Antivirus Security Pro

[kitek]

Witam serdecznie i proszę o pilną (w miarę możliwości) pomoc. Takie cudo jak w temacie zagościło u znajomego. Znalazłem jedną instrukcję usuwania tego dziadostwa i wpisałem kod aktywacyjny (znaleziony w tamtym temacie), co spowodowało, że program się "uspokoił" i można było spokojnie zrobić logi. Niestety GMER od razy się wywala, za to Kaspersky TDS Killer znalazł kolejną łajzę (pewnie kolega tamtego) i nazwał ją... Zresztą jest w załączniku. Z kolei Avira widzi 3 rzeczy:

TR/ATRAPS.Gen2

TR/SIREFEF.BW.7

TR/ATRAPS.Gen

w C:\Documents and Settings\Tadek\Ustawienia lokalne\Dane aplikacji\Google\Desktop\Install\{7966a5fb-d22f-80fd-46e9-8d6d4533e422}\... coś tam, krzaki.

 

Z góry dziękuję.

OTL.Txt

Extras.Txt

FRST.txt

Addition.txt

[picasso]

"Antivirus Security Pro" nie został usunięty. TDSSKiller notuje najnowszą wersję rootkita ZeroAccess imitującą Google. Przeważnie te dwie infekcje chodzą w parze. Poza tym, jest tu też adware. Przeprowadź następujące działania:

 

1. Otwórz Notatnik i wklej w nim:

 

U2 *etadpug; "C:\Program Files\Google\Desktop\Install\{7966a5fb-d22f-80fd-46e9-8d6d4533e422}\ \ \???\{7966a5fb-d22f-80fd-46e9-8d6d4533e422}\GoogleUpdate.exe" 
HKLM\...\Run: [NPSStartup] - [x]
HKCU\...\Run: [NETIANET] - D:\netianet.exe
HKCU\...\Run: [NTRedirect] - C:\WINDOWS\system32\rundll32.exe "C:\Documents and Settings\Tadek\Dane aplikacji\BabSolution\Shared\enhancedNT.dll",Run
HKCU\...\Run: [Google Update*] - [x] 
HKCU\...\Run: [AS2014] - C:\Documents and Settings\All Users\Dane aplikacji\gXlpUnr3\gXlpUnr3.exe [578712 2013-10-17] ()
MountPoints2: {1198a5ce-8743-11de-a5f2-000e50f26a08} - G:\n0euybx.exe
AppInit_DLLs: c:\docume~1\alluse~1\daneap~1\bitguard\261694~1.246\{c16c1~1\bitguard.dll [ 2013-10-01] ()
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=842D0015F2CC72F1&affID=119357&tt=070813_wt4&tsp=4972
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.duxet.com/
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
BHO: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files\Delta\delta\1.8.22.0\bh\delta.dll (Delta-search.com)
Toolbar: HKLM - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files\Delta\delta\1.8.22.0\deltaTlbr.dll (Delta-search.com)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
S3 PCAMPR5; \??\C:\WINDOWS\system32\PCAMPR5.SYS [x]
C:\Program Files\Google
C:\Documents and Settings\Tadek\Ustawienia lokalne\Dane aplikacji\Google
C:\Documents and Settings\All Users\Dane aplikacji\gXlpUnr3
C:\Documents and Settings\All Users\Dane aplikacji\Babylon
C:\Documents and Settings\Tadek\Dane aplikacji\BabSolution
C:\Documents and Settings\Tadek\Dane aplikacji\Babylon
C:\Documents and Settings\Tadek\Dane aplikacji\File Scout
C:\Documents and Settings\Tadek\Pulpit\Antivirus Security Pro.lnk
C:\Documents and Settings\Tadek\Pulpit\Antivirus Security Pro support.url
C:\Documents and Settings\Tadek\Menu Start\Programy\Antivirus Security Pro
C:\WINDOWS\Tasks\EPUpdater.job
C:\WINDOWS\Tasks\1-Click Maintenance.job
Reg: reg delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /f

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt.

