Strong Signal Ads

Mrozio99 · 13 Maj 2015 10:42

Witam. Od 2 dni wyskakują mi reklamy “Strong Signal Ads”. Bardzo proszę o pomoc.

FRST:

http://wklej.to/Xeim5

Addition:

http://wklej.to/4Nl6Q

Shortcut

http://wklej.to/Qq4Bl

Atis · 13 Maj 2015 10:49

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

CloseProcesses:
HKLM-x32\...\Run: [] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKU\S-1-5-21-425697130-2423384976-1920107721-1000\...\Run: [SoftonicAssistant] => "C:\Users\Waldek\AppData\Local\SoftonicAssistant\SoftonicAssistant.exe"
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll No File
CHR Extension: (Bookmark Manager) - C:\Users\Waldek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-05-12]
OPR Extension: (Strong Signal) - C:\Users\Waldek\AppData\Roaming\Opera Software\Opera Stable\Extensions\ldpclljhefhlahjipacagpcjolbejgcm [2015-05-12]
StartMenuInternet: (HKLM) OperaStable - C:\Program Files (x86)\Opera\Launcher.exe http://www.delta-homes.com/?type=sc&ts=1402563180&from=wpm0612&uid=SAMSUNGXHM321HI_S26VJ9FB339890
R2 Service Mgr StrongSignal; C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\PluginContainer.exe [556304 2015-05-13] ()
R2 Update Mgr StrongSignal; C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe [478992 2015-05-13] ()
S2 Kingsoft_WPS_UpdateService; C:\Users\Waldek\AppData\Local\Kingsoft\WPS Office\9.1.0.4941\wtoolex\wpsupdatesvr.exe [X]
S2 HTService; C:\Users\Waldek\AppData\Roaming\HTThread\hb.exe [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2014-12-28] ()
C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce
C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce
C:\Windows\System32\DRIVERS\EsgScanner.sys
2015-05-12 16:32 - 2015-05-12 16:32 - 00000000 ____ D () C:\Program Files (x86)\Strong Signal
2015-04-21 16:09 - 2015-04-21 16:09 - 00738232 _____ (Generic internet ) C:\Users\Waldek\Downloads\Word-Viewer(12113)-dp.exe
2015-05-12 16:33 - 2015-01-04 12:01 - 00000000 ____ D () C:\AdwCleaner
2015-01-08 11:23 - 2015-01-08 11:23 - 0000036 _____ () C:\Users\Waldek\AppData\Local\housecall.guid.cache
2014-10-14 14:46 - 2014-10-14 14:46 - 0000094 _____ () C:\Users\Waldek\AppData\Local\fusioncache.dat
2015-01-03 12:51 - 2015-01-03 12:51 - 0628496 _____ (CMI Limited) C:\Users\Waldek\AppData\Local\nsdC134.tmp
Task: {08375BC3-46F6-4ED4-BD39-092E7F26F0E1} - System32\Tasks\{97F85946-DD18-4F78-A760-FC53FC234A3E} => Chrome.exe http://ui.skype.com/ui/0/6.18.0.106/pl/abandoninstall?page=tsProgressBar
Task: {DE63A98D-8D8B-42C1-A680-1F13995479BC} - System32\Tasks\Norton Security Scan for Waldek => C:\Program Files (x86)\Norton Security Scan\Engine\4.1.0.28\Nss.exe [2014-01-27] (Symantec Corporation)
Task: {7550B898-10E0-44A9-BE7A-03F729D66E52} - System32\Tasks\WpsUpdateTask_Waldek => C:\Users\Waldek\AppData\Local\Kingsoft\WPS Office\9.1.0.4941\wtoolex\wpsupdate.exe
Task: {DE63A98D-8D8B-42C1-A680-1F13995479BC} - System32\Tasks\Norton Security Scan for Waldek => C:\Program Files (x86)\Norton Security Scan\Engine\4.1.0.28\Nss.exe [2014-01-27] (Symantec Corporation)
Task: {F2455260-F89E-4A43-AE0B-B978175CCCAA} - System32\Tasks\WpsNotifyTask_Waldek => C:\Users\Waldek\AppData\Local\Kingsoft\WPS Office\9.1.0.4941\wtoolex\wpsnotify.exe
Task: {FD967976-E9C2-46B9-A89B-BDABFC95549B} - System32\Tasks\{3317247D-10D1-4885-9C75-6067CB5D6864} => pcalua.exe -a C:\Users\Waldek\AppData\Local\Temp\{70772259-F3FF-4C98-A202-709E76234382}\setup.exe -d "C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153"
Task: C:\Windows\Tasks\Norton Security Scan for Waldek.job => C:\PROGRA~2\NORTON~2\Engine\410~1.28\Nss.exe
Task: C:\Windows\Tasks\WpsNotifyTask_Waldek.job => C:\Users\Waldek\AppData\Local\Kingsoft\WPS Office\9.1.0.4941\wtoolex\wpsnotify.exe
Task: C:\Windows\Tasks\WpsUpdateTask_Waldek.job => C:\Users\Waldek\AppData\Local\Kingsoft\WPS Office\9.1.0.4941\wtoolex\wpsupdate.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.