Złośliwe oprogramowanie pod postacią "JAVA", problem z reklamami

Mix-up · 19 Styczeń 2015 20:26

Witam,

Mam problem z systemem, a mianowicie przeglądając interia.pl przeniosło mnie na stronę, która sugerowała nieaktualne oprogramowanie java, nieostrożnie kliknąłem w instalację. W tym momencie instalują mi się niepożądane aplikacje, przeglądarka Chrome zwariowała, sama przenosi na inne strony, zainstalowała mi się bez wiedzy Opera, wyskakują okienka „anyprotect cloud backup” & „regclean pro”, reklamy z programami do czyszczenia systemu i rejestru.

Czy możecie rzucić okiem na moje logi i powiedzieć jak pozbyć się tego złośliwego oprogramowania, proszę?

FRST

http://www.wklej.org/id/1601171/

Addition:

http://wklej.org/id/1601175/

Shortcut:

http://wklej.org/id/1601177/

Z góry dziękuję za pomoc!

adamk1985 · 19 Styczeń 2015 20:32

Pobierz ADWCleaner - http://www.dobreprogramy.pl/AdwCleaner,Program,Windows,38865.html

i przeskanuj kompa

potem popraw JRT: - http://www.dobreprogramy.pl/Junkware-Removal-Tool,Program,Windows,39541.html

Zaraz ktoś mądry podsunie ci pewnie też skrypt do FRST-a

Odinstaluj na pewno: Operę jeśli jej nie chcesz, RegClean-Pro, Spybot - Search & Destroy, Techgile, GoHD, AnyProtect.

Zamiast daemona zainstaluj sobie gburner, a zamiast winrara zainstaluj Bandizip.

Atis · 19 Styczeń 2015 20:53

W panelu sterowania odinstaluj:

AnyProtect

RegClean-Pro

Spybot - Search & Destroy

Techgile

Pobierz i uruchom AdwCleaner Kliknij Szukaj i później Usuń.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.

Mix-up · 19 Styczeń 2015 21:00

Odinstalowane powyższe. Zrobiłem skan, poniżej log.

http://wklej.org/id/1601242/

Adamek1985, Atis, dziękuję!

Sorki, to był log z AdwCleaner, poniżej log z FRST:

http://wklej.org/id/1601250/

Atis · 19 Styczeń 2015 22:02

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hppp&ts=1420832211&from=smt&uid=ST9320325AS_6VE54WKLXXXX6VE54WKL
CHR StartupUrls: Default -> "https://www.google.com/", "hxxp://www.mystartsearch.com/?type=hppp&ts=1420832211&from=smt&uid=ST9320325AS_6VE54WKLXXXX6VE54WKL"
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
C:\AdwCleaner
C:\Windows\System32\Tasks\Safer-Networking
C:\Program Files (x86)\Spybot - Search & Destroy 2
C:\ProgramData\Spybot - Search & Destroy
C:\Users\Shad\Downloads\spybot-2.4.exe
C:\Users\Shad\AppData\Local\nsuB256.tmp
C:\Program Files (x86)\f20d5c01-2f71-477f-8bf1-1d409ef5b2d7
C:\ProgramData\846063261
C:\Users\Gość
C:\Users\Administrator
C:\Users\HomeGroupUser$
Task: {016B4BCF-7AAC-4F58-A10B-CB74B7978067} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-10_user => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-10.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {01F49E0A-6268-4164-AAC2-8CF5B29869A5} - System32\Tasks\RegClean Pro_DEFAULT => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
Task: {0A4AA773-7CCF-4998-AE8B-EB6BA786017C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {0D44AF21-3B04-4918-A112-519A44EAEBC9} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-11 => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-11.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {11D056AF-9105-4C2B-BFA4-FA8A03BCFEB2} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-2 => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-2.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {134C235F-69D0-43E1-99D7-736C60706796} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {2A4D03DA-93E8-40CF-B71C-478F60F11882} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-01-19] (AnyProtect.com) <==== ATTENTION
Task: {2D445311-5B92-43AB-8261-E96EE2BF0504} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-01-19] (AnyProtect.com) <==== ATTENTION
Task: {3ABD6C5B-57A0-486F-890F-898467E4530D} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-5 => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-5.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {3B7931C9-FFFD-4DB2-8D3E-7E9A51943668} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-5_user => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-5.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {3D7EB095-A399-4407-B234-002692EFA07A} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-1 => C:\Program Files (x86)\GoHD\GoHD-codedownloader.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {6FA279AD-291F-483A-8C80-C556B9635E5E} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
Task: {6FABE513-760D-46D0-B4E2-D03EF8CB0A95} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2015-01-19] (AnyProtect.com) <==== ATTENTION
Task: {7152D82B-4473-4637-BA90-C7C08167929A} - System32\Tasks\Price Fountain => C:\Users\Shad\AppData\Roaming\PriceFountain\UpdateProc\UpdateTask.exe [2015-01-09] () <==== ATTENTION
Task: {92CF3EB2-9F11-46BF-AB17-6249F9C54764} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {993A214A-CC73-4B23-B30C-67B9564319B3} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-6 => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-6.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {AAAA94EF-8E2C-41C4-BC35-F2A08A23D176} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-01-19] (globalUpdate) <==== ATTENTION
Task: {AFD7C100-207A-4E3E-A313-DE32A7A7C56A} - System32\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-7 => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-7.exe [2015-01-19] (InstallMoon) <==== ATTENTION
Task: {BAFC6F0E-39B3-4F1B-9323-55547EF4FA95} - System32\Tasks\{853CA67D-C844-4EEB-9D47-C7B9C9B4497F} => pcalua.exe -a C:\Users\Shad\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=smt
Task: {BCE97012-3817-4F2A-BB24-220D5F261284} - System32\Tasks\{510F65ED-8E4E-4D3A-8305-D53EB9C3C4C0} => pcalua.exe -a C:\Users\Shad\Downloads\IN1WLN71WW1.exe -d C:\Users\Shad\Downloads
Task: {D3C92865-8651-49CD-92D9-2194F873863F} - System32\Tasks\RegClean Pro_UPDATES => C:\Program Files (x86)\RCP\RegCleanPro.exe [2014-12-08] () <==== ATTENTION
Task: {E97BD6BF-9AD4-4205-9416-FFDA17EC1A60} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-01-19] (globalUpdate) <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-1.job => C:\Program Files (x86)\GoHD\GoHD-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-10_user.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-10.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-11.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-11.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-2.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-2.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-5.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-5_user.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-5.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-6.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-6.exe <==== ATTENTION
Task: C:\Windows\Tasks\a3172e06-5aec-43ea-b671-945c412d895e-7.job => C:\Program Files (x86)\GoHD\a3172e06-5aec-43ea-b671-945c412d895e-7.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\Windows\Tasks\Price Fountain.job => C:\Users\Shad\AppData\Roaming\PRICEF~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_DEFAULT.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ATTENTION
Task: C:\Windows\Tasks\RegClean Pro_UPDATES.job => C:\Program Files (x86)\RCP\RegCleanPro.exe <==== ATTENTION
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.