Prośba o sprawdzenie LOGów.

[Hormon666]

Witam! Prosiłbym o sprawdzenie moich logów, system ma nawet nie miesiąc, uruchamia się w ok 1:20min więc nawet trochę sporo. Dodatkowo na niektórych stronach wyskakuje jedna reklama o porno. Ciekaw jestem, czy posiadam jakieś śmiecie w kompie, antywirus Avast oraz systemowy nie znalazły jak dotąd nic.

 

Extras.Txt

OTL.Txt

[Kolobos]

Wykonaj skrypt w OTL:

 

:OTL

PRC - [2014-05-01 18:10:32 | 000,566,272 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\WPM\wprotectmanager.exe
PRC - [2014-04-11 04:05:52 | 000,705,136 | ---- | M] (Cherished Technololgy LIMITED) -- C:\ProgramData\IePluginService\PluginService.exe
PRC - [2011-07-21 13:44:08 | 020,237,824 | ---- | M] () -- C:\Users\Hormon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfBot.exe
SRV - [2014-05-01 18:10:32 | 000,566,272 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\WPM\wprotectmanager.exe -- (Wpm)
SRV - [2014-04-11 04:05:52 | 000,705,136 | ---- | M] (Cherished Technololgy LIMITED) [Auto | Running] -- C:\ProgramData\IePluginService\PluginService.exe -- (IePluginService)
SRV - [2014-03-04 13:32:56 | 000,411,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
IE - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.qone8.com/?type=hp&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49
IE - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49
IE - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.qone8.com/web/?type=ds&ts=1398960574&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49&q={searchTerms}
FF - prefs.js..browser.startup.homepage: "http://start.qone8.com/?type=hppp&ts=1400042024&from=smt&uid=ST3500418AS_5VM39W49XXXX5VM39W49"
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quick_start@gmail.com: C:\Users\Hormon\AppData\Roaming\Mozilla\Firefox\Profiles\vmj6eb2x.default\extensions\quick_start@gmail.com
O2 - BHO: (no name) - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - No CLSID value found.
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\Run: [Fatal1tySTU] File not found
O4 - HKU\.DEFAULT..\RunOnce: [sPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [sPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day0] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day1] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day2] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day3] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day4] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day5] Reg Error: Invalid data type. File not found
O4 - HKU\S-1-5-21-2065270572-1465547705-2699293322-1000..\RunOnce: [AsrOMG_Day6] Reg Error: Invalid data type. File not found
O4 - Startup: C:\Users\Hormon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfBot.exe ()
[2014-05-01 18:09:48 | 000,000,000 | ---D | M] -- C:\Users\Hormon\AppData\Roaming\qone8
[2014-04-30 13:50:22 | 000,000,000 | ---D | M] -- C:\Users\Hormon\AppData\Roaming\SFBot
[2014-05-01 18:10:39 | 000,000,000 | ---D | M] -- C:\Users\Hormon\AppData\Roaming\SupTab

 

:Commands

[emptytemp]

 

 

Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun:
http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner

Daj logi z FRST:
http://www.fixitpc.pl/topic/61-diagnostyka-ogólne-raporty-systemowe/#entry119294

Wklej na wklej.org i podaj linki.

Zrob pelny skan przy pomocy Mbam:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

[Hormon666]

Przeskanowane wszystko i logi z FRST:
FRST:http://wklej.org/id/1374325/
ADDITION:http://wklej.org/id/1374329/
SHORTCUT:http://wklej.org/id/1374332/

[Kolobos]

Obok frst utworz plik fixlist.txt z zawartoscia:

SearchScopes: HKLM - DefaultScope value is missing.
FF NewTab: chrome://quick_start/content/index.html
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
2014-05-27 16:00 - 2014-05-27 16:09 - 00000000 ____D () C:\AdwCleaner
2014-05-27 15:52 - 2014-05-27 15:52 - 00000000 ____D () C:\_OTL

 

W Frst wybierz Fix i to wszystko. 

[Hormon666]

Dziękuję ślicznie i pozdrawiam!