Reklamy

[Alesha 0]

Hey, mam problem z reklamami, wyskakują mi co chwilę a przy okazji włączają wyłączoną przeglądarkę.

Próbowałam sama znaleźć rozwiązanie problemu, ale nadal jest ten sam problem.

Przesyłam skany z programu FRST:

FRST.txt https://wklej.to/G26CF

Addition.txt https://wklej.to/YlpLe

[filutka78 11]

1) Odinstaluj niepotrzebny do niczego Akamai NetSession Interface

 

2) Otwórz Notatnik i wklej w nim:

RemoveDirectory: c:\program files (x86)\kukther

C:\ProgramData\service.exe

RemoveDirectory: C:\Program Files (x86)\Tulejedupy Log

RemoveDirectory: C:\ProgramData\Logic Handler

ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%

ShortcutWithArgument: C:\Users\Klaudia\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%

Task: {DC5A85BA-BB87-4A1A-AAB0-FA8F37A45F9D} - System32\Tasks\Qirakmomse => /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=TOSHIBAXMQ01ABD100_94ODP4PETXX94ODP4PET&v=201725 /q

Task: {DEE113F4-75A0-436C-9F40-8CA714DB3ED8} - System32\Tasks\Tulejedupy Log => C:\Program Files (x86)\Kukther\reirise.exe [2017-02-05] (Glarysoft Ltd)

Task: {75A3A10E-3324-4E9A-A080-CBDAF7C9A7A6} - \WPD\SqmUpload_S-1-5-21-2982923038-2014424793-3310140659-1002 -> Brak pliku <==== UWAGA

Task: {8704976F-C352-41C6-9528-BEEE5C3D0B3B} - \McAfee\McAfee Idle Detection Task -> Brak pliku <==== UWAGA

RemoveDirectory: C:\Program Files (x86)\PublicHotspot

2016-07-12 11:58 - 2016-07-12 11:58 - 7101952 _____ () C:\Users\Klaudia\AppData\Roaming\agent.dat

2016-07-12 11:58 - 2016-07-12 11:58 - 0054272 _____ () C:\Users\Klaudia\AppData\Roaming\ApplicationHosting.dat

2016-07-12 11:58 - 2016-07-12 11:58 - 0070176 _____ () C:\Users\Klaudia\AppData\Roaming\Config.xml

2016-07-12 11:56 - 2016-07-12 11:56 - 0018432 _____ () C:\Users\Klaudia\AppData\Roaming\InstallationConfiguration.xml

2016-07-12 11:56 - 2016-07-12 11:56 - 0128512 _____ () C:\Users\Klaudia\AppData\Roaming\Installer.dat

2016-07-12 11:58 - 2016-07-12 11:58 - 0126464 _____ () C:\Users\Klaudia\AppData\Roaming\lobby.dat

2016-07-12 11:58 - 2016-07-12 11:58 - 0018432 _____ () C:\Users\Klaudia\AppData\Roaming\Main.dat

2016-07-12 11:58 - 2016-07-12 11:58 - 0005568 _____ () C:\Users\Klaudia\AppData\Roaming\md.xml

2016-07-12 11:58 - 2016-07-12 11:58 - 0126464 _____ () C:\Users\Klaudia\AppData\Roaming\noah.dat

2016-07-12 11:58 - 2016-07-12 11:56 - 0700928 _____ () C:\Users\Klaudia\AppData\Roaming\Softfind.exe

2016-07-12 11:58 - 2016-07-12 11:58 - 0072704 _____ () C:\Users\Klaudia\AppData\Roaming\Softfind.tst

2016-07-12 11:57 - 2016-07-12 11:57 - 0848437 _____ () C:\Users\Klaudia\AppData\Roaming\Softstring.bin

2016-04-12 18:34 - 2017-02-05 19:29 - 0000062 _____ () C:\Users\Klaudia\AppData\Roaming\sp_data.sys

2016-07-12 11:59 - 2016-07-12 11:59 - 2279413 _____ () C:\Users\Klaudia\AppData\Roaming\Unais.bin

2016-07-12 11:59 - 2016-07-12 11:59 - 0032038 _____ () C:\Users\Klaudia\AppData\Roaming\uninstall_temp.ico

2016-07-12 11:58 - 2016-07-12 11:56 - 0700928 _____ () C:\Users\Klaudia\AppData\Roaming\Vilaplus.exe

2016-07-12 11:58 - 2016-07-12 11:58 - 1878389 _____ () C:\Users\Klaudia\AppData\Roaming\Vilaplus.tst

2016-06-09 17:57 - 2016-06-09 17:57 - 0000057 _____ () C:\ProgramData\Ament.ini

RemoveDirectory: C:\ProgramData\Thunder Network

RemoveDirectory: C:\Users\Public\Thunder Network

RemoveDirectory: C:\Program Files (x86)\UCBrowser

RemoveDirectory: C:\Users\Klaudia\AppData\Roaming\KuaiZip

RemoveDirectory: C:\Program Files (x86)\vlncminerwe

RemoveDirectory: C:\ProgramData\Avg

RemoveDirectory: C:\ProgramData\Avira

RemoveDirectory: C:\Users\Klaudia\AppData\Local\Fazgephazoch

RemoveDirectory: C:\Users\Klaudia\AppData\Roaming\vnlgp

RemoveDirectory: C:\Users\Klaudia\AppData\Roaming\Premerchanosck

RemoveDirectory: C:\Program Files\62VB84S7C3

C:\WINDOWS\SysWOW64\kz.exe

R4 KuaiZipDrive; \??\C:\WINDOWS\system32\drivers\KuaiZipDrive.sys [X]

R2 Plegerph; C:\Program Files (x86)\Kukther\ttkClient.dll [148992 2017-02-05] () [brak podpisu cyfrowego]

R2 GoogleChromeUpService; C:\ProgramData\service.exe [1620992 2017-02-05] () [brak podpisu cyfrowego] <==== UWAGA

R2 backlh; C:\ProgramData\Logic Handler\set.exe [2089472 2016-05-15] () [brak podpisu cyfrowego]

CHR HomePage: Default -> hxxp://www.sweet-page.com/?type=hp&ts=1409340254&from=cor&uid=ST1000LM024XHN-M101MBB_S2Y4J9AF108624

CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1409340254&from=cor&uid=ST1000LM024XHN-M101MBB_S2Y4J9AF108624","hxxp://www.gazeta.pl/0,0.html?p=156","www.wp.pl/?src01=dp120140913","hxxp://www.gazeta.pl/0, 0.html?p=156","hxxp://www.yessearches.com/?mode=nnnb&ptid=dam&uid=6CA757CAFA40E8C464C3519CB7515191&v=20160202&ts=AHEpBXAtCHMnBk..","hxxp://www.yoursearching.com/?type=hp&ts=1457864488&z=90274ab19a3fc72ea722d3fgbz5wbm1b3q3z0z7b2q&from=brd&uid=TOSHIBAXMQ01ABD100_94ODP4PETXX94ODP4PET","hxxp://www.yoursearching.com/?type=hp&ts=1457864789&z=96034ee922d2bc88bcf80a3g7z5wam9b4qfzbmbbam&from=brd&uid=TOSHIBAXMQ01ABD100_94ODP4PETXX94ODP4PET","hxxp://www.yessearches.com/?mode=nnnb&ptid=sqr1&uid=E3C032CAF4A612073F200096D257F927&v=20160301&ts=AHEpBnUqBnUpCE..","hxxp://www.yessearches.com/?mode=nnnb&ptid=dam&uid=EB18AC4762FC55191D751EB3A245DA8D&v=20160412&ts=AHEqA3IkA30tAU.."

CHR DefaultSearchURL: Default -> hxxp://search.so-v.com/web?type=ds&x=fqxbzkqqks-f646abe6&uid=c6332a95-1cc8-407d-89ca-1d1e1824bb09&q={searchTerms}

SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =

SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYon7Be-HRonE3N_Bwc5GnK7hqcrPLmJW6DVnBGxlWK2eCzZ4rVMGfHNL1D2of9KKGL2hwwcOmidDezkPTYGbTBexHPKFJSiuLhnsH50pWXzfWrOoJ5hHh7h8baYjgIE8CFSoMKfN5fIOWU0npVfZ3sbtK17A,,&q={searchTerms}

SearchScopes: HKU\S-1-5-21-2982923038-2014424793-3310140659-1002 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYon7Be-HRonE3N_Bwc5GnK7hqcrPLmJW6DVnBGxlWK2eCzZ4rVMGfHNL1D2of9KKGL2hwwcOmidDezkPTYGbTBexHPKFJSiuLhnsH50pWXzfWrOoJ5hHh7h8baYjgIE8CFSoMKfN5fIOWU0npVfZ3sbtK17A,,&q={searchTerms}

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYon7Be-HRonE3N_Bwc5GnK7hqcrPLmJW6DVnBGxlWK2eCzZ4rVMGfHNL1D2of9KKGL2hwwcOmidDezkPTYGbTBexHPKFJSiuLhnsH50pWXzfWrOoJ5hHh7h8baYjgIE8CFSoMKfN5fIOWU0npVfZ3sbtK17A,,&q={searchTerms}

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku

HKLM\...\Providers\mem4jqty: C:\Program Files (x86)\Tulejedupy Log\local64spl.dll [289792 2017-02-05] ()

ShellExecuteHooks: Brak nazwy - {305EB69A-DE4C-11E6-BED1-64006A5CFC23} - C:\Users\Klaudia\AppData\Roaming\Premerchanosck\Clkity.dll -> Brak pliku

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\...\Policies\Explorer: []

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\...\Run: [Akamai NetSession Interface] => C:\Users\Klaudia\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\...\Run: [msiql] => C:\Users\Klaudia\AppData\Local\Temp\00029835\msiql.exe [2072064 2017-02-05] () <===== UWAGA

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\...\Run: [XGTOJQESGO.exe] => C:\Users\Klaudia\AppData\Local\Temp\42-97b69-acd-f4f83-69d05b104fea8\XGTOJQESGO.exe [438272 2017-02-05] (dshjdsjhj) <===== UWAGA

HKU\S-1-5-21-2982923038-2014424793-3310140659-1002\...\Run: [bWGJPNLEKA.exe] => C:\Users\Klaudia\AppData\Local\Temp\42-97b69-acd-f4f83-69d05b104fea8\BWGJPNLEKA.exe [232448 2017-02-05] () <===== UWAGA

HKLM\...\RunOnce: [GEDICVPYMS] => "C:\Program Files\62VB84S7C3\FQG9VLMLA.exe"

HKLM\...\RunOnce: [OMEWPRODUCT_JVK44] => C:\Program Files (x86)\PublicHotspot\7MNV67.exe [70656 2017-02-05] (1@@K27K) <===== UWAGA

HKLM\...\RunOnce: [ZMSORCPYG5] => C:\Program Files (x86)\PublicHotspot\T6AASO52AO.exe [676864 2017-02-05] (1@@K27K)

HKLM-x32\...\Run: [] => [X]

FirewallRules: [TCP Query User{6BA22C28-B202-43A9-9D05-5F4A84F7A099}C:\users\klaudia\appdata\local\temp\is-42kfm.tmp\download\minithunderplatform.exe] => C:\users\klaudia\appdata\local\temp\is-42kfm.tmp\download\minithunderplatform.exe

FirewallRules: [uDP Query User{82C9CA08-0C6B-4079-8EB6-6B328E084584}C:\users\klaudia\appdata\local\temp\is-42kfm.tmp\download\minithunderplatform.exe] => C:\users\klaudia\appdata\local\temp\is-42kfm.tmp\download\minithunderplatform.exe

FirewallRules: [{8DDE8410-3B58-4496-B05C-2CCFED52D2C2}] => C:\Users\Klaudia\AppData\Local\Temp\is-42KFM.tmp\download\MiniThunderPlatform.exe

FirewallRules: [TCP Query User{2B6DEC44-9B72-4BDC-AD66-97C450050B81}C:\users\klaudia\appdata\local\akamai\netsession_win.exe] => C:\users\klaudia\appdata\local\akamai\netsession_win.exe

FirewallRules: [uDP Query User{5682DEDE-1BAD-4D10-B30B-6B3E26DB0E88}C:\users\klaudia\appdata\local\akamai\netsession_win.exe] => C:\users\klaudia\appdata\local\akamai\netsession_win.exe

C:\users\klaudia\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{F971D9BD-1B15-423B-A8DD-9C8D8B93C9D7}C:\users\klaudia\appdata\local\akamai\netsession_win.exe] => C:\users\klaudia\appdata\local\akamai\netsession_win.exe

FirewallRules: [uDP Query User{CDEED565-CBDA-4496-96BB-127AD46F84CF}C:\users\klaudia\appdata\local\akamai\netsession_win.exe] => C:\users\klaudia\appdata\local\akamai\netsession_win.exe

EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

3) Użyj >Adw-cleaner

najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk OCZYŚĆ (CLEANING), to kliknij na niego.

Pokaż raport z niego "C"

 

4) Zrób nowe logi FRST.

przed skanem zaznacz: Additional.txt Shortcut.txt,

 

F.

[Alesha 0]

Dziękuję za pomoc, zdaje się, że problem zniknął

Oto nowe logi:

FRST.txt: https://wklej.to/tBh2b

Addition.txt: https://wklej.to/1pyf6

Shortcut.txt: https://wklej.to/lSDIe

AdwCleaner: https://wklej.to/C9rFK

[filutka78 11]

2017-02-05 18:56 - 2017-02-05 18:56 - 00000000 ____D C:\Users\Klaudia\AppData\Roaming\Arrowhead

Znasz to?

 

Jeśli nie znasz, to zrobisz to:

Otwórz Notatnik i wklej w nim:

C:\Users\Klaudia\AppData\Roaming\Arrowhead

Task: {044CDD6A-9729-4625-BD8D-B89170944C2A} - System32\Tasks\{0BD1F4F5-C617-432C-99B3-5F14A158669E} => pcalua.exe -a "D:\Users\Public\Daybreak Game Company\Installed Games\DC Universe Online\Uninstaller.exe"

C:\Users\Klaudia\Desktop\Inne\Avast Free Antivirus.lnk

C:\Users\Klaudia\Desktop\Inne\Avast SafeZone Browser.lnk

EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

F.

[Alesha 0]

Skasowałam i to.

Wszystko jest już dobrze, jeszcze raz serdecznie dziękuję za pomoc