Dlaczego PRZED uzyciem FRST nie uzyles AdwCleaner?!
Odinstaluj:
UpdateChecker (HKCU\...\Popajar, inc UpdateChecker) (Version: - Popajar, inc) <==== ATTENTION
uTorrent Packages (HKCU\...\uTorrent Packages) (Version: - ) <==== ATTENTION
WS.Supporter 1.80 (HKLM\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{916e5338}) (Version: - Verified Publisher) <==== ATTENTION
YAC App Store (HKLM\...\Computer Software Market) (Version: - Woodtale Technology Inc.)
Yet Another Cleaner! (HKLM\...\iSafe) (Version: - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== ATTENTION
Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner
Obok frst.exe utworz plik fixlist.txt z zawartoscia:
Task: {06FB650E-6FD2-4620-9E89-FDA2F3D60B01} - System32\Tasks\Yahoo! Search => C:\Users\Bolek\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe <==== ATTENTION
Task: {07A8617B-2AEE-41AC-B899-A22A19F60703} - \BonanzaDealsUpdate No Task File <==== ATTENTION
Task: {0CCAEE54-00C7-47A8-A0D0-A7DD8CC19ACC} - \SaveSense No Task File <==== ATTENTION
Task: {7283E192-FE14-4CD4-BD8F-C164A66F7F5D} - \EPUpdater No Task File <==== ATTENTION
Task: {959C5A78-AAC7-405A-89E3-2A58F9F33D8C} - System32\Tasks\WS.Enabler-S-71009536 => c:\programdata\setapp\ws.enabler\WS.Enabler.exe <==== ATTENTION
Task: {CFBA5F9C-35E0-4FF9-B71E-28B35E6CBD70} - \YourFile DownloaderUpdate No Task File <==== ATTENTION
Task: {F8AF4A25-99BB-46D8-9645-74CCAEE2A050} - System32\Tasks\GS.Enabler-S-4560858878 => c:\programdata\quickset\gs.enabler\GS.Enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\GS.Enabler-S-4560858878.job => c:\programdata\quickset\gs.enabler\GS.Enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\WS.Enabler-S-71009536.job => c:\programdata\setapp\ws.enabler\WS.Enabler.exe <==== ATTENTION
(TODO: <Company name>) C:\Program Files\iSafe\appstore\appstoreSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files\iSafe\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files\iSafe\iSafeSvc2.exe
(Elex do Brasil Participações Ltda) C:\Program Files\iSafe\iSafeTray.exe
() C:\Program Files\iSafe\appstore\ipcdl.exe
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [fYrS6o1n5b] => C:\Users\Bolek\AppData\Roaming\UxEzNR8y\k85XkgH.exe.lnk
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [dXuU9r4p8e] => C:\Users\Bolek\AppData\Roaming\LmtoCGXn\QKHAWSk.exe.lnk
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [eXuV9r4q8e] => C:\Users\Bolek\AppData\Roaming\x4c6lpG5\GyvoKG7.exe [317440 2014-09-03] ()
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [n8F6lCgBkp] => C:\Users\Bolek\AppData\Roaming\t072hlC1\peb3pmM.exe.lnk
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [UMjJYgTfX2] => C:\Users\Bolek\AppData\Roaming\sY50fjAZ\VQNG1Yp.exe [811008 2014-09-05] (Jaaeulro)
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [bVsS6o2n5b] => C:\Users\Bolek\AppData\Roaming\v184imD3\EvslHD4.exe.lnk
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Run: [File] => "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Bolek\AppData\Roaming\File.jar"
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\CurrentVersion\Windows: [Load] C:\Windows\InstallDir\sound.exe <===== ATTENTION
HKU\S-1-5-21-2831363735-3650309122-2072175147-1000\...\Winlogon: [Shell] explorer.exe C:\Windows\InstallDir\sound.exe <==== ATTENTION
AppInit_DLLs: c:\progra~2\bitguard\261673~1.238\{c16c1~1\bitguard.dll => c:\progra~2\bitguard\261673~1.238\{c16c1~1\bitguard.dll File Not Found
AppInit_DLLs: c:\progra~1\wsbeb1~1.ena => c:\progra~1\wsbeb1~1.ena File Not Found
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://search.delta-homes.com/web/?utm_source...KSX&ts=1393448071&type=default&q= {searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://search.delta-homes.com/web/?utm_source...KSX&ts=1393448071&type=default&q= {searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://www.sweet-page.com/web/?type=ds&ts...SHIBAXDT01ACA200_83EX2DVKSXX83EX2DVKSX&q= {searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.sweet-page.com/web/?type=ds&ts...SHIBAXDT01ACA200_83EX2DVKSXX83EX2DVKSX&q= {searchTerms}
