajesz log z usuwania.

2. Odinstaluj: Google Toolbar, SweetIM for Messenger, YTD Toolbar v6.2
3. Podaj nowe logi robione opcją Skanuj

[macieg3]

LOGi po zabiegu:
OTL:
http://wklej.to/qFibq

extras:
http://wklej.to/Mc0BL

Generalnie komputer już działa.
Dziekuje za pomoc.

[mateo8898]

W OTL wklej:

:OTL
O3 - HKU\S-1-5-21-1025542430-1361525746-1932243868-1000\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.

Klikasz Wykonaj skrypt, później Sprzątanie

Przeczyść dysk oraz rejestr CCleaner

Wykonaj pełne skanowanie Malwarebytes' Anti-Malware - jeśli coś znajdzie usuń i daj raport (po uruchomieniu odrzuć okres testowy)

Zainstaluj SP1 http://www.instalki.pl/programy/downloa ... ack_1.html

Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz) http://www.instalki.pl/programy/downloa ... rer_9.html

[macieg3]

raport z Malwarebytes' Anti-Malware:

http://wklej.to/RdfMa

[mateo8898]

Nie wykonano akcji.

Usunąłeś to co znalazł??? Jeśli nie to usuń, opróżnij kwarantannę i wykonaj pozostałe kroki.