Złośliwy reklamiarz

[mrbm]

Proszę o pomoc...

FRST:
http://www.wklejto.pl/248144

Addition:
http://www.wklejto.pl/248145


Shortcut:
http://www.wklejto.pl/248146

[ordynat]

1) Do Notatnika wklej:

Kod: Zaznacz wszystko

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2984DB31-A4F2-41A0-B555-11C74EE5CDFC}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{2984DB31-A4F2-41A0-B555-11C74EE5CDFC}]
"NameServer"="8.8.8.8"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4879B46A-332A-4372-ADE0-B58A77A008B9}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{4879B46A-332A-4372-ADE0-B58A77A008B9}]
"NameServer"="8.8.8.8"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73EBCB58-8669-4085-B099-1F7A59F0B1CB}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{73EBCB58-8669-4085-B099-1F7A59F0B1CB}]
"NameServer"="8.8.8.8"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C351377A-3352-4802-8933-B10ADD5F04BC}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C351377A-3352-4802-8933-B10ADD5F04BC}]
"NameServer"="8.8.8.8"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D50893F5-73F2-48D8-B4BB-D4AB83FF1760}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D50893F5-73F2-48D8-B4BB-D4AB83FF1760}]
"NameServer"="8.8.8.8"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}]
"NameServer"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}]
"NameServer"="8.8.8.8"



Z Menu Notatnika >> Plik >> Zapisz jako >> Ustaw rozszerzenie na Wszystkie pliki >> Zapisz jako> FIX.REG >>
plik uruchom (dwuklik i OK).

2) Otwórz Notatnik i wklej w nim:

Task: {253694D8-1C2D-4C64-A539-3086D38D339B} - System32\Tasks\Fhuvac => C:\PROGRA~1\SHOPPE~1\Mukxykj.bat
Task: {B578A1CC-9694-4F2B-8BCC-0310663F5972} - System32\Tasks\Tuswutr => C:\PROGRA~1\GROOVE~1\Jetsy.bat
2016-02-18 15:05 - 2016-02-18 15:05 - 00205824 _____ () C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\knso8708.tmp
2016-02-17 12:00 - 2016-02-17 12:00 - 00389312 _____ () C:\Program Files\SFK\SSFK.exe
2016-02-16 12:32 - 2016-02-16 12:32 - 00416256 _____ () C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\hnsh90FB.tmp
2016-02-16 12:32 - 2016-02-16 12:32 - 00307712 _____ () C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\jnsm7B76.tmp
C:\Program Files\SFK
C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29
C:\ProgramData\JWdMJ
HKLM\...\Run: [SpaceSoundPro] => "C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe"
HKLM\...\Run: [Sound+] => "C:\Program Files\Sound+\Sound+.exe"
C:\Program Files\SpaceSoundPro
C:\Program Files\Sound+
HKU\S-1-5-21-3909002703-1748728374-1365869033-1000\...\Run: [AdobeBridge] => [X]
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
HKU\S-1-5-21-3909002703-1748728374-1365869033-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://services.eshield.com/general/newhometab.php?hometab=home&partner=11467&guid={261AA4D5-6358-4110-A803-28C7FA9ACA3B}&i=
HKU\S-1-5-21-3909002703-1748728374-1365869033-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://services.eshield.com/general/newhometab.php?hometab=home&partner=11467&guid={261AA4D5-6358-4110-A803-28C7FA9ACA3B}&i=
DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
SearchScopes: HKU\S-1-5-21-3909002703-1748728374-1365869033-1000 -> DefaultScope {0E3577CE-FAD0-49C8-B7BB-A3B9336477C6} URL = hxxp://search.eshield.com/serp?guid={261AA4D5-6358-4110-A803-28C7FA9ACA3B}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3909002703-1748728374-1365869033-1000 -> {0E3577CE-FAD0-49C8-B7BB-A3B9336477C6} URL = hxxp://search.eshield.com/serp?guid={261AA4D5-6358-4110-A803-28C7FA9ACA3B}&action=default_search&k={searchTerms}
SearchScopes: HKU\S-1-5-21-3909002703-1748728374-1365869033-1000 -> {DC765AF0-DA41-4A63-955E-3A0B2C2F54F6} URL = hxxp://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=11467
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll => Brak pliku
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursearching.com/?type=sc&ts=1455706771&z=ffb365c510754e16ff1a46bgcz5wdw0m2e8q0maqct&from=face&uid=ST9120823AS_5NJ1DTA7
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: yoursearching
FF Keyword.URL: hxxp://search.eshield.com/serp?guid={261AA4D5-6358-4110-A803-28C7FA9ACA3B}&action=default_search&k=
FF user.js: detected! => C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\user.js [2016-02-17]
FF SearchPlugin: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\searchplugins\omniboxes.xml [2016-02-16]
FF SearchPlugin: C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\searchplugins\yoursearching.xml [2016-02-17]
FF Extension: FirefixTab - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\extensions\deskCutv2@gmail.com [2016-02-16] [Brak podpisu cyfrowego]
FF Extension: Checked List 1.0.1 - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\extensions\{2a6b0fdc-8815-4aa5-a061-069d6db3f642}.xpi [2016-02-16] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\75loofsi.default\extensions\deskCutv2@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.yoursearching.com/?type=sc&ts=1455706771&z=ffb365c510754e16ff1a46bgcz5wdw0m2e8q0maqct&from=face&uid=ST9120823AS_5NJ1DTA7
R2 ihpmServer; C:\Program Files\RayDld\ihpmServer.exe [264944 2016-02-03] (RayDl)
R2 mefyqoquzbt; C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\knso8708.tmp [205824 2016-02-18] () [Brak podpisu cyfrowego]
R2 SSFK; C:\Program Files\SFK\SSFK.exe [389312 2016-02-17] ()
C:\Program Files\RayDld
R2 WdMan; C:\ProgramData\JWdMJ\WdMan.exe [794376 2016-02-17] (TU-Funs LIMITED)
R2 wucotusy; C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\hnsh90FB.tmp [416256 2016-02-16] () [Brak podpisu cyfrowego]
R2 zutuzuni; C:\Program Files\BF9813F7-1455622318-11DC-9104-F699101ABD29\jnsm7B76.tmp [307712 2016-02-16] () [Brak podpisu cyfrowego]
R1 cherimoya; C:\Windows\System32\drivers\cherimoya.sys [49408 2016-02-16] (Cherimoya Ltd) [Brak podpisu cyfrowego]
R1 {2a6b0fdc-8815-4aa5-a061-069d6db3f642}Gw; C:\Windows\System32\drivers\{2a6b0fdc-8815-4aa5-a061-069d6db3f642}Gw.sys [43112 2016-02-17] (StdLib)
R1 {4dc2d675-6c0f-4871-87ef-625b3f8c1ab8}Gw; C:\Windows\System32\drivers\{4dc2d675-6c0f-4871-87ef-625b3f8c1ab8}Gw.sys [43120 2016-02-16] (StdLib)
S0 MPCBase; System32\drivers\MPCBase.sys [X]
S1 MPCKpt; system32\DRIVERS\MPCKpt.sys [X]
S1 wfdrvr_vt_1_10_0_28; system32\drivers\wfdrvr_vt_1_10_0_28.sys [X]
2016-02-17 12:00 - 2016-02-17 12:00 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2016-02-17 12:00 - 2016-02-17 01:29 - 00043112 _____ (StdLib) C:\Windows\system32\Drivers\{2a6b0fdc-8815-4aa5-a061-069d6db3f642}Gw.sys
2016-02-17 11:59 - 2016-02-18 14:57 - 00000000 ____D C:\Users\HP\AppData\Roaming\yoursearching
2016-02-16 12:49 - 2016-02-16 12:49 - 00000000 ____D C:\Windows\system32\veaj
2016-02-16 12:49 - 2016-02-16 12:49 - 00000000 ____D C:\Users\HP\AppData\Roaming\NuadCiveta
2016-02-16 12:43 - 2016-02-16 12:56 - 00000000 ____D C:\Program Files\MPC Cleaner
2016-02-16 12:43 - 2016-02-16 12:49 - 00000000 ____D C:\Users\HP\AppData\Local\Tempfolder
2016-02-16 12:43 - 2016-02-16 12:43 - 00000000 ____D C:\Windows\system32\kobf
2016-02-16 12:43 - 2016-02-16 12:43 - 00000000 ____D C:\Users\HP\AppData\Roaming\AravceWykuu
2016-02-16 12:43 - 2016-02-16 12:43 - 00000000 ____D C:\Users\HP\AppData\LocalLow\Company
2016-02-16 12:43 - 2016-02-16 12:43 - 00000000 ____D C:\Users\HP\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
2016-02-16 12:42 - 2016-02-16 12:55 - 00000000 ____D C:\Program Files\SpaceSoundPro
2016-02-16 12:42 - 2016-02-16 12:55 - 00000000 ____D C:\Program Files\Sound+
2016-02-16 12:33 - 2016-02-16 01:34 - 00043120 _____ (StdLib) C:\Windows\system32\Drivers\{4dc2d675-6c0f-4871-87ef-625b3f8c1ab8}Gw.sys
C:\Windows\system32\Drivers\cherimoya.sys
C:\PROGRA~1\SHOPPE~1
C:\PROGRA~1\GROOVE~1
HOSTS:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).
Powstanie plik fixlog.txt.
Daj ten log.

3) Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

4) Zrób nowe logi FRST.
.

[mrbm]

http://www.wklejto.pl/248159

(coś jeszcze krzaczy)

Dodano Dzisiaj, 14:13:
Proszę, pomóżcie.. Coraz bardziej krzaczy. W tej chwili samoistnie pojawiają się jakieś zupełnie nieznane procesy instalacyjne. Dzisiejszy skan:

FRST:
http://www.wklejto.pl/248269

ADDITION:
http://www.wklejto.pl/248270