Skocz do zawartości
WAŻNE - Użytkownicy uprawnieni do pomocy
WAŻNE - Zakładanie tematu: obowiązkowe logi
Nadchodzące zmiany w logowaniu

yoursites123

cwirec

Przez cwirec
w Dział pomocy doraźnej

Rekomendowane odpowiedzi

Pomoc jest darmowa, ale proszę rozważ przekazanie dotacji na utrzymanie serwisu: klik.
picasso

picasso

Opublikowano
Opublikowano

Wygląda na to, że adware nabyłeś pobierając CollageIt z dobrychprogramów, tzn. przyczyną jest "Asystent pobierania" dobrychprogramów, na temat pobierania z tego portalu: KLIK. I w systemie jest o wiele więcej adware niż tylko zgłaszane przekierowania. System bardzo zaśmiecony. Próbując rozwiązać problem zainstalowałeś wątpliwy skaner SpyHunter. Działania do przeprowadzenia:

 

1. Odinstaluj:

- Adware i wątpliwy skaner: Conduit Engine, SFT_eng7 Toolbar, Softonic Assistant, SpyHunter 4, vShare.tv plugin 1.3.

- Stare wersje i zbędniki: Acrobat.com, Adobe AIR, Adobe Reader 9.5.3, Adobe Shockwave Player 11.6, AVG Web TuneUp, Badanie mające na celu poprawę produktów HP Deskjet 2540 series, Java™ 6 Update 39, Spybot - Search & Destroy, Windows Media Player Firefox Plugin. W Menu start wyszukaj też deinstalator Real Alternative.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Jacek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Public\Desktop\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT 
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursearching.com/?type=sc&ts=1448651802&z=96cf6dc7e5bfc168f2c6839g0z9z5b5qbw8gbm1t1t&from=cor&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
HKU\S-1-5-21-1679813524-3586070068-693276116-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
HKU\S-1-5-21-1679813524-3586070068-693276116-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
HKU\S-1-5-21-1679813524-3586070068-693276116-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
HKU\S-1-5-21-1679813524-3586070068-693276116-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
HKU\S-1-5-21-1679813524-3586070068-693276116-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT
URLSearchHook: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 - (Brak nazwy) - {8532a8b7-c06a-41bb-936a-8ce73e4711ed} - Brak pliku
URLSearchHook: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 - (Brak nazwy) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - Brak pliku
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
SearchScopes: HKLM -> {25401C80-818F-475F-930F-EF6C67D6B85A} URL = hxxp://searchfunmoods.com/results.php?f=4&q={searchTerms}&a=iron2&ir=iron2&cd=2XzuyEtN2Y1L1QzutDtDtByDyDyC0Dzz0FyBtBtB0ByD0EyBtN0D0Tzu0CtAyCyDtN1L2XzutBtFtBtFtCtFyEtDyB&cr=1468562263
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449688294&z=111d1fc6f9d5dc8f2e4f334g1z7z9t8q8b2bdoftec&from=ient07021&uid=TOSHIBAXMK2555GSX_796HTR8LTXX796HTR8LT&q={searchTerms}
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://startsear.ch/?aff=1&src=sp&cf=297f0119-2c0a-11e1-936d-002556d8f722&q={searchTerms}
SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031607
SearchScopes: HKLM -> {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
SearchScopes: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={32D31ADC-EB9C-432F-A818-240BDF04D9F5}&mid=6e593e25bc0d47cdb00ed16b5f181377-44027868006105378dec04b70e9dda9e7db8b395&lang=en&ds=AVG&coid=avgtbavg&cmpid=1015tb&pr=pr&d=2015-09-27 13:43:08&v=4.1.8.599&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={32D31ADC-EB9C-432F-A818-240BDF04D9F5}&mid=6e593e25bc0d47cdb00ed16b5f181377-44027868006105378dec04b70e9dda9e7db8b395&lang=en&ds=AVG&coid=avgtbavg&cmpid=1015tb&pr=pr&d=2015-09-27 13:43:08&v=4.1.8.599&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7
BHO: Brak nazwy -> {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} -> Brak pliku
Toolbar: HKLM - Brak nazwy - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - Brak pliku
Toolbar: HKU\.DEFAULT -> Brak nazwy - {8532A8B7-C06A-41BB-936A-8CE73E4711ED} - Brak pliku
Toolbar: HKU\.DEFAULT -> Brak nazwy - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {8532A8B7-C06A-41BB-936A-8CE73E4711ED} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - Brak pliku
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - Brak pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{4516CEE1-97DA-4030-A444-2D8E296B96B6}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{6F237DF9-9DDB-47AD-B218-400D54C286AD}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\InprocServer32 -> Brak ścieżki do pliku
CustomCLSID: HKU\S-1-5-21-1679813524-3586070068-693276116-1000_Classes\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}\InprocServer32 -> Brak ścieżki do pliku
