Win 8.1 64bit wszechobecne reklamy

GandalfTheBlack · 3 Wrzesień 2015 09:24

Witam,

siostra skarży się na reklamy w laptopie, które pojawiają się wszędzie i spowalniają pracę systemu. Samo napisanie tego posta było sporym wyzwaniem przez właśnie te reklamy.

Oto potrzebne skany:

FRST: http://www.wklej.org/id/1789337/

Addition: http://www.wklej.org/id/1789340/

Shortcut: http://www.wklej.org/id/1789341/

Tak to wygląda:

Atis · 3 Wrzesień 2015 10:14

W panelu sterowania odinstaluj:

Click Caption 1.10.0.2

Sale Clipper

Search App by Ask

YTD Video Downloader 4.8.3

Pobierz i uruchom AdwCleaner Kliknij Scan i później Cleaning.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.

GandalfTheBlack · 3 Wrzesień 2015 10:52

FRST: http://www.wklej.org/id/1789378/

Atis · 3 Wrzesień 2015 11:18

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM-x32\...\Run: [fst_pl_206] => [X]
Winlogon\Notify\igfxcui: igfxdev.dll [X]
ShellIconOverlayIdentifiers: [SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Brak pliku
ShellIconOverlayIdentifiers: [SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Brak pliku
ShellIconOverlayIdentifiers: [SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Brak pliku
ShellIconOverlayIdentifiers-x32: [SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Brak pliku
ShellIconOverlayIdentifiers-x32: [SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Brak pliku
ShellIconOverlayIdentifiers-x32: [SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Brak pliku
GroupPolicy: Zasady grupy Chrome wykryto <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Zasada ograniczeń <======= UWAGA
SearchScopes: HKLM -> {FDFEEB45-4A6B-4A30-8B24-494E19ECF4A8} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {FDFEEB45-4A6B-4A30-8B24-494E19ECF4A8} URL = hxxp://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8&tag=hp-uk3-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3991648223-842079012-3483512502-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Toolbar: HKU\S-1-5-21-3991648223-842079012-3483512502-1001 -> Brak nazwy - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Brak pliku
Toolbar: HKU\S-1-5-21-3991648223-842079012-3483512502-1001 -> Brak nazwy - {5347542D-5350-006A-76A7-7A786E7484D7} - Brak pliku
FF Homepage: hxxp://search.yahoo.com/?fr=hp-ddc-bd&type=bl-bfr-is __alt__ ddc_dsssyc_bd_com
FF NewTab: hxxp://search.yahoo.com/?fr=hp-ddc-bd-tab&type=bl-bfr-is __alt__ ddc_dsssyctab_bd_com
FF Keyword.URL: hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=bl-bfr-is __alt__ ddc_dss_bd_com&p={searchTerms}
FF SelectedSearchEngine: Yahoo Search!
FF DefaultSearchEngine: Yahoo Search!
FF Extension: Sale Clipper - C:\Users\Monika\AppData\Roaming\Mozilla\Firefox\Profiles\xxl9ckw7.default\Extensions\{d2c04f0d-d0b8-4e7c-acc4-a22ec46c802b}.xpi [2015-06-23]
CHR Extension: (Sale Clipper) - C:\Users\Monika\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggiiepeljfmglpbkailobjkompnnbhio [2015-06-23]
OPR Extension: (Sale Clipper) - C:\Users\Monika\AppData\Roaming\Opera Software\Opera Stable\Extensions\ggiiepeljfmglpbkailobjkompnnbhio [2015-06-23]
S2 Nero BackItUp Scheduler 4.0; C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe [X]
S3 ewusbmbb; \SystemRoot\system32\DRIVERS\ewusbwwan.sys [X]
S3 ew_hwusbdev; \SystemRoot\system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; \SystemRoot\System32\drivers\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; \SystemRoot\system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_cdcecm; \SystemRoot\system32\DRIVERS\ew_jucdcecm.sys [X]
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; \SystemRoot\System32\drivers\ew_juextctrl.sys [X]
S3 huawei_wwanecm; \SystemRoot\system32\DRIVERS\ew_juwwanecm.sys [X]
S3 hwdatacard; \SystemRoot\system32\DRIVERS\ewusbmdm.sys [X]
S1 {bb7b7a60-f574-47c2-8a0b-4c56f2da9802}Gw64; system32\drivers\{bb7b7a60-f574-47c2-8a0b-4c56f2da9802}Gw64.sys [X]
2015-09-03 12:42 - 2015-09-03 12:44 - 00000000 ____ D C:\AdwCleaner
2014-08-13 10:54 - 2014-08-13 10:54 - 0752128 _____ () C:\Users\Monika\AppData\Local\AlawarHelper.exe
2014-09-24 10:14 - 2014-09-24 10:14 - 0627560 _____ (ClickMeIn Limited) C:\Users\Monika\AppData\Local\nszEECB.tmp
2012-12-28 21:52 - 2012-12-28 21:52 - 0000595 _____ () C:\ProgramData\CyberlinkOutput.txt
2014-07-11 17:26 - 2014-07-11 17:26 - 0000141 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
Task: {0D8A891D-890C-4808-84D8-2F436AB14653} - \Microsoft\Windows\Application Experience\AitAgent -> Brak pliku <==== UWAGA
Task: {1274336E-AB06-46B6-A48C-0671C5557CC6} - \Microsoft\Windows\TaskScheduler\Maintenance Configurator -> Brak pliku <==== UWAGA
Task: {1687544D-7247-4F5A-965A-A6E920E55278} - \Microsoft\Windows\TaskScheduler\Manual Maintenance -> Brak pliku <==== UWAGA
Task: {1956A68C-B4A0-4BE1-97C1-272FCCB99337} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {1ADC8AC0-35B9-41E5-8E5A-49F2F31AAA0F} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
Task: {40525C58-79C2-47A1-9AA2-F1D7FC4F0691} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> Brak pliku <==== UWAGA
Task: {4E1D959A-FAE1-4EC5-9C89-3182708719EF} - System32\Tasks\{457F8F28-4D04-4A61-A9F6-DAD2ADAA2101} => pcalua.exe -a C:\Users\Monika\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cornl
Task: {6F02587F-8A2B-4552-97F6-DEEF229E335B} - \Microsoft\Windows\TaskScheduler\Idle Maintenance -> Brak pliku <==== UWAGA
Task: {812B9604-71A3-4C26-ACAF-C56E037C19AE} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
Task: {9FAE843A-AFE7-405D-8DE8-25613F111AD5} - System32\Tasks\{ACD9F294-A0E4-4E45-9A70-F88B824A967B} => pcalua.exe -a C:\Users\Monika\Desktop\14-4-mobility-win7-win8-win8.1-64-dd-ccc-whql.exe -d C:\Users\Monika\Desktop
Task: {B7992938-01F1-4F40-A0EC-0D23D2F0F152} - \Microsoft\Windows\TaskScheduler\Regular Maintenance -> Brak pliku <==== UWAGA
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - \Microsoft\Windows\SettingSync\BackupTask -> Brak pliku <==== UWAGA
Task: {F6E5581C-C139-479D-8780-C38EA381E9E2} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== UWAGA
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.