Agresywne reklamy plus zamulający system

Xilulek · 6 Październik 2014 19:57

zmulony komp, proszę o pomoc

FRST

http://wklej.org/id/1481233/

Additional

http://wklej.org/id/1481236/

Atis · 6 Październik 2014 20:13

W panelu sterowania odinstaluj:

CheapCoupon

Delta toolbar

Optimizer Pro v3.2

Shopper-Pro

WebConnect 3.0.0

Pobierz i uruchom AdwCleaner Kliknij Szukaj i później Usuń.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.

Xilulek · 6 Październik 2014 21:55

cheap coupon ciagle prosi o zamkniecie przegladarki - nawet po restarcie gdzie wszystko jest zamkniete - nieaktualne

http://wklej.org/id/1481332/

Atis · 6 Październik 2014 22:14

Odinstaluj McAfee Security Scan Plus.

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKU\S-1-5-21-3474292665-236664941-2962657505-1082\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.202\jsdrv.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackTrayMenu.lnk
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackUpdateChecker.lnk
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {D5A92381-BADA-4781-B201-AD4315A71C0E} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=888596&p={searchTerms}
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin -> C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)
CHR DefaultSearchKeyword: Default -> omiga-plus
CHR DefaultSearchProvider: Default -> omiga-plus
CHR DefaultSearchURL: Default -> http://isearch.omiga-plus.com/web/?type=dspp&ts=1409997947&from=epom&uid=SAMSUNGXHD503HI_S23CJ90Z600930&q={searchTerms}
CHR Extension: (A HREF) - C:\Users\Adminn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkanabbomegdcfhkfppalghjamfekegb [2014-09-26]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S2 SPDRIVER_1.37.0.202; \??\C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.202\jsdrv.sys [X]
C:\Users\Adminn\Downloads\Farbar-Recovery-Scan-Tool(46164)-dp (1).exe
C:\Windows\system32\WPRO_41_2001woem.tmp
C:\Users\Adminn\Downloads\FRST-OlderVersion
C:\AdwCleaner
C:\Users\Adminn\Downloads\Farbar-Recovery-Scan-Tool(46164)-dp.exe
C:\Users\Adminn\Downloads\foobar2000(13337)-dp.exe
C:\Users\Adminn\Downloads\foobar2000(13337)-dp (1).exe
Task: {03A899FB-50DA-407C-A935-CFED845CDB2A} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [2014-07-29] (PC Utilities Software Limited) <==== ATTENTION
Task: {09EB4EA4-053E-4AF5-8C9D-19044027EE45} - System32\Tasks\ShopperProJSUpd => C:\Program Files (x86)\ShopperPro\updater.exe [2014-07-22] (Goobzo) <==== ATTENTION
Task: {2E5B4EF1-2A4B-4DFB-8E72-88CAFCE6AE7B} - System32\Tasks\EPUpdater => C:\Users\Admin\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe <==== ATTENTION
Task: {4DAE87F8-B47F-4DEA-87E4-A76967E4A4CC} - System32\Tasks\SPDriver => C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.202\jsdrv.exe [2014-07-22] () <==== ATTENTION
Task: {4ED1B6E0-2D46-4458-B090-300401075E2A} - System32\Tasks\SPBIW_UpdateTask_Time_313037343139303935342d3437415a556c2a3223346c41 => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0
Task: {D1050CF5-3565-4CC7-8B2F-DF93975E2D38} - System32\Tasks\UNELEVATE_30646 => C:\Program Files (x86)\ShopperPro\JSDriver\1.37.0.202\jsdrv.exe [2014-07-22] () <==== ATTENTION
Task: {D85D62FE-40D9-4893-B970-E115C4AEBBAB} - System32\Tasks\ShopperPro => C:\Program Files (x86)\ShopperPro\ShopperPro.exe [2014-07-22] (Goobzo LTD) <==== ATTENTION
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.