Potrzebuje fixlist pomocy!

**Posty:** 2 · przez **jaco90lek** 12 Paź 2016, 13:37

Witam serdecznie.

Posiadam na komputerze bardzo dobrze znane 3 wirusy i potrzebuje je usunąć lecz nie potrafię utworzyć fixlista do FRST.

Wklejam to co potrzebne i liczę na waszą pomoc

FRST : http://pastebin.pl/view/d45a2651

Addition : http://pastebin.pl/view/a7bbe529

Shortcut : http://pastebin.pl/view/36a0df70

Z góry bardzo dziękuje!

**Posty:** 4765 · przez **ordynat** 12 Paź 2016, 14:11

1) Spróbuj odinstalować ten program:
trotux - Uninstall (HKLM-x32\...\{0C63C6D8-4F8D-4649-A7CA-ADF72967F55F}) (Version: - ) <==== ATTENTION

2) Jeszcze raz użyj RepairDNS.
Daj z tego log.

3) Otwórz Notatnik i wklej w nim:

FirewallRules: [{81EC3F80-CF97-4FBA-9AD5-E0ED8F907A2A}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{F901BDCE-4AC7-43CE-9BF7-9830C7E7F41B}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\Downloader\download\MiniThunderPlatform.exe
FirewallRules: [{B45941B3-4F85-439B-B259-7F9FB46701D6}] => (Allow) C:\Windows\system32\config\systemprofile\AppData\Roaming\youku\..\ytmediacenter\ikuacc.exe
FirewallRules: [{97823EB8-AC85-40C1-AF9B-D494DC028256}] => (Allow) C:\Windows\system32\config\systemprofile\AppData\Roaming\youku\..\ytmediacenter\ikuacc.exe
FirewallRules: [{2BAAC87E-0B9E-445A-85BC-D69FDA8D5331}] => (Allow) C:\Program Files (x86)\IQIYI Video\LStyle\5.4.28.3179\QyKernel.exe
FirewallRules: [{700B402A-447A-4A87-9D2E-F674D153FC00}] => (Allow) C:\Program Files (x86)\IQIYI Video\LStyle\5.4.28.3179\QyClient.exe
FirewallRules: [{A867C947-F29D-4991-8F2B-9FCFA9757C0C}] => (Allow) C:\Program Files (x86)\IQIYI Video\LStyle\5.4.28.3179\QyPlayer.exe
FirewallRules: [{05EF15E8-DADB-4102-A4BB-954B22409450}] => (Allow) C:\Program Files (x86)\IQIYI Video\LStyle\5.4.28.3179\QyFragment.exe
FirewallRules: [{67863E5F-66D3-40C5-92EE-04BB54584D7C}] => (Allow) C:\Windows\system32\config\systemprofile\AppData\Roaming\IQIYI Video\LStyle\QyUpdate.exe
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v YoukuMediaCenter /f
Reg: reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 /v app /f
RemoveDirectory: C:\Windows\system32\config\systemprofile\AppData\Roaming\IQIYI Video
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Hemkajdoa
RemoveDirectory: C:\Program Files (x86)\IQIYI Video
RemoveDirectory: C:\Windows\system32\config\systemprofile\AppData\Roaming\youku
RemoveDirectory: C:\Program Files (x86)\UCBrowser
RemoveDirectory: C:\Program Files (x86)\KuaiZip
RemoveDirectory: C:\Program Files (x86)\Atawuhtucult_
RemoveDirectory: C:\Program Files (x86)\GUMB3BF.tmp
RemoveDirectory: C:\Program Files (x86)\Pliperphbrily
RemoveDirectory: C:\ProgramData\AVAST Software
RemoveDirectory: C:\ProgramData\Avg
RemoveDirectory: C:\ProgramData\Avira
RemoveDirectory: C:\Program Files (x86)\Atawuhtucult
RemoveDirectory: C:\ProgramData\boost_interprocess
RemoveDirectory: C:\Users\Public\QiYi
RemoveDirectory: C:\Users\Jacek\AppData\Local\UCBrowser
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
RemoveDirectory: C:\Users\Jacek\AppData\Local\Tempfolder
RemoveDirectory: C:\Users\Jacek\AppData\LocalLow\Company
RemoveDirectory: C:\Program Files\Aiduwb
RemoveDirectory: C:\Users\Jacek\AppData\Roaming\KuaiZip
RemoveDirectory: C:\qycache
RemoveDirectory: C:\Program Files (x86)\YouKu
RemoveDirectory: C:\Program Files (x86)\hhh
C:\Program Files (x86)\Common Files\PliperphbrilyCommonFiles.exe
C:\PerfLogs\PerfLogsPerfLogs.exe
C:\Program Files (x86)\Google\PliperphbrilyGoogle.exe
C:\Intel\ProgramFilesIntel.exe
C:\NVIDIA\ProgramFilesNVIDIA.exe
C:\Program Files (x86)\ProgramFilesProgramFilesx.exe
C:\Program Files\PerfLogsProgramFiles.exe
C:\PerfLogs\UsersPerfLogs.exe
C:\Users\UsersProgramFiles.exe
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {AA3BFBD1-531C-4076-AAB7-7730A30CC25F} - System32\Tasks\Rehition Schedule => C:\Program Files (x86)\Pliperphbrily\clicacult.exe
Task: {FFC668B2-B529-4DA8-A5DB-464F83E7FA12} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== ATTENTION
Task: {58CF63E7-5A76-496B-9093-EFA3B9B8CD09} - System32\Tasks\Chtisriropy Renew => C:\Program Files (x86)\Atawuhtucult_\detught.exe [2016-10-12] (Glarysoft Ltd)