URLSearchHook: HKLM - Default Value = {3B81079D-2AC9-425f-A494-A1C7D93AFA3C}
URLSearchHook: HKCU - Default Value = {3B81079D-2AC9-425f-A494-A1C7D93AFA3C}
URLSearchHook: HKCU - (No Name) - {3B81079D-2AC9-425f-A494-A1C7D93AFA3C} - No File
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2488} URL =
http://dts.search.ask.com/sr?src=ieb&gct=...CH001&o=APN11459&apn_ptnrs=AG1&q= {searchTerms}
SearchScopes: HKCU - {BBC9F3B8-8F34-48FB-8D3A-84DD3134A528} URL =
http://rts.dsrlte.com/?q= {searchTerms}&r=183
BHO: DDeallExupress -> {04B94993-1FA4-FEE6-7270-F69AF78296BC} -> C:\ProgramData\DDeallExupress\0_pOtiIrNI.dll ()
BHO: DownSave -> {1DC6FA1B-FAC8-2D62-0575-25EC68E083C5} -> C:\ProgramData\DownSave\9ZLZrMIN.dll ()
BHO: No Name -> {1E5A18EB-3B72-78B3-C653-AFCC47012591} -> No File
BHO: No Name -> {35820408-a7d0-4d30-809f-659aa78bf420} -> No File
BHO: No Name -> {4626a2d5-9364-4561-b8c3-fcac4b5eb567} -> No File
BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No File
BHO: No Name -> {85177EEB-0577-EF1A-DAD8-D99A179C60F2} -> No File
BHO: weebsave -> {F247E60C-6181-BF33-B599-883949191C63} -> No File
Toolbar: HKLM - No Name - {CF0F43AB-9C23-4D7B-8040-201B82844854} - No File
FF NewTab: hxxp://rts.dsrlte.com/?m=tab
FF DefaultSearchEngine: Yahoo! Search
FF DefaultSearchEngine,S: WebSearch
FF DefaultSearchUrl:
http://websearch.searchsunmy.info/?pid=34&...p;lg=EN&cc=PL&unqvl=45&l=1&q=
FF SearchEngineOrder.1: WebSearch
FF SearchEngineOrder.1,S: WebSearch
FF SelectedSearchEngine: Yahoo! Search
FF SelectedSearchEngine,S: WebSearch
FF Homepage: www.wp.pl/?src01=dp220140907
FF Keyword.URL: user_pref("keyword.URL","hxxp://rts.dsrlte.com/?q=");
FF SearchPlugin: C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\searchplugins\buenosearch.xml
FF SearchPlugin: C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\searchplugins\keepmysearch.xml
FF SearchPlugin: C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\searchplugins\WebSearch.xml
FF Extension: SuaveLLotS - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\0dwyeeo@uiogdzo.com [2014-02-27]
FF Extension: weebsave - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\7muskhh@cgf-.edu [2014-02-02]
FF Extension: DDeallExupress - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\beaeyae@zwhl.com [2014-01-06]
FF Extension: DownSave - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\dsphsv@kncmx.org [2014-01-06]
FF Extension: Quick Start - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\quick_start@gmail.com [2014-02-26]
FF Extension: SaveSense - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23} [2014-02-04]
FF Extension: SmileysWeLove: Smileys for use with Facebook, GMail, and more - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\Extensions\jid1-vW9nopuIAJiRHw@jetpack.xpi [2014-01-26]
FF HKLM\...\Firefox\Extensions: [ext@VideoPlayerV3beta660.net] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta660\ff
FF HKLM\...\Firefox\Extensions: [ext@MediaPlayerV1alpha503.net] - C:\Program Files\MediaPlayerV1\MediaPlayerV1alpha503\ff
FF HKLM\...\Firefox\Extensions: [ext@MediaViewerV1alpha1595.net] - C:\Program Files\MediaViewerV1\MediaViewerV1alpha1595\ff
FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Bolek\AppData\Roaming\Mozilla\Firefox\Profiles\30kvh6wb.default\extensions\quick_start@gmail.com
FF HKLM\...\Firefox\Extensions: [ext@MediaViewV1alpha2756.net] - C:\Program Files\MediaViewV1\MediaViewV1alpha2756\ff
FF Extension: No Name - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta660\ff [Not Found]
FF Extension: No Name - C:\Program Files\MediaPlayerV1\MediaPlayerV1alpha503\ff [Not Found]
