Reklamy adclick

**Posty:** 52 · przez **ostry99** 24 Kwi 2016, 12:59

Witam,

na rogach ekranu monitora pojawiają się reklamy ADClick, których nie mogę zamknąć. Problem jest uciążliwy, proszę o sprawdzenie logów.

FRST http://wklej.org/id/2337129/
Addition http://wklej.org/id/2337130/
Shortcut http://wklej.org/id/2337138/
Gmer http://wklej.org/id/2337195/

**Posty:** 4765 · przez **ordynat** 24 Kwi 2016, 13:11

1) SPYHUNTER - od dawna jest na czarnej liście.
spróbuj odinstalować w ten sposób:
kliknij na tę ikonkę C:\Users\nazwa Użytkownika\Start Menu\Programs\SpyHunter\Uninstall.lnk (czyli >>START >>Programy>>SpyHunter>>Uninstall)
wyskoczy okienko, ale zamiast klikać wielki zielony guzik "continue" kliknij "no, thanks". To drugie odinstalowuje.

2) Uruchom Registry DeleteEx http://www.novirusthanks.org/products/registry-deleteex/ .
Zaznacz opcję "Recursively delete all subkeys". W pasku adresów po kolei wklej te ścieżki i je usuń:

HKLM\SYSTEM\CurrentControlSet\Services\MPCKpt
HKLM\SYSTEM\CurrentControlSet\Services\MPCProtectService

Zresetuj system.

3) Wejdź do folderu C:\Program Files (x86)\MPC AdCleaner i wyszukaj plik deinstalatora, z prawokliku "Uruchom jako Administrator".

4) Wejdź do folderu C:\Program Files (x86)\MPC Cleaner i wyszukaj plik deinstalatora, z prawokliku "Uruchom jako Administrator".

5) Otwórz Notatnik i wklej w nim:

