Spam od ads

Dla specjalistów Bezpieczeństwo
#1

Witam mam mały problem gdyż w firefoxie jestem zawalany reklamami, na innych sie to nie pojawia lecz w w FF jest totalna masakra. Bardzo proszę o pomoc :wink:

#2

Odinstaluj Cinemax,WinZipper,WorldofTanks.Otwórz notatnik systemowy i wklej:

Task: {0359AE5E-5DCE-4675-A679-AD5B7D3AC12C} - System32\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-4 = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-4.exe [2014-11-13] (SBG) ==== ATTENTION
Task: {0A94D335-ED4F-4ABB-9882-6AC30B8BEF30} - System32\Tasks\globalUpdateUpdateTaskMachineUA = C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-11-13] (globalUpdate) ==== ATTENTION
Task: {2413A68C-451C-47C8-B084-45C67190429E} - System32\Tasks\bMIlcjfVLNWQcbz9 = C:\Users\Bastek\AppData\Roaming\bMIlcjfVLNWQcbz9.exe [2015-04-03] ()
Task: {43C829FA-847F-44A2-ADAA-ADE739084E67} - System32\Tasks\AVG-Secure-Search-Update_0414c_rmv = C:\Program Files (x86)\AVG SafeGuard toolbar\AVG-Secure-Search-Update_0414c.exe [2014-04-21] ()
Task: {4FAFC4DE-C0B7-4A2E-BD80-8524C8269C6C} - System32\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-7 = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-7.exe [2014-11-13] (SBG) ==== ATTENTION
Task: {63ABE497-3EA1-43A0-9011-924AA70DF19E} - System32\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-6 = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-6.exe [2014-11-13] (SBG) ==== ATTENTION
Task: {ACE1D255-14C2-4514-9222-407458320B2E} - \temp_ad0f00fe-d5ec-407c-b9e1-29d019e07cae-2 No Task File ==== ATTENTION
Task: {AF794ABD-2AC9-4004-977D-CF59AA50A63D} - System32\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-11 = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-11.exe [2014-11-13] (SBG) ==== ATTENTION
Task: {B97B7D9E-6CD0-4F5A-B20C-465B24F00A85} - System32\Tasks\{8D402455-144E-444B-BA17-E03AC370B292} = pcalua.exe -a C:\Users\Bastek\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=amt
Task: {C6B77665-5B68-4D4C-8B96-81931078348E} - System32\Tasks\globalUpdateUpdateTaskMachineCore = C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2014-11-13] (globalUpdate) ==== ATTENTION
Task: {C8526D03-177E-4DC0-B544-E57A35BBF0B1} - System32\Tasks\AVG-Secure-Search-Update_0414c_rel = C:\Program Files (x86)\AVG SafeGuard toolbar\AVG-Secure-Search-Update_0414c.exe [2014-04-21] ()
Task: {DCF141F3-3D23-43A7-B3E3-6E8ABF59EB09} - System32\Tasks\sun_king_updating_service = C:\Program Files (x86)\sun king\sun_king_updating_service.exe [2015-04-01] ()
Task: {DCFF2096-496A-4D01-99F6-A0EAF45DBBE4} - System32\Tasks\Xzg9FPSCY1u = C:\Users\Bastek\AppData\Roaming\Xzg9FPSCY1u.exe [2015-04-03] ()
Task: {F496E2DE-B21B-439F-B0B6-5613B50E5906} - System32\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-1 = C:\Program Files (x86)\Cinemax\Cinemax-codedownloader.exe ==== ATTENTION
Task: {FBB9EC83-1F30-4B11-B551-8976E6F48A0C} - System32\Tasks\sun_king_notification_service = C:\Program Files (x86)\sun king\sun_king_notification_service.exe [2015-04-01] (FileProperties_CompanyName)
Task: C:\Windows\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-1.job = C:\Program Files (x86)\Cinemax\Cinemax-codedownloader.exe ==== ATTENTION
Task: C:\Windows\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-11.job = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-11.exe ==== ATTENTION
Task: C:\Windows\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-4.job = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-4.exe ==== ATTENTION
Task: C:\Windows\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-6.job = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-6.exe ==== ATTENTION
Task: C:\Windows\Tasks\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-7.job = C:\Program Files (x86)\Cinemax\ad0f00fe-d5ec-407c-b9e1-29d019e07cae-7.exe ==== ATTENTION
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0414c_rel.job = C:\Program Files (x86)\AVG SafeGuard toolbar\AVG-Secure-Search-Update_0414c.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_0414c_rmv.job = C:\Program Files (x86)\AVG SafeGuard toolbar\AVG-Secure-Search-Update_0414c.exe
Task: C:\Windows\Tasks\bMIlcjfVLNWQcbz9.job = C:\Users\Bastek\AppData\Roaming\bMIlcjfVLNWQcbz9.exe
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job = C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe ==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job = C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe ==== ATTENTION
Task: C:\Windows\Tasks\sun_king_notification_service.job = C:\Program Files (x86)\sun king\sun_king_notification_service.exeä/url='http:/cdn.selectbestopt.com/notf_sys/index.html' /crregname='sun king' /appid='73143' /srcid='2913' /bic='90f4a78465c821e5885b0327f99af52c' /verifier='03bedbdffcaeb6669cd5c32b8ac27835' /installerversion='1.50.3.10' /statsdomain='http:/stats.buildomserv.com/data.gif?' /errorsdomain='http:/stats.buildomserv.com/data.gif?' /monetizationdomain='http:/logs.buildomserv.com/monetization.gif
