Reklamy

Ols · 18 Kwietnia 2016

Jakiś wirus wkradł mi się do komputera.

Reklamy pojawiają się bez włączonej przeglądarki

w przeglądarce jak coś przeglądam z dupy wyskakują mi strony

co chwile wyskakuje jakieś potwierdzenie instalacji różnych programów

usunalem to co sie zainstalowalo, ale problem jest nadal

co muszę zrobić??

Ols · 22 Kwietnia 2016

ciężko troche usuneło, ale nie wszystko...

doszlo to tez do gier np na steamie reklamy wyskakuja, żeby napisać tu wiadomość to musze 15 minut klikać X i skip ad ;/

GFan · 22 Kwietnia 2016

Spróbuj przeczyścić system AdwCleanerem i Malwarebytes Anti-Malware.

Janusz. · 18 Kwietnia 2016

http://www.mpcforum.pl/topic/1364875-jak-wykona%C4%87-logi/

logi FRST.

Janusz. · 22 Kwietnia 2016

Bo adwcleaner nie usunie Ci wszystkiego. To jest automat który działa wg. schematów.

Nie wiem co namieszał AdwCleaner więc działam na ślepo.

Odinstaluj groover, shopperz.

Closeprocesses:
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\...\Run: [zabsdll.exe] => C:\Users\Kuba\AppData\Roaming\Micorsoft\NetProfiler\zabsdll.exe [994816 2015-08-16] ()
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\...\Run: [Services] => C:\ProgramData\services\tigutxtea.exe [32912 2015-05-29] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
Tcpip\..\Interfaces\{3be80ff4-6bce-499f-a007-e169d8f0dd05}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{6394a6c3-1aba-4c6f-865e-3109b0da08a3}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{aa97c658-ee81-11e5-abc3-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{ad6290e5-6570-4a87-acc4-c1cc23ca8056}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{ad6290e5-6570-4a87-acc4-c1cc23ca8056}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{d5c793c6-fe82-486e-b78b-7002e12d098c}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{d5c793c6-fe82-486e-b78b-7002e12d098c}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{dbf717a6-aab1-4df4-93a5-536a4ddaedf6}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{dbf717a6-aab1-4df4-93a5-536a4ddaedf6}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{ec4ef9fd-b319-4329-9683-cccc9e107787}: [NameServer] 104.197.191.4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130873219063355987&GUID=336A46BF-077B-49A2-A942-9F43DBC007B0
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=U270&ocid=U270DHP&osmkt=pl-pl
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: Kajajugt -> {1308CFBC-219D-42D4-84FC-E44F74703219} -> C:\Program Files\Kajajugt\Naajoj64.dll [2016-04-18] ()
BHO: Ekeh -> {4D26AC6E-ACC5-4F1B-8E69-15632B081960} -> C:\Program Files\Ekeh\Humneh64.dll [2016-04-18] ()
BHO: TSearch -> {6E727987-C8EA-44DA-8749-310C0FBE3C3E} -> C:\Program Files (x86)\Torrent Search\IEEF\38w9icVLckkY.dll => Brak pliku
Handler: WSISVCUchrome - {78A543EB-3A61-4ED3 -  Brak pliku
FF SearchEngineOrder.3: Bing 
FF Keyword.URL: hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q=
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - D:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono
CHR HomePage: Default -> hxxps://www.google.pl/
CHR StartupUrls: Default -> "hxxp://www.hohosearch.com/?mode=nnnb&ptid=isr&uid=F0C83DE217F7C46B3E0B4F9B9EBD828A&v=20160415&ts=AHEqA3UnAnQsC0.."
