Witam,
Laptop mojej znajomej pracuje dość wolno. Poza tym pojawiają się różne reklamy w czasie pracy. Przeskanowałem laptop Malwarebytes, usunąłem obiekty, które znalazł.
Bardzo proszę o analizę poniższych logów i pomoc w całkowitym usunięciu infekcji
Pobierz i uruchom AdwCleaner Kliknij Skanuj (Scan) i później Usuń (Cleaning).
Kliknij Skanuj (Scan) i pokaż nowy raport FRST i Addition.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
HKU\S-1-5-21-881362243-4221639735-2891982643-1000\...\Run: [Akamai NetSession Interface] = "C:\Users\Ola\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-881362243-4221639735-2891982643-1000\...\Policies\Explorer: []
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia ======= UWAGA
CHR HKU\S-1-5-21-881362243-4221639735-2891982643-1000\SOFTWARE\Policies\Google: Ograniczenia ======= UWAGA
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKU\S-1-5-21-881362243-4221639735-2891982643-1000 - Brak nazwy - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Brak pliku
FF SearchEngineOrder.1: V9
FF Extension: ActiveDiscount - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\i6dlil41.default\extensions\raru_smpueeb@_xxgdlvvnilrcohtas.edu [2015-05-04] [Brak podpisu cyfrowego]
S3 cpuz134; \??\C:\Users\Ola\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 STHDA; system32\DRIVERS\stwrt.sys [X]
2016-02-09 11:04 - 2015-01-24 21:17 - 00000000 ___DC C:\AdwCleaner
2013-06-26 23:44 - 2014-06-24 18:58 - 0003730 ____ C () C:\Program Files\Mozilla Firefoxavg-secure-search.xml
2015-05-27 15:44 - 2015-10-14 21:16 - 0000024 _____ () C:\Users\Ola\AppData\Roaming\appdataFr25.bin
2015-03-06 12:17 - 2015-05-04 18:50 - 0000020 _____ () C:\Users\Ola\AppData\Roaming\appdataFr3.bin
2013-06-18 10:51 - 2013-07-16 19:23 - 0000000 _____ () C:\Users\Ola\AppData\Roaming\bitlord_log.txt
2015-01-24 17:29 - 2015-01-24 17:29 - 0628496 _____ (CMI Limited) C:\Users\Ola\AppData\Local\nsmDBE9.tmp
2015-01-24 16:57 - 2015-01-24 16:56 - 0613057 _____ (CMI Limited) C:\Users\Ola\AppData\Local\nsu3CAE.tmp
2015-05-27 15:37 - 2015-05-27 15:45 - 0000780 _____ () C:\Users\Ola\AppData\Local\Temp-log.txt
2012-05-19 13:52 - 2016-02-09 11:05 - 0000000 _____ () C:\Users\Ola\AppData\Local\WavXMapDrive.bat
2012-05-20 21:23 - 2012-05-20 21:23 - 0017408 _____ () C:\Users\Ola\AppData\Local\WebpageIcons.db
2015-01-24 14:15 - 2015-01-24 20:58 - 0000112 _____ () C:\ProgramData\44yLth.dat
Task: {12E6DAC1-A38E-462D-9006-F45A45477BC4} - System32\Tasks\{615A047C-5C54-4C92-9B19-A3514E38DA86} = pcalua.exe -a "H:\programy\CorelDRAW Graphics Suite X4\Setup\Setup.exe" -d "H:\programy\CorelDRAW Graphics Suite X4\Setup"
Task: {154EBED9-8E4D-4F7E-BDD0-404DD558C8B3} - System32\Tasks\{129680E8-6D94-48A5-9B67-76B32C27C308} = pcalua.exe -a C:\Users\Ola\Downloads\iview437_setup.exe -d C:\Users\Ola\Downloads