 

2. Odinstaluj adware:

- Przez Panel sterowania: BitGuard, Delta Chrome Toolbar, Delta toolbar, McAfee Security Scan Plus.

- W Firefox: menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox.

 

3. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania. W systemie jest obiekt "Avira SearchFree Toolbar plus Web Protection", który jest po prostu adware Ask Toolbar skombinowanym z osłoną web AV. To trzeba ominąć przy usuwaniu, nie jestem pewna jaki wybór daje najnowszy AdwCleaner.

 

4. Uruchom TFC - Temp Cleaner.

 

5. Zrób nowe logi: skan FRST (bez Addition) + Farbar Service Scanner. Dołącz plik fixlog.txt i log z AdwCleaner.

 

 

 

.

[kitek]

Wszystko zrobione, dzięki wielkie.

Podczas czyszczenie AdwCleanerem nie znalazłem żadnych wpisów o Avirze, dlatego nic nie odznaczyłem.

Fixlog.txt

FRST.txt

FSS.txt

[picasso]

Zapomniałeś dodać log z AdwCleaner.

[kitek]

Faktycznie, sorki. To przez to, że logi są na C:

AdwCleanerR0.txt

AdwCleanerS0.txt

[picasso]

Poprzednie zadania wykonane. Kolejne do wdrożenia:

 

1. Poprawki. Otwórz Notatnik i wklej w nim:

 

S3 gusvc; "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe" [x]
C:\Program Files\Google

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

 

2. Rekonstrukcja skasowanych przez ZeroAccess usług. Otwórz Notatnik i wklej w nim:

 

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent]

"Type"=dword:00000020

"Start"=dword:00000002

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6c,\

00,73,00,61,00,73,00,73,00,2e,00,65,00,78,00,65,00,00,00

"DisplayName"="Usługi IPSEC"

"DependOnService"=hex(7):52,00,50,00,43,00,53,00,53,00,00,00,54,00,63,00,70,00,\

69,00,70,00,00,00,49,00,50,00,53,00,65,00,63,00,00,00,00,00

"DependOnGroup"=hex(7):00,00

"ObjectName"="LocalSystem"

"Description"="Zarządza zasadami zabezpieczeń IP i uruchamia sterownik ISAKMP/Oakley (IKE) i sterownik zabezpieczeń IP."

"PolstoreDllRegisterVersion"=dword:00000002
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Security]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,8d,00,02,00,01,01,00,00,00,00,00,\

05,0b,00,00,00,00,00,18,00,9d,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,\

23,02,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,\

02,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Enum]

"0"="Root\\LEGACY_POLICYAGENT\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess]

"Type"=dword:00000020

"Start"=dword:00000004

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

"DisplayName"="Routing i dostęp zdalny"

"DependOnService"=hex(7):52,00,70,00,63,00,53,00,53,00,00,00,00,00

"DependOnGroup"=hex(7):4e,00,65,00,74,00,42,00,49,00,4f,00,53,00,47,00,72,00,\

6f,00,75,00,70,00,00,00,00,00

"ObjectName"="LocalSystem"

"Description"="Oferuje usługi routingu firmom w środowiskach sieci lokalnych i rozległych."

@=""
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers]

"ActiveProvider"="{1AA7F846-C7F5-11D0-A376-00C04FC9DA04}"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers\{1AA7F840-C7F5-11D0-A376-00C04FC9DA04}]

"ConfigClsid"="{1AA7F840-C7F5-11D0-A376-00C04FC9DA04}"

"DisplayName"="Księgowanie usługi RADIUS"

"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,\

61,00,73,00,72,00,61,00,64,00,2e,00,64,00,6c,00,6c,00,00,00

"ProviderTypeGUID"="{76560D80-2BFD-11d2-9539-3078302C2030}"

"VendorName"="Microsoft"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Accounting\Providers\{1AA7F846-C7F5-11D0-A376-00C04FC9DA04}]

"ConfigClsid"=""

"DisplayName"="Księgowanie systemu Windows"