CHR HKLM\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files\vShare.tv plugin\vshareplg.crx [2011-08-31]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF HKLM\...\Firefox\Extensions: [{3112ca9c-de6d-4884-a869-9855de68056c}] - C:\ProgramData\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c}
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Jacek\AppData\Roaming\Mozilla\Firefox\Profiles\ssj8qhqw.default\extensions\deskCutv2@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Jacek\AppData\Roaming\Mozilla\Firefox\Profiles\ssj8qhqw.default\extensions\yahooprotected@gmail.com
FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Jacek\AppData\Roaming\Mozilla\Firefox\Profiles\ssj8qhqw.default\extensions\default_newtabff@gmail.com
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\40.1.8\\npsitesafety.dll [brak pliku]
FF Plugin: @ganymede/MARBLES,version=1.0 -> C:\Program Files\Ganymede\Plugins\MARBLES\NPMARBLES.dll [2011-07-15] (Ganymede Technologies)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll [2009-10-09] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll [2009-10-09] (RealNetworks, Inc.)
FF Plugin HKU\S-1-5-21-1679813524-3586070068-693276116-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Jacek\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [brak pliku]
Task: {0CE273D8-9E5C-47A6-84E1-140EA4441144} - System32\Tasks\{6BA5134D-A659-409D-BE2B-83950D46FE12} => pcalua.exe -a E:\Setup_Polish.exe -d E:\
Task: {18DFD9FC-082E-4E9B-8285-5F21D2B4EDAE} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E22FAAA-5038-4702-A146-81F5F9D06F60} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Jacek => C:\Program Files\Windows Calendar\wincal.exe
Task: {3B63104E-982B-4E3F-BEB4-27A24DCF6EB6} - System32\Tasks\{FB5BDEA0-0852-4C81-B0B8-1B55439FDB42} => pcalua.exe -a "C:\Users\Jacek\Desktop\foto i video\profile_d2x\Nowy folder\P-OPCLS-D300-V100W.exe" -d "C:\Users\Jacek\Desktop\foto i video\profile_d2x\Nowy folder"
Task: {5916F864-469C-4391-8604-E4EA141A2699} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {5C238432-FB0E-474C-B770-158AD60531DD} - System32\Tasks\{2534EF34-B3BA-46EF-84E5-24C73C36713B} => pcalua.exe -a C:\Users\Jacek\Documents\VirtualDub-1.9.9(dobreprogramy.pl)\auxsetup.exe -d C:\Users\Jacek\Documents\VirtualDub-1.9.9(dobreprogramy.pl)
Task: {7FF73A8C-EBE0-4307-9F93-AA40F03F487E} - System32\Tasks\{8115426D-D631-49EA-80C1-8AD3889D53A7} => pcalua.exe -a "C:\Users\Jacek\Desktop\foto i video\profile_d2x\Nowy folder\P-OPCPT-D300-V100W.exe" -d "C:\Users\Jacek\Desktop\foto i video\profile_d2x\Nowy folder"
Task: {A9AA550C-A515-4E59-AAE9-124D4920E4FC} - System32\Tasks\Launch HTC Sync Loader => C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe
Task: {ACDD310F-57C1-44F1-B3DF-C2EB93C99D99} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {D3DB917E-A5E8-457B-AB8F-299346B95300} - System32\Tasks\Funmoods => C:\Users\Jacek\AppData\Roaming\Funmoods\UPDATE~1\UPDATE~1.EXE 
Task: {E8B6060E-86E8-43E1-B4C4-87409DABC30C} - System32\Tasks\{EC199803-2367-498E-BD1E-D3A4132B3586} => pcalua.exe -a "C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe" -c /M{69EA6470-D4D3-49A3-89C8-0530C416ADB9}
Task: {EB7930BB-286F-4706-B2BA-637A45EC77D5} - System32\Tasks\{1D7DABD6-71CE-4C6E-93DB-72831B7D6A5F} => pcalua.exe -a C:\Users\Jacek\AppData\Local\Temp\Temp2_VirtualDub-1.9.9(dobreprogramy.pl).zip\auxsetup.exe
HKLM\...\Run: [] => [X]
Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X]
S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [1025352 2011-07-26] ()
R2 MgAssistService; C:\Program Files\Mobogenie\MgAssist.exe [63168 2014-01-31] () [brak podpisu cyfrowego]
R2 vToolbarUpdater40.1.8; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\40.1.8\ToolbarUpdater.exe [1875856 2015-10-04] (AVG Secure Search)
R3 ALSysIO; \??\C:\Users\Jacek\AppData\Local\Temp\ALSysIO.sys [X]
DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I
DeleteKey: HKCU\Software\dobreprogramy
DeleteKey: HKLM\SOFTWARE\yoursites123Software
DeleteKey: HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
C:\Program Files\Mozilla Firefoxavg-secure-search.xml
C:\Program Files\AVG\AVG10
C:\Program Files\Mobogenie
C:\Program Files\Mozilla Firefox\browser\searchplugins
C:\Program Files\Mozilla Firefox\extensions
C:\Program Files\Mozilla Firefox\plugins
C:\Program Files\Common Files\AVG Secure Search
C:\ProgramData\Google\Toolbar for Firefox
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\ProgramData\1WMiniPro1
C:\ProgramData\TEMP
C:\Users\Jacek\AppData\Local\Mobogenie
C:\Users\Jacek\AppData\LocalLow\prvlcl.dat
C:\Users\Jacek\AppData\Roaming\yoursearching
C:\Users\Jacek\AppData\Roaming\Microsoft\Office\Niedawny\*.LNK
C:\Users\Jacek\Downloads\*-dp*.exe
C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
CMD: netsh advfirewall reset
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Wyczyść przeglądarki z adware:

