"Twój komputer został zablokowany"- UKASH- PROSZĘ O POMOC

[Waves]

W własne pole skanowania/skrypt w OTL wklej:

Kod:

:Processes
Killallprocesses

:OTL
PRC - [2012-09-19 15:50:47 | 000,233,472 | ---- | M] () -- C:\Documents and Settings\All Users.WINDOWS1\Dane aplikacji\Premium\OptimizerPro\OptimizerPro.exe
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://websearch.mocaflix.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=d008d640000000000000000854187c35&tlver=1.4.19.19&affID=19444
IE - HKLM\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=8fbdfc7a-19e4-11e1-9176-000854187c35&q={searchTerms}
IE - HKLM\..\SearchScopes\{96bd48dd-741b-41ae-ac4a-aff96ba00f7e}: "URL" = http://startsear.ch/?aff=2&src=sp&cf=8fbdfc7a-19e4-11e1-9176-000854187c35&q={searchTerms}
IE - HKLM\..\SearchScopes\{B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B}: "URL" = http://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=download&chnl=download&cd=2XzuyEtN2Y1L1QzutDtDtDzzyDyEtCzzyB0CtAyD0DyCyEtDtN0D0Tzu0CtAtCyCtN1L2XzutBtFtBtFtDtFtAyEyE&cr=1845228416
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.mocaflix.com/?l=1&q={searchTerms}
IE - HKU\S-1-5-21-1417001333-1965331169-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.babylon.com/?babsrc=HP_ss&mntrId=d008d640000000000000000854187c35&tlver=1.4.19.19&affID=19444
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:File not found
O2 - BHO: (Funmoods Helper Object) - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - C:\Program Files\Funmoods\1.5.23.22\bh\escort.dll (Funmoods BHO)
O3 - HKLM\..\Toolbar: (StartSearchToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\StartSearch plugin\ssBarLcher.dll (StartSearch Inc.)
O3 - HKLM\..\Toolbar: (Search Results Toolbar) - {94366e2c-9923-431c-b0d6-747447dd0f2b} - C:\Program Files\searchresults1\searchresultsDx.dll (Ask.com)
O3 - HKLM\..\Toolbar: (Funmoods Toolbar) - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - C:\Program Files\Funmoods\1.5.23.22\escorTlbr.dll (Funmoods)
O3 - HKU\S-1-5-21-1417001333-1965331169-682003330-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O33 - MountPoints2\{3299fe6c-fe4d-11d5-94c5-000854187c35}\Shell\AutoRun\command - "" = K:\yveqsh93.exe
O33 - MountPoints2\{3299fe6c-fe4d-11d5-94c5-000854187c35}\Shell\open\Command - "" = K:\yveqsh93.exe

Files:
C:\yveqsh93.exe
C:\Documents and Settings\lolek.787F84AB93E84C4\Dane aplikacji\Funmoods
C:\Documents and Settings\lolek.787F84AB93E84C4\Menu Start\Programy\Autostart\runctf.lnk
C:\WINDOWS1\System32\mgking0.dll

:Commands
[EMPTYTEMP]
[EMPTYFLASH]

Klik na wykonaj skrypt. Pokaż nowy log po usuwaniu.

Pobierz:

[Aby zobaczyć linki, zarejestruj się tutaj]

Naciśnij delete/usuń.

Mam zagwozdkę z tym plikiem:

Kod:

C:\Documents and Settings\lolek.787F84AB93E84C4\Ustawienia lokalne\Temp\wlsidten.dll

Podpisany jest jako Корпорация Майкрософт . Przeskanuj go na

[Aby zobaczyć linki, zarejestruj się tutaj]