Dziwne zachowanie PC, dużo wirusów

[adamek]

Witam,

mój  PC dziwnie sie zachowuje i muli prosze o sprawdzenie logów.

system operacyjny windows 7 64 bit

 

Będe wdzieczny tez za opis i szczegóły wtargniecia tych wirusów do mojeko komputera.

Dziekuje.

 

Addition.txt

FRST.txt

Extras.Txt

OTL.Txt

Shortcut.txt

[picasso]

Brakuje obowiązkowego GMER. No cóż, mamy tu odpadkowe adware oraz szczątki trojana MSIL/Injector. Akcja:

 

1. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
Reg: reg query "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\System backup" /s
Reg: reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run /s
Reg: reg query HKLM\SYSTEM\CurrentControlSet\Services\Schedule /s
Reg: reg query "HKCU\Software\Microsoft\Windows Script" /s
Reg: reg query "HKCU\Software\Microsoft\Windows Script Host" /s
CMD: sc config "PLAY ONLINE. RunOuc" start= demand
R1 {29b136c9-938d-4d3d-8df8-d649d9b74d02}Gw64; C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}Gw64.sys [61120 2014-04-24] (StdLib)
R1 {29b136c9-938d-4d3d-8df8-d649d9b74d02}w64; C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys [60704 2014-05-22] (StdLib)
HKLM\...\Policies\Explorer\Run: [Help and Restore] => C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe [56472 2014-03-21] ( (Microsoft Corporation))
HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\Winlogon: [shell] explorer.exe,"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms}
BHO: No Name -> {122735e5-21b1-4899-93bc-0cdd6380a60a} -> No File
BHO-x32: No Name -> {122735e5-21b1-4899-93bc-0cdd6380a60a} -> No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CHR Extension: (GuoSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aedjecglgkjccpaalcgpocfjbcjohfko [2014-09-25]
CHR Extension: (GoSSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\leolnijocgbaebibcjhgjojpmeppkapo [2014-09-25]
GroupPolicy: Group Policy on Chrome detected 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
Task: {46A230F7-A3DA-4DC4-BDD4-210493A8EB17} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {6693FD75-2D2C-47A5-B762-90F4BBA83901} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: {998160A0-231E-4014-A042-F0742D8E0930} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe 
Task: {A0BBEE0B-2586-4F3B-BBEF-AE08D843F145} - System32\Tasks\SW-Booster-S-792098896 => c:\programdata\trusted publisher\sw-booster\SW-Booster.exe 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
C:\END
C:\Program Files (x86)\4jres.dll
C:\Program Files (x86)\4jUninstall RadioRage.dll
C:\Program Files (x86)\Mozilla Firefox\plugins
C:\Program Files (x86)\NextCioup
C:\Program Files (x86)\YouutUbeADBlocke
C:\ProgramData\db930178e28582b9
C:\ProgramData\GoeSave
C:\ProgramData\GuoSave
C:\ProgramData\NextCioup
C:\ProgramData\Norton
C:\ProgramData\Trusted Publisher
C:\ProgramData\YouutUbeADBlocke
C:\Users\Adam\jaijaeq.exe
C:\Users\Adam\Orig_0401.jar
C:\Users\Adam\AppData\Local\Chromatic Browser
C:\Users\Adam\AppData\Local\Comodo
C:\Users\Adam\AppData\Local\Torch
C:\Users\Adam\AppData\Roaming\msconfig.ini
C:\Users\Adam\AppData\Roaming\Windows Loader.exe
C:\Users\Adam\AppData\Roaming\AVG
C:\Users\Adam\AppData\Roaming\C03E69C9
C:\Users\Adam\AppData\Roaming\EZDownloader
C:\Users\Adam\AppData\Roaming\OpenCandy
C:\Users\Adam\AppData\Roaming\uTorrent
C:\Users\Adam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\µTorrent.lnk
C:\Users\Adam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Alcohol 52%.lnk
C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
C:\Users\Adam\Downloads\SpyHunter-installer.exe
C:\Users\Administrator\AppData\Local\Comodo
C:\Users\Administrator\AppData\Local\Chromatic Browser
C:\Users\Administrator\AppData\Local\Google
C:\Users\Administrator\AppData\Local\Torch
C:\Users\Gość\AppData\Local\Chromatic Browser
C:\Users\Gość\AppData\Local\Comodo
C:\Users\Gość\AppData\Local\Google
C:\Users\Gość\AppData\Local\Torch
C:\Windows\pss\TornTvDownloader.lnk.Startup
C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}Gw64.sys
C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys
C:\Windows\SysWow64\setup.exe
C:\Windows\SysWOW64\GroupPolicy\GPT.INI
RemoveDirectory: C:\Users\Adam\Desktop\Stare dane programu Firefox
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Adam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^TornTvDownloader.lnk
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\AlcoholAutomount
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\jaijaeq
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage EPM Support
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage Home Page Guard 64 bit
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage Search Scope Monitor
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage_4j Browser Plugin Loader
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage_4j Browser Plugin Loader 64
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\RadioRage_4jbar Uninstall
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SFAUpdater
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Smart File Advisor
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\System backup
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\TornTv Downloader
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. System zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. W Google Chrome:

• Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Zresetuj ustawienia przeglądarki. Zakładki i hasła nie zostaną naruszone.
• Ustawienia > karta Ustawienia > sekcja Wyszukiwanie > klik w Zarządzanie wyszukiwarkami > skasuj z listy niedomyślne śmieci (o ile będą).
• Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie Włącz.

3. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania.

 

4. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt i log z AdwCleaner.

 

 

 

 

.