 

Firefox:

  • Odłącz synchronizację (o ile włączona): KLIK.
  • Menu Pomoc > Informacje dla pomocy technicznej > Odśwież program Firefox. Zakładki i hasła nie zostaną naruszone.
  • Menu Historia > Wyczyść całą historię przeglądania.
Google Chrome:
  • Zresetuj synchronizację (o ile włączona): KLIK.
  • Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Resetowanie ustawień. Zakładki i hasła nie zostaną naruszone.
4. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition, ale już bez Shortcut. Dołącz też plik fixlog.txt.
Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

Poprawki:

 

1. Czy na pewno wcześniej zresetowałeś Google Chrome? Wykonaj to ponownie, nawet jeśli było to prowadzone.

 

2. Otwórz Notatnik i wklej w nim:

 

HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe
URLSearchHook: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 - (Brak nazwy) - {08d6b0b4-c132-470d-a8e2-aa2e9c3851c9} - Brak pliku
BHO: Brak nazwy -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> Brak pliku=
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll => Brak pliku
Toolbar: HKU\.DEFAULT -> Brak nazwy - {08D6B0B4-C132-470D-A8E2-AA2E9C3851C9} - Brak pliku
Toolbar: HKU\.DEFAULT -> Brak nazwy - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {08D6B0B4-C132-470D-A8E2-AA2E9C3851C9} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {30F9B915-B755-4826-820B-08FBA6BD249D} - Brak pliku
Toolbar: HKU\S-1-5-21-1679813524-3586070068-693276116-1000 -> Brak nazwy - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - Brak pliku
FF Plugin: @java.com/DTPlugin,version=1.6.0_39 -> C:\Windows\system32\npdeployJava1.dll [2013-01-15] (Sun Microsystems, Inc.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-10] ()
R3 ALSysIO; \??\C:\Users\Jacek\AppData\Local\Temp\ALSysIO.sys [X]
DeleteKey: HKCU\Software\Conduit
DeleteKey: HKCU\Software\InstallCore
DeleteKey: HKCU\Software\PRODUCTSETUP
DeleteKey: HKCU\Software\Softonic
DeleteKey: HKCU\Software\Speedchecker Limited
DeleteKey: HKCU\Software\StartSearch
DeleteKey: HKCU\Software\torch
DeleteKey: HKCU\Software\Uniblue
DeleteKey: HKCU\Software\vShare.tv
DeleteKey: HKCU\Software\YahooPartnerToolbar
DeleteKey: HKCU\Software\AppDataLow\Software\AVG Security Toolbar
DeleteKey: HKCU\Software\AppDataLow\Software\Toolbar
DeleteKey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{2890AD95-0209-92E4-03E0-69C5D783E039}
DeleteKey: HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1B48071-416D-474E-A13B-BE5456E7FC31}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
DeleteKey: HKCU\Software\Mozilla\Extends
DeleteKey: HKLM\SOFTWARE\Conduit
DeleteKey: HKLM\SOFTWARE\FFPluginHp
DeleteKey: HKLM\SOFTWARE\InstallCore
DeleteKey: HKLM\SOFTWARE\torch
DeleteKey: HKLM\SOFTWARE\Trymedia Systems
DeleteKey: HKLM\SOFTWARE\Uniblue
DeleteKey: HKLM\SOFTWARE\TSv
DeleteKey: HKLM\SOFTWARE\yoursearchingSoftware
DeleteKey: HKLM\SOFTWARE\Classes\b
DeleteKey: HKLM\SOFTWARE\Classes\Conduit.Engine
DeleteKey: HKLM\SOFTWARE\Classes\escort.escrtBtn.1
DeleteKey: HKLM\SOFTWARE\Classes\esrv.funmoodsESrvc
DeleteKey: HKLM\SOFTWARE\Classes\Prod.cap
DeleteKey: HKLM\SOFTWARE\Classes\protector_dll.protectorbho
DeleteKey: HKLM\SOFTWARE\Classes\protector_dll.protectorbho.1
DeleteKey: HKLM\SOFTWARE\Classes\Toolbar.CT3031607
DeleteKey: HKLM\SOFTWARE\Classes\AppID\esrv.EXE
DeleteKey: HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE
DeleteKey: HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
DeleteKey: HKLM\SOFTWARE\Classes\AppID\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}
DeleteKey: HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}
DeleteKey: HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{3CCC052E-BDEE-408A-BEA7-90914EF2964B}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{61F47056-E400-43D3-AF1E-AB7DFFD4C4AD}