C:\ProgramData\WindowsMsg
ShortcutWithArgument: C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://trustedsurf.com/?ssid=1461411557&a=1024132&src=sh&uuid=96d32d4f-a935-4c0d-bb3e-411e18312e60"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
Task: {0E7FF551-CF1B-4B76-9E5B-33D4DD026D51} - System32\Tasks\MPC AdCleaner => C:\Program Files (x86)\MPC AdCleaner\AdCleaner.exe [2016-03-10] (DotC United Inc) <==== UWAGA
C:\ProgramData\conhost.exe
C:\ProgramData\msiql.exe
C:\ProgramData\service.exe
C:\ProgramData\webad.xml
2016-04-23 13:39 - 2016-04-23 13:39 - 6494208 _____ () C:\Users\Mateusz\AppData\Roaming\agent.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0054272 _____ () C:\Users\Mateusz\AppData\Roaming\ApplicationHosting.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0065568 _____ () C:\Users\Mateusz\AppData\Roaming\Config.xml
2016-04-23 13:39 - 2016-04-23 13:39 - 0038995 _____ () C:\Users\Mateusz\AppData\Roaming\inst.lat
2016-04-23 13:39 - 2016-04-23 13:39 - 0015840 _____ () C:\Users\Mateusz\AppData\Roaming\InstallationConfiguration.xml
2016-04-23 13:39 - 2016-04-23 13:39 - 0127488 _____ () C:\Users\Mateusz\AppData\Roaming\Installer.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0126464 _____ () C:\Users\Mateusz\AppData\Roaming\lobby.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0018432 _____ () C:\Users\Mateusz\AppData\Roaming\Main.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0005568 _____ () C:\Users\Mateusz\AppData\Roaming\md.xml
2016-04-23 13:39 - 2016-04-23 13:39 - 0126464 _____ () C:\Users\Mateusz\AppData\Roaming\noah.dat
2016-04-23 13:39 - 2016-04-23 13:39 - 0987136 _____ () C:\Users\Mateusz\AppData\Roaming\Redfix.exe
2016-04-23 13:39 - 2016-04-23 13:39 - 0072717 _____ () C:\Users\Mateusz\AppData\Roaming\Redfix.tst
2016-04-23 13:39 - 2016-04-23 13:39 - 0848437 _____ () C:\Users\Mateusz\AppData\Roaming\Sun-Soft.bin
2016-04-24 10:49 - 2016-04-24 10:49 - 0965847 _____ ( ) C:\Users\Mateusz\AppData\Roaming\svrupg.exe
2016-04-23 13:39 - 2016-04-23 13:39 - 0032038 _____ () C:\Users\Mateusz\AppData\Roaming\uninstall_temp.ico
2016-04-23 13:39 - 2016-04-23 13:39 - 0987136 _____ () C:\Users\Mateusz\AppData\Roaming\VilaDax.exe
2016-04-23 13:39 - 2016-04-23 13:39 - 1626777 _____ () C:\Users\Mateusz\AppData\Roaming\VilaDax.tst
2016-04-23 13:44 - 2016-04-23 13:47 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Rikfootov
2016-04-23 13:44 - 2016-04-23 13:46 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\VypiwGyp
2016-04-23 13:44 - 2016-04-23 13:46 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\UPUpdata
2016-04-23 13:44 - 2016-04-23 13:46 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\LaexuGegobog
2016-04-23 13:44 - 2016-04-23 13:45 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Tueasjey
2016-04-23 13:44 - 2016-04-23 13:45 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Tempfolder
2016-04-23 13:44 - 2016-04-23 13:44 - 00000000 ____D C:\Program Files\Kajajugt
2016-04-23 13:43 - 2016-04-24 10:43 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-04-23 13:43 - 2016-04-23 13:43 - 00060136 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
2016-04-23 13:43 - 2016-04-23 13:43 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-04-23 13:43 - 2016-04-23 13:43 - 00000000 ____D C:\Program Files\Ekeh
2016-04-23 13:43 - 2016-04-23 13:43 - 00000000 ____D C:\Program Files (x86)\Pwtyfemuk
2016-04-23 13:40 - 2016-04-24 11:04 - 00002397 _____ C:\WINDOWS\SysWOW64\findit.xml
2016-04-23 13:40 - 2016-04-24 10:51 - 00000000 ____D C:\Program Files (x86)\1C09D493-1461411644-E511-90AB-1C394733E03B
2016-04-23 13:40 - 2016-04-23 13:40 - 00000000 ____D C:\ProgramData\Holdtams
2016-04-23 13:39 - 2016-04-24 11:03 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-04-24 11:40 - 2016-04-24 11:40 - 00022704 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
2016-04-24 11:39 - 2016-04-24 11:39 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Mateusz\Downloads\SpyHunter-Installer (1).exe
2016-04-24 11:39 - 2016-04-24 11:39 - 00000000 ____D C:\Program Files\Enigma Software Group
2016-04-24 11:10 - 2016-04-24 11:10 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Mateusz\Downloads\SpyHunter-Installer.exe
2016-04-24 11:04 - 2016-04-24 11:04 - 00000000 ____D C:\ProgramData\AppmatdloHs
2016-04-24 11:03 - 2016-04-24 11:04 - 00000000 ____D C:\ProgramData\AppmatdloH
2016-04-24 10:56 - 2016-04-24 10:56 - 00001634 _____ C:\ProgramData\webad.xml
2016-04-24 10:53 - 2016-04-24 10:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
2016-04-24 10:52 - 2016-04-24 10:58 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\MCorp
2016-04-24 10:51 - 2016-04-24 10:53 - 00000000 ____D C:\Program Files (x86)\MPC AdCleaner
2016-04-24 10:51 - 2016-04-24 10:51 - 00003434 _____ C:\WINDOWS\System32\Tasks\MPC AdCleaner
2016-04-24 10:51 - 2016-04-24 10:51 - 00001943 _____ C:\Users\Mateusz\Desktop\MPC AdCleaner.lnk
2016-04-24 10:51 - 2016-04-24 10:51 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MPC AdCleaner
2016-04-24 10:49 - 2016-04-24 10:49 - 00965847 _____ ( ) C:\Users\Mateusz\AppData\Roaming\svrupg.exe
2016-04-24 10:49 - 2016-04-24 10:49 - 00000000 ____D C:\ProgramData\WindowsMsg
2016-04-24 10:49 - 2016-04-24 10:49 - 00000000 ____D C:\Program Files (x86)\osTip
2016-04-24 10:43 - 2016-04-24 10:53 - 00001805 _____ C:\Users\Public\Desktop\MPC Cleaner.lnk
2016-04-24 11:41 - 2016-04-24 11:41 - 00003450 _____ C:\WINDOWS\System32\Tasks\SpyHunter4Startup
2016-04-24 11:41 - 2016-04-24 11:41 - 00001139 _____ C:\Users\Mateusz\Desktop\SpyHunter.lnk
2016-04-24 11:41 - 2016-04-24 11:41 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Enigma Software Group
2016-04-24 11:41 - 2016-04-24 11:41 - 00000000 ____D C:\sh4ldr
HKU\S-1-5-21-3847043773-3950941954-2623349926-1001\...\Run: [msiql] => C:\ProgramData\msiql.exe [1909760 2016-04-23] ()
HKU\S-1-5-21-3847043773-3950941954-2623349926-1001\...\Run: [taskhost] => rundll32.exe C:\ProgramData\WindowsMsg\675D131108D4FD145B0BFBC68A3E018A.dll Start /AUTORUN
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SpyHunter
C:\Program Files\update
C:\Program Files (x86)\MPC AdCleaner
Task: {BA9BADC0-245F-49E9-B4DA-75AFEFCBBADE} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2016-04-24] (Enigma Software Group USA, LLC.)
C:\Program Files\Enigma Software Group
S3 mfeaack01; \Device\mfeaack01.sys [X]
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-04-23] (DotC United Inc)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2016-04-24] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-04-24] ()
R2 UpdateAgentService; C:\Program Files\update\UpdateAgent.exe [226216 2015-12-14] ()
S2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1042304 2016-04-24] (Enigma Software Group USA, LLC.)
R2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-04-23] (DotC United Inc)
S2 AppmatdloH; C:\ProgramData\\AppmatdloH\\AppmatdloH.exe [693248 2016-04-24] () [Brak podpisu cyfrowego]
S2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe [987136 2016-04-23] () [Brak podpisu cyfrowego]
C:\ProgramData\\AppmatdloH
CHR StartupUrls: Default -> "search.mpc.am/?geo=pl"
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = search.mpc.am/?geo=pl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = search.mpc.am/?geo=pl
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = search.mpc.am/?geo=pl
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = search.mpc.am/?geo=pl
HKU\S-1-5-21-3847043773-3950941954-2623349926-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVRmzv2pJwNObeR_98Utx3C8ptXD3NM9Mo1vC9EAW5oFG4W-wqwzae383GbTHq-WWMcgvF_T0dLMKQdgw9aYGudGxdfxSIuKT9RM0IRiu9OgRsLJ4cwKhkmARxBDwDoc4rpsL0pMSzZ21twlhSFKN7PgQGen4FvRUg4FFKUk4YhRLsrjC0QXccPw,,&q={searchTerms}
HKU\S-1-5-21-3847043773-3950941954-2623349926-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVRmzv2pJwNObeR_98Utx3C8ptXD3NM9Mo1vC9EAW5oFG4W-wqwzae383GbTHq-WWMcgvF_T0dLMKQdgw9aYGudGxdfxSIuKT9RM0IRiu9OgRsLJ4cwKhkmARxBDwDoc4rpsL0pMSzZ21twlhSFKN7PgQGen4FvRUg4FFKUk4YhRLsrjC0QXccPw,,&q={searchTerms}
HKU\S-1-5-21-3847043773-3950941954-2623349926-1001\Software\Microsoft\Internet Explorer\Main,Start Page = search.mpc.am/?geo=pl
SearchScopes: HKLM -> DefaultScope {0644EE93-D778-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVRmzv2pJwNObeR_98Utx3C8ptXD3NM9Mo1vC9EAW5oFG4W-wqwzae383GbTHq-WWMcgvF_T0dLMKQdgw9aYGudGxdfxSIuKT9RM0IRiu9OgRsLJ4cwKhkmARxBDwDoc4rpsL0pMSzZ21twlhSFKN7PgQGen4FvRUg4FFKUk4YhRLsrjC0QXccPw,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3847043773-3950941954-2623349926-1001 -> DefaultScope {0644EE93-D778-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.mpc.am/index/search?q={searchTerms}&cx=partner-pub-3796753109442372:3837783968&ie=UTF-8
SearchScopes: HKU\S-1-5-21-3847043773-3950941954-2623349926-1001 -> {0644EE93-D778-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.mpc.am/index/search?q={searchTerms}&cx=partner-pub-3796753109442372:3837783968&ie=UTF-8
SearchScopes: HKU\S-1-5-21-3847043773-3950941954-2623349926-1001 -> {4339C80F-BEED-49BC-B2CF-0CD5A08C6387} URL =
SearchScopes: HKU\S-1-5-21-3847043773-3950941954-2623349926-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBVRmzv2pJwNObeR_98Utx3C8ptXD3NM9Mo1vC9EAW5oFG4W-wqwzae383GbTHq-WWMcgvF_T0dLMKQdgw9aYGudGxdfxSIuKT9RM0IRiu9OgRsLJ4cwKhkmARxBDwDoc4rpsL0pMSzZ21twlhSFKN7PgQGen4FvRUg4FFKUk4YhRLsrjC0QXccPw,,&q={searchTerms}
Tcpip\..\Interfaces\{04be7cf5-3efb-461e-a6f0-3cd014d7e143}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{21f93890-d22e-11e5-87b6-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{2eb83fdd-acc1-47a8-af5a-58335b52ba76}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{c1a8c6c0-b0ba-4cf8-9960-621540d908d5}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{c3881c6e-feb9-11e5-87ba-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{d2839c07-f9b5-48c4-b4af-e0b1b055ab6c}: [NameServer] 104.197.191.4
AppInit_DLLs: C:\ProgramData\AppmatdloH\LamEx.dll => C:\ProgramData\AppmatdloH\LamEx.dll [361984 2016-04-24] ()
AppInit_DLLs-x32: C:\ProgramData\AppmatdloH\OntoTancom.dll => C:\ProgramData\AppmatdloH\OntoTancom.dll [257536 2016-04-24] ()
C:\Users\Public\Desktop\MPC Cleaner.lnk
C:\Users\Mateusz\Desktop\SpyHunter.lnk
ShortcutWithArgument: C:\Users\Mateusz\Start Menu\Programs\SpyHunter\SpyHunter Emergency Startup.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> "C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter4.com"
ShortcutWithArgument: C:\Users\Mateusz\Start Menu\Programs\SpyHunter\Uninstall.lnk -> C:\Users\Mateusz\AppData\Roaming\Enigma Software Group\sh_installer.exe (Enigma Software Group USA, LLC.) -> -r sh
C:\Users\Mateusz\Start Menu\Programs\SpyHunter
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
HOSTS:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).
Powstanie plik fixlog.txt.
Daj ten log.

6) Zrób nowe logi FRST.
Przed skanem zaznacz "Addition.txt" oraz "Shortcut.txt"
.

Autor postu otrzymał pochwałę

**Posty:** 52 · przez **ostry99** 24 Kwi 2016, 14:01

Dzięki!

2) W obu przypadkach pojawil sie blad 'Failed to delete registry key.'

Logi
FixLog -> http://wklej.org/id/2337437/
FRST -> http://wklej.org/id/2337447/
Addition -> http://wklej.org/id/2337448/
Shortcut -> http://wklej.org/id/2337449/

**Posty:** 4765 · przez **ordynat** 24 Kwi 2016, 14:24

Otwórz Notatnik i wklej w nim:

S2 GoogleChromeUpService; C:\Users\Mateusz\AppData\Roaming\UPUpdata\service.exe /s GoogleChromeUpService /uid:51490 /local:br [X]
CHR HomePage: Default -> search.mpc.am
CHR DefaultSearchURL: Default -> hxxp://search.mpc.am?q={searchTerms}&cx=partner-pub-3796753109442372:3837783968
CHR DefaultSearchKeyword: Default -> mpc safe search
ProxyServer: [S-1-5-21-3847043773-3950941954-2623349926-1001] => 127.0.0.1:18159
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

Autor postu otrzymał pochwałę

Reklamy adclick

Reklamy adclick

Reklamy adclick

Reklamy adclick

Reklamy adclick

Kto jest na forum