zamulający komp, rozwalona przeglądarka

[martinesq]

ostatnio strasznie zaczął mi zamulać komp, i przeglądarka świruje, reklamy, itp. złapałem jakiegoś syfa.. pomóżcie drodzy administratorzy

 

 

Addition.txt

FRST.txt

Shortcut.txt

gemer.txt

OTL.Txt

Extras.Txt

[jessica]

@Picasso teraz pomaga tylko 2-3 razy w miesiącu, czyli średnio co 12 dni.

 

1) Odinstaluj:

PC Data App (HKLM-x32\...\PCData App) (Version:  - ) <==== ATTENTION

RObOSaveR (HKLM-x32\...\{BE360B8B-0F10-CA89-FC84-A5EAB71A6AF8}) (Version:  - RobouSAVear) <==== ATTENTION

Supporter 1.80 (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{be0fb33b}) (Version:  - Costmin) <==== ATTENTION

BittSaaver (HKLM-x32\...\{A3FC46A0-9B62-0EF3-B475-743B3A2762B1}) (Version:  - BitSaveer) <==== ATTENTION
ChEaapMoe (HKLM-x32\...\{F6C44C71-2CFE-8176-3A4D-CBD0DCE5AEFA}) (Version:  - CheapMe) <==== ATTENTION
CostMin (HKLM-x32\...\{2F5F003B-C71B-72E3-42B4-DE51AB079EB2}) (Version: 1.0.0.1199 - CostMin)

 

2) Użyj >Adw-cleaner
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner.txt

 

3) Otwórz Notatnik i wklej w nim:

 

Task: {CC44908D-7900-43D7-83F9-A777E875DFBE} - System32\Tasks\AmiUpdXp => C:\Users\mato\AppData\Local\31042\a8591.exe [2014-05-26] () <==== ATTENTION
Task: C:\Windows\Tasks\AmiUpdXp.job => C:\Users\mato\AppData\Local\31042\a8591.exe <==== ATTENTION
C:\Program Files (x86)\Supporter\Supporter_x64.dll
C:\Program Files (x86)\Supporter\Supporter.dll
C:\Program Files (x86)\Supporter\SupporterSvc.dll
C:\Program Files (x86)\Supporter
C:\Windows\SysWOW64\nethtsrv.exe
C:\Program Files\PCDApp\dgen.exe
C:\Program Files\PCDApp\libcurl-4.dll
C:\Program Files\PCDApp
C:\Windows\SysWOW64\netupdsrv.exe
AppInit_DLLs: C:\PROGRA~2\SUPPOR~1\SUPPOR~2.DLL => C:\Program Files (x86)\Supporter\Supporter_x64.dll
AppInit_DLLs-x32: c:\progra~2\suppor~1\suppor~1.dll => C:\Program Files (x86)\Supporter\Supporter.dll
BHO: CostMin - {7AE97584-8860-8214-DB02-29BFD8134C27} - C:\Program Files (x86)\CostMin\Ve6v.x64.dll ()
C:\Program Files (x86)\CostMin\Ve6v.x64.dll
BHO: ChEaapMoe - {8071F7EF-C83B-9CCD-3838-722EB16D1B52} - C:\ProgramData\ChEaapMoe\oq5XHy.x64.dll ()
C:\ProgramData\ChEaapMoe\oq5XHy.x64.dll
BHO-x32: CostMin - {7AE97584-8860-8214-DB02-29BFD8134C27} - C:\Program Files (x86)\CostMin\Ve6v.dll ()
BHO-x32: ChEaapMoe - {8071F7EF-C83B-9CCD-3838-722EB16D1B52} - C:\ProgramData\ChEaapMoe\oq5XHy.dll ()
BHO-x32: RObOSaveR - {963CDE27-5C00-3959-898E-7033A6B5F131} - C:\ProgramData\RObOSaveR\h.dll ()
BHO-x32: BittSaaver - {A596122C-FD77-E518-4A51-6A0C39C3512A} - C:\ProgramData\BittSaaver\T.dll ()
C:\ProgramData\BittSaaver\T.dll
C:\ProgramData\RObOSaveR\h.dll
C:\ProgramData\ChEaapMoe\oq5XHy.dll
C:\Program Files (x86)\CostMin\Ve6v.dll
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 be0fb33b; C:\Program Files (x86)\Supporter\SupporterSvc.dll
R2 NetHttpService; C:\Windows\SysWOW64\nethtsrv.exe
S2 ProtectMonitor; C:\Program Files\PCDApp\StartHelp.exe
R2 ServiceUpdater; C:\Windows\SysWOW64\netupdsrv.exe
R1 nethfdrv; C:\Windows\system32\drivers\nethfdrv.sys [46160 2014-06-17] (nethfdrv)
C:\Windows\SysWOW64\installd.exe
C:\ProgramData\RObOSaveR
C:\ProgramData\ChEaapMoe
C:\ProgramData\80085dad5f485056
C:\Users\mato\AppData\Local\Torch
C:\Users\mato\AppData\Local\Packages
C:\Users\mato\AppData\Local\Comodo
C:\Users\mato\AppData\Local\Chromatic Browser
C:\Users\Gość\AppData\Local\Torch
C:\Users\Gość\AppData\Local\Comodo
C:\Users\Administrator\AppData\Local\Torch
C:\Users\Administrator\AppData\Local\Comodo
C:\Users\Administrator\AppData\Local\Chromatic Browser
C:\ProgramData\BittSaaver
C:\ProgramData\CostMin
C:\Program Files (x86)\CostMin
C:\Windows\Tasks\AmiUpdXp.job
C:\Windows\System32\Tasks\AmiUpdXp
C:\Windows\Minidump\053014-27877-01.dmp
C:\Windows\System32\Tasks\AmiUpdXp
C:\Users\mato\AppData\Local\31042
C:\Users\mato\AppData\Local\Temp\49442e40_.exe
C:\Users\mato\AppData\Local\Temp\5d037a5a_.exe
C:\Users\mato\AppData\Local\Temp\AutoRun.exe
C:\Users\mato\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\mato\AppData\Local\Temp\Checkupdate.exe
C:\Users\mato\AppData\Local\Temp\drvinstal.exe
C:\Users\mato\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\mato\AppData\Local\Temp\gcapi_dll.dll
C:\Users\mato\AppData\Local\Temp\gtapi_signed.dll
C:\Users\mato\AppData\Local\Temp\MP3_Launcher_1_27_0_0.exe
C:\Users\mato\AppData\Local\Temp\Social Club v1.1.0.6 Setup.exe
C:\Users\mato\AppData\Local\Temp\sonarinst.exe
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reboot:

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt. Daj ten log.

 

4) Zrób nowe logi z FRST.

 

jessi

[martinesq]

zarzucam raportami jessico :3

AdwCleanerS0.txt

Fixlog.txt

FRST.txt

Addition.txt

Shortcut.txt

[jessica]

Otwórz Notatnik i wklej w nim:

 

C:\Program Files (x86)\RObOSaveR
C:\Program Files (x86)\BittSaaver
Reboot:

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt. Daj ten log.
 

Zrób nowy log z FRST (już bez Addition i bez Shortcut)

 

jessi