OPR StartupUrls: ],"urls_signature":""},"speeddial":{"bookmarks_folder_guid":"82A719F5-9F0E-4E5A-84F5-86E6F5A07F68","imported_to_bookmarks":true},"spellcheck":{"dictionaries":["pl"
R2 Dhrelrer; C:\Users\Kuba\AppData\Roaming\Rikfootov\Rikfootov.exe [174432 2016-04-17] ()
R2 Kufhuo; C:\Users\Kuba\AppData\Roaming\Tueasjey\Tueasjey.exe [174416 2016-04-17] ()
S4 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
R2 Tiuauh; C:\Users\Kuba\AppData\Roaming\VypiwGyp\Wivmor.exe [125776 2016-04-17] ()
S1 MPCKpt; system32\DRIVERS\MPCKpt.sys [X]
C:\Users\Kuba\AppData\Roaming\Tueasjey
C:\Users\Kuba\AppData\Roaming\Rikfootov
C:\Users\Kuba\AppData\Roaming\VypiwGyp
Task: {0D7CADA1-BB69-4B81-918F-8CCB73BE0F24} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA
Task: {178AD858-A5FD-4546-95F9-90AC505191C0} - \CCleanerSkipUAC -> Brak pliku <==== UWAGA
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> Brak pliku <==== UWAGA
Task: {38B38A65-95DB-4A87-80D7-9D9A4632F6D3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA
Task: {7BCF0606-96BF-484E-AE05-E4A7BC6A8A1C} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
Task: {7EEC5DCA-4330-4A65-B723-58B87D17C70E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA
Task: {8CB69821-E013-43B5-91DC-898B00C10D2F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA
Task: {9CB95FAA-5A81-4EFB-9DD8-D8F3D6DD5C94} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA
Task: {C2A4AC78-935B-41B9-9035-35155F68C16B} - System32\Tasks\Uwewbiut => C:\Program Files\Kajajugt\Eiomu.bat [2016-04-18] () <==== UWAGA
Task: {C5924A0E-08E6-4827-91A0-97578C59D277} - System32\Tasks\Redywo => C:\Program Files\Ekeh\Uosietta.bat [2016-04-18] () <==== UWAGA
Task: {D578D428-D098-4D46-BB14-4239083B9056} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA
Task: {D718005D-3EC4-4EBF-B97D-E1E9AB6EC786} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA
Task: {E1425114-1ABD-413B-AD7E-FFFC56D47441} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA
Task: {E9E96755-AEA8-474F-84B7-1492F1EDF9CC} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA
Task: {EA64985A-04EB-4B5D-9013-7EA86C5C834B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA
2016-04-17 11:17 - 2016-04-17 11:17 - 00146256 _____ () C:\Users\Kuba\AppData\Roaming\Tueasjey\
2016-04-17 11:50 - 2016-04-17 11:50 - 00146272 _____ () C:\Users\Kuba\AppData\Roaming\Rikfootov\
2016-04-17 11:50 - 2016-04-17 11:50 - 00115552 _____ () C:\Users\Kuba\AppData\Roaming\Rikfootov\
2016-04-17 11:50 - 2016-04-18 13:12 - 00183648 _____ () C:\Users\Kuba\AppData\Roaming\LaexuGegobog\
2016-04-17 11:17 - 2016-04-18 13:12 - 00183632 _____ () C:\Users\Kuba\AppData\Roaming\VypiwGyp\
2016-04-17 11:17 - 2016-04-17 11:17 - 00261968 _____ () C:\Users\Kuba\AppData\Roaming\Tueasjey\
 C:\Users\Kuba\AppData\Roaming\Rikfootov\


CMD: dir /a "C:\Users\Kuba\appdata\Local"
CMD: dir /a "C:\Users\Kuba\appdata\Roaming"
CMD: dir /a "C:\Users\Kuba\appdata\Locallow"
CMD: dir /a "C:\Program Files (x86)"
CMD: dir /a "C:\Program Files"
CMD: dir /a "C:\ProgramData"
CMD: dir /a "C:\program files (x86)\common files"
CMD: dir /a "C:\Windows"
RemoveProxy:
EmptyTemp:

Zapisz jako fixlist.txt umieść obok FRST i kliknij FIX/Napraw. Po restarcie utworzy sie fixlog, zamieść go na forum.