Task: {21607EF3-E196-4FD2-BE99-1D4A302BE644} - System32\Tasks\4302b581db2c75f47106e61331e30ae3 => Rundll32.exe "C:\Program Files (x86)\Windows Multimedia Platform\ycufdl.dll",e62dc6c6547f46bda862da2d05af6862
C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
R2 AtawuhtucultInternetExplorer; "C:\Program Files (x86)\Atawuhtucult_\AtawuhtucultInternetExplorer.exe" e47b5abf08794d6b8b774f94eeb062f4 [X]
S2 AtawuhtucultKuaiZip; "C:\Program Files (x86)\KuaiZip\AtawuhtucultKuaiZip.exe" e47b5abf08794d6b8b774f94eeb062f4 [X]
S2 Citdhwa; "C:\Users\Jacek\AppData\Roaming\AzigcWig\Geeswu.exe" -cms [X]
S2 GoogleCleanBrowser; "C:\Program Files (x86)\CleanBrowser\GoogleCleanBrowser.exe" ae2ce54ab1294744903dca4a5f8539bf [X]
S2 InternetExplorerhhh; "C:\Program Files (x86)\hhh\InternetExplorerhhh.exe" c54102ea829e4d458c86147e71427a8f [X]
S2 ProgramFilesqycache; "C:\qycache\ProgramFilesqycache.exe" 3e19779b2974487e881c2174c0562504 [X]
R2 WebServe; C:\Program Files (x86)\YouKu\YoukuClient\WebServe.exe [370224 2015-12-08] (TODO: <公司名>) <==== ATTENTION
R2 ProgramFilesProgramFilesx; C:\Program Files (x86)\ProgramFilesProgramFilesx.exe [228352 2016-10-12] () [File not signed]
R2 Rohucultatoergh; C:\Program Files (x86)\Atawuhtucult_\rrgsch.dll [280064 2016-10-12] () [File not signed]
R2 UsersPerfLogs; C:\PerfLogs\UsersPerfLogs.exe [228352 2016-10-12] () [File not signed]
R2 UsersProgramFiles; C:\Users\UsersProgramFiles.exe [228352 2016-10-12] () [File not signed]
R2 Viokdojvaf; C:\Users\Jacek\AppData\Roaming\Hemkajdoa\Hemkajdoa.exe [170496 2016-08-11] () [File not signed]
R2 PerfLogsPerfLogs; C:\PerfLogs\PerfLogsPerfLogs.exe [228352 2016-10-12] () [File not signed]
R2 PerfLogsProgramFiles; C:\Program Files\PerfLogsProgramFiles.exe [228352 2016-10-12] () [File not signed]
R2 PliperphbrilyCommonFiles; C:\Program Files (x86)\Common Files\PliperphbrilyCommonFiles.exe [228352 2016-10-12] () [File not signed]
R2 PliperphbrilyGoogle; C:\Program Files (x86)\Google\PliperphbrilyGoogle.exe [228352 2016-10-12] () [File not signed]
R2 ProgramFilesIntel; C:\Intel\ProgramFilesIntel.exe [228352 2016-10-12] () [File not signed]
R2 ProgramFilesNVIDIA; C:\NVIDIA\ProgramFilesNVIDIA.exe [228352 2016-10-12] () [File not signed]
FF Plugin HKU\.DEFAULT: youku.com/YoukuAgent -> C:\Windows\SYSTEM32\config\systemprofile\AppData\Roaming\ytmediacenter\npYoukuAgent.dll [No File]
FF Plugin HKU\.DEFAULT: youku.com/YoukuAgent_x86_64 -> C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ytmediacenter\X64\npYoukuAgent_x64.dll [2016-08-24] (Youku)
FF Plugin: @iqiyi.com/npclient -> C:\Program Files (x86)\IQIYI Video\LStyle\5.4.28.3179\npclient.dll [No File]
BHO-x32: YoukuEyeOnIE Class -> {7DC4B5B6-C122-44C4-825C-B310513A47CB} -> C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\ytmediacenter\ykcool.dll [2015-12-25] (Youku.com)
ManualProxies: 0hxxp://127.0.0.1:8088/ppsva.pac
AutoConfigURL: [S-1-5-21-1529912858-1414345264-3061538310-1001] => hxxp://127.0.0.1:8088/ppsva.pac
ShellIconOverlayIdentifiers: [KzShlobj2] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F3} => C:\Program Files (x86)\KuaiZip\X64\KZipShell.dll [2016-10-12] ()
ShellIconOverlayIdentifiers-x32: [ Report] -> {32C50D96-7A9E-4F3E-8763-F74D86AFEDC2} => C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\ytmediacenter\report.dll [2015-10-10] (Youku.com)
ShellIconOverlayIdentifiers-x32: [ YoukuModShlExt] -> {9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E} => C:\Windows\SysWow64\config\systemprofile\AppData\Roaming\ytmediacenter\coreplay.dll [2015-12-08] (Youku.com)
HKLM-x32\...\Run: [app] => C:\Program Files (x86)\hhh\uc.exe
HKLM-x32\...\Run: [YoukuMediaCenter] => C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\ytmediacenter\YoukuMediaCenter.exe [3193904 2016-09-22] (youku.com)
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0C63C6D8-4F8D-4649-A7CA-ADF72967F55F}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{0C63C6D8-4F8D-4649-A7CA-ADF72967F55F}
C:\Users\Jacek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\UC浏览器.lnk
C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器
C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
HOSTS:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: Unicode
>>Zapisz
Plik umieść w folderze C:\Users\Jacek\Downloads
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

