Miales uzyc AdwCleaner PRZED wykonaniem skanowania przy pomocy FRST.
Odinstaluj:
AutocompletePro (HKLM-x32\...\AutocompletePro3_is1) (Version: - ) <==== ATTENTION
BitTorrentBar Toolbar (HKLM-x32\...\BitTorrentBar Toolbar) (Version: 6.2.2.4 - BitTorrentBar)
Conduit Engine (HKLM-x32\...\conduitEngine) (Version: - Conduit Ltd.) <==== ATTENTION
IePluginService12.27.0.3326 (HKLM-x32\...\IePlugins) (Version: 12.27.0.3326 - Cherished Technololgy LIMITED) <==== ATTENTION
Updater Service (HKLM-x32\...\Updater Service) (Version: 15,9,28,27 - ) <==== ATTENTION
vShare.tv plugin 1.3 (HKLM-x32\...\vShare.tv plugin) (Version: 1.3 - vShare.tv, Inc.) <==== ATTENTION
WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.82 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION
YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== ATTENTION
Obok frst.exe utworz plik fixlist.txt z zawartoscia:
Task: {08CA861C-3A55-446F-A114-F77822B23BBF} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ATTENTION
Task: {4233759C-AD22-4183-ADCF-E62D2234B8A6} - System32\Tasks\Searchya => C:\Users\R590\AppData\Roaming\Searchya\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {49237614-0290-47A9-9CFF-36F1B5A1C624} - System32\Tasks\{8F7CC360-1F5F-4147-9155-A440D6D4624F} => Firefox.exe
Task: {D4F2775F-2B7E-4051-A696-3A7511B88A89} - System32\Tasks\{3BF58710-493D-407E-975A-D2876BA8B6E3} => Firefox.exe
Task: C:\windows\Tasks\Searchya.job => C:\Users\R590\AppData\Roaming\Searchya\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
HKU\S-1-5-21-885473801-1135821649-2530607942-1000\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.delta-homes.com/?type=hp&ts=13...d=WDCXWD5000BEVT-35A0RT0_WD-WXE1A40F6281F6281
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
http://www.delta-homes.com/?type=hp&ts=13...d=WDCXWD5000BEVT-35A0RT0_WD-WXE1A40F6281F6281
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.delta-homes.com/?type=hp&ts=13...d=WDCXWD5000BEVT-35A0RT0_WD-WXE1A40F6281F6281
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.delta-homes.com/?type=hp&ts=13...d=WDCXWD5000BEVT-35A0RT0_WD-WXE1A40F6281F6281
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
HKU\S-1-5-21-885473801-1135821649-2530607942-1000\Software\Microsoft\Internet Explorer\Main,Search Page =
http://search.delta-homes.com/web/?utm_source...281&ts=1393428191&type=default&q= {searchTerms}
HKU\S-1-5-21-885473801-1135821649-2530607942-1000\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.searchalgo.com/?cid=4151
HKU\S-1-5-21-885473801-1135821649-2530607942-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.delta-homes.com/?type=hp&ts=13...d=WDCXWD5000BEVT-35A0RT0_WD-WXE1A40F6281F6281
HKU\S-1-5-21-885473801-1135821649-2530607942-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://search.delta-homes.com/web/?utm_source...281&ts=1393428191&type=default&q= {searchTerms}
URLSearchHook: HKLM-x32 - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\tbBitT.dll No File
URLSearchHook: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\tbBitT.dll No File
URLSearchHook: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 - (No Name) - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No File
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
SearchScopes: HKLM -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
http://www.searchya.com/?q= {searchTerms}&f=4&a=syd72&cd=2XzuyEtN2Y1L1QzutDtDtByEyDyE0AyDzytAyB0EtDzyyB0CtN0D0Tzu0CyDzztCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu0D1F1S1C1P0P1C1F1N1C1T1H2UtF1E1I1V0P0R0OtCtDtD&cr=1205478504&ir=
