Witam mam problem z wirusem zmieniającym numery kont, zechciałby ktoś pomóc?
FRST:
Addition:
Log Addition nie jest kompletny.
Dlaczego?
Nie jest cały.Umieść na wklej .org
Pobierz i uruchom AdwCleaner Kliknij Szukaj i później Usuń.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CloseProcesses:
HKLM-x32\...\Run: [Windows(R) Statistics Service] => C:\ProgramData\WinSTAT\WinSTAT.exe [1460736 2014-07-03] (Microsoft® Corporation)
HKU\S-1-5-21-1737183989-2921495425-1029108954-1000\...\Run: [Windows(R) Statistics Service] => C:\ProgramData\WinSTAT\WinSTAT.exe [1460736 2014-07-03] (Microsoft® Corporation)
HKU\S-1-5-21-1737183989-2921495425-1029108954-1000\...\Policies\Explorer: []
AppInit_DLLs: C:\PROGRA~2\SupTab\SEARCH~2.DLL => C:\PROGRA~2\SupTab\SEARCH~2.DLL File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SupTab\SEARCH~1.DLL => "C:\PROGRA~2\SupTab\SEARCH~1.DLL" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinSTAT.exe (Microsoft® Corporation)
Startup: C:\Users\Jacob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSTAT.exe (Microsoft® Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1404638795&from=cor&uid=TOSHIBAXMK6475GSX_22I5F66HSXX22I5F66HS&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1404638795&from=cor&uid=TOSHIBAXMK6475GSX_22I5F66HSXX22I5F66HS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1404638795&from=cor&uid=TOSHIBAXMK6475GSX_22I5F66HSXX22I5F66HS&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1404638795&from=cor&uid=TOSHIBAXMK6475GSX_22I5F66HSXX22I5F66HS&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {539E6CB9-3EC4-4200-82C8-912280C0A40F} URL =
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF HKLM-x32\...\Firefox\Extensions: [12x3q4@3244516.com] - C:\Program Files (x86)\Better-Surf\ff
CHR Extension: (poricechoep) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcoigllpomleojiobgdieobohnmpljio [2014-08-30]
CHR Extension: (Browser Extension) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gdalhedleemkkdjddjgfjmcnbpejpapp [2014-08-30]
CHR Extension: (WebbIonog) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlfnnnmbjgidpbcjobjefomikagjkldo [2014-09-11]
CHR Extension: (NeextCouip) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\odhkcdheceimajpgbjjminggmgmlkfhm [2014-09-01]
CHR Extension: (poricechoep) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcoigllpomleojiobgdieobohnmpljio\3.9 [2014-08-30]
CHR Extension: (NeextCouip) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\odhkcdheceimajpgbjjminggmgmlkfhm\1.0 [2014-09-01]
CHR Extension: (WebbIonog) - C:\Users\Jacob\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlfnnnmbjgidpbcjobjefomikagjkldo\1.1 [2014-09-11]
CHR HKLM-x32\...\Chrome\Extension: [mmifolfpllfdhilecpdpmemhelmanajl] - C:\Program Files (x86)\BetterSurf\BetterSurfPlus\ch\BetterSurfPlus.crx [2014-05-08]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S2 HOSTS Anti-PUPs; C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware.exe [285795 2014-04-26] () [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [757872 2014-06-19] (Cherished Technololgy LIMITED)
R1 {55685567-4840-4a91-962b-49a412e9485a}Gw64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys [61112 2014-05-26] (StdLib)
R1 {55685567-4840-4a91-962b-49a412e9485a}w64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys [61112 2014-06-09] (StdLib)
R1 {6fcd6092-9615-4f7f-8898-8df53980e5d2}w64; C:\Windows\System32\drivers\{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys [61112 2014-07-10] (StdLib)
R1 {9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64; C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys [61112 2014-05-24] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}w64.sys
C:\Windows\System32\drivers\{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys
C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys
C:\Users\Jacob\Desktop\FRST-OlderVersion
C:\Users\Jacob\AppData\Roaming\tor
C:\ProgramData\WebbIonog
C:\ProgramData\IePluginServices
C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs
C:\Program Files (x86)\Better-Surf
C:\ProgramData\WinSTAT
Task: {00BB7B18-9E55-4CCC-B6B3-C2C90676E215} - \AmiUpdXp No Task File <==== ATTENTION
Task: {04FFFFF3-450C-4C0D-9F45-455963629CBE} - System32\Tasks\WinSTAT => C:\ProgramData\WinSTAT\WinSTAT.exe [2014-07-03] (Microsoft® Corporation)
Task: {ECA0F54E-2169-472B-91D3-E25A4C59E38C} - \Dealply No Task File <==== ATTENTION
Hosts:
EmptyTemp:
Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.
Kliknij Scan i pokaż nowy raport z FRST bez Addition.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
HKLM-x32\...\Run: [HOSTS Anti-Adware_PUPs] => C:\Program Files (x86)\Hosts_Anti_Adwares_PUPs\HOSTS_Anti-Adware_main.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
C:\AdwCleaner
DeleteQuarantine:
Uruchom FRST i kliknij Fix. Skasuj folder C:\FRST
Usuń stare punkty przywracania: Aby usunąć wszystkie punkty przywracania
Dysk przeskanuj Malwarebytes Anti-Malware
Podczas instalacji usuń zaznaczenie przy Uruchom okres testowy Malwarebytes Anti-Malware Premium.
http://wstaw.org/m/2014/03/25/2014-03-25_123039.png
Język PL > Settings > General Settings > Language > Polish
Odinstaluj:
Adobe Shockwave Player 12.1
Java 2 Runtime Environment, SE v1.4.2_03
Java 6 Update 30
Zainstaluj Java 8 Update 25
Ok zrobiłem , skanowanie wykazało jeszcze jakieś 2 zagrożenia ale numery kont się już nie zmieniają. Dzięki wielkie za pomoc.