Elektroda.pl
Elektroda.pl
X
CControls
Proszę, dodaj wyjątek www.elektroda.pl do Adblock.
Dzięki temu, że oglądasz reklamy, wspierasz portal i użytkowników.

Logi do usunięcia reklamiarza

fredk 19 Paź 2015 17:04 732 8
  • CControls
  • Pomocny post
    #2 19 Paź 2015 17:07
    Kolobos
    Spec od komputerów

    OTL jest zbedny, za to addition.txt jest wymagany!

    0
  • CControls
  • Pomocny post
    #4 19 Paź 2015 18:42
    Acorus 20
    Spec od komputerów

    Odinstaluj Adobe Reader 9.1, Akamai NetSession Interface, High Stairs, istartsurf, WordFly 1.10.0.25. Otwórz notatnik systemowy i wklej:

    Cytat:
    Task: {4E9D56E7-7F13-4887-AB15-27FA2E731F00} - System32\Tasks\WarThunder sun => Chrome.exe --app=hxxp://mmotraffic.com/catalog/goplay/1000932/MTE3NjYvLy8xMDAwOTMy/ --app-window-size=1366,768
    Task: {854779EB-88D0-4837-8885-7BAB78FCE179} - System32\Tasks\WarThunder sat => Chrome.exe --app=hxxp://mmotraffic.com/catalog/goplay/1000932/MTE3NjYvLy8xMDAwOTMy/ --app-window-size=1366,768
    Task: {ADE4B32E-35B6-4235-83BC-2F549CE64503} - System32\Tasks\WarThunder24 => Chrome.exe --app=hxxp://mmotraffic.com/catalog/goplay/1000932/MTE3NjYvLy8xMDAwOTMy/ --app-window-size=1366,768
    Task: {BE1A614E-F97D-4F37-A12E-1C93F393C8DD} - System32\Tasks\WordFly Auto Updater 1.10.0.25 Pending Update => C:\Program Files\WordFly_1.10.0.25\Update\WordflyAutoUpdateClient.exe [2015-09-30] (WF)
    Task: {E3C256A6-0FCD-4897-8182-B4A36B7E867A} - System32\Tasks\WordFly Auto Updater 1.10.0.25 Core => C:\Program Files\WordFly_1.10.0.25\Update\WordflyAutoUpdateClient.exe [2015-09-30] (WF)
    HKU\S-1-5-21-4191737361-3551783702-793974025-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Rafał\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
    HKU\S-1-5-21-4191737361-3551783702-793974025-1000\...\MountPoints2: {939a93af-7293-11e5-9b4d-842b2baa86e9} - E:\AutoRun.exe
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    HKU\S-1-5-21-4191737361-3551783702-793974025-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.istartsurf.com/?type=hp&ts=1445099...id=wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181
    HKU\S-1-5-21-4191737361-3551783702-793974025-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
    HKU\S-1-5-21-4191737361-3551783702-793974025-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.istartsurf.com/?type=hp&ts=1445099...id=wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181




    SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4191737361-3551783702-793974025-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-4191737361-3551783702-793974025-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    BHO: High Stairs -> {45e60e41-85ee-4c01-9dac-1ecb9bf64179} -> C:\Program Files\High Stairs\Extensions\45e60e41-85ee-4c01-9dac-1ecb9bf64179.dll [2015-10-18] ()
    CHR HomePage: Default -> hxxp://www.istartsurf.com/?type=hp&ts=1445099...id=wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181
    CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hp&ts=1445099329&z=82a3259c1c818aefac69f49gfz5z4w6e8tatdcfobt&from=cor&uid=wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181"
    CHR DefaultSearchURL: Default -> hxxp://www.istartsurf.com/web/?type=ds&ts=144...wdcxwd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    CHR DefaultSearchKeyword: Default -> istartsurf
    R2 ihpmServer; C:\Program Files\RayDld\ihpmServer.exe [270568 2015-10-12] ()
    R2 Service Mgr HighStairs; C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugincontainer.exe [1047784 2015-10-19] ()
    R2 Update Mgr HighStairs; C:\Program Files\Common Files\b4bc9939-75e9-422b-af5c-653de35c4f4b\updater.exe [610536 2015-10-19] ()
    R2 wfsrvc_1.10.0.25; C:\Program Files\WordFly_1.10.0.25\Service\wfsrvc.exe [301632 2015-09-30] (WF)
    S2 ASInsHelp; \??\C:\Windows\system32\drivers\AsInsHelp32.sys [X]
    2015-10-18 17:46 - 2015-10-18 17:47 - 00000000 ____D C:\Program Files\High Stairs
    2015-10-17 18:29 - 2015-10-17 18:29 - 00000000 ____D C:\Program Files\RayDld
    2015-10-17 18:28 - 2015-10-17 18:29 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\istartsurf
    EmptyTemp:

    Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
    Uruchom jako administrator FRST i kliknij w Fix/Napraw. Pobierz i uruchom jako administrator AdwCleaner https://toolslib.net/downloads/finish/1/ Kliknij Scan i później Cleaning.

    0
  • #5 22 Paź 2015 03:37
    fredk
    Poziom 5  

    Dzięki wielkie. Po problemie. Pozdro!

    0
  • #6 22 Paź 2015 08:46
    Domino_2
    Pomocny dla użytkowników

    Możesz skasować folder C:\FRST.

    0
  • #7 25 Paź 2015 01:02
    fredk
    Poziom 5  

    Wybaczcie, ale zanim zdążyłem się nacieszyć że wszystko ok i uprzedzić by nie wchodzić na strony gdzie jest mozliwosc pobrania reklamiarzy, dziewczyna już od razu przy ściąganiu sterownikow niechcący znów pobrala pełno tego syfu.

    Wysylam logi z terazniejszego stanu kompa i obiecuje ze kolejnym razem juz sie lepiej zabezpiecze.

    Pozdro.

    0
  • Pomocny post
    #8 25 Paź 2015 01:20
    Kolobos
    Spec od komputerów

    Odinstaluj: Dll-Files Fixer

    Fixlist.txt dla FRST:
    Task: {07830B5D-35A6-48C3-81BF-884032528B80} - System32\Tasks\Opera scheduled Autoupdate 1444857265 => C:\Program Files\Opera\launcher.exe [2015-09-17] (Opera Software)
    Task: {0FE60CB8-4C1B-42AB-AE14-E836BD8F485C} - System32\Tasks\DLL-Files.Com Fixer_MONTHLY => C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe [2015-07-09] (Dll-FIles.Com)
    Task: {25A3F196-9577-45F0-8C6C-AB265D58DD0E} - System32\Tasks\RDReminder => C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe [2015-07-09] (Dll-FIles.Com)
    Task: {34531DB8-0A3C-4F9E-A447-D2B8C82C32B8} - System32\Tasks\DLL-Files.Com Fixer_Updates => C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe [2015-07-09] (Dll-FIles.Com)
    Task: C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job => C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe
    Task: C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job => C:\Program Files\Dll-Files.com Fixer\DLLFixer.exe
    () C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\PluginContainer.exe
    () C:\Users\Rafał\AppData\Roaming\Gameo\gameo.exe
    () C:\Program Files\Common Files\b4bc9939-75e9-422b-af5c-653de35c4f4b\Updater.exe
    () C:\Users\Rafał\AppData\Roaming\Gameo\gameo.exe
    () C:\Program Files\RayDld\ihpmServer.exe
    () C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugins\8\Plugin.exe
    () C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugins\12\Plugin.exe
    () C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugins\2\Plugin.exe
    () C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugins\12\Plugin.exe
    HKLM\...\RunOnce: [360safeuninst_f3e1de0f0228c80791add17e8806663b] => C:\Users\RAFA~1\AppData\Local\Temp\f3e1de0f0228c80791add17e8806663b_remove360.bat [597 2015-10-24] () <===== UWAGA
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&...wd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&...wd2500aajs-75m0a0_wd-wmav2dl5118151181&q={searchTerms}
    SearchScopes: HKLM -> DefaultScope - brak wartości
