Elektroda.pl
Elektroda.pl
X
Proszę, dodaj wyjątek www.elektroda.pl do Adblock.
Dzięki temu, że oglądasz reklamy, wspierasz portal i użytkowników.

Samoczynnie wyskakujące reklamy oraz otwierające się okna.

ad81 10 Paź 2015 22:42 996 4
  • #1 10 Paź 2015 22:42
    ad81
    Poziom 2  

    Witam, tak jak w temacie wyskakujące reklamy i otwierające się strony.

    0 4
  • #2 10 Paź 2015 23:36
    Kolobos
    Spec od komputerów

    @ad81 wymagane sa logi z FRST, a nie jeden log z OTL.

    Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun: https://toolslib.net/downloads/viewdownload/1-adwcleaner/

    Daj w zalaczniku logi z FRST (Frst.txt oraz Addition.txt):
    http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/

    @Tomcio_12 Wyjasnij w jaki sposob adblock pomoze w przypadku zainfekowanego komputera? Do tego zapoznaj sie z: http://sjp.pwn.pl/sjp/pomoc;2504362.html

    0
  • #4 11 Paź 2015 10:14
    Acorus 20
    Spec od komputerów

    Odinstaluj Download Updater, GamesDesktop 008.005010101, MyBestOffersToday 008.014010099, Performance Optimizer, PhraseProfessor 1.10.0.24, SpyHunter, WebCake 3.00, YAC(Yet Another Cleaner!). Pobierz i uruchom jako administrator AdwCleaner https://toolslib.net/downloads/finish/1/ Kliknij Scan i później Cleaning.
    Pokaż nowe logi z FRST.

    0
  • #5 11 Paź 2015 10:25
    Kolobos
    Spec od komputerów

    Odinstaluj:
    Download Updater (AOL LLC) (HKLM-x32\...\SoftwareUpdUtility) (Version: - ) <==== UWAGA
    GamesDesktop 008.005010101 (HKLM-x32\...\gmsd_pl_005010101_is1) (Version: - GAMESDESKTOP) <==== UWAGA
    MyBestOffersToday 008.014010099 (HKLM-x32\...\mbot_pl_014010099_is1) (Version: - MYBESTOFFERSTODAY) <==== UWAGA
    Performance Optimizer (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{892cc6a3}) (Version: - GTgroup) <==== UWAGA
    PhraseProfessor 1.10.0.24 (HKLM-x32\...\PhraseProfessor_1.10.0.24) (Version: 1.10.0.24 - PhraseProfessor) <==== UWAGA
    SpyHunter (HKLM-x32\...\{46B04D53-4E34-4388-B6EE-80FAB66AEF9B}) (Version: 4.12.13.4202 - Enigma Software Group USA, LLC)
    WebCake 3.00 (HKLM\...\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}) (Version: 3.00 - WebCake LLC) <==== UWAGA
    YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version: - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== UWAGA


    Obok frst.exe utworz plik fixlist.txt z zawartoscia:
    Task: {0517A19C-277D-43F6-A679-A082605BA5D7} - System32\Tasks\SmartWeb Upgrade Trigger Task => C:\Users\Przemysław\AppData\Local\SmartWeb\SmartWebHelper.exe <==== UWAGA
    Task: {1116F6FB-3BE2-4819-8735-37272863B2AE} - System32\Tasks\WordWizard Auto Updater 1.10.0.24 Pending Update => C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe [2015-09-02] (WordWizard)
    Task: {1FF32278-1353-40C2-9045-A4A20163C630} - System32\Tasks\WordWizard Auto Updater 1.10.0.24 Core => C:\Program Files (x86)\WordWizard_1.10.0.24\Update\WordwizardAutoUpdateClient.exe [2015-09-02] (WordWizard)
    Task: {2523EAE2-7AC1-486E-8E19-3B2A02D4A172} - System32\Tasks\{68A2AC6D-4E1C-4820-A38E-6350EB8B3B50} => pcalua.exe -a "D:\Programy\Netfabb odtwarzacz\netfabb\netfabbUninstaller.exe"
    Task: {28574AF3-EF71-4714-923E-45EB25E73EBE} - System32\Tasks\FCBfan => C:\Users\Przemysław\AppData\Roaming\FCBfan\fcbfan.exe
    Task: {32934623-8BDC-4472-B6CF-87B26A806129} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-09-29] (AnyProtect.com) <==== UWAGA
    Task: {3D6B7206-56D4-46E1-8DFD-27FAA2C6F02A} - System32\Tasks\ShdUpdate => C:\Users\Przemysław\AppData\Local\ShdUpdate\shupd.exe [2015-08-16] (Visual Tools)
    Task: {5CE27A3A-0752-485D-90B0-798B8290D194} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-09-29] (AnyProtect.com) <==== UWAGA
    Task: {5DA9D3A1-AD66-4A5F-A333-FF06A3DA8D71} - System32\Tasks\EPUpdater => C:\Users\Przemysław\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-06-06] () <==== UWAGA
    Task: {7408E7E3-88F3-4984-B6D2-D619436B5BB4} - System32\Tasks\SpyHunter4Startup => C:\Program Files (x86)\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-09-29] (Enigma Software Group USA, LLC.)
    Task: {74542E69-E104-4A5C-A741-FFBC5ABE11EE} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-09-29] (AnyProtect.com) <==== UWAGA