Task: {2472E77C-0367-47CF-801B-B56F19693A7E} - System32\Tasks\{8C9AD14A-3EEA-4154-BDC4-C836D1EF8D96} = pcalua.exe -a C:\Users\Ola\Downloads\6890-INST-WIN7-A.EXE -d "C:\Program Files\Mozilla Firefox"
Task: {28C1081B-79BF-46D8-9366-9525B3935577} - System32\Tasks\{43B75DA5-3D46-4C85-A568-FAD5EF473C0B} = C:\Users\Ola\Desktop\WhatsApp-Hack-Sniffer-v-2.3_recovered\WhatsApp Hack Sniffer v 2.3.exe
Task: {45F15329-D8B8-4AC2-BFB7-C9B456C20CDD} - System32\Tasks\{C04B7185-C024-4F95-9378-4F94D5C6B378} = pcalua.exe -a C:\Users\Ola\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=amt
Task: {5C5E518F-CBB2-4ED3-84E9-C1F9C2292696} - System32\Tasks\{BA6D0847-E21F-4B0A-8ACD-D54FE6D578C0} = pcalua.exe -a C:\Users\Ola\AppData\Local\{FE8E8CCA-3620-418A-8A73-65F652ED69FF}\OffersWizard.exe -c -delete-
Task: {5EA24A88-FFEE-421F-8E91-A1D04AD5CDD9} - System32\Tasks\{775A401D-4AC1-403B-9B6B-CED7D6F75FBD} = pcalua.exe -a "C:\ProgramData\NoMore Ads\NoMore Ads.exe" -c /progname=NoMore Ads /progver=3.4.2 /progpub=NoMore Ads /proguninstallurl=asdahjka.com /deleteappfolder=0 /deletefile2="C:\Program Files\Google\Chrome\Applicationupdate.dll" /deletefile3="C:\Program Files\Google\Chrome\Applicationchrome.dll" /VERYSILENT
Task: {5F6682CC-7BEC-48FF-9801-E5769F423A36} - System32\Tasks\{7CD2D20D-2E3E-4293-9767-ED7CAB60DED1} = C:\Program Files\Ares\Ares.exe
Task: {78684B90-681A-41CA-9BC8-7F37FFB8C87F} - System32\Tasks\{43E7B7A6-AEB2-4999-A757-E5E8222A9809} = pcalua.exe -a "E:\AutoCAD 2008\Setup\Setup.exe" -d "E:\AutoCAD 2008\Setup"
Task: {79C657F0-976D-45EC-A874-6B513BAE98D9} - System32\Tasks\{D9731D8D-3254-4CC7-A17B-56B2BFEB156F} = pcalua.exe -a "C:\Program Files\PowerISO\PowerISO.exe" -d C:\Users\Ola\Desktop\AutoCAD.2008.PL\CD1\CD1 -c "C:\Users\Ola\Desktop\AutoCAD.2008.PL\CD1\CD1\AutoCAD 2008 PL Cd1.nrg"
Task: {7AFA5142-63D6-490E-BDBA-CC36037789B1} - \DNSCOLFAX - Brak pliku ==== UWAGA
Task: {AA50897F-955F-48CC-9FAD-4F52E79DC038} - System32\Tasks\{1AB1277C-AA2C-43C8-A8AA-03D7DC6E2F1D} = pcalua.exe -a F:\ModemDeviceSetup.exe -d F:\
Task: {D215F9EE-355B-47A3-8C1F-65C1E5747D0B} - System32\Tasks\{466EB62D-1707-49CE-BFD4-CF97A268312D} = pcalua.exe -a E:\setup_db.exe -d E:\
Task: {D91D7FCD-F7E1-4335-8370-75C6B2EC2352} - System32\Tasks\{D917BE2F-532D-43B2-8C85-0EA2801E45A0} = pcalua.exe -a "C:\Program Files\ActiveDeals\ActiveDeals.exe" -c /s /n /i:"ExecuteCommands;UninstallCommands" ""
Task: {DF893910-476C-4D9F-8320-69CD5C6D04DD} - System32\Tasks\{430D036B-240E-4412-A116-2BDCA62EFB00} = C:\Program Files\Ares\Ares.exe
Task: {EF64D2E9-ECBF-4558-B8EE-67C053F0766E} - System32\Tasks\{0B7BFBC9-4E6C-4B3F-B9AF-B185100BA4BE} = C:\Users\Ola\Desktop\WhatsApp-Hack-Sniffer-v-2.3_recovered\WhatsApp Hack Sniffer v 2.3.exe
EmptyTemp:
Uruchom FRST i kliknij Napraw (Fix). Pokaż raport z usuwania Fixlog.
Odinstaluj Chrome zaznaczając usunięcie danych przeglądania za pomocą Geek Uninstaller Free: KLIK
Skasuj folder C:\FRST
Dziękuję bardzo za pomoc! 