Wyskakujące okienka

[krecik88]

Witam,
Mam problem z wirusami, a mianowicie wyskakuje mi kilka okienek, oraz próbuje zainstalować mi się flash player recommended. Generalnie to gorzej nigdy nie miałem, a to za sprawą ściągania jednego darmowego programu.
Proszę o pomoc

OTL.Txt: http://wklej.org/id/1543171/

Extras.Txt: http://wklej.org/id/1543172/

[ordynat]

"WindowsMangerProtect" = WindowsMangerProtect20.0.0.1270
"AppEnable" = AppEnable

Odinstaluj to!

Potem:
Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Daj z tego raport C:\AdwCleaner\AdwCleaner[S].txt.

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
[2014-09-20 10:35:36 | 000,000,000 | ---D | M] -- C:\Users\Krecik\AppData\Roaming\OpenCandy
[2014-11-17 06:32:46 | 000,048,776 | ---- | M] (StdLib) -- C:\Windows\SysNative\drivers\{55bbc577-fb0b-4e77-8a51-e033716a9ead}Gw64.sys
[2014-11-18 08:30:10 | 000,048,776 | ---- | M] (StdLib) -- C:\Windows\SysNative\drivers\{820a714f-c526-4777-8e87-e9d6612e0938}Gw64.sys
[2014-11-17 18:25:50 | 000,000,000 | ---D | C] -- C:\ProgramData\IePluginServices
[2014-11-17 18:25:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SupTab
[2014-11-17 18:25:39 | 000,000,000 | ---D | C] -- C:\ProgramData\WindowsMangerProtect
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-21-2229370422-3445775471-1886306493-1000..\Run: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup File not found
O2 - BHO: (AppEnable) - {23d4646c-263a-4e2d-a08c-6c704557973d} - C:\Program Files (x86)\AppEnable\AppEnablebho.dll (AppEnable)
[2014-11-17 18:25:18 | 000,000,000 | ---D | M] ("Fast Start") -- C:\Users\Krecik\AppData\Roaming\mozilla\Firefox\Profiles\9n4jm6ou.default\extensions\faststartff@gmail.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\faststartff@gmail.com: C:\Users\Krecik\AppData\Roaming\Mozilla\Firefox\Profiles\9n4jm6ou.default\extensions\faststartff@gmail.com [2014-11-17 18:25:18 | 000,000,000 | ---D | M]
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - prefs.js..extensions.enabledAddons: faststartff%40gmail.com:4.3.0
FF - prefs.js..browser.search.defaultenginename: "mystartsearch"
FF - prefs.js..browser.search.selectedEngine: "mystartsearch"
IE - HKU\S-1-5-21-2229370422-3445775471-1886306493-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE - HKU\S-1-5-21-2229370422-3445775471-1886306493-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2
IE - HKU\S-1-5-21-2229370422-3445775471-1886306493-1000\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hp&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1416245117&from=amt&uid=ST1000DM003-9YN162_S1D5X9S2XXXXS1D5X9S2&q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
DRV:64bit: - [2014-11-18 08:30:10 | 000,048,776 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{820a714f-c526-4777-8e87-e9d6612e0938}Gw64.sys -- ({820a714f-c526-4777-8e87-e9d6612e0938}Gw64)
DRV:64bit: - [2014-11-17 06:32:46 | 000,048,776 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\{55bbc577-fb0b-4e77-8a51-e033716a9ead}Gw64.sys -- ({55bbc577-fb0b-4e77-8a51-e033716a9ead}Gw64)
SRV - [2014-11-17 18:25:39 | 000,490,640 | ---- | M] (Fuyu LIMITED) [Auto | Running] -- C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe -- (WindowsMangerProtect)

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[-HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes]
[-HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes]
[-HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes]
[-HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes]

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.

[krecik88]

Dzięki za pomoc,
to jest raport końcowy

OTL: http://wklej.org/id/1543499/

Adw Cleaner: http://wklej.org/id/1543501/

[ordynat]

Usuniemy jeszcze strumień ADS, który podpiął się pod folder WINDOWS:
Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
@Alternate Data Stream - 24 bytes -> C:\Windows:32AFFCDE64075431

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt.

Raportu z tego już nie dawaj.

Kończymy:
W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.