    Task: {754CE05C-48B1-41B2-95EE-D1AEFBEFBA3C} - System32\Tasks\{08BC39FD-9ACD-4A87-93DF-CB9CB81F1D5E} => pcalua.exe -a C:\ProgramData\DeleteAd\DeleteAd.exe -c /progname=DeleteAd /progver=3.4.2 /progpub=DeleteAd /proguninstallurl=asdahjka.com /deleteappfolder=0 /deletefile1="C:\Users\Przemysław\AppData\Roaming\appdataFr2.bin" /VERYSILENT
    Task: {CB2DE8DE-D0B2-4FDF-B527-AB5714659AA3} - System32\Tasks\{A2742D6C-2A92-4AD3-926B-69F34413E6D1} => pcalua.exe -a "C:\Program Files (x86)\sweetpacks bundle uninstaller\uninstaller.exe" -c "/appName=SweetIM Bundle by SweetPacks"
    Task: {DF52F467-5323-49D6-894E-9FFAE568C1A2} - System32\Tasks\AmiUpdXp => C:\Users\Przemysław\AppData\Local\8173\Updater.exe [2015-09-29] () <==== UWAGA
    Task: C:\windows\Tasks\AmiUpdXp.job => C:\Users\Przemysław\AppData\Local\8173\Updater.exe <==== UWAGA
    Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
    Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
    Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
    Task: C:\windows\Tasks\PhraseProfessor Auto Updater 1.10.0.24 Core.job => C:\Program Files (x86)\PhraseProfessor_1.10.0.24\Update\PhraseProfessorAutoUpdateClient.exe <==== UWAGA
    () C:\Users\Beata\AppData\Local\Crsoft\crsvc.exe
    () C:\Users\Beata\AppData\Roaming\NetService\netservice.exe
    () C:\Program Files\Web Amplified\bin\utilWebAmplified.exe
    () C:\Program Files\Web Amplified\bin\WebAmplified.PurBrowse.exe
    () C:\Program Files\Web Amplified\bin\WebAmplified.expext.exe
    () C:\Program Files\Web Amplified\bin\WebAmplified.BrowserAdapter.exe
    () C:\Program Files\Web Amplified\updateWebAmplified.exe
    GroupPolicy: Ograniczenia - Chrome <======= UWAGA
    CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.aqovd.com?oem=sunadplv3&uid=104b1a9b_HBG4e&tm=1444236639
    HKU\S-1-5-21-1176898781-1678282298-494040993-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.aqovd.com?oem=sunadplv3&uid=104b1a9b_HBG4e&tm=1444236639
    BHO: Web Amplified 1.0.0.7 -> {4f93c386-c677-4212-9bc8-47814de68c52} -> C:\Program Files\Web Amplified\WebAmplifiedbho.dll [2015-10-01] (Web Amplified)
    Edge HomeButtonPage: HKU\S-1-5-21-1176898781-1678282298-494040993-1001 -> hxxp://www.oursurfing.com/?type=hp&ts=144...p;from=amt&uid=3219913727_198264_d0189f64
    FF HKLM\...\Firefox\Extensions: [{059C69EC-324F-4C02-8F08-D4FECA1E5614}] - C:\Program Files\shopperz071020151013\Firefox => nie znaleziono
    CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=...p;from=cmi&uid=3219913727_198264_D0189F64
    CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1444229738&z=aa89fc9186b8852d69aaee8g0zazezeo0o1t0w5o1o&from=cmi&uid=3219913727_198264_D0189F64"
    CHR Extension: (dheionainndbbpoacpnopgmnihkcmnkl) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\dheionainndbbpoacpnopgmnihkcmnkl [2015-10-10]
    CHR Extension: (Reloadie) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\fijhlnmmmgflacagjecncpmpnhjieggk [2015-10-11]
    CHR Extension: (Widthie) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\gegdfeiahlfolhcfioipjlkombmgbakh [2015-10-10]
    CHR Extension: (EasyCalendar) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcgcoifbkbphhjnekfkmohklfaimhikk [2015-10-11]
    CHR Extension: (Bleaner) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-10-11]
    3]
    CHR Extension: (Search People) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-10-11]
    CHR Extension: (pnjaodmkngahhkoihejjehlcdlnohgmp) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnjaodmkngahhkoihejjehlcdlnohgmp [2015-10-10]
