Problem z usunięciem malware

[kristian]

Witam,

 

Nie mogę usunąć programów typu malware z komputera, przez co wyskakują ciągłe reklamy w przeglądarce oraz przeniesienia na inne strony internetowe z reklamami. Załączam logi, proszę o pomoc.

 

Pozdrawiam.

Addition.txt

FRST.txt

gmer.txt

Shortcut.txt

[picasso]

Mnóstwo adware, w tym wygląda na to, że jest tu też ten nowy typ adware JS w Firefox. Do przeprowadzenia następujące akcje:

 

1. Deinstalacje:

- Przez Panel sterowania odinstaluj adware Cyti Web oraz starą wersję Adobe Flash Player 16 NPAPI.

- Uruchom narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście odpadkowy wpis Google Update Helper > Dalej.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
R1 {09c3ffd6-f1a3-4fde-86e1-d448e8559c21}Gw64; C:\Windows\System32\drivers\{09c3ffd6-f1a3-4fde-86e1-d448e8559c21}Gw64.sys [48832 2015-03-09] (StdLib)
R1 {1a7531da-31ad-48c5-8d60-be70ecfbab93}Gw64; C:\Windows\System32\drivers\{1a7531da-31ad-48c5-8d60-be70ecfbab93}Gw64.sys [48832 2015-02-25] (StdLib)
R1 {34789ec0-129d-4a2d-b089-9977cdae65db}Gw64; C:\Windows\System32\drivers\{34789ec0-129d-4a2d-b089-9977cdae65db}Gw64.sys [48832 2015-02-13] (StdLib)
R1 {4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64; C:\Windows\System32\drivers\{4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64.sys [48784 2015-01-22] (StdLib)
R1 {4bcd2e21-b225-4bad-81f4-2c4a7013cd87}Gw64; C:\Windows\System32\drivers\{4bcd2e21-b225-4bad-81f4-2c4a7013cd87}Gw64.sys [48832 2015-03-03] (StdLib)
R1 {4bd643ce-8ef9-41bb-9b43-501b4f8fae85}Gw64; C:\Windows\System32\drivers\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}Gw64.sys [48832 2015-02-10] (StdLib)
R1 {5272c3f2-75bf-4a26-8574-fbbaa7fc6a9d}Gw64; C:\Windows\System32\drivers\{5272c3f2-75bf-4a26-8574-fbbaa7fc6a9d}Gw64.sys [48784 2015-01-14] (StdLib)
R1 {56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64; C:\Windows\System32\drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys [48784 2015-01-25] (StdLib)
R1 {7a11bc7a-fa65-4d5a-ade4-5a0d20eea01d}Gw64; C:\Windows\System32\drivers\{7a11bc7a-fa65-4d5a-ade4-5a0d20eea01d}Gw64.sys [48784 2015-02-04] (StdLib)
R1 {955a1491-962c-4a4d-a25b-ddfc77991b58}Gw64; C:\Windows\System32\drivers\{955a1491-962c-4a4d-a25b-ddfc77991b58}Gw64.sys [48832 2015-02-16] (StdLib)
R1 {9cdb05d3-a225-439b-a302-3c928fc40412}Gw64; C:\Windows\System32\drivers\{9cdb05d3-a225-439b-a302-3c928fc40412}Gw64.sys [48784 2015-01-19] (StdLib)
R1 {9d525140-2aa5-4c29-b571-058468248f69}Gw64; C:\Windows\System32\drivers\{9d525140-2aa5-4c29-b571-058468248f69}Gw64.sys [48832 2015-02-22] (StdLib)
R1 {bab3007b-75f3-4020-8eee-4c923fdcb91b}Gw64; C:\Windows\System32\drivers\{bab3007b-75f3-4020-8eee-4c923fdcb91b}Gw64.sys [48832 2015-02-28] (StdLib)
R1 {c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64; C:\Windows\System32\drivers\{c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64.sys [48832 2015-02-09] (StdLib)
R1 {d487b1e4-59cf-4940-87da-e7c5a283dab7}Gw64; C:\Windows\System32\drivers\{d487b1e4-59cf-4940-87da-e7c5a283dab7}Gw64.sys [48832 2015-03-06] (StdLib)
R1 {e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}Gw64; C:\Windows\System32\drivers\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}Gw64.sys [48832 2015-02-18] (StdLib)
R1 {e99acdf0-fa83-4c75-b15b-f0d544a8fd2a}Gw64; C:\Windows\System32\drivers\{e99acdf0-fa83-4c75-b15b-f0d544a8fd2a}Gw64.sys [48784 2015-01-16] (StdLib)
R1 {ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64; C:\Windows\System32\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys [48784 2015-01-31] (StdLib)
R1 {f2944598-b89f-4e10-b544-5173761572df}Gw64; C:\Windows\System32\drivers\{f2944598-b89f-4e10-b544-5173761572df}Gw64.sys [48784 2015-01-28] (StdLib)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-09] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-09] (globalUpdate) [File not signed]
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158864 2014-12-29] (XTab system)
