Reklamy PriceFountain

[shibby]

Witam Serdecznie, mam podobny problem co kilku użytkowników z PriceFountain jeśli ktoś może pomóc to będę wdzięczny.

Addition.txt

FRST.txt

Shortcut.txt

[picasso]

Zasady działu: KLIK. Tu jest zakaz podpinania się pod cudze wątki. Wydzielone w osobny temat.

 

Od razu uwaga na początek, definitywnie było tu pobieranie z dobrychprogramów via szkodliwy "Asystent pobierania": KLIK. Działania do przeprowadzenia:

 

1. Klawisz z flagą Windows + X > Programy i funkcje > odinstaluj McAfee Security Scan Plus (sponsowany zbędnik), Search Provided by Yahoo (adware), Shared C Run-time for x64 (odpadek po odinstalowanym McAfee)

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
Task: {0FF5DD40-139D-4AE9-BA87-9D4066E5BF29} - System32\Tasks\UpdateTask => C:\Users\Tomasz\AppData\Local\{0E9C3~1\UNINST~1.EXE [2015-10-17] ()
Task: {1D0EAD36-DACF-4778-AC0A-054667D2FB38} - System32\Tasks\Price Fountain => C:\Users\Tomasz\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE 
Task: {6736B4C3-0B5F-4C4B-96A2-7B2964AD4CCB} - System32\Tasks\help4u_updating_service => C:\Program Files (x86)\help4u\help4u_updating_service.exe 
Task: {6ECF0A52-9E53-4BB8-8827-ACC2A576D50D} - System32\Tasks\AdjudicationsPaleontologistsV2 => Rundll32.exe ArteriogramLarkier.dll,main 7 1 
Task: {86099486-47CA-4453-A863-D7BF4D96E7FC} - System32\Tasks\help4u_notification_service => C:\Program Files (x86)\help4u\help4u_notification_service.exe 
Task: {B7EA7B2D-EB02-4F86-B9B4-9637915E5F05} - System32\Tasks\{678F1855-3E44-42E5-9DB8-A9E1E655E002} => pcalua.exe -a "C:\Program Files (x86)\Sense\Uninstall.exe" -c /fromcontrolpanel=1
Task: {BC91E1D6-3FE1-425C-B724-F5E89A878FBA} - System32\Tasks\{90530114-1D17-4677-96BB-F674539ED408} => pcalua.exe -a "C:\Users\Tomasz\Downloads\eset-smart-security-64bit-8.0.304.2-pl\e_8_64\FIX\FIX\box, mara-fix v1.8\Eset fix\Eset fix.exe" -d "C:\Users\Tomasz\Downloads\eset-smart-security-64bit-8.0.304.2-pl\e_8_64\FIX\FIX\box, mara-fix v1.8\Eset fix"
Task: {D1C19B0E-1C35-48CA-8C46-E0BD1A38E005} - System32\Tasks\4UKOOyXwbSuEEhQb => C:\Users\Tomasz\AppData\Roaming\4UKOOyXwbSuEEhQb.exe 
Task: C:\WINDOWS\Tasks\4UKOOyXwbSuEEhQb.job => C:\Users\Tomasz\AppData\Roaming\4UKOOyXwbSuEEhQb.exe 
Task: C:\WINDOWS\Tasks\help4u_notification_service.job => C:\Program Files (x86)\help4u\help4u_notification_service.exeǢ/url='hxxp:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='help4u' /appid='73143' /srcid='2913' /bic='896c9c2df74490b8bba4809ba912fe86' /verifier='50d08d275a08c8722741359252159354' /installerversion='1.50.3.10' /statsdomain='hxxp:/stats.buildomserv.com/data.gif?' /errorsdomain='hxxp:/stats.buildomserv.com/data.gif?' /monetizationdomain='hxxp:/logs.buildomserv.com/monetization.gif 
Task: C:\WINDOWS\Tasks\help4u_updating_service.job => C:\Program Files (x86)\help4u\help4u_updating_service.exe§ /campid=2913 /verid=1 /url=hxxp:/cdn.buildomserv.com/txt/@CAMPID@/@VER@/file.txt /appid=73143 /taskname=help4u_updating_service /funurl=hxxp:/stats.buildomserv.com 
Task: C:\WINDOWS\Tasks\Price Fountain.job => C:\Users\Tomasz\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE 
Task: C:\WINDOWS\Tasks\UpdateTask.job => C:\Users\Tomasz\AppData\Local\{0E9C3~1\UNINST~1.EXE
GroupPolicy: Ograniczenia - Chrome 
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia 
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Brak pliku
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Aggiorna ESET license.lnk [2015-04-08]
S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1681403894-334063220-2750973403-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-1681403894-334063220-2750973403-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://fr.yhs4.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ir_15_30&param1=1&param2=f%3D1%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtAtAtC0DyEzy0B0AyEzztN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFyCtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEyDyBtB0E0B0FtAtGyC0E0B0BtG0Ezz0DyDtGyC0FyE0DtGzz0AtA0FyBzy0C0C0BtAtA0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyCzztC0C0C0EyEtG0D0D0BtDtGyEzztAyEtG0B0DyCyCtGtA0A0BtDtCzy0A0D0C0DtAtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzzyC%26cr%3D997527101%26a%3Dwncy_ir_15_30%26os%3DWindows%2B8.1
