Ciągle reklamy - logi do sprawdzenia

[Polon013]

Witam.

 

Mam małą prośbę, kuzynka ma problem z wyskakującymi reklamami.

 

Oto logi:

http://wklej.org/id/1350863/

http://wklej.org/id/1350864/

 

Mógłby ktoś coś doradzić co zrobić?

 

Z góry dzięki.

Pozdr.

[Kolobos]

Uwazaj co sciagasz i skad! Podczas instalacji rezygnuj z instalowania dodatkowych szkodliwych programow. Programy sciagaj ze stron producentow. Zawsze wybieraj instalacje zaawansowana. Wtedy unikniesz tego co widac ponizej.

 

Odinstaluj:

BrowseSmart

Google Toolbar for Internet Explorer

Bing Bar

Ask Toolbar

aartemis Browser Protecter

Bonanza Deals (remove only)

IePluginService12.27.0.332

Mobogenie

RegClean Pro

SupTab

WinZipper

SaveSense
Skype Packages
VuuPC Packages"SaveSense" = SaveSense

 

Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner

 

Wykonaj skrypt w OTL:

 

:OTL

PRC - [2014-04-04 11:22:32 | 000,350,496 | ---- | M] () -- C:\Program Files (x86)\BrowseSmart\bin\utilBrowseSmart.exe
PRC - [2014-04-04 11:19:22 | 000,350,496 | ---- | M] () -- C:\Program Files (x86)\BrowseSmart\updateBrowseSmart.exe
PRC - [2014-04-01 21:08:12 | 000,094,496 | ---- | M] () -- C:\Program Files (x86)\BrowseSmart\bin\XTLSApp.exe
PRC - [2014-02-26 15:29:24 | 000,425,104 | ---- | M] (Taiwan Shui Mu Chih Ching Technology Limited.) -- C:\Program Files (x86)\WinZipper\winzipersvc.exe
PRC - [2014-02-26 10:30:22 | 000,501,904 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\WPM\wprotectmanager.exe
PRC - [2014-02-26 08:44:20 | 000,508,016 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\IePluginService\PluginService.exe
PRC - [2014-02-14 03:42:08 | 000,166,352 | ---- | M] (APN LLC.) -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
PRC - [2014-02-14 03:41:47 | 001,758,160 | ---- | M] (APN) -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
PRC - [2013-12-13 09:40:31 | 000,761,024 | ---- | M] () -- C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
SRV - [2014-04-04 11:22:32 | 000,350,496 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\BrowseSmart\bin\utilBrowseSmart.exe -- (Util BrowseSmart)
SRV - [2014-04-04 11:19:22 | 000,350,496 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\BrowseSmart\updateBrowseSmart.exe -- (Update BrowseSmart)
SRV - [2014-02-26 15:29:24 | 000,425,104 | ---- | M] (Taiwan Shui Mu Chih Ching Technology Limited.) [Auto | Running] -- C:\Program Files (x86)\WinZipper\winzipersvc.exe -- (winzipersvc)
SRV - [2014-02-26 10:30:22 | 000,501,904 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\WPM\wprotectmanager.exe -- (Wpm)
SRV - [2014-02-26 08:44:20 | 000,508,016 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\IePluginService\PluginService.exe -- (IePluginService)
SRV - [2014-02-14 03:42:08 | 000,166,352 | ---- | M] (APN LLC.) [Auto | Running] -- C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe -- (APNMCP)
SRV - [2014-01-31 15:16:25 | 000,146,920 | ---- | M] (SaveSense) [On_Demand | Stopped] -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe -- (savesenselivem)
SRV - [2014-01-31 15:16:25 | 000,146,920 | ---- | M] (SaveSense) [Auto | Stopped] -- C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe -- (savesenselive)
SRV - [2013-12-24 11:17:21 | 000,148,976 | ---- | M] (BonanzaDeals) [On_Demand | Stopped] -- C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe -- (bonanzadealslivem)
SRV - [2013-12-24 11:17:21 | 000,148,976 | ---- | M] (BonanzaDeals) [Auto | Stopped] -- C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe -- (bonanzadealslive)
DRV:64bit: - [2014-03-18 16:23:37 | 000,061,120 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\wStLib64.sys -- (wStLib64)
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{8D3EA39B-9D08-4834-8545-FFDDCFEBC5F2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.aartemis.com/web/?type=ds&ts=1387876647&from=cor&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&q={searchTerms}
