Wyskakujące reklamy, przekierunkowania, trojany, pomocy

**Posty:** 2 · przez **kari94** 07 Kwi 2015, 20:07

Witam.
Mam poważny problem z moim komputerem. Ciągle wyskakują mi reklamy i prze kierunkowania do innych stron. Żaden program antywirusowy nie usuwa trojanów. Proszę o pomoc.
Oto log:
frst: http://www.wklejto.pl/225240
add: http://www.wklejto.pl/225241
shourtcut: http://www.wklejto.pl/225242

**Posty:** 4765 · przez **ordynat** 07 Kwi 2015, 20:17

1) Odinstaluj te programY:

Special Box (HKLM\...\Special Box) (Version: 2015.03.12.185656 - Special Box) <==== ATTENTION
Internet Speed Tracker Internet Explorer Toolbar (HKLM-x32\...\InternetSpeedTracker_9tbar Uninstall Internet Explorer) (Version: - Mindspark Interactive Network) <==== ATTENTION

2) Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

3) Otwórz Notatnik i wklej w nim:

Task: {AAC97D4C-86C9-4406-B526-5DC243530432} - \ReimageUpdater No Task File <==== ATTENTION
Task: {AEFBBF24-8333-43E0-9031-8ED7310F6BDE} - \Reimage Reminder No Task File <==== ATTENTION
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
C:\Program Files (x86)\Special Box
HKLM-x32\...\Run: [Internet Speed Tracker Search Scope Monitor] => "C:\PROGRA~2\INTERN~2\bar\2.bin\9tsrchmn.exe" /m=2 /w /h
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
HKU\S-1-5-21-2840933420-1225328898-113816797-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.tb.ask.com/index.jhtml?n=781B14CC&p2=^BBQ^man000^YYA^&ptb=AC9F373C-659D-46CD-9D80-D50F2B31287B
HKU\S-1-5-21-2840933420-1225328898-113816797-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
SearchScopes: HKLM-x32 -> {a0892e19-6051-4ae6-9a5f-91542a166b2b} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^BBQ^man000^YYA^&ptb=AC9F373C-659D-46CD-9D80-D50F2B31287B&ind=2015040710&n=781b14c6&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKU\S-1-5-21-2840933420-1225328898-113816797-1001 -> {a0892e19-6051-4ae6-9a5f-91542a166b2b} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^BBQ^man000^YYA^&ptb=AC9F373C-659D-46CD-9D80-D50F2B31287B&ind=2015040710&n=781b14c6&psa=&st=sb&searchfor={searchTerms}
BHO: No Name -> {01ab6474-e5da-4da8-9f63-3307d89680cd} -> No File
BHO: No Name -> {1435fac4-10f7-421d-93ec-062da090ca29} -> No File
BHO: No Name -> {423d7332-7d7e-486e-8288-aa34fbab579b} -> No File
BHO: No Name -> {a89213b8-f1bb-4ed9-b83e-e0e7ec8a3f46} -> No File
BHO: No Name -> {eca52564-d794-40db-a275-0cbfd59f1ca5} -> No File
BHO: No Name -> {f215c3a6-2688-4890-b819-59f7853d82a7} -> No File
BHO-x32: No Name -> {01ab6474-e5da-4da8-9f63-3307d89680cd} -> No File
BHO-x32: No Name -> {1435fac4-10f7-421d-93ec-062da090ca29} -> No File
BHO-x32: No Name -> {423d7332-7d7e-486e-8288-aa34fbab579b} -> No File
BHO-x32: No Name -> {a89213b8-f1bb-4ed9-b83e-e0e7ec8a3f46} -> No File
BHO-x32: No Name -> {eca52564-d794-40db-a275-0cbfd59f1ca5} -> No File
BHO-x32: No Name -> {f215c3a6-2688-4890-b819-59f7853d82a7} -> No File
CHR HomePage: Default -> hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v
CHR StartupUrls: Default -> "hxxp://search.yac.mx/?utm_source=b&utm_medium=iSafe&from=iSafe&uid=st500lt012-1dg142_s3p9bz3vxxxxs3p9bz3v"
