Navsmart.info jako strona startowa

[danielbv]

Witam
Moja dziewczyna ściągnęła jakiś program (nie pamiętam nazwy, ale miał służyć do włamu na konto na Facebooku). Oczywiście zainfekowała tym laptopa. Czyściłem go Malwerebytes Anti-Malwere, ale strona startowa navsmart.info pozostała i podejrzewam, że na komputerze pozostały jakieś śmieci. Proszę o pomoc.

Addition.txt

FRST.txt

Shortcut.txt

gmer.txt

[jessica]

@Picasso ma dziś zacząć znów pomagać, ale do końca dnia zostało niecałe 2 godziny, więc szanse na to, by @Picasso dotrzymała obietnicy są coraz mniejsze.

Jeśli jednak zacznie pomagać, to moich zaleceń nie wykonuj.

 

1) Odinstaluj niepotrzebny Akamai NetSession Interface

 

 

2) Otwórz Notatnik i wklej w nim:

 

Task: {3CF683F2-911B-49F9-931A-FBFAC9CE3166} - Brak ścieżki do pliku
Task: {72B432B4-6BC3-4990-AD50-07795D985C2C} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== UWAGA
Task: {7879DC33-3EB9-4ED8-8ABF-7E6B0B9DDEB7} - System32\Tasks\{49439B8F-5618-8BDE-28AB-2AF2E0168DFB} => C:\Users\Acer\AppData\Roaming\PRICEF~1\PRICEF~1.EXE <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\UCBrowser
RemoveDirectory: C:\Users\Acer\AppData\Roaming\PRICEF~1
RemoveDirectory: C:\Program Files (x86)\LuDaShi
RemoveDirectory: C:\Program Files (x86)\SrpnFiles
RemoveDirectory: C:\Users\Acer\AppData\Roaming\VidtigLenla
RemoveDirectory: C:\Program Files\Harv
RemoveDirectory: C:\Program Files\Enigma Software Group
RemoveDirectory: C:\Users\Acer\AppData\Roaming\Enigma Software Group
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://navsmart.info
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://navsmart.info
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --load-extension="C:\Users\Acer\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://navsmart.info
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://navsmart.info
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --load-extension="C:\Users\Acer\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://navsmart.info
ShortcutWithArgument: C:\Users\Acer\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --load-extension="C:\Users\Acer\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://navsmart.info
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->  --load-extension="C:\Users\Acer\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk" hxxp://navsmart.info
FirewallRules: [TCP Query User{2EB70A59-00E0-4EC9-939A-E11958A14671}C:\users\acer\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\acer\appdata\local\akamai\netsession_win.exe
FirewallRules: [uDP Query User{88D47DF1-CEDF-4136-89F1-64A4E3E64274}C:\users\acer\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\acer\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{7A4604D1-2047-4A7B-9E6A-B9323A3A0CE5}C:\users\acer\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\acer\appdata\local\akamai\netsession_win.exe
FirewallRules: [uDP Query User{AB4BF6D6-28BE-4B53-8558-F9BD4F610F08}C:\users\acer\appdata\local\akamai\netsession_win.exe] => (Block) C:\users\acer\appdata\local\akamai\netsession_win.exe
FirewallRules: [{7AD771EC-43DF-4E65-8522-2E71EE56822A}] => (Allow) C:\Program Files (x86)\SrpnFiles\SrpnFiles.exe
FirewallRules: [{0E251AAD-BDEB-401E-A95D-0364DB608887}] => (Allow) C:\Program Files (x86)\SrpnFiles\SrpnFiles.exe
FirewallRules: [{2560ED98-57E8-42FD-9CB3-E00DDD431EC0}] => (Allow) C:\Program Files (x86)\SrpnFiles\downloader.exe
FirewallRules: [{B8ED3F0B-D17F-4734-BC50-835F464A61F3}] => (Allow) C:\Program Files (x86)\SrpnFiles\downloader.exe
FirewallRules: [{2699F2A1-0A6F-4942-9F49-5E86CB91A2CC}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{E7BF91C8-1E35-4BC1-A615-75AB03497818}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{378CFA0C-FD6D-4191-91A8-165D82AE5B4C}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\Downloader\download\MiniThunderPlatform.exe
FirewallRules: [{413D559B-11D3-48AC-9E01-D7D6A4C939C2}] => (Allow) C:\Program Files (x86)\LuDaShi\ComputerZTray.exe
FirewallRules: [{2B92A684-C14E-42DD-B8DC-6F56BD67BBD6}] => (Allow) C:\Program Files (x86)\LuDaShi\ComputerZTray.exe
FirewallRules: [{E41022F3-7C19-4A54-AEB8-9FC37F380276}] => (Allow) C:\Program Files (x86)\LuDaShi\Utils\mininews.exe
FirewallRules: [{754DC0D1-3B78-4C36-BBAA-A12AE67C1805}] => (Allow) C:\Program Files (x86)\LuDaShi\Utils\mininews.exe
C:\users\acer\appdata\local\akamai\netsession_win.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2587670942-906282010-1634158504-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Acer\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-2587670942-906282010-1634158504-1000\...\Run: [bingSvc] => C:\Users\Acer\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-11-05] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-2587670942-906282010-1634158504-1000\...\Run: [ComputerZ-Tray] => "C:\Program Files (x86)\LuDaShi\ComputerZTray.exe" /autorun
HKU\S-1-5-21-2587670942-906282010-1634158504-1000\...\Policies\Explorer: []
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
S2 552BDF53-0D8F-4278-89CE-B10DAFFB7676; "C:\Program Files\Harv\Omichh.exe" [X]
S2 HpSvc; C:\Program Files (x86)\LuDaShi\lpi\HpSvc.dll [X] <==== UWAGA
S2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [X]
S2 UCBrowserSvc; "C:\Program Files (x86)\UCBrowser\Application\UCService.exe" [X]
S2 Vanin; "C:\Users\Acer\AppData\Roaming\VidtigLenla\Ohudkh.exe" -cms [X]
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [80768 2016-04-25] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== UWAGA
C:\Windows\System32\DRIVERS\ucguard.sys
S3 dbx; system32\DRIVERS\dbx.sys [X]
S0 ftegb; System32\drivers\ldjn.sys [X]
NETSVCx32: HpSvc -> C:\Program Files (x86)\LuDaShi\lpi\HpSvc.dll ==> Brak pliku
2016-07-04 17:22 - 2016-07-04 17:22 - 6870016 _____ () C:\Users\Acer\AppData\Roaming\agent.dat
2016-07-04 17:22 - 2016-07-04 17:22 - 0128512 _____ () C:\Users\Acer\AppData\Roaming\Installer.dat
2016-07-04 17:22 - 2016-07-04 17:22 - 0018432 _____ () C:\Users\Acer\AppData\Roaming\Main.dat
2014-05-01 09:57 - 2014-05-01 09:57 - 0000057 _____ () C:\ProgramData\Ament.ini
C:\Users\Acer\Start Menu\Programs\SpyHunter\Uninstall.lnk
C:\Users\Acer\Start Menu\Programs\SpyHunter\SpyHunter.lnk
HOSTS:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

2) Zrób nowe logi FRST.

 

Jak tylko zauważysz, ze @Picasso znów pomaga na forum, to zgłosisz temat w https://www.fixitpc.pl/topic/29279-zg%C5%82oszenia-temat%C3%B3w-bez-odpowiedzi/

 

jessi