Pojawiajace sie puste okno z traya i wiele innych rzeczy, które dziać sie nie powinny

[poszczyca]

Witam,

 

Ciezko okreslic problem, gdzys problemow jest tu mnostwo. Laptop obslgiwany przez osobe totalnie anty-pc. Jestem u niej przez najblizsze 2 dni i pomyslalam, ze chociaz troche uda mi sie poprawic komfort uzytkowania tego zaniedbanego cudka

 

Ponizej logi i prosba o pomoc.

OTL.Txt

Extras.Txt

Shortcut.txt

Addition.txt

FRST.txt

[picasso]

Objaśnij mi tytułowy wątek: "pojawiajace sie puste okno z traya i wiele innych rzeczy, które dziać sie nie powinny". O jakim pustym oknie mowa i co konkretnie się dzieje, co nie powinno?

 

Temat przenoszę do działu Windows. Oznak czynnej infekcji tu nie widać, jedynie minimalne i nie wpływające na nic odpadki adware. Aczkolwiek jest tu wątpliwość na temat adresów DNS pobranych z routera. Dwa ostatnie wg WHOIS to IP holenderskie. Czy ten komputer jest w polskiej sieci czy zagranicznej?

 

Tcpip\Parameters: [DhcpNameServer] 192.168.2.254 195.241.77.55 195.241.77.58

 

Z rzeczy zwracających uwagę są tu zdekompletowane odpadkowe instalacje AVG (ostał się pasek) i McAfee (SiteAdvisor nie ma wejścia na liście zainstalowanych, lecz się uruchamia). Pod tym kątem:

 

1. Otwórz Notatnik i wklej w nim:

 