    R2 Crashhd; C:\Users\Beata\AppData\Local\Crsoft\crsvc.exe [185800 2015-09-25] ()
    R2 NetTcpHandler; C:\Users\Beata\AppData\Roaming\NetService\netservice.exe [173088 2015-07-09] ()
    R2 Update Web Amplified; C:\Program Files\Web Amplified\updateWebAmplified.exe [464120 2015-10-11] ()
    R2 Util Web Amplified; C:\Program Files\Web Amplified\bin\utilWebAmplified.exe [464120 2015-10-11] ()
    R1 {b666938f-73a7-45e6-be3c-578b46fc5b7e}Gw; C:\WINDOWS\System32\drivers\{b666938f-73a7-45e6-be3c-578b46fc5b7e}Gw.sys [43152 2015-10-10] (StdLib)
    S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
    S1 {6939a927-ce62-4a88-a27a-fd77343fd696}Gw; system32\drivers\{6939a927-ce62-4a88-a27a-fd77343fd696}Gw.sys [X]
    S1 {b4e11afe-4c35-4044-965f-6641cc18f62e}Gw; system32\drivers\{b4e11afe-4c35-4044-965f-6641cc18f62e}Gw.sys [X]
    S1 {f4191bb0-3007-4fbd-b83f-cc45648f3845}Gw; system32\drivers\{f4191bb0-3007-4fbd-b83f-cc45648f3845}Gw.sys [X]
    2015-10-10 22:43 - 2015-10-10 22:43 - 00225598 _____ C:\Users\Beata\Downloads\OTL (1).Txt
    2015-10-10 21:48 - 2015-10-10 23:57 - 00043152 _____ (StdLib) C:\WINDOWS\system32\Drivers\{b666938f-73a7-45e6-be3c-578b46fc5b7e}Gw.sys
    2015-10-10 21:41 - 2015-10-11 09:14 - 00000000 ____D C:\AdwCleaner
    2015-10-10 21:09 - 2015-10-11 09:16 - 00001016 _____ C:\WINDOWS\Tasks\n5FPaftRWuGJ.job
    2015-10-10 20:58 - 2015-10-11 09:16 - 00001018 _____ C:\WINDOWS\Tasks\VzKJXwNwlg3JE.job
    2015-10-10 14:18 - 2015-10-11 09:16 - 00001036 _____ C:\WINDOWS\Tasks\sNCom1ypxxEiQuxoM0Dsj6.job
    2015-10-10 14:15 - 2015-10-10 14:15 - 00000000 ____D C:\Program Files\8fa9c6c1-37c0-4027-bb89-20433c8ab86a
    2015-10-09 18:11 - 2015-10-11 09:16 - 00001028 _____ C:\WINDOWS\Tasks\RQFwFcppAt3Q2RHOGS.job
    2015-10-09 17:54 - 2015-10-11 09:16 - 00001020 _____ C:\WINDOWS\Tasks\1l7Fw5gBjdyTaW.job
    2015-10-09 17:53 - 2015-10-09 17:53 - 00000000 ____D C:\Program Files\4a184016-332a-473e-9209-a9db2844cb41
    2015-10-09 13:02 - 2015-10-11 09:16 - 00001032 _____ C:\WINDOWS\Tasks\RE0QnjzM8yHru0aH6bDY.job
    2015-10-08 20:24 - 2015-10-11 09:16 - 00001042 _____ C:\WINDOWS\Tasks\wAN98bNpNIfN5Rx1oSnECMPTo.job
    2015-10-08 20:23 - 2015-10-08 20:23 - 00000000 ____D C:\Program Files\c272be0b-11e1-4d77-bf62-6338b4916b4e
    2015-10-08 14:54 - 2015-10-11 09:16 - 00001026 _____ C:\WINDOWS\Tasks\8uAZwCp0VRi12H6IA.job
    2015-10-08 14:53 - 2015-10-08 14:53 - 00000000 ____D C:\Program Files\ae958e1b-3c48-4edc-a9e3-4fa790f06969
    2015-10-08 00:12 - 2015-10-11 09:16 - 00001012 _____ C:\WINDOWS\Tasks\Y2d4p1TOlb.job
    2015-10-08 00:11 - 2015-10-08 00:11 - 00000000 ____D C:\Program Files\6adc74eb-7639-4310-b049-6d8ae3a80301
    2015-10-07 23:39 - 2015-10-11 09:16 - 00001026 _____ C:\WINDOWS\Tasks\mDvyHefw5cHFw9JZI.job
    2015-10-07 23:32 - 2015-10-07 23:32 - 00333506 _____ (AnySend.com) C:\Users\Beata\AppData\Local\nspDC4E.tmp
    2015-10-07 20:13 - 2015-10-11 09:16 - 00000000 ____D C:\Program Files\Web Amplified
    2015-10-07 20:13 - 2015-10-07 20:13 - 00000296 _____ C:\task.vbs
    2015-10-07 19:22 - 2015-10-07 23:34 - 00004672 _____ C:\WINDOWS\system32\Diixexeqw.ini
    2015-10-07 19:22 - 2015-10-07 23:34 - 00002384 _____ C:\WINDOWS\system32\DiixexeqwOff.ini
    2015-10-07 19:22 - 2015-10-07 23:12 - 00000000 ____D C:\Users\Beata\AppData\Local\Tempfolder
    2015-10-07 19:22 - 2015-10-07 09:15 - 00283464 _____ C:\WINDOWS\system32\Diixexeqw.dll
    2015-10-07 19:21 - 2015-10-07 23:11 - 00000045 _____ C:\user.js
    2015-10-07 19:21 - 2015-10-07 19:21 - 00000000 ____D C:\Users\Beata\AppData\LocalLow\Company
    2015-10-07 19:21 - 2015-09-24 11:46 - 00047520 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\Drivers\cherimoya.sys
