Syf w kompie

[Marylka]

Jak w temacie. Dziękuję.

 

FRST - http://wklej.org/id/1757563/txt/

 

Addition - http://www.wklej.org/id/1757566/txt/

 

Shortcut - http://www.wklej.org/id/1757568/txt/

 

GMER - http://www.wklej.org/id/1757610/txt/

[picasso]

Marylka, na przyszłość: proszę dokładniej opisuj o co chodzi z "syfem na kompie", bo logi nie zawsze mogą wszystko pokazać i opis często kieruje na szukanie w miejscach niewidocznych w skanach. Póki co do wykonania:

 

1. Deinstalacje:

- Przez Panel sterowania odinstaluj adware Search App by Ask oraz stare wersje i zbędnik Adobe AIR, Adobe Flash Player 10 ActiveX, Adobe Reader X (10.1.9), AVG Web TuneUp, Java 8 Update 45, JavaFX 2.1.1.

- Uruchom narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście odpadek Google Update Helper > Dalej.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-21-3369816969-207793647-2651142573-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dregol.com/?f=1&a=drg_ir_15_19&cd=2XzuyEtN2Y1L1Qzu0EtDtB0AzztBtCtA0CtC0D0BtA0A0CyBtN0D0Tzu0StCtBtByEtN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAzztD0FyByC0DtAtG0CzzyD0BtG0D0FtCtCtGyEtC0FyDtGyD0EtD0Ezy0E0AzzyEtB0Czz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AyBtAtByDtA0BzytG0DtDyByEtGyE0CyEyDtG0AtD0FtBtGtCyC0F0AyEtByEyB0AyDtAyD2QtN0A0LzutB&cr=1874553017&ir=
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://no.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_ir_15_17&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dno%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1Qzu0EtDtB0AzztBtCtA0CtC0D0BtA0A0CyBtN0D0Tzu0StCtBtDzztN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StA0AyBtB0B0EyE0FtGyBzy0ByEtGtByE0AyDtG0ByDzzyBtGyD0CtDtD0EyEyCyEtBtC0Ezy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EtDyEzz0AzzyE0DtG0ByCyCyBtGyE0CtC0CtGzytBtD0AtGtD0ByEzy0FyEyC0AyB0C0AtD2QtN0A0LzutB%26cr%3D1703710940%26a%3Dwny_ir_15_17%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_19&cd=2XzuyEtN2Y1L1Qzu0EtDtB0AzztBtCtA0CtC0D0BtA0A0CyBtN0D0Tzu0StCtBtByEtN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAzztD0FyByC0DtAtG0CzzyD0BtG0D0FtCtCtGyEtC0FyDtGyD0EtD0Ezy0E0AzzyEtB0Czz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AyBtAtByDtA0BzytG0DtDyByEtGyE0CyEyDtG0AtD0FtBtGtCyC0F0AyEtByEyB0AyDtAyD2QtN0A0LzutB&cr=1874553017&ir=
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {00BC9FD1-74D3-4AC4-B5F8-74C46F5C060D} URL =
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://no.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_ir_15_17&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dno%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1Qzu0EtDtB0AzztBtCtA0CtC0D0BtA0A0CyBtN0D0Tzu0StCtBtDzztN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2StA0AyBtB0B0EyE0FtGyBzy0ByEtGtByE0AyDtG0ByDzzyBtGyD0CtDtD0EyEyCyEtBtC0Ezy2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0EtDyEzz0AzzyE0DtG0ByCyCyBtGyE0CtC0CtGzytBtD0AtGtD0ByEzy0FyEyC0AyB0C0AtD2QtN0A0LzutB%26cr%3D1703710940%26a%3Dwny_ir_15_17%26os%3DWindows 7 Home Premium&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {5888CAF8-7CB6-4761-BFAA-05C37DFDFC1F} URL = http://isearch.avg.com/search?cid={E46A6DB1-EEE9-40DC-8167-76ACB7A8AD05}&mid=80293891b75f47d19697cd8898516b5f-8c651b501602ef2bdeb42579f37b98d17e583b56&lang=en&ds=AVG&pr=fr&d=2011-10-22 16:34:14&v=8.0.0.34&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_19&cd=2XzuyEtN2Y1L1Qzu0EtDtB0AzztBtCtA0CtC0D0BtA0A0CyBtN0D0Tzu0StCtBtByEtN1L2XzutAtFtCtDtFtBtFtDtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StAzztD0FyByC0DtAtG0CzzyD0BtG0D0FtCtCtGyEtC0FyDtGyD0EtD0Ezy0E0AzzyEtB0Czz2QtN1M1F1B2Z1V1N2Y1L1Qzu2S0AyBtAtByDtA0BzytG0DtDyByEtGyE0CyEyDtG0AtD0FtBtGtCyC0F0AyEtByEyB0AyDtAyD2QtN0A0LzutB&cr=1874553017&ir=