Ols · 21 Kwietnia 2016

http://sendfile.es/pokaz/778513---pbmu.html

http://sendfile.es/pokaz/778514---w0ls.html

http://sendfile.es/pokaz/778515---srwv.html

Ols · 23 Kwietnia 2016

Bo adwcleaner nie usunie Ci wszystkiego. To jest automat który działa wg. schematów.

Nie wiem co namieszał AdwCleaner więc działam na ślepo.

Odinstaluj groover, shopperz.

Closeprocesses:
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\...\Run: [zabsdll.exe] => C:\Users\Kuba\AppData\Roaming\Micorsoft\NetProfiler\zabsdll.exe [994816 2015-08-16] ()
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\...\Run: [Services] => C:\ProgramData\services\tigutxtea.exe [32912 2015-05-29] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
Tcpip\..\Interfaces\{3be80ff4-6bce-499f-a007-e169d8f0dd05}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{6394a6c3-1aba-4c6f-865e-3109b0da08a3}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{aa97c658-ee81-11e5-abc3-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{ad6290e5-6570-4a87-acc4-c1cc23ca8056}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{ad6290e5-6570-4a87-acc4-c1cc23ca8056}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{d5c793c6-fe82-486e-b78b-7002e12d098c}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{d5c793c6-fe82-486e-b78b-7002e12d098c}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{dbf717a6-aab1-4df4-93a5-536a4ddaedf6}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{dbf717a6-aab1-4df4-93a5-536a4ddaedf6}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{ec4ef9fd-b319-4329-9683-cccc9e107787}: [NameServer] 104.197.191.4
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130873219063355987&GUID=336A46BF-077B-49A2-A942-9F43DBC007B0
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2063651412-2300223398-3532993737-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=U270&ocid=U270DHP&osmkt=pl-pl
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2063651412-2300223398-3532993737-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: Kajajugt -> {1308CFBC-219D-42D4-84FC-E44F74703219} -> C:\Program Files\Kajajugt\Naajoj64.dll [2016-04-18] ()
BHO: Ekeh -> {4D26AC6E-ACC5-4F1B-8E69-15632B081960} -> C:\Program Files\Ekeh\Humneh64.dll [2016-04-18] ()
BHO: TSearch -> {6E727987-C8EA-44DA-8749-310C0FBE3C3E} -> C:\Program Files (x86)\Torrent Search\IEEF\38w9icVLckkY.dll => Brak pliku
Handler: WSISVCUchrome - {78A543EB-3A61-4ED3 -  Brak pliku
FF SearchEngineOrder.3: Bing 
FF Keyword.URL: hxxp://www.bing.com/search?FORM=U270DF&PC=U270&q=
FF HKLM-x32\...\Thunderbird\Extensions: [[email protected]] - D:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono
CHR HomePage: Default -> hxxps://www.google.pl/
CHR StartupUrls: Default -> "hxxp://www.hohosearch.com/?mode=nnnb&ptid=isr&uid=F0C83DE217F7C46B3E0B4F9B9EBD828A&v=20160415&ts=AHEqA3UnAnQsC0.."
OPR StartupUrls: ],"urls_signature":""},"speeddial":{"bookmarks_folder_guid":"82A719F5-9F0E-4E5A-84F5-86E6F5A07F68","imported_to_bookmarks":true},"spellcheck":{"dictionaries":["pl"
R2 Dhrelrer; C:\Users\Kuba\AppData\Roaming\Rikfootov\Rikfootov.exe [174432 2016-04-17] ()
R2 Kufhuo; C:\Users\Kuba\AppData\Roaming\Tueasjey\Tueasjey.exe [174416 2016-04-17] ()
S4 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
R2 Tiuauh; C:\Users\Kuba\AppData\Roaming\VypiwGyp\Wivmor.exe [125776 2016-04-17] ()
S1 MPCKpt; system32\DRIVERS\MPCKpt.sys [X]
C:\Users\Kuba\AppData\Roaming\Tueasjey
C:\Users\Kuba\AppData\Roaming\Rikfootov
C:\Users\Kuba\AppData\Roaming\VypiwGyp
Task: {0D7CADA1-BB69-4B81-918F-8CCB73BE0F24} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA
Task: {178AD858-A5FD-4546-95F9-90AC505191C0} - \CCleanerSkipUAC -> Brak pliku <==== UWAGA
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification -> Brak pliku <==== UWAGA
Task: {38B38A65-95DB-4A87-80D7-9D9A4632F6D3} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA
Task: {7BCF0606-96BF-484E-AE05-E4A7BC6A8A1C} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
Task: {7EEC5DCA-4330-4A65-B723-58B87D17C70E} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA
Task: {8CB69821-E013-43B5-91DC-898B00C10D2F} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA
Task: {9CB95FAA-5A81-4EFB-9DD8-D8F3D6DD5C94} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA
Task: {C2A4AC78-935B-41B9-9035-35155F68C16B} - System32\Tasks\Uwewbiut => C:\Program Files\Kajajugt\Eiomu.bat [2016-04-18] () <==== UWAGA
Task: {C5924A0E-08E6-4827-91A0-97578C59D277} - System32\Tasks\Redywo => C:\Program Files\Ekeh\Uosietta.bat [2016-04-18] () <==== UWAGA
Task: {D578D428-D098-4D46-BB14-4239083B9056} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA
Task: {D718005D-3EC4-4EBF-B97D-E1E9AB6EC786} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA
Task: {E1425114-1ABD-413B-AD7E-FFFC56D47441} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA
Task: {E9E96755-AEA8-474F-84B7-1492F1EDF9CC} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA
Task: {EA64985A-04EB-4B5D-9013-7EA86C5C834B} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA
2016-04-17 11:17 - 2016-04-17 11:17 - 00146256 _____ () C:\Users\Kuba\AppData\Roaming\Tueasjey\
2016-04-17 11:50 - 2016-04-17 11:50 - 00146272 _____ () C:\Users\Kuba\AppData\Roaming\Rikfootov\
2016-04-17 11:50 - 2016-04-17 11:50 - 00115552 _____ () C:\Users\Kuba\AppData\Roaming\Rikfootov\
2016-04-17 11:50 - 2016-04-18 13:12 - 00183648 _____ () C:\Users\Kuba\AppData\Roaming\LaexuGegobog\
2016-04-17 11:17 - 2016-04-18 13:12 - 00183632 _____ () C:\Users\Kuba\AppData\Roaming\VypiwGyp\
2016-04-17 11:17 - 2016-04-17 11:17 - 00261968 _____ () C:\Users\Kuba\AppData\Roaming\Tueasjey\
 C:\Users\Kuba\AppData\Roaming\Rikfootov\


