Wyskakujące reklamy chrome

[oldzieta]

Witam, mam problem z wyskakującymi reklamami. Ściągnęłam coś z internetu przez co zainfekował mi się komputer. Skanowałam już go za pomocą adwcleaner i programów antywirusowych, ale nie rozwiązało to problemu. Proszę o pomoc przy stworzeniu fixlist do programu frst64.

Addition.txt

FRST.txt

[jessica]

Otwórz Notatnik i wklej w nim:

 

HKLM-x32\...\RunOnce: [Dumimasagace] => C:\Windows\SysWOW64\wscript.exe /E:vbscript /B "C:\Users\MateuszK\AppData\Local\253CBA~1\Celadat.dat"
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
Task: {82095C9D-B692-4EFB-B873-FF5C0EB376DB} - System32\Tasks\snp => C:\ProgramData\RemoteSaver\2kbq1ycl.exe
Task: {9216258E-1E98-4875-8012-579CCE773354} - System32\Tasks\NORWEWCFAEIREHUG => C:\ProgramData\Service1291\Service1291.exe [2015-08-09] () <==== ATTENTION
Task: {9758B59F-18A3-4AF7-97CB-DE0028338239} - System32\Tasks\EKTCHDIZSV1 => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
C:\ProgramData\Service1291
Task: {F7AD80AB-DA7F-458E-B436-F3626CCD7A0A} - System32\Tasks\snf => C:\ProgramData\RemoteSaver\2kbq1ycl.exe
C:\ProgramData\RemoteSaver
C:\ProgramData\FlashBeat
Task: C:\Windows\Tasks\EKTCHDIZSV1.job => C:\ProgramData\FlashBeat\FlashBeat.exe <==== ATTENTION
Task: C:\Windows\Tasks\NORWEWCFAEIREHUG.job => C:\ProgramData\Service1291\Service1291.exe <==== ATTENTION
C:\ProgramData\qwUNTL\dat\WEkehOEB.dll
C:\ProgramData\qwUNTL
HKLM\...\Run: [] => [X]
C:\Users\MateuszK\AppData\Local\253CBA~1
AppInit_DLLs: c:\progra~3\flashb~1\flashb~2.dll => c:\progra~3\flashb~1\flashb~2.dll File not found
AppInit_DLLs-x32: c:\progra~3\flashb~1\flashb~1.dll => "c:\progra~3\flashb~1\flashb~1.dll" File not found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2015-08-09]
ProxyEnable: [.DEFAULT] => Internet Explorer proxy is enabled.
ProxyServer: [.DEFAULT] => http=127.0.0.1:65425;https=127.0.0.1:65425
HKU\S-1-5-21-2447186742-3676154164-1405930604-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWrPzQENNZPocWTwQ6NbMwwuoe_yDskTEHbbrdEsx51shnkTBINi-4YWA-NeYT5wlrxD7mQACqfwR0_Wk6VznF3pOn2JkrUVTrm-27R9VXhFgz3TjqhzX5L9bU9pp9capvahvGCrY2Of1ttCwQoyPg3lxUyw,,&q={searchTerms}
SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWrPzQENNZPocWTwQ6NbMwwuoe_yDskTEHbbrdEsx51shnkTBINi-4YWA-NeYT5wlrxD7mQACqfwR0_Wk6VznF3pOn2JkrUVTrm-27R9VXhFgz3TjqhzX5L9bU9pp9capvahvGCrY2Of1ttCwQoyPg3lxUyw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2447186742-3676154164-1405930604-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKU\S-1-5-21-2447186742-3676154164-1405930604-1001 -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGIjVkxlyIP4NYe17aVLWrPzQENNZPocWTwQ6NbMwwuoe_yDskTEHbbrdEsx51shnkTBINi-4YWA-NeYT5wlrxD7mQACqfwR0_Wk6VznF3pOn2JkrUVTrm-27R9VXhFgz3TjqhzX5L9bU9pp9capvahvGCrY2Of1ttCwQoyPg3lxUyw,,&q={searchTerms}
2015-08-09 21:16 - 2015-08-14 00:21 - 00000354 ____H C:\Windows\Tasks\NORWEWCFAEIREHUG.job
2015-08-09 21:16 - 2015-08-13 23:47 - 00000342 _____ C:\Windows\Tasks\EKTCHDIZSV1.job
2015-08-09 21:16 - 2015-08-09 21:16 - 00003368 _____ C:\Windows\System32\Tasks\NORWEWCFAEIREHUG
2015-08-09 21:16 - 2015-08-09 21:16 - 00002856 _____ C:\Windows\System32\Tasks\EKTCHDIZSV1
2015-08-09 21:16 - 2015-08-09 21:16 - 00000000 ____D C:\ProgramData\Service1291
2015-08-09 21:16 - 2015-08-09 21:16 - 00000000 ____D C:\ProgramData\28341ff220e0446c9fff27c4493d622e
2015-08-09 21:16 - 2015-08-09 21:16 - 00000000 _____ C:\dummy.htm
2015-08-09 20:56 - 2015-08-10 00:39 - 00000000 ____D C:\Program Files (x86)\F093FD3A-1439150210-3E4C-9C1E-3DA9C5C2584F
2015-08-09 20:55 - 2015-08-09 20:55 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-09 20:44 - 2015-08-10 14:58 - 00000000 ____D C:\Program Files (x86)\F093FD3A-1439149499-3E4C-9C1E-3DA9C5C2584F
2015-08-09 20:44 - 2015-08-09 20:44 - 00000000 ____D C:\Program Files (x86)\mbot_gb_014010056
2015-08-02 14:02 - 2015-08-02 14:02 - 00802523 _____ C:\Users\MateuszK\Downloads\VLC-media-player-13060-dp.zip
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

 

Zrób nowe logi FRST.

 

Napisz, czy problem znikł?

 

jessi