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://search.delta-homes.com/web/?type=ds&am...D5000BEVT-35A0RT0_WD-WXE1A40F6281F6281&q= {searchTerms}
SearchScopes: HKLM-x32 -> {3541C4DE-1D7F-D7F6-A968-795317832DC7} URL =
http://search.conduit.com/ResultsExt.aspx?q= {searchTerms}&SearchSource=4&ctid=CT2790392
SearchScopes: HKLM-x32 -> {9B8E6BD2-332A-4B07-9FDA-5252738F3070} URL =
http://www.google.com/search?sourceid=ie7&q= {searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
http://www.searchya.com/?q= {searchTerms}&f=4&a=syd72&cd=2XzuyEtN2Y1L1QzutDtDtByEyDyE0AyDzytAyB0EtDzyyB0CtN0D0Tzu0CyDzztCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu0D1F1S1C1P0P1C1F1N1C1T1H2UtF1E1I1V0P0R0OtCtDtD&cr=1205478504&ir=
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> DefaultScope {a8177b71-ee19-4e0f-b2f9-02d533eb946D} URL =
http://www.searchalgo.com/search.html?q= {searchTerms}&cid=4151
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
http://www.searchya.com/?q= {searchTerms}&f=4&a=syd72&cd=2XzuyEtN2Y1L1QzutDtDtByEyDyE0AyDzytAyB0EtDzyyB0CtN0D0Tzu0CyDzztCtN1L2XzutBtFtBtFyEtFyBtAtCtN1L1Czu0D1F1S1C1P0P1C1F1N1C1T1H2UtF1E1I1V0P0R0OtCtDtD&cr=1205478504&ir=
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
http://www1.delta-search.com/?q= {searchTerms}&babsrc=SP_ss&mntrId=005A000B6B7C7443&affID=119357&tt=110713_91114&tsp=4942
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
http://search.delta-homes.com/web/?utm_source...281&ts=1393428191&type=default&q= {searchTerms}
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
http://startsear.ch/?aff=1&q= {searchTerms}
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {86050036-471C-4B65-98A2-BA9DEFBB6542} URL =
http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q= {searchTerms}&locale=en_US&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^PL&apn_uid=09541B16-AAE4-4912-A211-FE71739488D9&apn_sauid=7D29DDF3-BEA2-4E93-8A90-3FC66233C150
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {9B8E6BD2-332A-4B07-9FDA-5252738F3070} URL =
http://www.google.com/search?sourceid=ie7&q= {searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_pl___PL395
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {a8177b71-ee19-4e0f-b2f9-02d533eb946D} URL =
http://www.searchalgo.com/search.html?q= {searchTerms}&cid=4151
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL =
http://www.daemon-search.com/search/web?q= {searchTerms}
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL =
http://search.conduit.com/ResultsExt.aspx?q= {searchTerms}&SearchSource=4&ctid=CT2790392
SearchScopes: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL =
http://mystart.incredimail.com/mb68/?search= {searchTerms}&loc=search_box&u=92541870456983422
BHO-x32: Conduit Engine -> {30F9B915-B755-4826-820B-08FBA6BD249D} -> C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll No File
BHO-x32: SaveSense -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} -> C:\Users\R590\AppData\Local\SaveSense\SaveSenseIE.dll No File
BHO-x32: IE5BarLauncherBHO Class -> {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} -> C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
BHO-x32: BitTorrentBar Toolbar -> {88c7f2aa-f93f-432c-8f0e-b7d85967a527} -> C:\Program Files (x86)\BitTorrentBar\tbBitT.dll No File
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM-x32 - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\tbBitT.dll No File
Toolbar: HKLM-x32 - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll No File
Toolbar: HKLM-x32 - VShareToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (VShare Inc.)