    BHO: High Stairs -> {45e60e41-85ee-4c01-9dac-1ecb9bf64179} -> C:\Program Files\High Stairs\Extensions\45e60e41-85ee-4c01-9dac-1ecb9bf64179.dll [2015-10-24] ()
    R2 ihpmServer; C:\Program Files\RayDld\ihpmServer.exe [270568 2015-10-12] ()
    R2 Service Mgr HighStairs; C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b\plugincontainer.exe [1045736 2015-10-24] ()
    R2 Update Mgr HighStairs; C:\Program Files\Common Files\b4bc9939-75e9-422b-af5c-653de35c4f4b\updater.exe [610024 2015-10-24] ()
    R3 360AvFlt; system32\DRIVERS\360AvFlt.sys [X]
    R3 360Box; system32\DRIVERS\360Box.sys [X]
    2015-10-24 16:31 - 2015-10-24 16:31 - 00000000 ____D C:\Users\Rafał\AppData\LocalLow\360WD
    2015-10-24 16:28 - 2015-10-24 16:28 - 00000000 ___HD C:\Users\Rafał\AppData\Roaming\GoldenGate
    2015-10-24 16:28 - 2015-10-24 16:28 - 00000000 ____D C:\Program Files\RayDld
    2015-10-24 16:27 - 2015-10-24 16:32 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\Gameo
    2015-10-24 16:27 - 2015-10-24 16:29 - 00000000 ____D C:\ProgramData\b4bc9939-75e9-422b-af5c-653de35c4f4b
    2015-10-24 16:27 - 2015-10-24 16:28 - 00000000 ____D C:\Users\Rafał\AppData\Local\Gameo
    2015-10-24 16:27 - 2015-10-24 16:28 - 00000000 ____D C:\Program Files\High Stairs
    2015-10-24 16:27 - 2015-10-24 16:27 - 00000173 _____ C:\Users\Rafał\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url
    2015-10-24 16:27 - 2015-10-24 16:27 - 00000000 ____D C:\Program Files\Common Files\b4bc9939-75e9-422b-af5c-653de35c4f4b
    2015-10-24 16:27 - 2015-10-24 16:27 - 00000000 ____D C:\Program Files\360
    2015-10-24 00:27 - 2015-10-24 16:14 - 00000280 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_Updates.job
    2015-10-24 00:27 - 2015-10-24 16:14 - 00000264 _____ C:\Windows\Tasks\DLL-Files.Com Fixer_MONTHLY.job
    2015-10-24 00:27 - 2015-10-24 00:27 - 05403720 _____ (Dll-Files.com ) C:\Users\Rafał\Downloads\dffsetup-xinput1_3.exe
    2015-10-24 00:27 - 2015-10-24 00:27 - 00001046 _____ C:\Windows\system32\Dll-Files Fixer.lnk
    2015-10-24 00:27 - 2015-10-24 00:27 - 00000000 ____D C:\Users\Rafał\AppData\Roaming\dll-files.com
    2015-10-24 00:27 - 2015-10-24 00:27 - 00000000 ____D C:\ProgramData\TEMP
    2015-10-24 00:27 - 2015-10-24 00:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dll-Files Fixer
    2015-10-24 00:27 - 2015-10-24 00:27 - 00000000 ____D C:\Program Files\Dll-Files.com Fixer
    2015-10-19 21:10 - 2015-10-19 21:11 - 00000000 ____D C:\AdwCleaner
    2015-10-19 16:42 - 2015-10-19 16:42 - 00039694 _____ C:\Users\Rafał\Downloads\Extras.Txt
    2015-10-19 16:33 - 2015-10-19 17:02 - 00281084 _____ C:\Users\Rafał\Downloads\OTL.Txt
    2015-10-19 16:27 - 2015-10-19 16:27 - 00602112 _____ (OldTimer Tools) C:\Users\Rafał\Downloads\OTL.exe
    2015-10-18 17:46 - 2015-10-18 17:46 - 00914088 _____ (Web program ) C:\Users\Rafał\Downloads\AVS-Video-Editor-36779-dp.exe
    C:\Users\RAFA~1\AppData\Local\Temp\f3e1de0f0228c80791add17e8806663b_remove360.bat
    EmptyTemp:

    0
  • #9 25 Paź 2015 13:33
    fredk
    Poziom 5  

    dzieki,
    teraz temat do zamkniecia

    0