Pełno reklam pomocy!

Dla specjalistów Bezpieczeństwo
#1

Włączają mi się reklamy w nowych oknach.

Problem występuje na dwóch laptopach.

Z góry dziękuję za pomoc.

OTL: http://wklej.org/id/1786830/

Extras.txt: http://wklej.org/id/1786834/

Frxst.txt: http://wklej.org/id/1786849/

Addition.txt: http://wklej.org/id/1786854/

Sortcut.txt: http://wklej.org/id/1786855/

AdwCleaner: http://wklej.org/id/1786861/

RSIT

log.txt: http://wklej.org/id/1786901/

info.txt: http://wklej.org/id/1786904/

#2

Odinstaluj YAC(Yet Another Cleaner!).Otwórz notatnik systemowy i wklej:

Task: {5FE78971-A58A-4BFA-97B9-EB0FB292E587} - System32\Tasks\{11EFBF47-8E03-4865-A2B0-AB825C547FDD} = pcalua.exe -a C:\Users\PC\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=smt
ShellIconOverlayIdentifiers: [00avast] - {472083B0-C522-11CF-8763-00608CC02F24} = Brak pliku
GroupPolicy: Zasady grupy Chrome wykryto ======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Zasada ograniczeń ======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hpts=1418846320from=wpm12173uid=WDCXWD1600BEVT-22ZCT0_WD-WXC20950265902659
HKU\S-1-5-21-3042498549-3902017219-2472964953-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hpts=1418846320from=wpm12173uid=WDCXWD1600BEVT-22ZCT0_WD-WXC20950265902659
SearchScopes: HKLM - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKLM - {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\.DEFAULT - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\.DEFAULT - {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-19 - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-19 - {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-20 - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-20 - {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-21-3042498549-3902017219-2472964953-1000 - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-21-3042498549-3902017219-2472964953-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3042498549-3902017219-2472964953-1000 - {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=dsts=1432197811from=zzgbkk123uid=wdcxwd1600bevt-22zct0_wd-wxc20950265902659z=4dd871b65cbabddc5454ee7gdzcc8ocg7t0m5b9e2tq={searchTerms}
SearchScopes: HKU\S-1-5-21-3042498549-3902017219-2472964953-1000 - {6B41B9A1-46D1-41CA-8FCE-76D8BD9C1BEC} URL = hxxp://search.delta-homes.com/web/?type=dsts=1418846320from=wpm12173uid=WDCXWD1600BEVT-22ZCT0_WD-WXC20950265902659q={searchTerms}
FF NewTab: hxxp://www.delta-homes.com/newtab/?type=ntts=1418846320from=wpm12173uid=WDCXWD1600BEVT-22ZCT0_WD-WXC20950265902659
FF SearchEngineOrder.1: V9
FF SelectedSearchEngine: V9
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\1o7dlkmu.default\searchplugins\ask-search.xml [2014-10-21]
FF SearchPlugin: C:\Users\PC\AppData\Roaming\Mozilla\Firefox\Profiles\1o7dlkmu.default\searchplugins\V9.xml [2015-01-22]
R2 iSafeService; C:\Program Files\Elex-tech\YAC\iSafeSvc.exe [118048 2015-07-01] (Elex do Brasil Participações Ltda)
S2 Update Framed Display; "C:\Program Files\Framed Display\updateFramedDisplay.exe" [X]
S2 Update PodoWeb; "C:\Program Files\PodoWeb\updatePodoWeb.exe" [X]
S2 Util Framed Display; "C:\Program Files\Framed Display\bin\utilFramedDisplay.exe" [X]
R1 iSafeKrnl; C:\Program Files\Elex-tech\YAC\iSafeKrnl.sys [227520 2015-07-01] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [50280 2015-07-01] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files\Elex-tech\YAC\iSafeKrnlKit.sys [97912 2015-07-01] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [45032 2015-07-01] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files\Elex-tech\YAC\iSafeKrnlR3.sys [73232 2015-07-01] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [44712 2015-06-30] (Elex do Brasil Participações Ltda)
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

Przeskanuj programem Malwarebytes Anti-Malware https://www.malwarebytes.org/downloads/

#3

Nie mogę odinstalować YAC(Yet Another Cleaner!)  :-( 

#4

Pomiń to i wykonaj resztę.

#5

Zrobiłem tak i dalej to samo

#6

Pokaż nowe logi z FRST.

#7

http://wklej.org/id/1788203/ - Shortcut

http://wklej.org/id/1788205/ -Addition

http://wklej.org/id/1788206/ -Frst

#8

Otwórz notatnik systemowy i wklej:

SearchScopes: HKLM - DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL =
SearchScopes: HKU\S-1-5-21-3042498549-3902017219-2472964953-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
2015-09-01 16:54 - 2015-05-19 19:30 - 00000000 ____ D C:\Users\PC\AppData\Roaming\Elex-tech
2015-09-01 16:53 - 2015-01-15 17:59 - 00000000 ____ D C:\Program Files\Elex-tech
2015-08-30 21:36 - 2015-05-19 19:23 - 00000000 ____ D C:\AdwCleaner
DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

Reset Chrome: https://support.google.com/chrome/answer/3296214?hl=pl

W pasek adresu wpisz: about:support Kliknij Odśwież program Firefox.

#9

Nie ma już reklam :smiley:

Z drugim laptopem otworzyć nowy wątek?

#10

Możesz.