IE - HKLM\..\SearchScopes\{8D3EA39B-9D08-4834-8545-FFDDCFEBC5F2}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=DCJB
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313&type=default&q={searchTerms}
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313&type=default&q={searchTerms}
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313&type=default&q={searchTerms}
IE - HKU\S-1-5-21-3264365029-3392624113-2209895587-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
FF - HKLM\Software\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=3: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF - HKLM\Software\MozillaPlugins\@tools.bdupdater.com/BonanzaDealsLive Update;version=9: C:\Program Files (x86)\BonanzaDealsLive\Update\1.3.23.0\npGoogleUpdate3.dll (BonanzaDeals)
FF - HKLM\Software\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=3: C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF - HKLM\Software\MozillaPlugins\@tools.updaterss.com/SaveSenseLive Update;version=9: C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
CHR - default_search_provider: delta-homes (Enabled)
CHR - default_search_provider: search_url = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313&type=default&q={searchTerms}
CHR - default_search_provider: suggest_url = ,
CHR - homepage: http://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST1000LM024XHN-M101MBB_S314J90DA80066A80066&ts=1393421313
CHR - Extension: Extended Protection = C:\Users\laptop\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo\1.4.1_2\
CHR - Extension: Ask Toolbar = C:\Users\laptop\AppData\Local\Google\Chrome\User Data\Default\Extensions\pljcgbedjplidkdjahbaalanadmjfgop\32.3_0\
O2 - BHO: (IETabPage Class) - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
O2 - BHO: (SaveSense) - {71e129ff-6c2a-4984-818c-7e2c998b8d99} - C:\Users\laptop\AppData\Local\SaveSense\SaveSenseIE.dll (SaveSense)
O2 - BHO: (BonanzaDeals) - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll (BonanzaDeals)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [ApnTBMon] C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (APN)
O4 - HKLM..\Run: [fst_pl_14] File not found
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe ()
[2014-04-06 15:01:07 | 000,001,368 | ---- | M] () -- C:\Users\laptop\Desktop\Wyczyść rejestr za darmo!.lnk
[2014-04-06 15:01:00 | 000,000,288 | ---- | M] () -- C:\Windows\tasks\RegClean Pro_DEFAULT.job
[2014-04-06 14:16:00 | 000,000,306 | ---- | M] () -- C:\Windows\tasks\SaveSense.job
[2014-04-06 12:22:02 | 000,000,936 | ---- | M] () -- C:\Windows\tasks\BonanzaDealsLiveUpdateTaskMachineUA.job
[2014-04-06 12:21:01 | 000,000,942 | ---- | M] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineUA.job
[2014-04-06 12:01:11 | 000,000,938 | ---- | M] () -- C:\Windows\tasks\SaveSenseLiveUpdateTaskMachineCore.job
[2014-04-06 12:01:11 | 000,000,932 | ---- | M] () -- C:\Windows\tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
[2014-03-18 16:23:37 | 000,061,120 | ---- | M] (StdLib) -- C:\Windows\SysNative\drivers\wStLib64.sys
[2013-12-24 11:18:32 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\0C1I1L1R1J0M1P0I1G
[2014-01-31 15:16:32 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\0F1F1C2Y1H1P1C0I0T
[2013-12-24 11:17:35 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\aartemis
[2014-02-15 22:51:08 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\newnext.me
[2014-01-31 15:16:23 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\SaveSense
[2014-02-26 15:29:17 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\SupTab
[2013-12-24 11:16:03 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\systweak
[2014-03-10 15:33:10 | 000,000,000 | ---D | M] -- C:\Users\laptop\AppData\Roaming\WinZipper

 

 

 

Zrob pelny skan przy pomocy Mbam:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

 

 

Daj oba logi z FRST:
http://www.fixitpc.pl/topic/61-diagnostyka-ogólne-raporty-systemowe/#entry119294

(na wklej.org i podaj linki)

Edytowane 3 Maja 2014 przez Kolobos