"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,\

70,00,72,00,64,00,64,00,6d,00,2e,00,64,00,6c,00,6c,00,00,00

"ProviderTypeGUID"="{76560D81-2BFD-11d2-9539-3078302C2030}"

"VendorName"="Microsoft"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers]

"ActiveProvider"="{1AA7F841-C7F5-11D0-A376-00C04FC9DA04}"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers\{1AA7F83F-C7F5-11D0-A376-00C04FC9DA04}]

"ConfigClsid"="{1AA7F83F-C7F5-11D0-A376-00C04FC9DA04}"

"DisplayName"="Uwierzytelnianie usługi RADIUS"

"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,00,\

61,00,73,00,72,00,61,00,64,00,2e,00,64,00,6c,00,6c,00,00,00

"VendorName"="Microsoft"

"ProviderTypeGUID"="{76560D00-2BFD-11d2-9539-3078302C2030}"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Authentication\Providers\{1AA7F841-C7F5-11D0-A376-00C04FC9DA04}]

"ConfigClsid"=""

"DisplayName"="Uwierzytelnianie systemu Windows"

"Path"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,00,\

70,00,72,00,64,00,64,00,6d,00,2e,00,64,00,6c,00,6c,00,00,00

"VendorName"="Microsoft"

"ProviderTypeGUID"="{76560D01-2BFD-11d2-9539-3078302C2030}"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\DemandDialManager]

"DllPath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6d,\

00,70,00,72,00,64,00,64,00,6d,00,2e,00,64,00,6c,00,6c,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces]

"Stamp"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\0]

"InterfaceName"="Sprzężenie zwrotne"

"Type"=dword:00000005

"Enabled"=dword:00000001

"Stamp"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\0\Ip]

"ProtocolId"=dword:00000021

"InterfaceInfo"=hex:01,00,00,00,68,00,00,00,03,00,00,00,05,00,ff,ff,38,00,00,\

00,00,00,00,00,40,00,00,00,04,00,ff,ff,04,00,00,00,01,00,00,00,40,00,00,00,\

07,00,ff,ff,10,00,00,00,01,00,00,00,48,00,00,00,00,00,00,00,01,00,00,00,00,\

00,00,00,58,02,c2,01,08,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\1]

"InterfaceName"="Wewnętrzny"

"Type"=dword:00000004

"Enabled"=dword:00000001

"Stamp"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\1\Ip]

"ProtocolId"=dword:00000021

"InterfaceInfo"=hex:01,00,00,00,68,00,00,00,03,00,00,00,05,00,ff,ff,38,00,00,\

00,00,00,00,00,40,00,00,00,04,00,ff,ff,04,00,00,00,01,00,00,00,40,00,00,00,\

07,00,ff,ff,10,00,00,00,01,00,00,00,48,00,00,00,00,00,00,00,01,00,00,00,00,\

00,00,00,58,02,c2,01,08,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2]

"InterfaceName"="{8BE61CC0-E394-4310-A592-FED02D84FD4E}"

"Type"=dword:00000003

"Enabled"=dword:00000001

"Stamp"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2\Ip]

"ProtocolId"=dword:00000021

"InterfaceInfo"=hex:01,00,00,00,68,00,00,00,03,00,00,00,05,00,ff,ff,38,00,00,\

00,00,00,00,00,40,00,00,00,04,00,ff,ff,04,00,00,00,01,00,00,00,40,00,00,00,\

07,00,ff,ff,10,00,00,00,01,00,00,00,48,00,00,00,00,00,00,00,01,00,00,00,00,\

00,00,00,58,02,c2,01,08,07,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters]

"RouterType"=dword:00000001

"ServerFlags"=dword:00802702

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

6d,00,70,00,72,00,64,00,69,00,6d,00,2e,00,64,00,6c,00,6c,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\AppleTalk]

"EnableIn"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip]

"AllowClientIpAddresses"=dword:00000000

"AllowNetworkAccess"=dword:00000001

"EnableIn"=dword:00000001

"IpAddress"="0.0.0.0"

"IpMask"="0.0.0.0"