DeleteKey: HKLM\SOFTWARE\Classes\CLSID\{E2B98EEA-EE55-4E9B-A8C1-6E5288DF785A}
DeleteKey: HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}
DeleteKey: HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\88F4981A41C989480BC43B3C81A84BD458B7C0FB._service_run
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mobilegeni daemon
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\QuickTime Task
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SDTray
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SpybotPostWindows10UpgradeReInstall
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\SunJavaUpdateSched
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\WinampAgent
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
DeleteKey: HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2BC04DF-EFBD-409A-95CA-36874E5AB92A}
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\Update RightSurf
DeleteKey: HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WdsManPro
DeleteKey: HKU\.DEFAULT\Software\AVG Secure Search
DeleteKey: HKU\.DEFAULT\Software\vShare.tv
DeleteKey: HKU\.DEFAULT\Software\Winamp Toolbar
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\Software\AVG Security Toolbar
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\Software\Conduit
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\Software\conduitEngine
DeleteKey: HKU\.DEFAULT\Software\AppDataLow\Software\PriceGong
RemoveDirectory: C:\FRST\Quarantine
RemoveDirectory: C:\Program Files\AVG Security Toolbar
RemoveDirectory: C:\Program Files\Spybot - Search & Destroy 2
RemoveDirectory: C:\ProgramData\AVG Security Toolbar
RemoveDirectory: C:\ProgramData\Avg_Update_0814tb
RemoveDirectory: C:\ProgramData\Spybot - Search & Destroy
RemoveDirectory: C:\ProgramData\Trymedia
RemoveDirectory: C:\Users\Jacek\AppData\Local\AVG Security Toolbar
RemoveDirectory: C:\Users\Jacek\AppData\Local\torch
RemoveDirectory: C:\Users\Jacek\AppData\LocalLow\AVG Secure Search
RemoveDirectory: C:\Users\Jacek\AppData\LocalLow\AVG Security Toolbar
RemoveDirectory: C:\Users\Jacek\AppData\LocalLow\BabylonToolbar
RemoveDirectory: C:\Users\Jacek\AppData\LocalLow\Conduit
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Funmoods
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Systweak
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Uniblue
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\mipony
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Mozilla\Firefox\Profiles\ssj8qhqw.default
RemoveDirectory: C:\Users\Jacek\Desktop\Stare dane programu Firefox
RemoveDirectory: C:\Users\Jacek\Documents\Mobogenie
CMD: del /q C:\Users\Jacek\daemonprocess.txt
CMD: del /q C:\Users\Jacek\Downloads\SpyHunter-Installer.exe
CMD: del /q C:\Windows\system32\conduitEngine.tmp
CMD: del /q C:\Windows\System32\drivers\EsgScanner.sys

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Tym razem nie będzie restartu. Przedstaw wynikowy fixlog.txt.

Odnośnik do komentarza
picasso

picasso

Opublikowano
Opublikowano

W takim razie nie wiem o co chodzi, bo DelFix komunikował usunięcie folderu C:\FRST, a Hitman wykrył FRST w tym właśnie folderze. Sprawdź czy folder ten nadal jest na dysku - jeśli tak, to przez SHIFT+DEL (omija Kosz) skasuj potwierdzając wszystkie komunikaty o "usuwaniu plików systemowych".

 

Na koniec wyczyść foldery Przywracania systemu oraz uzupełnij najnowsze wersje odinstalowanych programów Adobe i Java (o ile potrzebne): KLIK.

Odnośnik do komentarza
Gość
Ten temat został zamknięty. Brak możliwości dodania odpowiedzi.
Tematy

  • Ostatnio przeglądający   0 użytkowników

    • Brak zarejestrowanych użytkowników przeglądających tę stronę.
×
×
  • Dodaj nową pozycję...