Jak usunąć wirusa Blaster z Windows XP? Analiza logów OTL

Chciał bym prosić o pomoc w logach otl....
Wirus blaster wszystko blokuje..
System win xp.

Logi w załącznikach.

Z góry dzięki .

Odinstaluj:
SweetPacks bundle uninstaller
Java(TM) 6 Update 19
Web Assistant 2.0.0.478
Pando Media Booster
Bonjour
SweetIM for Messenger 3.7
Adobe Reader 9.3 - Polish
Internet Explorer Toolbar 4.6 by SweetPacks
WebCake 3.00
Update Manager for SweetPacks 1.1
AVG Security Toolbar
Incredibar Toolbar on IE
uTorrentControl_v2 Toolbar
Linkury Smartbar Engine
Hoolapp For Android

Uzyj AdwCleaner, opcja Delete.

W Chrome zmien strone glowna na google.

Wykonaj skrypt w OTL:

:OTL
MOD - [2012-12-17 01:44:38 | 000,027,958 | ---- | M] () -- C:\Program Files\Common Files\logonInit.dll
SRV - File not found [On_Demand | Stopped] -- C:\Program Files\WebCake\WebCakeDesktop.Updater.exe C:\D -- (WebCake Desktop Updater)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Web Assistant\ExtensionUpdaterService.exe -- (Web Assistant Updater)
SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe -- (vToolbarUpdater13.2.0)
SRV - [2013-04-07 10:54:58 | 001,156,400 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\dmwu.exe -- (IBUpdaterService)
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=hp&babsrc=lnkry_nt
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
IE - HKCU\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKCU\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://feed.helperbar.com/?publisher=OC&dpid=...5f&affid=111583&searchtype=ds&babsrc=lnkry&q={searchTerms}
FF - prefs.js..browser.search.selectedEngine: "Web Search"
FF - prefs.js..browser.startup.homepage: "http://feed.helperbar.com/?publisher=OC&dpid=OC&co=PL&userid=228a20e9-6ef4-40ea-b9a9-3e418eb90d5f&affid=111583&searchtype=hp&babsrc=lnkry"
FF - prefs.js..extensions.enabledAddons: helperbar%40helperbar.com:1.0
FF - prefs.js..keyword.URL: "http://feed.helperbar.com/?publisher=OC&dpid=OC&co=PL&userid=228a20e9-6ef4-40ea-b9a9-3e418eb90d5f&affid=111583&searchtype=ds&babsrc=lnkry&q="
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox
[2012-11-11 19:55:34 | 000,000,000 | ---D | M] (uTorrentControl_v2) -- C:\D & S\Fumaa\Dane aplikacji\Mozilla\Firefox\extensions\{7473b6bd-4691-4744-a82b-7854eb3d70b6}
[2013-01-16 21:59:30 | 000,000,000 | ---D | M] ("Linkury Smartbar") -- C:\D & S\Fumaa\Dane aplikacji\Mozilla\Firefox\Profiles\uhwxd96q.default\extensions\helperbar@helperbar.com
[2013-06-15 17:43:16 | 000,000,000 | ---D | M] (WebCake) -- C:\D & S\Fumaa\Dane aplikacji\Mozilla\Firefox\Profiles\uhwxd96q.default\extensions\plugin@getwebcake.com
[2013-06-17 23:11:22 | 000,002,120 | ---- | M] () -- C:\D & S\Fumaa\Dane aplikacji\Mozilla\Firefox\Profiles\uhwxd96q.default\searchplugins\MyStart Search.xml
[2013-01-20 21:48:23 | 000,002,455 | ---- | M] () -- C:\D & S\Fumaa\Dane aplikacji\Mozilla\Firefox\Profiles\uhwxd96q.default\searchplugins\Web Search.xml
O2 - BHO: (WebCake) - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files\WebCake\WebCakeIEClient.dll (WebCake LLC)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Program Files\Web Assistant\Extension32.dll File not found
O2 - BHO: (Incredibar.com Helper Object) - {6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll (Montera Technologeis LTD)
O2 - BHO: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll (Conduit Ltd.)
O2 - BHO: (SweetPacks Browser Helper) - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentControl_v2 Toolbar) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - C:\Program Files\uTorrentControl_v2\prxtbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (SweetPacks Toolbar for Internet Explorer) - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
O3 - HKLM\..\Toolbar: (Incredibar Toolbar) - {F9639E4A-801B-4843-AEE3-03D9DA199E77} - C:\Program Files\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll (Montera Technologeis LTD)
O4 - HKCU..\Run: [Hoolapp Android] C:\D & S\Fumaa\Dane aplikacji\HoolappForAndroid\Hoolapp.exe ()
O4 - HKCU..\Run: [Internet Security] C:\D & S\All Users\Dane aplikacji\ildefender.exe (FileZilla Project)
O4 - HKCU..\Run: [WebCake Desktop] C:\D & S\Fumaa\Dane aplikacji\WebCake\WebCakeDesktop.exe (WebCake LLC)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-0016-0000-0019-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_19-windows-i586.cab (Java Plug-in 1.6.0_19)
O20 - Winlogon\Notify\LogonInit: DllName - (logonInit.dll) - C:\Program Files\Common Files\logonInit.dll ()
[2013-06-17 21:18:13 | 000,848,384 | ---- | C] (FileZilla Project) -- C:\D & S\All Users\Dane aplikacji\ildefender.exe
[2013-06-15 17:43:15 | 000,000,000 | ---D | C] -- C:\Program Files\WebCake
[2013-06-15 17:43:15 | 000,000,000 | ---D | C] -- C:\D & S\Fumaa\Dane aplikacji\WebCake
[2013-06-15 17:43:04 | 000,000,000 | ---D | C] -- C:\D & S\All Users\Dane aplikacji\Tarma Installer
[2013-06-15 17:43:04 | 000,000,000 | ---D | C] -- C:\D & S\Fumaa\Menu Start\Programy\Hoolapp for Android
[2013-06-15 17:43:03 | 000,000,000 | ---D | C] -- C:\D & S\Fumaa\Dane aplikacji\HoolappForAndroid
[2013-06-06 21:56:12 | 000,000,000 | ---D | C] -- C:\D & S\All Users\Dane aplikacji\Trymedia
[2013-06-17 21:18:14 | 000,000,780 | ---- | M] () -- C:\D & S\All Users\Pulpit\Internet Security Pro.lnk
[2013-06-15 17:43:04 | 000,000,931 | ---- | M] () -- C:\D & S\Fumaa\Pulpit\Hoolapp™ for Android.lnk
[2013-06-15 17:42:52 | 000,000,661 | ---- | M] () -- C:\D & S\Fumaa\Pulpit\.lnk
[2013-06-10 23:33:18 | 000,000,571 | ---- | M] () -- C:\Program Files\Common Files\userInit.dll
[2013-06-15 17:42:40 | 000,631,232 | ---- | C] () -- C:\D & S\Fumaa\Pulpit\Hamachi_Downloader.exe
[2012-12-17 17:42:31 | 000,000,571 | ---- | C] () -- C:\Program Files\Common Files\userInit.dll
[2012-12-17 01:44:38 | 000,027,958 | ---- | C] () -- C:\Program Files\Common Files\logonInit.dll