    2015-10-07 18:50 - 2015-10-07 18:50 - 00000266 __RSH C:\ProgramData\ntuser.pol
    2015-10-07 18:50 - 2015-10-07 18:50 - 00000000 ____D C:\Users\Beata\AppData\Roaming\shortCutStore
    2015-10-07 18:50 - 2015-10-07 18:50 - 00000000 ____D C:\Users\Beata\AppData\Local\Crsoft
    2015-10-07 17:13 - 2015-10-11 09:16 - 00001040 _____ C:\WINDOWS\Tasks\4LhTlIHPLx6cwbmGfoPTW5AY.job
    2015-10-07 17:10 - 2015-10-07 17:10 - 00000000 ____D C:\Users\Beata\AppData\Local\MyBrowser
    2015-10-07 17:10 - 2015-10-07 17:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyBrowser
    2015-10-07 16:57 - 2015-10-11 09:16 - 00001006 _____ C:\WINDOWS\Tasks\y9Y2B2B.job
    2015-10-07 16:48 - 2015-10-07 16:48 - 00000000 _____ C:\ProgramData\inf.dat
    2015-10-07 16:46 - 2015-10-10 23:30 - 00000458 _____ C:\WINDOWS\Tasks\Adobe Flash box Files Update Ver 2015107.job
    2015-10-07 16:46 - 2015-10-07 16:47 - 00000000 ____D C:\ProgramData\adb
    2015-10-07 16:46 - 2015-10-07 16:46 - 00000000 ____D C:\ProgramData\4997GameBox_Data
    2015-10-07 16:44 - 2015-10-07 16:44 - 00000000 ____D C:\Users\Public\QiYi
    2015-10-07 16:42 - 2015-10-07 20:48 - 00000000 ____D C:\Program Files\baidu
    2015-10-07 16:42 - 2013-08-22 08:13 - 00000824 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
    2015-10-07 16:39 - 2015-10-07 16:39 - 00000000 ____D C:\Users\Beata\AppData\Local\CrashRpt
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\1l7Fw5gBjdyTaW
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\1l7Fw5gBjdyTaW.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\4LhTlIHPLx6cwbmGfoPTW5AY
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\4LhTlIHPLx6cwbmGfoPTW5AY.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\8uAZwCp0VRi12H6IA
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\8uAZwCp0VRi12H6IA.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\mDvyHefw5cHFw9JZI
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\mDvyHefw5cHFw9JZI.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\n5FPaftRWuGJ
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\n5FPaftRWuGJ.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\RE0QnjzM8yHru0aH6bDY
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\RE0QnjzM8yHru0aH6bDY.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\RQFwFcppAt3Q2RHOGS
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\RQFwFcppAt3Q2RHOGS.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\sNCom1ypxxEiQuxoM0Dsj6
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\sNCom1ypxxEiQuxoM0Dsj6.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\VzKJXwNwlg3JE
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\VzKJXwNwlg3JE.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\wAN98bNpNIfN5Rx1oSnECMPTo
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\wAN98bNpNIfN5Rx1oSnECMPTo.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\Y2d4p1TOlb
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\Y2d4p1TOlb.exe
    2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Beata\AppData\Roaming\y9Y2B2B
    2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Beata\AppData\Roaming\y9Y2B2B.exe
    2015-10-07 23:32 - 2015-10-07 23:32 - 0333506 _____ (AnySend.com) C:\Users\Beata\AppData\Local\nspDC4E.tmp
    C:\ProgramData\inf.dat
    C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
    EmptyTemp:

    W FRST wybierz Napraw.

    Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
    http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

    Po wykonaniu daj nowe logi z FRST, ze skanowania.

    0