CHR Extension: (Special Box) - C:\Users\karinka\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpaobfplglbecddbhjjmgabndhgcnck [2015-03-16]
CHR Extension: (IIseaver) - C:\ProgramData\plikinifhdpnaaohcpaccdnmmmdpmdhl\ []
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
R2 InternetSpeedTracker_9tService; C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tbarsvc.exe [90696 2015-04-07] (Mindspark)
R2 Update Special Box; C:\Program Files (x86)\Special Box\updateSpecialBox.exe [401648 2015-04-07] ()
R2 Util Special Box; C:\Program Files (x86)\Special Box\bin\utilSpecialBox.exe [401648 2015-04-07] ()
Toolbar: HKLM-x32 - Internet Speed Tracker - {665cb5b7-4c3b-4995-8cec-1f4d5860edc9} - C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tbar.dll [2015-04-07] (Mindspark)
Toolbar: HKU\S-1-5-21-2840933420-1225328898-113816797-1001 -> Internet Speed Tracker - {665CB5B7-4C3B-4995-8CEC-1F4D5860EDC9} - C:\Program Files (x86)\InternetSpeedTracker_9t\bar\1.bin\9tbar.dll No File
BHO-x32: Search Assistant BHO -> {cc28794a-99d4-4b1b-bccf-b065ce5f9feb} -> C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tSrcAs.dll [2015-04-07] (Mindspark)
BHO-x32: Toolbar BHO -> {9e28b297-11d4-4293-aa6f-558658ee66ae} -> C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tbar.dll [2015-04-07] (Mindspark)
URLSearchHook: HKU\S-1-5-21-2840933420-1225328898-113816797-1001 - (No Name) - {b287e6b2-868b-4ac1-acce-c69eb5fd29d1} - C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tSrcAs.dll (Mindspark)
HKLM-x32\...\Run: [Internet Speed Tracker EPM Support] => C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\9tmedint.exe [12872 2015-04-07] (Mindspark)
HKLM-x32\...\Run: [Internet Speed Tracker AppIntegrator 32-bit] => C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\AppIntegrator.exe [225864 2015-04-07] (Mindspark)
HKLM-x32\...\Run: [Internet Speed Tracker AppIntegrator 64-bit] => C:\Program Files (x86)\InternetSpeedTracker_9t\bar\2.bin\AppIntegrator64.exe [258632 2015-04-07] (Mindspark)
HKLM-x32\...\Run: [Internet Speed Tracker Search Scope Monitor] => "C:\PROGRA~2\INTERN~2\bar\2.bin\9tsrchmn.exe" /m=2 /w /h
C:\Program Files (x86)\InternetSpeedTracker_9t
R1 {20da0614-35ac-464d-8200-eee5dbb17760}Gw64; C:\Windows\System32\drivers\{20da0614-35ac-464d-8200-eee5dbb17760}Gw64.sys [48784 2015-04-01] (StdLib)
R1 {71841b04-1cf8-4575-bb09-affe4c54c593}Gw64; C:\Windows\System32\drivers\{71841b04-1cf8-4575-bb09-affe4c54c593}Gw64.sys [48784 2015-03-16] (StdLib)
R1 {d6a952e5-7b3c-4022-b41c-bf46977ae947}Gw64; C:\Windows\System32\drivers\{d6a952e5-7b3c-4022-b41c-bf46977ae947}Gw64.sys [48784 2015-03-12] (StdLib)
S2 ATE_PROCMON; \??\C:\Program Files (x86)\Anti Trojan Elite\ATEPMon.sys [X]
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
C:\Program Files (x86)\Elex-tech
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.
Uruchom FRST i kliknij przycisk Fix.

----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).
.

Autor postu otrzymał pochwałę

**Posty:** 2 · przez **kari94** 08 Kwi 2015, 12:24

Wszystko jest już ok. Bardzo dziękuję za pomoc.