Problemy z Great Deals - reklamy itd.

[Fust3nD 0]

Witam mam uporczywe problemy siedzac na chromie wyskakuja mi jakies dziwne reklamy np na serwisach aukcyjnych z jakimis przedmiotami. Jezeli by ktos zauwazyl jeszcze jakies problemy/inne wirusy prosze mnie pokierowac bo jestem totalnie zielony w tych sprawach. Logi:

 

http://www.wklej.org/id/2451085/ (FRST)

 

http://www.wklej.org/id/2451119/ (Addition)

[Miszel03 0]

W systemie widać szczątki po usuniętym już adware SmarterPower, niestety widać tutaj jeszcze aktywne szkodniki takie jak np. adware Guntony oraz kilka innych. Na przyszłość: w systemie u Ciebie widzę również szczątkowe elementy po oprogramowaniu YAC i SpyHunter oba te programy są bardzo wątpliwej reputacji, były na czarnej liście, - instalacja stanowczo odradzana.

 

Dezynfekcja:

 

1. Do notatnika wklej i zapisz jako fixlist.txt i kliknij Fix w Interfejsie FRST

Plik fixlist.txt umieść obok programu FRST

 

CloseProcesses:
CreateRestorePoint:
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-3949429607-1792238317-1548453112-1000\...\Run: [] => [X]
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  Brak pliku
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-3949429607-1792238317-1548453112-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
HKU\S-1-5-21-3949429607-1792238317-1548453112-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.com/?bcutc=sp-006
HKU\S-1-5-21-3949429607-1792238317-1548453112-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.google.com/?bcutc=sp-006
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB&q={searchTerms}
SearchScopes: HKLM -> {4411D28A-8E11-4F26-AA16-B4192652F7B0} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB&q={searchTerms}
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1422019199&from=zbd1&uid=toshibaxmk5065gsxn_y0tqb14hbxxy0tqb14hb&q={searchTerms}
SearchScopes: HKLM-x32 -> {C3F741AD-CAD2-4F2D-9416-CA1EE713AB81} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1000 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1422019199&from=zbd1&uid=toshibaxmk5065gsxn_y0tqb14hbxxy0tqb14hb&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1000 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1422019199&from=zbd1&uid=toshibaxmk5065gsxn_y0tqb14hbxxy0tqb14hb&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1000 -> {5C76546A-D5F7-4978-9D77-EAEDFE38B0C2} URL = hxxp://rover.ebay.com/rover/1/4908-44618-9400-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1000 -> {F5FEA5DF-E303-42F2-86B3-0F403DA3AD68} URL = hxxp://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {209F02FC-2B3F-4C59-959E-2C57CB8CA309} URL = hxxp://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB&ts=1393425538&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1422019199&from=zbd1&uid=toshibaxmk5065gsxn_y0tqb14hbxxy0tqb14hb&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {4411D28A-8E11-4F26-AA16-B4192652F7B0} URL = 
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {A176413D-E840-4004-92DD-4F81293FE0D1} URL = hxxp://rover.ebay.com/rover/1/4908-44618-9400-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {C3F741AD-CAD2-4F2D-9416-CA1EE713AB81} URL = 
SearchScopes: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-006&q={searchTerms}
BHO-x32: Brak nazwy -> {88be1aa9-6740-461c-9e3e-f35eb8fa741c} -> Brak pliku
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Brak pliku
Toolbar: HKLM - Brak nazwy - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Brak pliku
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-05-16] ()
R2 Guntony_protect; C:\ProgramData\Guntony\protect\protect.exe [302976 2016-05-12] ()
S2 Guntony_update; C:\Program Files (x86)\Guntony\Guntony\bin\Guntony_server.exe [473472 2016-05-12] ()
C:\ProgramData\Guntony
C:\windows\System32\Tasks\GuntonyCheckTask
C:\windows\System32\Tasks\GuntonyBrowserUpdateCore
C:\Users\Jarek\AppData\Local\Guntony
C:\Program Files (x86)\Guntony
C:\windows\System32\Tasks\GuntonyBrowserUpdateUA
C:\Users\Public\Documents\Guntony
S2 Update SmarterPower; "C:\Program Files (x86)\SmarterPower\updateSmarterPower.exe" [X]
S2 Util RightSurf; "C:\Program Files (x86)\RightSurf\bin\utilRightSurf.exe" [X]
S2 Util SmarterPower; "C:\Program Files (x86)\SmarterPower\bin\utilSmarterPower.exe" [X]
C:\Program Files (x86)\SmarterPower
R1 {5eeb83d0-96ea-4249-942c-beead6847053}Gw64; C:\Windows\System32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}Gw64.sys [61080 2014-08-28] (StdLib)
S3 IT9135BDA; System32\Drivers\IT9135BDA.sys [X]
S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]
2016-05-16 15:32 - 2016-05-16 15:32 - 00022704 _____ C:\windows\system32\Drivers\EsgScanner.sys
2016-05-16 15:31 - 2016-05-16 15:32 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Jarek\Downloads\SpyHunter-Installer.exe
2016-05-16 15:30 - 2016-05-16 15:30 - 03286400 _____ (Enigma Software Group USA, LLC.) C:\Users\Jarek\Downloads\Niepotwierdzony 42613.crdownload
2016-05-16 17:08 - 2015-01-09 17:26 - 00000000 ____D C:\Program Files (x86)\Elex-tech
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Jarek\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Jarek\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Jarek\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Jarek\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-3949429607-1792238317-1548453112-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Jarek\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll => Brak pliku
C:\Users\Jarek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\Users\Jarek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\Users\Jarek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\Users\Jarek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\Users\Jarek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\48499db33039e897\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Guntony\Guntony\chrome.exe (Google Inc.)
ShortcutWithArgument: C:\Users\Jarek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB
ShortcutWithArgument: C:\Users\Jarek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB
ShortcutWithArgument: C:\Users\Jarek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.sweet-page.com/?type=sc&ts=1390926145&from=cor&uid=TOSHIBAXMK5065GSXN_Y0TQB14HBXXY0TQB14HB
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main" /f
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-21\Software\Microsoft\Internet Explorer\SearchScopes" /f
CMD: dir /a "C:\Program Files"
CMD: dir /a "C:\Program Files (x86)"
CMD: dir /a "C:\Program Files\Common Files\System"
CMD: dir /a "C:\Program Files (x86)\Common Files\System"
CMD: dir /a C:\ProgramData
CMD: dir /a C:\Users\Jarek\AppData\Local
CMD: dir /a C:\Users\Jarek\AppData\LocalLow
CMD: dir /a C:\Users\Jarek\AppData\Roaming
EmptyTemp:

 

2. Przez Panel Sterowania Odinstaluj:

Amazon 1Button App

Amazon Assistant

 

3. Wyczyść:

>> Google Chrome:

 

• Zresetuj synchronizację (o ile włączona), punkt 2: KLIK.
  
• Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Zresetuj ustawienia przeglądarki. Zakładki i hasła nie zostaną naruszone, ale używane rozszerzenia zostaną wyłączone.
  
• Ustawienia > karta Ustawienia > sekcja Wyszukiwanie > klik w Zarządzanie wyszukiwarkami > skasuj z listy searchinterneat-a.akamaihd.net oraz inne niedomyślne śmieci (o ile będą).
  
• Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie Włącz.
  

 

>> FireFox:

 

• Odłącz synchronizację (o ile włączona): KLIK.
  
• Menu Pomoc > Informacje dla pomocy technicznej > Zresetuj / Odśwież program Firefox. Zakładki i hasła nie zostaną naruszone.
  
• Menu Historia > Wyczyść całą historię przeglądania.
  

 

4. Pobierz AdwCleaner uruchom go i kliknij szukaj a gdy uaktywni się przycisk usuń kliknij go.

 

5. Wstaw raport ze skryptu (Fixlog) i raport z Adwclaner (Raport z Adwcleaner znajduję się w tym folderze: C:\AdwCleaner) + zrób nowe logi z FRST (Zaznacz też: Addition i ShortCup)