Task: C:\Windows\Tasks\sun_king_updating_service.job = C:\Program Files (x86)\sun king\sun_king_updating_service.exe© /campid=2913 /verid=1 /url=http:/cdn.buildomserv.com/txt/@CAMPID@/@VER@/file.txt /appid=73143 /taskname=sun_king_updating_service /funurl=http:/stats.buildomserv.com
Task: C:\Windows\Tasks\temp_ad0f00fe-d5ec-407c-b9e1-29d019e07cae-2.job = ==== ATTENTION
Task: C:\Windows\Tasks\Xzg9FPSCY1u.job = C:\Users\Bastek\AppData\Roaming\Xzg9FPSCY1u.exe
ShellIconOverlayIdentifiers: [00avast] - {472083B0-C522-11CF-8763-00608CC02F24} = No File
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
HKU\S-1-5-21-3995545375-2010775081-3461000954-1001\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=dsts=1418363467from=wpm12123uid=395049983_1052482_E897A2FDq={searchTerms}
HKU\S-1-5-21-3995545375-2010775081-3461000954-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKU\S-1-5-21-3995545375-2010775081-3461000954-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
HKU\S-1-5-21-3995545375-2010775081-3461000954-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=dsts=1418363467from=wpm12123uid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1415887887from=amtuid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKU\S-1-5-21-3995545375-2010775081-3461000954-1001 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=dsts=1418363467from=wpm12123uid=395049983_1052482_E897A2FDq={searchTerms}
SearchScopes: HKU\S-1-5-21-3995545375-2010775081-3461000954-1001 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=dsts=1418363467from=wpm12123uid=395049983_1052482_E897A2FDq={searchTerms}
BHO: Cinemax - {11111111-1111-1111-1111-110611111195} - C:\Program Files (x86)\Cinemax\Cinemax-bho64.dll [2014-11-13] (SBG)
BHO-x32: Cinemax - {11111111-1111-1111-1111-110611111195} - C:\Program Files (x86)\Cinemax\Cinemax-bho.dll [2014-11-13] (SBG)
BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll [2014-11-13] (Thinknice Co. Limited)
BHO-x32: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File
FF SearchEngineOrder.1: V9
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: V9
FF Homepage: hxxp://www.mystartsearch.com/?type=hpts=1415887887from=amtuid=395049983_1052482_E897A2FD
FF SearchPlugin: C:\Users\Bastek\AppData\Roaming\Mozilla\Firefox\Profiles\b5q055vr.default\searchplugins\V9.xml [2015-01-29]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\delta-homes.xml [2014-12-12]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\mystartsearch.xml [2014-11-13]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml [2014-08-27]
FF Extension: CinemaxME - C:\Users\Bastek\AppData\Roaming\Mozilla\Firefox\Profiles\b5q055vr.default\Extensions\9d2db1ce83264e61a7ee63d4f@f932995ed00643899218cf824d695.com [2015-03-17]
FF Extension: Fast Start - C:\Users\Bastek\AppData\Roaming\Mozilla\Firefox\Profiles\b5q055vr.default\Extensions\faststartff@gmail.com [2014-11-13]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Bastek\AppData\Roaming\Mozilla\Firefox\Profiles\b5q055vr.default\extensions\faststartff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [detgdp@gmail.com] - C:\Users\Bastek\AppData\Roaming\Mozilla\Firefox\Profiles\b5q055vr.default\extensions\detgdp@gmail.com
CHR HomePage: Default - hxxp://www.delta-homes.com/?type=hpts=1418363467from=wpm12123uid=395049983_1052482_E897A2FD
CHR StartupUrls: Default - "hxxp://www.delta-homes.com/?type=hpts=1418363467from=wpm12123uid=395049983_1052482_E897A2FD"
CHR DefaultSearchKeyword: Default - delta-homes
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-11-13] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2014-11-13] (globalUpdate) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [714208 2014-11-13] (Cherished Technololgy LIMITED)
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424624 2015-01-12] (Taiwan Shui Mu Chih Ching Technology Limited.) ==== ATTENTION
R1 {55dce8ba-9dec-4013-937e-adbf9317d990}Gw64; C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys [61120 2014-07-18] (StdLib)
R1 {bb7b7a60-f574-47c2-8a0b-4c56f2da9802}Gw64; C:\Windows\System32\drivers\{bb7b7a60-f574-47c2-8a0b-4c56f2da9802}Gw64.sys [48784 2014-09-26] (StdLib)
S3 EagleX64; \\C:\Windows\system32\drivers\EagleX64.sys [X]
S1 iSafeKrnlMon; \\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2015-04-03 15:49 - 2015-04-03 15:49 - 01577472 _____ () C:\Users\Bastek\AppData\Roaming\bMIlcjfVLNWQcbz9.exe
2015-04-03 15:49 - 2015-04-03 15:49 - 01224704 _____ () C:\Users\Bastek\AppData\Roaming\Xzg9FPSCY1u.exe
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.