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL = https://mysearch.avg.com/search?cid={BC289C5C-FAE5-4D32-94EE-C4BD32B00FBD}&mid=80293891b75f47d19697cd8898516b5f-8c651b501602ef2bdeb42579f37b98d17e583b56&lang=en&ds=AVG&coid=avgtbavg&cmpid=0415tb&pr=fr&d=2015-03-23 16:37:11&v=4.1.0.411&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3369816969-207793647-2651142573-1001 -> {E3E3AA5F-A062-42B6-89AE-639AC30A5FCD} URL = http://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11412&pf=V7&p2=^BBK^OSJ000^YY^NO&gct=&itbv=12.17.1.65&apn_uid=BDF9625C-E30F-4980-957B-1A468747BC5F&apn_ptnrs=BBK&apn_dtid=^OSJ000^YY^NO&apn_dbr=cr_37.0.2062.124&doi=2014-10-04&trgb=CR&q={searchTerms}&psv=&pt=tb
BHO-x32: IEExtension.VDownloaderBHO -> {7b523e7c-f096-4e36-a0cb-7efeb5c675c1} -> C:\windows\SysWOW64\mscoree.dll [2010-11-05] (Microsoft Corporation)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File
CustomCLSID: HKU\S-1-5-21-3369816969-207793647-2651142573-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Kaisa Lachcik\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3369816969-207793647-2651142573-1001_Classes\CLSID\{A75BE48D-BF58-4A8B-B96C-F9A09DFB9844}\InprocServer32 -> %LOCALAPPDATA%\Pokki\ocdeskband_0.dll No File
Task: {07FDE57F-129A-400A-9A53-6210D7A7F44E} - System32\Tasks\{725F7816-F4CE-4E03-8406-BB688B723AE9} => pcalua.exe -a C:\PROGRA~2\RUN_DR~1\\uninstall.exe -c /uninstaller
Task: {F465CA69-625E-48DC-BAF0-CACDFF9789F3} - System32\Tasks\Trojan Killer => C:\Program Files\GridinSoft Trojan Killer\trojankiller.exe
HKLM-x32\...\Run: [NPSStartup] => [X]
S1 lwnfd_1_10_0_14; system32\drivers\lwnfd_1_10_0_14.sys [X]
S1 tbfd_1_10_0_15; system32\drivers\tbfd_1_10_0_15.sys [X]
C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml
C:\Program Files (x86)\AskPartnerNetwork
C:\Program Files (x86)\Google
C:\Program Files (x86)\Mozilla Firefox
C:\Program Files (x86)\Run_Dregol
C:\Program Files (x86)\Common Files\ApnStub.exe
C:\Program Files (x86)\Common Files\ApnToolbarInstaller.exe
C:\Programdata\Google
C:\Programdata\Mozilla
C:\Users\Kaisa Lachcik\AppData\Local\Google
C:\Users\Kaisa Lachcik\AppData\Local\Mozilla
C:\Users\Kaisa Lachcik\AppData\Roaming\Mozilla
C:\Users\Kaisa Lachcik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
C:\Users\Public\AlexaNSISPlugin.1868.dll
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
Reg: reg delete HKCU\Software\Google /f
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKCU\Software\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Google /f
Reg: reg delete HKLM\SOFTWARE\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\8063f2dd /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Napraw uszkodzony specjalny skrót IE. W pasku eksploratora wklej poniższą ścieżkę i ENTER:

 

C:\Users\Kaisa Lachcik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools

 

Prawoklik na zlokalizowany tam skrót Internet explorer (bez dodatków) > Właściwości > w polu Element docelowy po ścieżce "C:\Program Files\Internet Explorer\iexplore.exe" dopisz dwie spacje i -extoff

 

3. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt. Wypowiedz się na czym stoimy.

 

W skrypcie powyżej usuwam szczątki źle odinstalowanych przeglądarek Google Chrome i Firefox. Ewentualna świeża instalacja którejś z nich potem.

[Marylka]

Dziekuje Picasso.

 

Zamieszczam nowy log z FRST http://www.wklej.org/id/1761421/txt/ i z Fixlog  http://www.wklej.org/id/1761423/txt/