CMD: dir /a "C:\Users\Kuba\appdata\Local"
CMD: dir /a "C:\Users\Kuba\appdata\Roaming"
CMD: dir /a "C:\Users\Kuba\appdata\Locallow"
CMD: dir /a "C:\Program Files (x86)"
CMD: dir /a "C:\Program Files"
CMD: dir /a "C:\ProgramData"
CMD: dir /a "C:\program files (x86)\common files"
CMD: dir /a "C:\Windows"
RemoveProxy:
EmptyTemp:

Zapisz jako fixlist.txt umieść obok FRST i kliknij FIX/Napraw. Po restarcie utworzy sie fixlog, zamieść go na forum.

Przeskanowałem tym antywirem w wersji premium próbnym znalezione zagrożenia 2500 usunięto 0... Ale po restarcie komputera reklamy znikneły

Janusz. · 23 Kwietnia 2016

Czyli problem sam sobie rozwiązałeś?

Ols · 23 Kwietnia 2016

Czyli problem sam sobie rozwiązałeś?

Po części z waszą pomocą, ale tak

Dzięki wszystkim

Zaloguj się

👋 Witaj na MPCForum!

Reklamy

Pytanie

Ols

Ols

8 odpowiedzi na to pytanie

Rekomendowane odpowiedzi

Ols

Ols

GFan

GFan

Janusz.

Janusz.

Janusz.

Janusz.

Ols

Ols

Ols

Ols

Janusz.

Janusz.

Ols

Ols

Zarchiwizowany