Trotux , UCbrowser ciągle wykrywane pomimo usunięcia

Kolobos napisał:

Wymagane sa logi z FRST.

Cytat:

CustomCLSID: HKU\S-1-5-21-4279119922-2032976690-675935974-1001_Classes\CLSID\{E68D0A55-3C40-4712-B90D-DCFA93FF2534}\InprocServer32 -> C:\Users\Sephirot\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll => Brak pliku
Task: {58D3A43B-3A03-450F-BAAF-C0DB4B5D3D5F} - System32\Tasks\UCBrowserUpdaterCore => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-08] (UCWeb Inc) <==== UWAGA
Task: {9BD79347-4635-45F9-9184-14CBF742B246} - System32\Tasks\Opera scheduled Autoupdate 1476268903 => C:\Program Files (x86)\Opera\launcher.exe [2016-09-23] (Opera Software)
Task: {B0D61C52-BD96-4FE5-BE26-CF0E546A451F} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-10-08] (UCWeb Inc) <==== UWAGA
Task: {C16A9C24-1AAE-4C40-9CCD-BDE0D3E2EF62} - System32\Tasks\SecureUpdater => C:\Program Files (x86)\UCBrowser\Application\uclauncher.exe [2016-10-12] (UC Web Inc.) <==== UWAGA
Task: {D5DD2113-650F-4726-A5C5-8674EA758CF8} - System32\Tasks\{B1069130-177A-47F7-9522-8C06ECD2F627} => pcalua.exe -a C:\WINDOWS\st6unst.exe -c -n "J:\GRY\Diablo II\Hero Editor\ST6UNST.LOG"
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== UWAGA
Task: C:\Windows\Tasks\UCBrowserUpdaterCore.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== UWAGA
Shortcut: C:\Users\Sephirot\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Intеrnеt Ехрlоrеr (Nо Аdd-оns).lnk -> C:\Users\Sephirot\AppData\Roaming\HPReyos\ReyosStarter3.exe (Brak pliku) <===== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Моzillа Firеfох.lnk -> C:\Users\Sephirot\AppData\Roaming\HPReyos\ReyosStarter3.exe (Brak pliku) <===== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ореrа 27.lnk -> C:\Users\Sephirot\AppData\Roaming\HPReyos\ReyosStarter3.exe (Brak pliku) <===== Cyrillic
ShortcutWithArgument: C:\Users\Sephirot\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) ->
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll Brak pliku
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => Brak pliku
GroupPolicy: Ograniczenia <======= UWAGA
GroupPolicy\User: Ograniczenia <======= UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-4279119922-2032976690-675935974-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-016&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-016&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4279119922-2032976690-675935974-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-016&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4279119922-2032976690-675935974-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR1&pc=SPLH
SearchScopes: HKU\S-1-5-21-4279119922-2032976690-675935974-1001 -> {260455A2-71A7-4dd9-B556-E8A7E9314FCD} URL = hxxp://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV
SearchScopes: HKU\S-1-5-21-4279119922-2032976690-675935974-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-016&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4279119922-2032976690-675935974-1001 -> {F1D1C754-508C-4b5a-8E87-C3E3AD857427} URL = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A7941509802&ie=UTF-8&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A7941509802&q={searchTerms}
BHO-x32: DIALux Browser Helper Object -> {F586CB96-7091-42ec-9829-F5D5CE65AFC1} -> G:\DIALux 4.12.0.1 Setup\Dialux.BHO_x86.dll => Brak pliku
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Brak pliku
FF ProfilePath: C:\Users\Sephirot\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\9cffzxni.default\Profiles\9cffzxni.default [nie znaleziono]
FF HKLM-x32\...\Firefox\Extensions: [support@vdownloader.com] - C:\Program Files\VDownloader\Addons\FireFox => nie znaleziono
FF HKU\S-1-5-21-4279119922-2032976690-675935974-1001\...\Firefox\Extensions: [lyrmix@lyrmix.net] - C:\Program Files (x86)\Lyrmix\FF => nie znaleziono
FF Plugin: @Microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-4279119922-2032976690-675935974-1001: vitzo.com/VDownloader -> C:\Program Files\VDownloader\Addons\npVDownloader.dll [Brak pliku]
CHR StartupUrls: ChromeDefaultData -> "hxxp://www.gazeta.pl/0,0.html?p=189","hxxp://www.gazeta.pl/0,0.html?p=190"
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.trotux.com/search/?q={searchTerms}&z=6c7f9279ce88f74953a2783g8zem6w2m1b8e4bbg5c&from=clc&uid=ST3640323AS_9VK016V0XXXX9VK016V0&type=sp
CHR DefaultSearchKeyword: ChromeDefaultData -> trotux
CHR Profile: C:\Users\Sephirot\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2016-10-06] <==== UWAGA
S4 Akamai; c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll [X]
S3 GalaxyClientService; "J:\GRY\GalaxyClient\GalaxyClientService.exe" [X]
S3 Survarium-Steam Update Service; "J:\GRY\STEAM\steamapps\common\Survarium\game\binaries\x86\survarium_service.exe" "Survarium-Steam" [X]
R1 ucdrv; C:\Windows\System32\drivers:ucdrv-x64.sys [80850 ] (UC Web Inc.) <==== UWAGA
S2 AODDriver4.2.0; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U0 aswVmm; Brak ImagePath
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S4 nvlddmkm; system32\DRIVERS\nvlddmkm.sys [X]
S3 NVNET; system32\DRIVERS\nvmf6264.sys [X]
2016-10-07 09:13 - 2016-10-07 09:13 - 00038803 _____ C:\ComboFix.txt
2016-10-06 21:07 - 2016-10-13 12:21 - 00002568 _____ C:\Windows\System32\Tasks\UCBrowserUpdaterCore
2016-10-06 21:07 - 2016-10-13 12:21 - 00000462 _____ C:\Windows\Tasks\UCBrowserUpdater.job
2016-10-06 21:07 - 2016-10-13 12:21 - 00000298 _____ C:\Windows\Tasks\UCBrowserUpdaterCore.job
2016-10-06 21:07 - 2016-10-12 18:48 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-10-06 21:07 - 2016-10-06 21:07 - 00003442 _____ C:\Windows\System32\Tasks\UCBrowserUpdater
2016-10-04 10:47 - 2016-10-13 11:58 - 00000000 ____D C:\AdwCleaner
2016-10-03 09:51 - 2016-10-03 09:51 - 00000000 ____D C:\Users\Sephirot\AppData\Local\UCBrowser
2016-10-07 09:13 - 2016-07-29 22:17 - 00000000 ____D C:\Qoobox
EmptyTemp:

Domino_2 napisał:

W logach nie widać już nic poważnego. Czy nadal problem występuje?