Mnóstwo wyskakujących reklam i wirusy

Codemat · 12 Kwietnia 2015

Witam,

mam problem od dłuższego czasu. Podczas przeglądania internetu co chwile wyskakuje reklama. Jest to straszna katorga, gdy próbuje wyszukać coś w google to muszę przejść przez falę 7 tysięcy reklam...

Win7, 64 bit.

Bardzo proszę o pomoc, logi w załączniku

picasso · 14 Kwietnia 2015

W tle działa aktywne adware Techgile okopane mnóstwem sterowników, poza tym ogólne śmietnisko i bardzo stare wersje przeglądarek (notabene zabrudzonych). Akcje do przeprowadzenia:

1. Przez Panel sterowania odinstaluj:

- Adware Delta Chrome Toolbar, FoxTab FLV Player, FoxTab PDF Reader, IncrediMail MediaBar 2 Toolbar oraz podejrzany Tibia MULTI-ip changer.

- Stare wersje i zbędniki: ACE Mega CoDecS Pack, Adobe Flash Player 16 ActiveX, Adobe Reader 9.5.5 - Polish, Akamai NetSession Interface, Facebook Messenger 2.1.4814.0, Google Chrome, Java 7 Update 55, Mozilla Firefox 10.0.2 (x86 pl). Facebook Messenger to historyczny produkt.

Przy deinstalacji Firefox i Google Chrome wybierz opcję Usuń także dane przeglądarki. Na razie nie instaluj żadnych nowych wersji, w punkcie 2 będzie usuwanie komponentów tych przeglądarek.