4) Zrób nowe logi FRST.
Przed skanem zaznacz "Addition.txt" oraz "Shortcut.txt"
.

Autor postu otrzymał pochwałę

**Posty:** 2 · przez **jaco90lek** 12 Paź 2016, 14:28

Z poziomu Dodaj/Usuń programy nie da rady

Dodano Dzisiaj, 14:41:
RepairDNS: http://pastebin.pl/view/b9532aab

Dodano Dzisiaj, 14:50:
FRST : http://pastebin.pl/view/b07a0df6

Addition : http://pastebin.pl/view/fa2c2099

Shortcut : http://pastebin.pl/view/5875fde8

Myślę, że procesy wyglądają tak jak powinny wyglądać

Dziękuje bardzo. Piwko dla Ciebie!

)

**Posty:** 4765 · przez **ordynat** 12 Paź 2016, 15:16

Otwórz Notatnik i wklej w nim:

S2 GUMBBFtmpGoogle; "C:\Program Files (x86)\GUMB3BF.tmp\GUMBBFtmpGoogle.exe" 420f678469254505a655a4b567f7c9a0 [X]
C:\Windows\SysWOW64\Number of results
CHR HomePage: Default -> hxxp://start.funmoods.com/?f=1&a=nv1
ShellIconOverlayIdentifiers-x32: [ Report] -> {32C50D96-7A9E-4F3E-8763-F74D86AFEDC2} => No File
ShellIconOverlayIdentifiers-x32: [ YoukuModShlExt] -> {9071723E-9F41-4A8C-9CC2-EB6F94BA9B9E} => No File

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

Potem kończymy:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na PLIK, potem na ODINSTALUJ.

RepairDNS - usuń ręcznie.
.