"UseDhcpAddressing"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\StaticAddressPool]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ip\StaticAddressPool\0]

"From"=dword:00000000

"To"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ipx]

"EnableIn"=dword:00000001

"AcceptRemoteNodeNumber"=dword:00000001

"AllowNetworkAccess"=dword:00000001

"AutoWanNetAllocation"=dword:00000001

"FirstWanNet"=dword:00000000

"GlobalWanNet"=dword:00000001

"LastWanNet"=dword:00000000

"WanNetPoolSize"=dword:000003e8
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Nbf]

"EnableIn"=dword:00000001

"AllowNetworkAccess"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Performance]

"Open"="OpenRasPerformanceData"

"Close"="CloseRasPerformanceData"

"Collect"="CollectRasPerformanceData"

"Library"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,\

00,61,00,73,00,63,00,74,00,72,00,73,00,2e,00,64,00,6c,00,6c,00,00,00

"Last Counter"=dword:00000804

"Last Help"=dword:00000805

"First Counter"=dword:000007de

"First Help"=dword:000007df

"WbemAdapFileSignature"=hex:01,88,e5,06,07,8c,88,44,d4,76,d0,a7,86,ec,e9,f9

"WbemAdapFileTime"=hex:00,24,53,21,c2,9e,c8,01

"WbemAdapFileSize"=dword:00003000

"WbemAdapStatus"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy]

"ProductDir"="C:\\WINDOWS\\system32\\IAS"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\01]

@="IAS.ProxyPolicyEnforcer"

"Requests"="0 1 2"

"Responses"="0 1 2 3 4"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\02]

@="IAS.NTSamNames"

"Providers"="1"

"Requests"="0"

"Responses"="0 1 3"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\03]

@="IAS.BaseCampHost"

"Requests"="0 1"

"Responses"="0 1 2 4"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\04]

@="IAS.RadiusProxy"

"Providers"="2"

"Responses"="0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\05]

@="IAS.NTSamAuthentication"

"Providers"="1"

"Requests"="0"

"Responses"="0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\06]

@="IAS.AccountValidation"

"Providers"="1"

"Requests"="0"

"Responses"="0 1"

"Reasons"="33"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\07]

@="IAS.PolicyEnforcer"

"Providers"="1"

"Requests"="0"

"Responses"="0 1 3"

"Reasons"="33"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\08]

@="IAS.NTSamPerUser"

"Providers"="1"

"Requests"="0"

"Responses"="0 1 3"

"Reasons"="33"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\09]

@="IAS.EAP"

"Providers"="1"

"Requests"="0 2"

"Responses"="0"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\10]

@="IAS.URHandler"

"Providers"="0 1"

"Requests"="0 2"

"Responses"="0 1"

"Reasons"="33"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\11]

@="IAS.ChangePassword"

"Providers"="1"

"Requests"="0"

"Responses"="0 1"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\12]

@="IAS.AuthorizationHost"

"Requests"="0 1 2"

"Responses"="0 1 2 4"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\13]

@="IAS.Accounting"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy\Pipeline\14]

@="IAS.MSChapErrorReporter"

"Providers"="0 1"

"Requests"="0"

"Responses"="2"
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers]

"Stamp"=dword:00000000
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\RouterManagers\Ip]

"ProtocolId"=dword:00000021

"GlobalInfo"=hex:01,00,00,00,80,00,00,00,02,00,00,00,03,00,ff,ff,08,00,00,00,\

01,00,00,00,30,00,00,00,06,00,ff,ff,3c,00,00,00,01,00,00,00,38,00,00,00,00,\

00,00,00,00,00,00,00,01,00,00,00,07,00,00,00,02,00,00,00,01,00,00,00,03,00,\

00,00,0a,00,00,00,16,27,00,00,03,00,00,00,17,27,00,00,05,00,00,00,12,27,00,\

00,07,00,00,00,0d,00,00,00,6e,00,00,00,08,00,00,00,78,00,00,00,00,00,00,00,\

00,00,00,00,00,00,00,00

"DLLPath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,69,\

00,70,00,72,00,74,00,72,00,6d,00,67,00,72,00,2e,00,64,00,6c,00,6c,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Security]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess]