Toolbar: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll No File
Toolbar: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> No Name - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
Toolbar: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> No Name - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
Toolbar: HKU\S-1-5-21-885473801-1135821649-2530607942-1000 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
FF Plugin-x32:
@TOOLS .updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin-x32:
@TOOLS .updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-885473801-1135821649-2530607942-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Trials Evolution Gold Edition\datapack\orbit\npuplaypc.dll No File
FF HKLM-x32\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\R590\AppData\Roaming\Mozilla\Firefox\Profiles\qkipplz2.default\extensions\quick_start@gmail.com
CHR Extension: (Save Sense - Shop & Travel) - C:\Users\R590\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlfekbihalclhgcbbdggcnjagkgflgkd [2014-01-21]
CHR HKLM-x32\...\Chrome\Extension: [defdhglnppeioeflggkmglipcecffkhk] - C:\Program Files (x86)\AutocompletePro\chrome\autocompleteprochrome.crx [2010-11-03]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files (x86)\vShare.tv plugin\vshareplg.crx [2011-08-09]
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [120128 2015-01-09] (Elex do Brasil Participações Ltda)
S2 MaintainerSvc2.60.0411857; "C:\ProgramData\4c0f6683-2f83-421e-8410-9d669d28d41d\maintainer.exe" [X]
S2 Update PortalMore; "C:\Program Files (x86)\PortalMore\updatePortalMore.exe" [X]
S2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [X] <==== ATTENTION
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2015-01-09] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2015-01-09] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2015-01-09] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [42152 2015-01-09] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [93352 2015-01-09] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-01-03] (Elex do Brasil Participações Ltda)
R1 {169497b9-55ad-4428-8f84-60e3161c1843}w64; C:\Windows\System32\drivers\{169497b9-55ad-4428-8f84-60e3161c1843}w64.sys [48784 2014-11-08] (StdLib)
R1 {9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64; C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys [61112 2014-05-07] (StdLib)
U3 ar9mf2jn; C:\Windows\System32\Drivers\ar9mf2jn.sys [0 ] (Intel Corporation) <==== ATTENTION (zero size file/folder)
S2 BTSERIAL; \??\C:\windows\system32\drivers\btserial.sys [X]
S3 btwampfl; system32\drivers\btwampfl.sys [X]
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [X]
2015-01-16 11:22 - 2015-01-16 11:23 - 00000000 ____D () C:\FRST
2015-01-16 11:11 - 2015-01-16 11:13 - 00000000 ____D () C:\AdwCleaner
2015-01-09 17:19 - 2015-01-09 17:19 - 00000000 ____D () C:\Users\R590\AppData\Roaming\Elex-tech
2015-01-09 17:19 - 2015-01-09 17:19 - 00000000 ____D () C:\Program Files (x86)\Elex-tech
2015-01-09 17:19 - 2015-01-09 11:10 - 00045224 _____ (Elex do Brasil Participações Ltda) C:\windows\system32\Drivers\iSafeKrnlBoot.sys
2015-01-09 17:19 - 2015-01-03 09:57 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\windows\system32\Drivers\iSafeNetFilter.sys
2015-01-13 20:47 - 2014-02-26 16:23 - 00000000 ____D () C:\Program Files (x86)\WinZipper
2015-01-13 20:47 - 2010-11-21 10:04 - 00000000 ____D () C:\Program Files (x86)\ConduitEngine
2015-01-13 20:47 - 2010-11-21 10:04 - 00000000 ____D () C:\Program Files (x86)\BitTorrentBar
2015-01-13 20:47 - 2010-11-03 18:08 - 00000000 ____D () C:\Program Files (x86)\AutocompletePro
2015-01-13 17:32 - 2014-11-08 21:19 - 00000000 ____D () C:\ProgramData\SettingsGuard
2015-01-13 17:32 - 2014-02-26 16:23 - 00000000 ____D () C:\Users\R590\AppData\Roaming\SupTab
2015-01-13 17:32 - 2014-02-26 16:23 - 00000000 ____D () C:\ProgramData\IePluginService
2015-01-13 17:32 - 2014-01-21 10:07 - 00000000 ____D () C:\Users\R590\AppData\Local\SaveSense
2015-01-09 16:47 - 2014-02-26 16:23 - 00000000 ____D () C:\Users\R590\AppData\Roaming\WinZipper
EmptyTemp:
W FRST wybierz Fix. Po wykonaniu usun katalog C:\FRST.
Zrob skan przy pomocy:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
Usun to co wykryje.
Po wykonaniu WSZYSTKIEGO w takiej kolejnosci jak podalem, daj nowe logi z FRST ze skanowania.