HKU\S-1-5-21-1681403894-334063220-2750973403-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01
SearchScopes: HKLM -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL =
SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1681403894-334063220-2750973403-1001 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ir_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtAtAtC0DyEzy0B0AyEzztN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFyCtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEyDyBtB0E0B0FtAtGyC0E0B0BtG0Ezz0DyDtGyC0FyE0DtGzz0AtA0FyBzy0C0C0BtAtA0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyCzztC0C0C0EyEtG0D0D0BtDtGyEzztAyEtG0B0DyCyCtGtA0A0BtDtCzy0A0D0C0DtAtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzzyC%26cr%3D997527101%26a%3Dwncy_ir_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1681403894-334063220-2750973403-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1681403894-334063220-2750973403-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://fr.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_ir_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dfr%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzuyB0CtDyDtDyBtAtAtC0DyEzy0B0AyEzztN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFyCtN1L1Czu1ByEtN1L1G1B1V1N2Y1L1Qzu2SyEyDyBtB0E0B0FtAtGyC0E0B0BtG0Ezz0DyDtGyC0FyE0DtGzz0AtA0FyBzy0C0C0BtAtA0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StCyCzztC0C0C0EyEtG0D0D0BtDtGyEzztAyEtG0B0DyCyCtGtA0A0BtDtCzy0A0D0C0DtAtA2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzzyC%26cr%3D997527101%26a%3Dwncy_ir_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1681403894-334063220-2750973403-1001 -> {E42D9249-EB39-477F-9647-9127E803E00C} URL =
Toolbar: HKLM - Brak nazwy - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Brak pliku
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
CHR HKLM\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1681403894-334063220-2750973403-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ajcmdlkeklfmbjffnlofgfkjcnpfckab] - hxxps://clients2.google.com/service/update2/crx
DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I
DeleteKey: HKCU\Software\dobreprogramy
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Mozilla\Thunderbird
DeleteKey: HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main
DeleteKey: HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder /v "McAfee Security Scan Plus.lnk" /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v AvastUI.exe /f
RemoveDirectory: C:\ProgramData\TEMP
RemoveDirectory: C:\Users\Tomasz\AppData\Local\{0E9C38C0-2A34-5478-47AC-719063C48D08}
RemoveDirectory: C:\Users\Tomasz\AppData\Local\AdjudicationsPaleontologists
RemoveDirectory: C:\Users\Tomasz\AppData\Roaming\PriceFountain
RemoveDirectory: C:\Users\Tomasz\Desktop\Stare dane programu Firefox
C:\Users\Tomasz\AppData\Roaming\4UKOOyXwbSuEEhQb
C:\Users\Tomasz\AppData\Roaming\Setup62601.exe
C:\Users\Tomasz\AppData\Roaming\Uo9Dd04KrkUvCA7TwXESDJC114h
C:\Users\Public\Desktop\Aggiorna ESET license.lnk
C:\Users\Tomasz\Downloads\*-dp*.exe
DisableService: PLAY ONLINE. RunOuc
Hosts:
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Wyczyść Google Chrome z adware:

• Zresetuj synchronizację (o ile włączona): KLIK.
• Jeśli potrzebne, wyeksportuj zakładki: CTRL+SHIFT+O > Organizuj > Eksportuj zakładki do pliku HTML.
• Ustawienia > karta Ustawienia > Osoby > załóż nowy profil i się na niego zaloguj + zaimportuj zakładki, a stary usuń całkowicie.

4. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition, ale już bez Shortcut. Dołącz też plik fixlog.txt. Edytowane 2 Czerwca 2016 przez picasso
Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso