sprawdzenie logów

[wojtok89 0]

Wyskakują reklamy dragon branch ads w otwartej karcie i w nowych.

 

http://wklej.org/id/1703299/ add

http://wklej.org/id/1703304/ frst

[Miszel03 0]

Owszem, jest tutaj adware Dragon Branch jest też wiele innych śmieciwoych przekierowywań. Ponad to widać tutaj ślady po infekcji ZeroAccess!

 

Zaczynamy:

 

1. Do notatnika wklej i zapisz jako fixlist.txt i kliknij Fix w Interfejsie FRST

Plik fixlist.txt umieść obok programu FRST

 

CloseProcesses:
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (No File)
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: No Name -> {10921475-03CE-4E04-90CE-E2E7EF20C814} ->  No File
SearchScopes: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000 -> {1E4257BA-ECCB-493A-B246-C0424CF12106} URL = http://search.yahoo.com/search?p={searchterms}&ei=UTF-
8&fr=w3i&type=W3i_DS,105,0_0,Search,20120625,6900,0,6,0
Winsock: Catalog5 01 C:\windows\system32\mswsock.dll [231424 2013-10-09] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
FF Extension: Dragon Branch - C:\Users\gienek\AppData\Roaming\Mozilla\Firefox\Profiles\vsvk4c4r.default\Extensions\{cba1be0d-f6d3-4548-bccd-fb56885b460e}.xpi [2015-05-03]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
U3 a9v0bx46; C:\windows\system32\Drivers\a9v0bx46.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero size file/folder)
S1 A2DDA; \??\D:\EEK\BIN\a2ddax86.sys [X]
S3 AIDA32Driver; \??\C:\Users\gienek\AppData\Local\Temp\Rar$EX00.620\aida32.sys [X]
S3 ALSysIO; \??\C:\Users\gienek\AppData\Local\Temp\ALSysIO.sys [X]
S3 BT; No ImagePath
S3 BTCOM; No ImagePath
S3 BTCOMBUS; No ImagePath
S3 Btcsrusb; No ImagePath
S0 BTHidEnum; No ImagePath
S0 BTHidMgr; No ImagePath
S3 btwampfl; No ImagePath
S3 btwl2cap; No ImagePath
S3 catchme; \??\C:\Users\gienek\AppData\Local\Temp\catchme.sys [X]
S3 cleanhlp; \??\D:\eek\bin\cleanhlp32.sys [X]
S3 cpuz134; \??\C:\Users\gienek\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [X]
S3 SASENUM; \??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS [X]
S3 SWDUMon; system32\DRIVERS\SWDUMon.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S4 VComm; No ImagePath
S4 VcommMgr; No ImagePath
S3 VirtualDK; \??\C:\usb_boot_prep_xp\usb_prep8\vdk.sys [X]
S3 VirtualFD; \??\D:\ll\vfd.sys [X]
S3 vserial; System32\DRIVERS\vserial.sys [X]
S3 wanatw; No ImagePath
Task: {09F546D7-58DD-4EC7-B877-ACD6F4CA9516} - \Program aktualizacji online firmy Adobe. No Task File <==== ATTENTION
Task: {39B35260-E480-483E-96BB-A1B70B551CCD} - \Program aktualizacji online produktu Real Player. No Task File <==== ATTENTION
AlternateDataStreams: C:\ProgramData\Temp:07BF512B
AlternateDataStreams: C:\ProgramData\Temp:373E1720
AlternateDataStreams: C:\ProgramData\Temp:900081EB
AlternateDataStreams: C:\ProgramData\Temp:DA5888A7
AlternateDataStreams: C:\ProgramData\Temp:FB6A21E3
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\008i.com -> 008i.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\008k.com -> 008k.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\00hq.com -> 00hq.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\0190-dialers.com -> 0190-dialers.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\01i.info -> 01i.info
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\02pmnzy5eo29bfk4.com -> 02pmnzy5eo29bfk4.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\05p.com -> 05p.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\07ic5do2myz3vzpk.com -> 07ic5do2myz3vzpk.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\08nigbmwk43i01y6.com -> 08nigbmwk43i01y6.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\093qpeuqpmz6ebfa.com -> 093qpeuqpmz6ebfa.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\0calories.net -> 0calories.net
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\0cj.net -> 0cj.net
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\0scan.com -> 0scan.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\1-britney-spears-nude.com -> 1-britney-spears-nude.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\1-domains-registrations.com -> 1-domains-registrations.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\1-se.com -> 1-se.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\1001movie.com -> 1001movie.com
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\1001night.biz -> 1001night.biz
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\100gal.net -> 100gal.net
IE restricted site: HKU\S-1-5-21-2440634791-3158896077-4223476700-1000\...\100sexlinks.com -> 100sexlinks.com
Removeproxy:
CMD: ipconfig /flush dns
cmd: netsh winsock reset
EmptyTemp:

 

2. Pobierz AdwClaner uruchom go i kliknij szukaj a gdy ukatywni się przycisk usuń kliknij go.

 

AdwClaner: http://www.bleepingcomputer.com/download/adwcleaner/

 

3. Wstaw raport ze skryptu (Fixlog) i raport z Adwclaner (Raport z Adwclaner znajduję się w tym folderze: C:\AdwCleaner) + zrób nowe logi z FRST (Zaznacz też: Addition i ShortCup)

 

EDIT:

 

Masz prawo do zakładania tematów na innych forach, ale z przyzwoitości mógłbyś o tym napisać, analiza oraz nałożenie odpowiednich instrukicji zajmuje mi dużo cennego czasu które mógłbym poświęcić dla innych użytkowników!

 

http://forum.komputerswiat.pl/topic/66786-sprawdzenie-logow/

[wojtok89 0]

sory następnym razem będę o tym pamiętać.