2. Otwórz Notatnik i wklej w nim:

CloseProcesses:
CreateRestorePoint:
R1 {049bbcc5-fa2f-4f64-ac57-0d003a8907b3}Gw64; C:\Windows\System32\drivers\{049bbcc5-fa2f-4f64-ac57-0d003a8907b3}Gw64.sys [48784 2014-10-28] (StdLib)
R1 {55685567-4840-4a91-962b-49a412e9485a}Gw64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys [61112 2014-05-27] (StdLib)
R1 {69f4939e-c3db-4f47-938c-0519bbf69309}Gw64; C:\Windows\System32\drivers\{69f4939e-c3db-4f47-938c-0519bbf69309}Gw64.sys [48784 2014-10-27] (StdLib)
R1 {7d71b13c-fa47-4ddb-a69a-0fd038af3e02}Gw64; C:\Windows\System32\drivers\{7d71b13c-fa47-4ddb-a69a-0fd038af3e02}Gw64.sys [48784 2015-04-06] (StdLib)
R1 {9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64; C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys [61112 2014-05-12] (StdLib)
S2 gupdate1caf048fc0435a0; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2010-05-10] (Google Inc.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-22] (Malwarebytes Corporation)
R2 Update Techgile; C:\Program Files (x86)\Techgile\updateTechgile.exe [397040 2015-04-12] ()
R2 Util Techgile; C:\Program Files (x86)\Techgile\bin\utilTechgile.exe [397040 2015-04-12] ()
S3 cpuz130; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S2 NMSAccessU; C:\Users\Adrian\AppData\Local\Temp\{542FA3D1-2289-4CD8-82B1-EE222BA2B814}\NMSAccessU.exe [X]
S3 NVHDA; system32\drivers\nvhda64v.sys [X]
Task: {9980A57F-63A0-4A00-AA97-4C8B74F6977D} - System32\Tasks\{111B60CC-5B99-4BDC-AC5F-426233FB526E} => pcalua.exe -a D:\Metin2_20080908.exe -d D:\
Task: {AA716098-337D-4AA9-AF35-3D13169C979A} - \WPD\SqmUpload_S-1-5-21-511461997-2466024275-2353699939-500 No Task File 
Task: {EFC92F18-8431-41ED-86A8-C524E71BE8DE} - System32\Tasks\EPUpdater => C:\Users\Adrian\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] () 
Task: {F3A32570-EBC7-4D68-8AC0-9CF5766FF3C6} - System32\Tasks\BitGuard => Sc.exe start BitGuard 
HKLM-x32\...\Run: [NPSStartup] => [X]
AppInit_DLLs: c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll => c:\progra~3\bitguard\271832~1.68\{c16c1~1\loader.dll File Not Found
AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found
GroupPolicy: Group Policy on Chrome detected 
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
CHR HKU\S-1-5-21-511461997-2466024275-2353699939-1000\SOFTWARE\Policies\Google: Policy restriction 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?PC=AV01
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-511461997-2466024275-2353699939-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-511461997-2466024275-2353699939-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://q.search-simple.com/?affID=na
HKU\S-1-5-21-511461997-2466024275-2353699939-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?PC=AV01
URLSearchHook: HKLM-x32 - (No Name) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No File
SearchScopes: HKLM-x32 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://startsear.ch/?aff=1&src=sp&cf=946f9eea-663b-11e1-bbbc-6cf04974a08f&q={searchTerms}
SearchScopes: HKLM-x32 -> {117CEF7C-958C-4856-BB3A-CF81FA8209DD} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={869E18E1-7133-11E1-930B-6CF04974A08F}
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1098640
SearchScopes: HKLM-x32 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://startsear.ch/?aff=2&src=sp&cf=946f9eea-663b-11e1-bbbc-6cf04974a08f&q={searchTerms}
SearchScopes: HKLM-x32 -> {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&affID=119535&tt=gc_&babsrc=SP_ss_gin2g&mntrId=CEB66CF04974A08F
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {117CEF7C-958C-4856-BB3A-CF81FA8209DD} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&barid={869E18E1-7133-11E1-930B-6CF04974A08F}
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/custom/java/redirect?client=ie&tb=ORJ&o=100000026&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {5727E0A1-B0BA-4888-96B0-C9C348D0C33E} URL = http://mystart.incredimail.com/mb68/?search={searchTerms}&loc=search_box&u=92260265520678787
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {A2FBF33A-96E6-4651-9B87-42DBE2B8FEC0} URL = http://q.search-simple.com/?affID=na&q={searchTerms}&r=187
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = http://www.daemon-search.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT1098640
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://startsear.ch/?aff=2&src=sp&cf=946f9eea-663b-11e1-bbbc-6cf04974a08f&q={searchTerms}
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> {F650D391-5523-4ABD-B34D-C72502C83D97} URL = http://search.babylon.com/?q={searchTerms}&AF=110810&babsrc=SP_ss&mntrId=ceb6f6ff0000000000000060b307721f
BHO-x32: No Name -> {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} -> No File
BHO-x32: No Name -> {ecdee021-0d17-467f-a1ff-c7a115230949} -> No File
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - No Name - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No File
Toolbar: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKU\S-1-5-21-511461997-2466024275-2353699939-1000 -> No Name - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
C:\Program Files (x86)\DAEMON Tools Toolbar
C:\Program Files (x86)\DealPly
C:\Program Files (x86)\Google
C:\Program Files (x86)\Mozilla Firefox
C:\Program Files (x86)\Techgile
C:\Program Files (x86)\Winamp Toolbar
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Metin2\Metin2 PL.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaxUp Video Downloader.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ares
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DealPly
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 12
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kolekcja Klasyki\Kozacy - Antologia
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tiveria
C:\ProgramData\Mozilla
C:\ProgramData\Temp
C:\Users\Adrian\cm0304.exe
C:\Users\Adrian\AppData\Local\*.html
C:\Users\Adrian\AppData\Local\{A09B6328-7909-4D8D-81B5-121C073EA055}
C:\Users\Adrian\AppData\Local\cache
C:\Users\Adrian\AppData\Local\Google
C:\Users\Adrian\AppData\Local\Mobogenie
C:\Users\Adrian\AppData\Local\Mozilla
C:\Users\Adrian\AppData\Local\Pay-By-Ads
C:\Users\Adrian\AppData\Roaming\BabMaint.exe
C:\Users\Adrian\AppData\Roaming\LiveSupport.exe_log.txt
C:\Users\Adrian\AppData\Roaming\regsvr32.exe_log.txt
C:\Users\Adrian\AppData\Roaming\BabSolution
C:\Users\Adrian\AppData\Roaming\File Scout
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\FIFA 12.lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Winamp (2).lnk
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitGuard
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FoxTab FLV Player
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MKJogo
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mobogenie
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
C:\Users\Adrian\AppData\Roaming\Microsoft\Windows\Start Menu\FoxTab PDF Reader
C:\Users\Adrian\AppData\Roaming\Mozilla
C:\Users\Adrian\Desktop\Płyty i muzyka\Play League of Legends.lnk
C:\Users\Adrian\Desktop\Płyty i muzyka\TeamSpeak 3 Client.lnk
C:\Users\Adrian\Desktop\Płyty i muzyka\wolne kawałki rap\Głebia tożsamości(promo).lnk
C:\Users\Adrian\Desktop\Płyty i muzyka\Origin Games\FIFA 12\Support\Plik Przeczytaj.lnk
C:\Users\Adrian\Documents\Microsoft Office PowerPoint 2003.lnk
C:\Users\Adrian\Downloads\yet_another_cleaner_hdr.exe
C:\Users\Ilona\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
C:\Users\Ilona\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
C:\Users\Ilona\Desktop\Ares.lnk
C:\Users\Ilona\Desktop\Google Chrome.lnk
C:\Users\Ilona\Desktop\Kozacy - Powrót na wojnę.lnk
C:\Users\Ilona\Desktop\Metin2 PL.lnk
C:\Users\Ilona\Desktop\Tiveria.lnk
C:\Users\TomeczeK\AppData\Local\Microsoft\Windows\GameExplorer\{1B224F7B-114E-4F42-B3E5-3BCF3E141AA9
C:\Users\TomeczeK\Desktop\Ares.lnk
C:\Users\TomeczeK\Desktop\Heroes of Might and Magic V.lnk
C:\Users\TomeczeK\Desktop\Metin2 PL.lnk
C:\Users\TomeczeK\Desktop\Tiveria.lnk
C:\Users\TomeczeK\Desktop\nieurzywane\Hitman - Krwawa forsa.lnk
C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\*.lnk
C:\Windows\pss\debug.log.Startup
C:\Windows\System32\drivers\{049bbcc5-fa2f-4f64-ac57-0d003a8907b3}Gw64.sys
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys
C:\Windows\System32\drivers\{69f4939e-c3db-4f47-938c-0519bbf69309}Gw64.sys
C:\Windows\System32\drivers\{7d71b13c-fa47-4ddb-a69a-0fd038af3e02}Gw64.sys
C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys
C:\Windows\system32\drivers\MBAMSwissArmy.sys
Reg: reg delete HKCU\Software\Google /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKCU\Software\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Google /f
Reg: reg delete HKLM\SOFTWARE\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Users^Adrian^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^debug.log" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ApnUpdater" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DAEMON Tools Lite" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\msnmsgr" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched" /f
Reg: reg delete "HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SweetIM" /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
EmptyTemp:

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

3. Są tu trzy konta w użyciu, z każdego muszą być dostarczone raporty FRST:

==================== Accounts: ============================= 

Adrian (S-1-5-21-511461997-2466024275-2353699939-1000 - Administrator - Enabled) => C:\Users\Adrian

Ilona (S-1-5-21-511461997-2466024275-2353699939-1003 - Limited - Enabled) => C:\Users\Ilona

TomeczeK (S-1-5-21-511461997-2466024275-2353699939-1004 - Limited - Enabled) => C:\Users\TomeczeK

Po kolei zaloguj się na każde poprzez pełny restart komputera (a nie Wyloguj czy Przełącz użytkownika), na każdym zrób nowe logi FRST z opcji Scan (zaznaczone pole Addition, by powstały po dwa logi z kadego konta). Na kontach limitowanych Ilona i Tomeczek FRST startuj przez dwuklik a nie "Uruchom jako Administrator" (to zmieni kontekst kont na Adriana).

Dołącz też plik fixlog.txt.

Codemat · 14 Kwietnia 2015

Przy usuwaniu jednego z programów napotkałem problem (przepraszam, że z telefonu ale każde odwiedzanie stron hostingowych kończy się niepowodzeniem)

Pierwsza faza dezynfekcji wykonana. Co do kont użytkowników - żadne prócz Administratora (Adrian) nie były wykorzystywane, więc usunąłem. Podrzucam nowe logi

Addition.txt

Fixlog.txt

FRST.txt

picasso · 15 Kwietnia 2015

Wprawdzie zadałam "IncrediMail MediaBar 2 Toolbar" do deinstalacji, ale wiedziałam, że to uszkodzony obiekt (to widać w raportach), więc nie dziwi ten błąd który prezentujesz. Szczątki zostaną dokasowane ręcznie. Wszystkie operacje przeszły gładko, teraz poprawki:

1. Otwórz Notatnik i wklej w nim:

HKU\S-1-5-21-511461997-2466024275-2353699939-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Adrian\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-511461997-2466024275-2353699939-1000\...\Run: [Facebook Update] => C:\Users\Adrian\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
Task: {528447B5-ADB9-442A-AAED-93D65E8E3A18} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-511461997-2466024275-2353699939-1000Core => C:\Users\Adrian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {52E15BC4-A270-4A0F-A388-EA3EAD5117FB} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-511461997-2466024275-2353699939-1000UA => C:\Users\Adrian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {A8DD4626-7700-4416-BCAC-1AA83F86D427} - System32\Tasks\{2EEE7391-6628-4EB8-9116-4B20D7B8A8FA} => pcalua.exe -a C:\PROGRA~2\INCRED~2\UNWISE.EXE -c /U C:\PROGRA~2\INCRED~2\INSTALL.LOG
Task: {C640B76F-6410-4B19-A545-8EC90FC9AA51} - System32\Tasks\{D3A2E4D1-6BF6-4E77-BC4B-007001C90113} => pcalua.exe -a C:\Users\Adrian\Downloads\WDM_A406.exe -d C:\Users\Adrian\Downloads
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-511461997-2466024275-2353699939-1000Core.job => C:\Users\Adrian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-511461997-2466024275-2353699939-1000UA.job => C:\Users\Adrian\AppData\Local\Facebook\Update\FacebookUpdate.exe
RemoveDirectory: C:\Program Files (x86)\Asprate
RemoveDirectory: C:\Program Files (x86)\IncrediMail_MediaBar_2
RemoveDirectory: C:\Users\Adrian\AppData\Local\Facebook
RemoveDirectory: C:\Users\Adrian\Downloads\FRST-OlderVersion
RemoveDirectory: C:\Users\Ilona
RemoveDirectory: C:\Users\TomeczeK
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\IncrediMail_MediaBar_2 Toolbar" /f

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

2. Uruchom AdwCleaner. Na razie wybierz tylko opcję Szukaj (nie stosuj jeszcze Usuń) i dostarcz wynikowy log z folderu C:\AdwCleaner.

Codemat · 15 Kwietnia 2015

Poprawki wykonane. Podsyłam nowe logi:

AdwCleanerR0.txt

Fixlog.txt

picasso · 16 Kwietnia 2015

Log AdwCleaner wygląda bardzo dziwnie, są pokazane powielenia wpisów oraz różne poprawne klucze kończące się na ukośniku. Uruchomienie czyszczenia AdwCleaner w takiej sytuacji prawdopodobnie coś uszkodzi... Trzeba robić usuwanie inną metodą:

1. Otwórz Notatnik i wklej w nim:

C:\Program Files (x86)\BabylonToolbar
C:\Program Files (x86)\Conduit
C:\Program Files (x86)\webget
C:\ProgramData\5a2bbf30b22ded70
C:\ProgramData\Ask
C:\ProgramData\Babylon
C:\ProgramData\BitGuard
C:\ProgramData\Tarma Installer
C:\Users\Adrian\daemonprocess.txt
C:\Users\Adrian\AppData\Local\genienext
C:\Users\Adrian\AppData\Local\lollipop
C:\Users\Adrian\AppData\Local\onlysearch
C:\Users\Adrian\AppData\LocalLow\Conduit
C:\Users\Adrian\AppData\LocalLow\ConduitEngine
C:\Users\Adrian\AppData\LocalLow\Delta
C:\Users\Adrian\AppData\LocalLow\IncrediMail_MediaBar_2
C:\Users\Adrian\AppData\Roaming\Babylon
C:\Users\Adrian\AppData\Roaming\newnext.me
C:\Users\Adrian\AppData\Roaming\OpenCandy
C:\Users\Adrian\AppData\Roaming\Systweak
C:\Users\Adrian\Documents\Mobogenie
C:\Windows\System32\roboot64.exe
C:\Windows\SysWOW64\BitGuard
C:\Windows\SysWOW64\rlls.dll
Reg: reg delete HKCU\Software\8538cdfe23aba17 /f
Reg: reg delete HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F} /f
Reg: reg delete HKCU\Software\AppDataLow\Software\Conduit /f
Reg: reg delete HKCU\Software\AppDataLow\Software\conduitEngine /f
Reg: reg delete HKCU\Software\AppDataLow\Software\IncrediMail_MediaBar_2 /f
Reg: reg delete HKCU\Software\AppDataLow\Toolbar /f
Reg: reg delete HKCU\Software\BABSOLUTION /f
Reg: reg delete HKCU\Software\BabylonToolbar /f
Reg: reg delete HKCU\Software\Classes\Applications\lollipop.exe /f
Reg: reg delete HKCU\Software\Classes\keepmysearch /f
Reg: reg delete HKCU\Software\DataMngr /f
Reg: reg delete "HKCU\Software\dt soft\daemon tools toolbar" /f
Reg: reg delete HKCU\Software\filescout /f
Reg: reg delete HKCU\Software\IM /f
Reg: reg delete HKCU\Software\ImInstaller /f
Reg: reg delete HKCU\Software\InstallCore /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183} /f
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} /f
Reg: reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyOverride /f
Reg: reg delete HKCU\Software\lollipop /f
Reg: reg delete HKCU\Software\Softonic /f
Reg: reg delete HKCU\Software\SweetIM /f
Reg: reg delete HKCU\Software\systweak /f
Reg: reg delete HKCU\Software\vShare.tv /f
Reg: reg delete HKCU\Software\YahooPartnerToolbar /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\{6791A2F3-FC80-475C-A002-C014AF797E9C} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\8538cdfe23aba17 /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Babylon /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\BabylonToolbar /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\escort.DLL /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\escortApp.DLL /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\escortEng.DLL /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\escorTlbr.DLL /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\AppID\esrv.EXE /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3FD9A2FE-8A4D-4B1C-AB7A-A025658C74CC} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\escort.escrtBtn.1 /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Prod.cap /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Toolbar.CT1098640 /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\Toolbar.CT2724386 /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Conduit /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\conduitEngine /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\DataMngr /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\DealPly /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\ImInstaller /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\IncrediMail_MediaBar_2 /f
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42617127-D706-4D30-A1BC-BACEFB7D401F}" /f
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{920F67ED-6F13-418E-BBB0-D6426C36847B}" /f
Reg: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd" /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3FD9A2FE-8A4D-4B1C-AB7A-A025658C74CC} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31} /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\SweetIM /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\systweak /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Techgile /f
Reg: reg delete HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52} /f
Reg: reg delete HKLM\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} /f
Reg: reg delete HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB} /f
Reg: reg delete HKLM\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} /f
Reg: reg delete HKLM\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} /f
Reg: reg delete HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5} /f
Reg: reg delete "HKLM\SOFTWARE\Tarma Installer" /f
Reg: reg delete HKU\S-1-5-18\Software\Techgile /f

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Przedstaw wynikowy fixlog.txt.

2. Uruchom AdwCleaner, wybierz tylko Szukaj i dostarcz wynikowy log C:\AdwCleaner\AdwCleaner[R1].txt.

Codemat · 16 Kwietnia 2015

Kolejne logi:

AdwCleanerR1.txt

Fixlog.txt

picasso · 16 Kwietnia 2015

Kolejne poprawki. Do Notatnika wklej:

DeleteKey: HKCU\Software\DataMngr
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\escort.escrtBtn.1
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Prod.cap
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Toolbar.CT1098640
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Classes\Toolbar.CT2724386
DeleteKey: HKLM\SOFTWARE\Wow6432Node\DataMngr
RemoveDirectory: C:\AdwCleaner
RemoveDirectory: C:\FRST\Quarantine

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Pokaż wynikowy fixlog.txt.

Codemat · 17 Kwietnia 2015

Zrobione. Mogę już instalować Google Chrome?

Fixlog.txt

Zaloguj się

Mnóstwo wyskakujących reklam i wirusy

Rekomendowane odpowiedzi

Codemat

Odnośnik do komentarza

picasso

Odnośnik do komentarza

Codemat

Odnośnik do komentarza

picasso

Odnośnik do komentarza

Codemat

Odnośnik do komentarza

picasso

Odnośnik do komentarza

Codemat

Odnośnik do komentarza

picasso

Odnośnik do komentarza

Codemat

Odnośnik do komentarza

Jeśli chcesz dodać odpowiedź, zaloguj się lub zarejestruj nowe konto

Zarejestruj nowe konto

Zaloguj się

Ostatnio przeglądający 0 użytkowników

Przeglądaj

Cała aktywność