FF Extension: No Name - C:\Program Files\MediaViewerV1\MediaViewerV1alpha1595\ff [Not Found]
FF Extension: No Name - C:\Program Files\MediaViewV1\MediaViewV1alpha2756\ff [Not Found]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
CHR Extension: (Media View) - C:\Users\Bolek\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\mikmmnnoheolklggnajcfflecjdfchga [2014-06-28]
CHR Extension: (Video Player) - C:\Users\Bolek\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\oejjbmgafckaophpmaojejnckjeoghfk [2014-06-28]
CHR Extension: (Gmail) - C:\Users\Bolek\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-28]
CHR HKLM\...\Chrome\Extension: [eeinimombkaenoojgccmcagddckcnene] - C:\Program Files\MediaViewerV1\MediaViewerV1alpha1595\ch\MediaViewerV1alpha1595.crx []
CHR HKLM\...\Chrome\Extension: [fnelgfmpooffemibikhmcklfnnimgijo] - C:\Users\ddwwaa\AppData\Local\CRE\fnelgfmpooffemibikhmcklfnnimgijo.crx []
CHR HKLM\...\Chrome\Extension: [ieakfmpjhljbpbfpldjkddkjmmgjmgon] - C:\Program Files\WebConnect\ieakfmpjhljbpbfpldjkddkjmmgjmgon.crx []
CHR HKLM\...\Chrome\Extension: [mikmmnnoheolklggnajcfflecjdfchga] - C:\Program Files\MediaViewV1\MediaViewV1alpha2756\ch\MediaViewV1alpha2756.crx []
CHR HKLM\...\Chrome\Extension: [oejjbmgafckaophpmaojejnckjeoghfk] - C:\Program Files\VideoPlayerV3\VideoPlayerV3beta660\ch\VideoPlayerV3beta660.crx []
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 appstoreService; C:\Program Files\iSafe\appstore\appstoreSvc.exe [12464 2014-07-18] (TODO: <Company name>)
R2 iSafeService; C:\Program Files\iSafe\iSafeSvc.exe [118048 2014-07-25] (Elex do Brasil Participações Ltda)
R2 scan; C:\Users\Bolek\common\scan.dll [480368 2014-03-04] (Bitdefender)
S2 916e5338; "C:\Windows\system32\rundll32.exe" "c:\progra~1\WSSvc.dll",service
S2 ABConfSV; C:\Users\Bolek\common\arcaconfsv.exe [X]
S2 AVTasks2; C:\Users\Bolek\common\arcatasksservice.exe [X]
R1 iSafeKrnl; C:\Program Files\iSafe\iSafeKrnl.sys [214592 2014-07-25] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [40768 2014-07-25] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files\iSafe\iSafeKrnlKit.sys [68288 2014-07-25] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files\iSafe\iSafeKrnlR3.sys [37696 2014-07-25] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Program Files\iSafe\iSafeNetFilter.sys [40280 2014-07-09] (Elex do Brasil Participações Ltda) [File not signed]
R1 {664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w; C:\Windows\System32\drivers\{664f7cae-01d9-48b5-bc90-e3c3d6bb0ddb}w.sys [52936 2014-04-24] (StdLib)
S3 ABWFP; \??\C:\Users\Bolek\ArcaVir\ABWFP.sys [X]
S0 amdxata; system32\drivers\amdxata.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 NVFLASH; \??\C:\Windows\system32\drivers\nvflash.sys [X]
S3 NvStreamKms; \??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [X]
S3 vtany; \??\C:\Windows\vtany.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
2014-10-08 17:27 - 2014-10-08 17:28 - 00000000 ____D () C:\Users\Bolek\AppData\Roaming\Systweak
2014-10-08 17:27 - 2014-10-08 17:27 - 00753704 _____ ( ) C:\Users\Bolek\Desktop\pobierz-uTorrent.exe
2014-10-08 17:26 - 2014-10-08 17:27 - 00753704 _____ ( ) C:\Users\Bolek\Downloads\pobierz-uTorrent.exe
2014-10-18 01:03 - 2014-08-02 23:28 - 00000000 ____D () C:\Program Files\iSafe
2014-10-18 01:01 - 2014-01-30 23:43 - 00000428 ____H () C:\Windows\Tasks\WS.Enabler-S-71009536.job
2014-10-18 01:01 - 2013-12-27 19:06 - 00000444 ____H () C:\Windows\Tasks\GS.Enabler-S-4560858878.job
2014-10-14 19:57 - 2014-08-02 23:28 - 00000000 ____D () C:\Users\Bolek\AppData\Roaming\iSafe
2014-10-10 17:16 - 2014-09-05 15:44 - 00000000 ____D () C:\Users\Bolek\AppData\Roaming\sY50fjAZ
EmptyTemp:
W FRST wybierz Fix.
Zrob pelny skan przy pomocy Mbam:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
oraz
http://ftp.drweb.com/pub/drweb/cureit/launch.exe
Po wykonaniu daj nowe logi z FRST, ze skanowania.