Wyskakujące reklamy - ks.exe

carlito89 · 29 Lipiec 2015 13:18

Witam,

Mam dokładnie ten sam problem co kolega w tym temacie:

http://forum.dobreprogramy.pl/upierdliwy-wirus-z-reklam%C4%85-przy-starcie-systemu-t511525/

Zakładam, że rady, które dano jemu są personalizowane i nie pomogą mnie. Dodam jedynie, że reklama nie pojawia się po usunięciu skrótu: Archive z autostartu, ale to pewnie nie rozwiązuje problemu dlatego wklejam raport z FRST i bardzo proszę o pomoc.

FRST:

http://wklej.org/id/1765000/

Addition txt:

http://wklej.org/id/1765006/

Shortcut txt:

http://wklej.org/id/1765008/

Pozdrawiam

Atis · 29 Lipiec 2015 14:12

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

CloseProcesses:
HKU\S-1-5-21-3228294644-3005118042-2186107232-1000\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-3228294644-3005118042-2186107232-1000\...\RunOnce: [Adobe Speed Launcher] => 1438175392
Startup: C:\Users\Tomek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SynTPEnh.vbs [2015-07-25] ()
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR Extension: (Chrome Web Store Payments) - C:\Users\Tomek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-12-20]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_3; \??\C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 NTIOLib_MSIClock_CC; \??\B:\Programy\Command Center\ClockGen\NTIOLib_X64.sys [X]
S3 NTIOLib_MSICOMM_CC; \??\B:\Programy\Command Center\NTIOLib_X64.sys [X]
S3 NTIOLib_MSICPU_CC; \??\B:\Programy\Command Center\CPU\NTIOLib_X64.sys [X]
S3 NTIOLib_MSIDDR_CC; \??\B:\Programy\Command Center\DDR\NTIOLib_X64.sys [X]
S3 NTIOLib_MSIFrequency_CC; \??\B:\Programy\Command Center\ClockGen\CPU_Frequency\NTIOLib_X64.sys [X]
S3 NTIOLib_MSIRatio_CC; \??\B:\Programy\Command Center\CPU\CPU_Ratio\NTIOLib_X64.sys [X]
S3 NTIOLib_MSISMB_CC; \??\B:\Programy\Command Center\SMBus\NTIOLib_X64.sys [X]
S3 NTIOLib_MSISuperIO_CC; \??\B:\Programy\Command Center\SuperIO\NTIOLib_X64.sys [X]
2015-07-29 15:08 - 2015-07-29 15:09 - 00000000 ____ D C:\AdwCleaner
2015-07-28 08:43 - 2015-07-28 08:43 - 00000000 ____ D C:\Users\Tomek\AppData\Local\CEF
C:\Users\Tomek\AppData\Roaming\*.exe
C:\Users\Tomek\AppData\Roaming\SynTPEnh.vbs
Task: {222FD7FF-F14C-4B76-B66F-0614F0582062} - System32\Tasks\{5FD38B98-B4B1-4B85-99D4-992BC3306660} => pcalua.exe -a E:\Uninstall.exe -d E:\
Task: {70B22406-FE76-4561-89D6-0BA818CFB26C} - System32\Tasks\{09D43FE1-7E9F-44AF-9123-29577C295A19} => Chrome.exe http://ui.skype.com/ui/0/7.0.80.102/pl/go/help.faq.installer?LastError=1618
Task: {8397571B-1FEA-4664-81C3-AAFBEFB8C897} - System32\Tasks\{BA96E66B-23D2-41AC-AE86-6269FB559E3C} => pcalua.exe -a "B:\Gry\The Bards Tale\Config\The Bard's Setup.exe" -d "B:\Gry\The Bards Tale\Config"
Task: {E95078F6-2017-425D-83D4-B0ADF9131CEC} - System32\Tasks\{15C5495B-B9A7-454F-8400-5F4586B22B35} => pcalua.exe -a "B:\Pobrane\OC_GURU II V1.78_B141219.exe" -d B:\Pobrane
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\06996019.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\06996019.sys => ""="Driver"
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.