System jest zainfekowany, zly dzial.
Odinstaluj:
McAfee Security Scan
Uzyj AdwCleaner o ile jeszcze tego nie zrobiles.
Obok frst.exe utworz plik fixlist.txt z zawartoscia:
() C:\Users\Admin\AppData\Local\Temp\tmp.exe
() C:\Users\Admin\AppData\Roaming\winap32.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(NVVSCDR) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0x00.exe
() C:\Users\Admin\AppData\Roaming\screensnapper\svosti.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcbarsvc.exe
(BreakPoint Software 5) C:\Users\Admin\AppData\Local\Temp\shs34.exe
() C:\Users\Admin\AppData\Roaming\screensnapper\svosti.exe
C:\Users\Admin\AppData\Roaming\winap32.exe
C:\Users\Admin\AppData\Roaming\screensnapper\
C:\Program Files (x86)\WeatherBlink\
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0x00.exe
HKLM\...\Run: [WeatherBlink Home Page Guard 64 bit] => "C:\PROGRA~2\WEATHE~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [Allin1Convert Home Page Guard 64 bit] => "C:\PROGRA~2\ALLIN1~1\bar\1.bin\AppIntegrator64.exe"
HKLM-x32\...\Run: [WeatherBlink EPM Support] => C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcmedint.exe [12872 2013-12-22] (Mindspark Interactive Network, Inc.)
HKLM-x32\...\Run: [WeatherBlink Search Scope Monitor] => "C:\PROGRA~2\WEATHE~1\bar\1.bin\gcsrchmn.exe" /m=2 /w /h
HKLM-x32\...\Run: [Allin1Convert EPM Support] => "C:\PROGRA~2\ALLIN1~1\bar\1.bin\8hmedint.exe" T8EPMSUP.DLL,S
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000\...\Run: [winap32] => C:\Users\Admin\AppData\Roaming\winap32.exe [1411720 2013-04-04] ()
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000\...\Run: [shs34.exe] => C:\Users\Admin\AppData\Local\Temp\shs34.exe [1114112 2014-08-25] (BreakPoint Software 5) <===== ATTENTION
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000\...\Winlogon: [Shell] C:\Users\Admin\AppData\Local\Temp\mins\mins.exe [3750912 2014-09-28] (MPSOFTWARE) <==== ATTENTION
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [winap32] => C:\Users\Admin\AppData\Roaming\winap32.exe [1411720 2013-04-04] ()
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [shs34.exe] => C:\Users\Admin\AppData\Local\Temp\shs34.exe [1114112 2014-08-25] (BreakPoint Software 5) <===== ATTENTION
HKU\S-1-5-21-2984246463-1008046116-3798576916-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Winlogon: [Shell] C:\Users\Admin\AppData\Local\Temp\mins\mins.exe [3750912 2014-09-28] (MPSOFTWARE) <==== ATTENTION
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0x00.exe (NVVSCDR)
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogom.vbs ()
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogom.vbs
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XenoSuite.lnk
ShortcutTarget: XenoSuite.lnk -> C:\Program Files (x86)\XenoBot\XenoSuite.exe (No File)
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
URLSearchHook: HKCU - (No Name) - {8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} - C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcSrcAs.dll (Mindspark)
URLSearchHook: HKCU - (No Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - C:\Program Files (x86)\Allin1Convert_8h\bar\1.bin\8hSrcAs.dll No File
SearchScopes: HKCU - {B0A0DAF1-4FF4-41B6-BBCE-5797FC608E04} URL =
http://www.search.ask.com/web?tpid=ORJ-V7-SAT...1387.91&doi=2014-05-10&trgb=IE&q= {searchTerms}&psv=
BHO: Free Games 115 -> {3EEF222A-E2BD-4650-A1B9-A1C2EF0B700A} -> C:\Program Files (x86)\Free Games 115\ScriptHost64.dll (BestOffers)
BHO: Ask Shopping Toolbar -> {4F524A2D-5637-2D53-4154-7A786E7484D7} -> "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7-SAT\Passport_x64.dll" No File
BHO-x32: Free Games 115 -> {3EEF222A-E2BD-4650-A1B9-A1C2EF0B700A} -> C:\Program Files (x86)\Free Games 115\ScriptHost.dll (BestOffers)
BHO-x32: Ask Shopping Toolbar -> {4F524A2D-5637-2D53-4154-7A786E7484D7} -> "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7-SAT\Passport.dll" No File
BHO-x32: Search Assistant BHO -> {9b9dcae3-be34-424c-8d73-75e305a9e091} -> C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcSrcAs.dll (Mindspark)
BHO-x32: Toolbar BHO -> {dc9051c2-8f55-479a-97a4-747980d9047f} -> C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcbar.dll (Mindspark)
Toolbar: HKLM - Ask Shopping Toolbar - {4F524A2D-5637-2D53-4154-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7-SAT\Passport_x64.dll" No File
Toolbar: HKLM-x32 - Ask Shopping Toolbar - {4F524A2D-5637-2D53-4154-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7-SAT\Passport.dll" No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
FF Plugin-x32: @WeatherBlink.com/Plugin -> C:\Program Files (x86)\WeatherBlink\bar\1.bin\NPgcStub.dll No File
FF Extension: Widget context - C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-04-15]
FF HKCU\...\Firefox\Extensions: [freegames115@BestOffers] - C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\freegames115@BestOffers
FF Extension: Free Games 115 - C:\Users\Admin\AppData\Roaming\Mozilla\Extensions\freegames115@BestOffers [2014-03-03]
CHR DefaultSearchKeyword: Default -> sweet-page
CHR DefaultSearchProvider: Default -> sweet-page
CHR DefaultSearchURL: Default ->
http://www.sweet-page.com/web/?type=ds&ts...XWD10EARX-00PASB0_WD-WCAZAJ18688086880&q= {searchTerms}
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaojmikegpiepcfdkkjaplodkpfmlo [2014-05-16]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ainbkicbloikcngphmjfpjdemblcojdd [2014-06-12]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-05-16]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2014-05-16]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-06-12]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oifomnalkciipmgkfgdjkepdocgiipjg [2014-05-16]
CHR Extension: (No Name) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkndmigholgfjlniaohblojbhgjbkakn [2014-05-16]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 WeatherBlinkService; C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcbarsvc.exe [88648 2013-12-22] (COMPANYVERS_NAME)
S2 vToolbarUpdater18.1.9; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [X]
EmptyTemp:
W FRST wybierz Fix.
Po wykonaniu zrob ponownie skan przy pomocy FRST i daj Addition.txt oraz CALY frst.txt, a nie kawalek tak jak teraz.
jestem w tym zielony.
Paq32 Wstaw jeszcze Addition.txt bo brakuje.
