Dziwne strony w przeglądarce-pomocy

Wojciech32 · 13 Wrzesień 2009 20:43

Od jakiegoś czasu przy uruchamianiu Mozilli Firefoxa otwiera mi się mnóstwo stron z jakimiś reklamami itp.

Błagam pomóżcie!

Z góry dziękuję za każdą dobrą radę!

Oto logi:

http://wklejto.pl/42489

http://www.wklejto.pl/42490

http://www.wklejto.pl/42498

http://www.wklejto.pl/42499

Umpfh · 14 Wrzesień 2009 00:16

W okienko OTL wklej poniższy skrypt i klik na Run Fix:

:Processes explorer.exe :OTL O2 - BHO: NP Helper Class - {35B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Internet Saving Optimizer\3.7.1.4630\NPIEAddOn.dll O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No CLSID value found. O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found. O4 - HKLM…\Run: [NDSTray.exe] File not found O4 - HKLM…\Run: [NWEReboot] File not found O4 - HKLM…\Run: [TFncKy] File not found O8 - Extra context menu item: Analizuj za pomoc¹ LeechGet - C:\Program Files\LeechGet 2004\Parser.html File not found O8 - Extra context menu item: E&ksport do programu Microsoft Excel - Reg Error: Value error. File not found O8 - Extra context menu item: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE File not found O8 - Extra context menu item: Pobierz u¿ywaj¹c kreatora LeechGet - C:\Program Files\LeechGet 2004\Wizard.html File not found O8 - Extra context menu item: Pobierz u¿ywaj¹c LeechGet - C:\Program Files\LeechGet 2004\AddUrl.html File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\bnmndrv.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\bnmndrv.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\bnmndrv.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\bnmndrv.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\bnmndrv.dll () O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\System32\bnmndrv.dll () O33 - MountPoints2{224affa0-3669-11de-bf07-0013027b8c1d}\Shell - “” = AutoRun O33 - MountPoints2{224affa0-3669-11de-bf07-0013027b8c1d}\Shell\AutoRun - “” = Auto&Play O33 - MountPoints2{4506ee5e-44a9-11de-bf2a-0013027b8c1d}\Shell\AutoRun - “” = Auto&Play O33 - MountPoints2{bd80e452-e0f2-11dd-be4f-0013027b8c1d}\Shell\AutoRun\command - “” = qvmdcnor.exe O33 - MountPoints2{bd80e452-e0f2-11dd-be4f-0013027b8c1d}\Shell\explore\Command - “” = qvmdcnor.exe O33 - MountPoints2{bd80e452-e0f2-11dd-be4f-0013027b8c1d}\Shell\open\Command - “” = qvmdcnor.exe O33 - MountPoints2{e46c1933-43e3-11de-bf28-0013027b8c1d}\Shell\AutoRun\command - “” = wscript.exe …vbs O33 - MountPoints2{e46c1933-43e3-11de-bf28-0013027b8c1d}\Shell\open\command - “” = wscript.exe …vbs O16 - DPF: {F84E0B64-1E86-4640-8094-5B38CEB28C1E} (SkyFex Client Object) - https://skyfex.com/download/SkyFexClient.cab O16 - DPF: {7557F5AA-D486-401D-BE55-0163FA78B5B8} (SkyFex Expert Object) - https://skyfex.com/download/SkyFexExpert.cab :Reg [-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2] :Commands [emptytemp] [start explorer] [Reboot]

Daj loga powstałego po kasowaniu + nowego.

ciemnowidz · 14 Wrzesień 2009 04:57

Umpfh, wiesz od czego ten plik?

Domyślam się, że nie. Poza tym OTL i tak tego nie usunie co najwyżej się zawiesi.

Wojciech32 , wklej w OTL

:Processes explorer.exe :OTL FF - prefs.js…extensions.enabledItems: {2224E955-00E9-4613-A844-CE69FCCAAE91}:3.7.1.4630 FF - prefs.js…extensions.enabledItems: {0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC}:1.6.0.940 FF - HKLM\software\mozilla\Firefox\Extensions\{2224E955-00E9-4613-A844-CE69FCCAAE91}: C:\Program Files\Internet Saving Optimizer\3.7.1.4630\FF [2009/09/03 17:28:48 | 00,000,000 | —D | M] FF - HKLM\software\mozilla\Firefox\Extensions\{0BA0192D-94A5-45e3-B2B8-3EC5A1A0B5EC}: C:\Program Files\Media Access Startup\1.6.0.940\FF [2009/09/03 17:28:58 | 00,000,000 | —D | M] O2 - BHO: (Media Access Startup) - {25B8D58C-B0CB-46b0-BA64-05B3804E4E86} - C:\Program Files\Media Access Startup\1.6.0.940\HPIEAddOn.dll () O2 - BHO: (System Search Dispatcher) - {CDBFB47B-58A8-4111-BF95-06178DCE326D} - C:\Program Files\System Search Dispatcher\1.4.1.1010\ssd.dll File not found O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found. O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found. O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {5617ECA9-488D-4BA2-8562-9710B9AB78D2} - No CLSID value found. O3 - HKU\S-1-5-21-1862067393-1772702364-111652429-1006…\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found. O4 - HKLM…\Run: [NDSTray.exe] File not found O4 - HKLM…\Run: [NWEReboot] File not found O4 - HKLM…\Run: [TFncKy] File not found [2009/09/03 17:41:25 | 00,000,000 | —D | C] – C:\Documents and Settings\Wojciech\Local Settings\Application Data\Internet Saving Optimizer [2009/09/03 17:28:59 | 00,000,000 | —D | C] – C:\Documents and Settings\Wojciech\Local Settings\Application Data\Media Access Startup [2009/09/03 17:28:57 | 00,000,000 | —D | C] – C:\Program Files\Media Access Startup [2009/09/03 17:28:47 | 00,000,000 | —D | C] – C:\Program Files\Internet Saving Optimizer [2009/09/03 17:28:15 | 00,000,000 | —D | C] – C:\Program Files\DoubleD [2009/09/03 17:27:43 | 00,000,000 | —D | C] – C:\Documents and Settings\Wojciech\Local Settings\Application Data\DoubleD :Files C:\Program Files\mozilla firefox\searchplugins\sukoku117.xml :Reg [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “SuperHidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “Hidden”=dword:00000001 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced] “ShowSuperHidden”=dword:00000001 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL] “CheckedValue”=dword:00000001 [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden] @="" :Commands [emptytemp] [start explorer] [Reboot]

Klikasz Run Fix. Pokazujesz log z usuwania i nowy z OTL.

Wojciech32 · 14 Wrzesień 2009 16:54

Oto logi:

http://www.wklejto.pl/42527

http://www.wklejto.pl/42528

– Dodane 14.09.2009 (Pn) 21:06 –

jest Ok czy jeszcze nie?

ciemnowidz · 15 Wrzesień 2009 04:44

Kroki końcowe.

Wyłącz na chwilę przywracanie systemu - XP/Vista

Wykonaj pełny skan Malwarebytes Anti-Malware, jeśli coś znajdzie - usuń i wklej log.

Przeczyść dysk i rejestr CCleaner’em.

Podepnij pamięci przenośne i zastosuj FlashDisinfector