R2 Update Cyti Web; C:\Program Files (x86)\Cyti Web\updateCytiWeb.exe [405280 2015-04-07] ()
R2 Util Cyti Web; C:\Program Files (x86)\Cyti Web\bin\utilCytiWeb.exe [405280 2015-04-07] ()
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [473088 2015-01-14] (Fuyu LIMITED) [File not signed]
S2 hedyleje; C:\Users\KamilPC\AppData\Roaming\VOPackage\nsv6296.tmp [X]
S2 serverjo; C:\Users\KamilPC\AppData\Roaming\VOPackage\JOSrv.exe [X]
S1 wpnfd_1_10_0_6; system32\drivers\wpnfd_1_10_0_6.sys [X]
Task: {1BBF662A-E197-45D4-A8DF-BE89736C3835} - System32\Tasks\24seven_savings_updating_service => C:\Program Files (x86)\24Seven savings\24seven_savings_updating_service.exe [2015-04-01] ()
Task: {23E2850B-7BB8-4114-86B8-F809FBEC70B5} - System32\Tasks\DoctorPC_Popup => C:\Program Files (x86)\Doctor PC\Splash.exe
Task: {3ED9651B-1AEB-4C8A-95AF-4801F90A1F43} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: {559F8561-A291-4F0D-A7B8-C30C9C0CB550} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: {6B595CE5-FBF3-4101-9A48-2BE77D06F556} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: {803D251A-ACA7-4D26-A0A9-8564BF45EC79} - System32\Tasks\VfNxGDQuM => C:\Users\KamilPC\AppData\Roaming\VfNxGDQuM.exe [2015-04-03] ()
Task: {934C5548-15D4-47A7-B8BC-E383F2BBD801} - System32\Tasks\24seven_savings_notification_service => C:\Program Files (x86)\24Seven savings\24seven_savings_notification_service.exe [2015-04-01] (FileProperties_CompanyName)
Task: {9C92CB0D-FC8C-4CE8-8A9A-70C090ACC075} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-09] (globalUpdate) 
Task: {C0628883-750D-48A3-884A-065214688145} - System32\Tasks\{AD2768F8-0BDA-4B10-BFA5-1CD97D73C72A} => pcalua.exe -a C:\Users\KamilPC\Downloads\g1vu12ww.exe -d C:\Users\KamilPC\Downloads
Task: {CA6B415E-82BB-449C-BF9B-91008635C786} - System32\Tasks\DoctorPC_Start => C:\Program Files (x86)\Doctor PC\DoctorPC.exe
Task: {DFB68C78-1B9C-4120-AF12-2DD3EFF9EF71} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-09] (globalUpdate) 
Task: C:\Windows\Tasks\24seven_savings_notification_service.job => C:\Program Files (x86)\24Seven savings\24seven_savings_notification_service.exeë/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='24Seven savings' /appid='73143' /srcid='2913' /bic='28d469e49a0bfe7b7f297f37115e0f6b' /verifier='e1eda4c439e8100dab42b1c92dde724e' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif
Task: C:\Windows\Tasks\24seven_savings_updating_service.job => C:\Program Files (x86)\24Seven savings\24seven_savings_updating_service.exe° /campid=2913 /verid=1 /url=http:/cdn.buildomserv.com/txt/@CAMPID@/@VER@/file.txt /appid=73143 /taskname=24seven_savings_updating_service /funurl=http:/stats.buildomserv.com
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe 
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe 
Task: C:\Windows\Tasks\VfNxGDQuM.job => C:\Users\KamilPC\AppData\Roaming\VfNxGDQuM.exe
HKLM-x32\...\Run: [gmsd_pl_45] => [X]
GroupPolicy: Group Policy on Chrome detected 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1421264603&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1421264603&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421264603&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1421264603&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
HKU\S-1-5-21-4150524941-2062964317-4216320369-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
HKU\S-1-5-21-4150524941-2062964317-4216320369-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKU\S-1-5-21-4150524941-2062964317-4216320369-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM
HKU\S-1-5-21-4150524941-2062964317-4216320369-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4150524941-2062964317-4216320369-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1421264670&from=cor&uid=ST500LT012-1DG142_W3P65AHMXXXXW3P65AHM&q={searchTerms}
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll [2014-12-29] (Thinknice Co. Limited)
BHO-x32: Cyti Web 1.0.0.7 -> {aa2fac44-d24d-4fed-9e32-397d138365f1} -> C:\Program Files (x86)\Cyti Web\CytiWebbho.dll [2015-02-09] (Cyti Web)
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll No File
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-02-09] (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll [2015-02-09] (globalUpdate)
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\KamilPC\AppData\Roaming\Mozilla\Firefox\Profiles\bzoyuabv.default\extensions\fftoolbar2014@etech.com
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\KamilPC\AppData\Roaming\Mozilla\Firefox\Profiles\bzoyuabv.default\extensions\faststartff@gmail.com
C:\Program Files (x86)\713a9672-1cb2-4ff6-8f64-3ef203471ed6
C:\Program Files (x86)\24Seven savings
C:\Program Files (x86)\Cyti Web
C:\Program Files (x86)\globalUpdate
C:\Program Files (x86)\Google
C:\Program Files (x86)\Mozilla Firefox\my.cfg
C:\Program Files (x86)\Mozilla Firefox\browser\defaults
C:\Program Files (x86)\XTab
C:\ProgramData\AppMgr3.16.8591351
C:\ProgramData\WindowsMangerProtect
C:\Users\KamilPC\AppData\Local\nsj313F.tmp
C:\Users\KamilPC\AppData\Local\Crossbrowse
C:\Users\KamilPC\AppData\Local\Doctor_PC
C:\Users\KamilPC\AppData\Local\Google
C:\Users\KamilPC\AppData\Local\Opera Software
C:\Users\KamilPC\AppData\Roaming\VfNxGDQuM
C:\Users\KamilPC\AppData\Roaming\VfNxGDQuM.exe
C:\Users\KamilPC\AppData\Roaming\Opera Software
C:\Users\KamilPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
C:\Users\KamilPC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
C:\Users\KamilPC\Documents\DoctorPC
C:\Windows\System32\drivers\{09c3ffd6-f1a3-4fde-86e1-d448e8559c21}Gw64.sys
C:\Windows\System32\drivers\{1a7531da-31ad-48c5-8d60-be70ecfbab93}Gw64.sys
C:\Windows\System32\drivers\{34789ec0-129d-4a2d-b089-9977cdae65db}Gw64.sys
C:\Windows\System32\drivers\{4a90d0b9-0668-4ad5-92c2-d78786884485}Gw64.sys
C:\Windows\System32\drivers\{4bcd2e21-b225-4bad-81f4-2c4a7013cd87}Gw64.sys
C:\Windows\System32\drivers\{4bd643ce-8ef9-41bb-9b43-501b4f8fae85}Gw64.sys
C:\Windows\System32\drivers\{5272c3f2-75bf-4a26-8574-fbbaa7fc6a9d}Gw64.sys
C:\Windows\System32\drivers\{56db9de0-c769-4563-8e82-7e39885bf1ad}Gw64.sys
C:\Windows\System32\drivers\{7a11bc7a-fa65-4d5a-ade4-5a0d20eea01d}Gw64.sys
C:\Windows\System32\drivers\{955a1491-962c-4a4d-a25b-ddfc77991b58}Gw64.sys
C:\Windows\System32\drivers\{9cdb05d3-a225-439b-a302-3c928fc40412}Gw64.sys
C:\Windows\System32\drivers\{9d525140-2aa5-4c29-b571-058468248f69}Gw64.sys
C:\Windows\System32\drivers\{bab3007b-75f3-4020-8eee-4c923fdcb91b}Gw64.sys
C:\Windows\System32\drivers\{c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64.sys
C:\Windows\System32\drivers\{d487b1e4-59cf-4940-87da-e7c5a283dab7}Gw64.sys
C:\Windows\System32\drivers\{e85a0e97-fa40-4dc4-a79e-e1c1cabe72eb}Gw64.sys
C:\Windows\System32\drivers\{e99acdf0-fa83-4c75-b15b-f0d544a8fd2a}Gw64.sys
C:\Windows\System32\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys
C:\Windows\System32\drivers\{f2944598-b89f-4e10-b544-5173761572df}Gw64.sys
C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
C:\Windows\SysWOW64\rootpa.e2e
Reg: reg delete HKCU\Software\Google /f
Reg: reg delete HKLM\SOFTWARE\Google /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Dodatkowe czyszczenie Firefox:

• menu Pomoc > Informacje dla pomocy technicznej > Odśwież program Firefox. Zakładki i hasła nie zostaną naruszone.
• menu Historia > Wyczyść historię przeglądania

4. Zrób nowy log FRST z opcji Scan, zaznacz ponownie pole Addition, by powstały dwa logi. Dołącz też plik fixlog.txt.

[kristian]

Witam,

 

W panelu sterowania nie było programu CityWeb, odinstalowałem natomiast Adobe Flash Player 16. W narzędziu Microsoftu nie znalazłem pliku Google Update Helper, więc też nie odinstalowałem. Odświeżyłem program Firefox, wyczyściłem historię, załączam pliki.

 

Pozdrawiam i dziękuje za dotychczasową pomoc.

Addition.txt

Fixlog.txt

FRST.txt