"Type"=dword:00000020

"Start"=dword:00000002

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

"DisplayName"="Zapora systemu Windows/Udostępnianie połączenia internetowego"

"DependOnService"=hex(7):4e,00,65,00,74,00,6d,00,61,00,6e,00,00,00,57,00,69,00,\

6e,00,4d,00,67,00,6d,00,74,00,00,00,00,00

"DependOnGroup"=hex(7):00,00

"ObjectName"="LocalSystem"

"Description"="Zapewnia usługi translacji adresów sieciowych, adresowania, rozpoznawania nazw i/lub blokowania dostępu intruzów wszystkim komputerom w sieci domowej lub biurowej."
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch]

"Epoch"=dword:0000042e
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters]

"ServiceDll"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,\

00,74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

69,00,70,00,6e,00,61,00,74,00,68,00,6c,00,70,00,2e,00,64,00,6c,00,6c,00,00,\

00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Security]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup]

"ServiceUpgrade"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Setup\InterfacesUnfirewalledAtUpdate]

"All"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Enum]

"0"="Root\\LEGACY_SHAREDACCESS\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]

"Type"=dword:00000020

"Start"=dword:00000002

"ErrorControl"=dword:00000001

"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\

74,00,25,00,5c,00,53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\

00,76,00,63,00,68,00,6f,00,73,00,74,00,2e,00,65,00,78,00,65,00,20,00,2d,00,\

6b,00,20,00,6e,00,65,00,74,00,73,00,76,00,63,00,73,00,00,00

"DisplayName"="Centrum zabezpieczeń"

"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,77,00,69,00,6e,00,\

6d,00,67,00,6d,00,74,00,00,00,00,00

"ObjectName"="LocalSystem"

"Description"="Monitoruje ustawienia zabezpieczeń i konfiguracje systemu."
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Parameters]

"ServiceDll"=hex(2):25,00,53,00,59,00,53,00,54,00,45,00,4d,00,52,00,4f,00,4f,\

00,54,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,\

77,00,73,00,63,00,73,00,76,00,63,00,2e,00,64,00,6c,00,6c,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Security]

"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00,00,30,00,00,00,02,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00,00,00,05,0b,00,00,00,00,\

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00,00,00,23,02,00,00,01,01,\

00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Enum]

"0"="Root\\LEGACY_WSCSVC\\0000"

"Count"=dword:00000001

"NextInstance"=dword:00000001
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]

"Start"=dword:00000002
 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
 

[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
 

[-HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
 

[-HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
 

[-HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]

 

Adnotacja dla innych czytających: import dopasowany do Windows XP.

 

Z menu Notatnika > Plik > Zapisz jako > Ustaw rozszerzenie na Wszystkie pliki > Zapisz jako FIX.REG

 

Uruchom plik przez dwuklik, potwierdź import do rejestru. Zresetuj system i zrób nowy log z Farbar Service Scanner.

 

 

 

 

.

[kitek]

Gotowe.

Fixlog.txt

FSS.txt

[picasso]

O ile FIX.REG wykonany, to nadal jest problem z usunięciem folderu Google. Usuwam go w całości, gdyż nie ma tu nic od Google zainstalowanego. Kolejne podejście. Otwórz Notatnik i wklej w nim:

 

Unlock: C:\Program Files\Google
C:\Program Files\Google

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

 

 

 

.

[kitek]

Niestety, ciągle siedzi ten folder.

 

Wiem, że nie prosiłaś, ale zrobiłem w międzyczasie szybki skan Antimalwarebytes

 

 

Muszę niestety oddać już kompa, więc spróbuję dalej sam.

Zrobię sprzątanie, aktualizacje i takie tam.

 

Tak czy inaczej: dzięki wielkie za pomoc.

Fixlog.txt

MBAM-log-2013-10-20 (19-59-51).txt

Edytowane 23 Października 2013 przez kitek