(AVG Secure Search) C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
S3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [1025352 2011-09-01] ()
S2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [X]
HKU\S-1-5-21-1281656285-3292631135-2204216889-1000\...\Run: [ares] => "C:\Program Files (x86)\Ares\Ares.exe" -h
HKU\S-1-5-21-1281656285-3292631135-2204216889-1000\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] => C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-05-31] (AVG Secure Search)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT3072253
URLSearchHook: HKCU - (No Name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {1D5217A2-4338-4436-A220-2C442C445FD2} URL = http://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKCU - DefaultScope {76A329A6-E52B-44D7-812A-8BC1A2849157} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
SearchScopes: HKCU - {1D5217A2-4338-4436-A220-2C442C445FD2} URL = http://startsear.ch/?aff=1&q={searchTerms}
SearchScopes: HKCU - {5243D09F-B573-4980-AF53-D4D07A792538} URL = https://isearch.avg.com/search?cid={E89087DD-46A9-4F6D-87C8-E7629F3D688F}&mid=634ac6f5eaac47d1bb3bcd3c4e67acb5-36a08e4b3a79c86122e7ed60bdbcdaea472a8675&lang=pl&ds=AVG&pr=fr&d=2012-10-11 16:34:46&v=13.2.0.1&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {76A329A6-E52B-44D7-812A-8BC1A2849157} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={E89087DD-46A9-4F6D-87C8-E7629F3D688F}&mid=634ac6f5eaac47d1bb3bcd3c4e67acb5-36a08e4b3a79c86122e7ed60bdbcdaea472a8675&lang=pl&ds=AVG&pr=fr&d=2012-10-11 16:34:46&v=15.2.0.5&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {A71916CF-98FE-446E-A9AA-3C30502360F3} URL =
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - No File
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO-x32: IE5BarLauncherBHO Class - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - VShareToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-04-11]
Task: {4DE0D8A3-5339-4E54-B0D9-F289E1CF272A} - System32\Tasks\{7E36CD30-2582-4AAF-9810-91266B0A9297} => Firefox.exe http://ui.skype.com/ui/0/6.1.0.129.272/en/abandoninstall?source=lightinstaller&page=tsMain
Task: {5165515C-6933-48DF-9A1C-2F5F397D42E0} - System32\Tasks\{FA473040-29A1-4412-926D-4494B78D807B} => Firefox.exe http://ui.skype.com/ui/0/6.6.73.106.456/pl/abandoninstall?page=tsProgressBar
Task: {578E1CFD-DBEA-4B21-B12A-A0E7D3F3E94C} - System32\Tasks\{A300601E-3E9B-45EA-B52B-2AC6C7FA8C9E} => Firefox.exe http://ui.skype.com/ui/0/6.1.0.129.272/en/abandoninstall?page=tsMain
Task: {82B54BEB-D13D-43CB-BFB7-1FE0BC9572A7} - \Program aktualizacji online firmy Adobe. No Task File 
Task: {87B30D1B-456C-4188-962C-484B1D498CF6} - System32\Tasks\{8FDEF766-5532-4B02-8E60-14D56ED9EE50} => Firefox.exe http://ui.skype.com/ui/0/5.3.0.120/en/abandoninstall?page=tsDownload&installinfo=google-toolbar:notoffered;ienotdefaultbrowser2,google-chrome:offered-notinstalled
Task: {98A6D39B-DDFC-40BC-BCB2-115EB1B17197} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{6CB3EDA3-8BF3-49BB-A827-69FE40D4E7C6}.exe
Task: {A09C0320-D759-466B-8BF9-791FD66909CD} - System32\Tasks\{490BAFFD-7E57-4CE9-BB26-8CBC34E3D574} => C:\Program Files (x86)\Ares\Ares.exe
Task: {A276CFDE-D012-4F7E-8DCE-96FE303BD64F} - System32\Tasks\{307E04C5-12DB-46DF-AEFB-D676EF789FB6} => Firefox.exe http://ui.skype.com/ui/0/6.6.73.106.456/pl/abandoninstall?page=tsProgressBar
Task: {A7A2BDF5-6895-4279-8946-B6D743E7A808} - System32\Tasks\{9A5BEFF0-7B50-4B04-8EEA-B0276D6CA1C5} => Firefox.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=6.2.0.106&LastError=12002
Task: {A9C5F85A-8870-4076-AD46-BFA4A753C23A} - System32\Tasks\{17A99AF5-FB69-4F62-9802-137D675CA0CB} => C:\Program Files (x86)\Ares\Ares.exe
Task: {AF6FAAB1-D13D-42D5-B342-BB547B4B2D2E} - System32\Tasks\{0871BF2F-EFB7-483E-90D8-661DC2F7398B} => C:\Program Files (x86)\Ares\Ares.exe
Task: {E545B943-D778-4E40-8F5D-2FF5965CA64E} - System32\Tasks\{31F0B8A8-3F15-492F-B945-A1A59338017E} => C:\Program Files (x86)\Ares\Ares.exe
Task: {EBE2F4D7-45CE-418C-95D4-A01D0BA5BF9E} - System32\Tasks\{EC31D610-1E4D-4957-80F7-78B1FF80ECAF} => Firefox.exe http://www.skype.com/go/downloading?source=lightinstaller&ver=6.1.0.129.272&LastError=12002
Task: {F877F85B-9056-4F90-8441-A8DFDD6C4B2D} - System32\Tasks\{0C0929F2-2C5B-4145-B357-C284C6599189} => C:\Program Files (x86)\Ares\Ares.exe
Task: {FA6CCE39-C75C-4080-96A1-300EA68C3D23} - System32\Tasks\{7F135FE4-0A83-4F16-B110-F391B4BB012B} => C:\Program Files (x86)\Ares\Ares.exe
Task: {FC3EE66B-4F83-43A7-A041-0A5050C7AA5F} - System32\Tasks\{2B0F77D2-437E-4C41-AA75-2E503432C0DA} => C:\Program Files (x86)\Ares\Ares.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{6CB3EDA3-8BF3-49BB-A827-69FE40D4E7C6}.exe
CMD: regsvr32 /u "C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll"
CMD: C:\Windows\SysWOW64\regsvr32.exe /u /s "C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll"
CMD: netsh advfirewall reset
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks" /v {A3BC75A2-1F87-4686-AA43-5347D756017C} /f
Reg: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v BootExecute /t REG_EXPAND_SZ /d "autocheck autochk *" /f
C:\Users\kasia\AppData\Local\Conduit
C:\Users\Default\AppData\Roaming\TuneUp Software
C:\Users\kasia\AppData\Roaming\AVG
C:\Users\kasia\AppData\Roaming\WinBatch
C:\Users\kasia\Desktop\Ares - Shortcut.lnk
C:\Program Files (x86)\AVG
C:\Program Files (x86)\AVG Secure Search
C:\Program Files (x86)\McAfee
C:\Program Files (x86)\mozilla firefox\components\Scriptff.dll
C:\Program Files (x86)\mozilla firefox\plugins
C:\ProgramData\McAfee
C:\ProgramData\MFAData
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ares
Reboot:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. System zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. Przez Panel sterowania odinstaluj adware vShare.tv plugin 1.3 oraz stare programy i zbędne integracje producenta:

 

==================== Installed Programs ======================
 

Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.45.2 - Adobe Systems Incorporated)

Adobe Reader 9.5.5 (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)

Amazon.co.uk (HKLM-x32\...\{A74F16FA-1D5B-405B-8D8D-1BC6F9DAED8B}) (Version: - Amazon EU S.a.r.L.)

Bing Bar (HKLM-x32\...\{3365E735-48A6-4194-9988-CE59AC5AE503}) (Version: 7.3.132.0 - Microsoft Corporation)

eBay (HKLM-x32\...\{FDE58148-57E7-43BF-879A-29CCE818C078}) (Version: 1.1.9 - eBay Inc.)

Java™ 6 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216017FF}) (Version: 6.0.170 - Sun Microsystems, Inc.)

vShare.tv plugin 1.3 (HKLM-x32\...\vShare.tv plugin) (Version: 1.3 - vShare.tv, Inc.) 

Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)

Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)

 

3. Uruchom to narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście po kolei poniższe wpisy pozostawione po deinstalacji AVG oraz ewentualne odpadki po w/w deinstalacji Windows Live > Dalej.

 

Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)

Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)

Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)

Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)

 

4. Wyczyść Firefox: menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox. Zakładki i hasła nie zostaną naruszone.

 

5. Uruchom McAfee Consumer Product Removal Tool.

 

6. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania.

 

7. Uruchom TFC - Temp Cleaner.

 

8. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt i log z AdwCleaner.

 

 

 

 

.