Zrob skan przy pomocy mbam oraz cureit.

Zainstaluj:
Foxit: ninite.com/foxit/
Java: ninite.com/java/
Firefox

Po wykonaniu daj nowy log z OTL.

Zrobione . Odinstalowałem wszystko co się dało .
Skrypt Zrobiony .
Skany zrobione .
Programy Zainstalowane .

W załączniku umieszczam wszystkie logi jakie otrzymałem , oraz nowe OTL.
Jeżeli coś źle wkleiłem albo o czymś zapomniałem to wystarczy napisać , zaraz dodam .

Nie widze zebys wykonal skrypt. Wklej go do OTL razem z :OTL na poczatku, wykonaj i po wykonaniu daj log z wykonania oraz nowy log ze skanowania.

Dziwne , jestem pewien że wykonałem skrypt. Ale zrobię to jeszcze raz , oto logi:

Wpisz w uruchom:
netsh int ip reset c:\Reset.txt
netsh winsock reset

W Chrome zmien wyszukiwarke na Google i usun Web (helpbar).

Wykonaj skrypt w OTL:

:OTL
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll File not found

Po wykonaniu daj nowy log z OTL.

Zrobione . Nie umiałem tylko usunąć tego helpbara z Chroma . Oto logi :

Uzyj: http://images.malwareremoval.com/jpshortstuff/SystemLook.exe wklej do niego:

:filefind
mswsock.dll

Po wykonaniu daj log.

Zrobione .

Daj log z combofix.

Dziwne , kiedy robię skan combofixem to w trakcie mi się zacina komp i nic nie można zrobić .

Sprobuj uruchomic w trybie awaryjnym.