Objawy zainfekowania:
Witam,
po starcie systemu Win7 pokazuje mi się takie okno :
[Aby zobaczyć linki, zarejestruj się tutaj]
Wykonywane działania:
ESET SMART SECURITY 7
Logi:
OTL:
[Aby zobaczyć linki, zarejestruj się tutaj]
EXTRAS:
[Aby zobaczyć linki, zarejestruj się tutaj]
FRST:
[Aby zobaczyć linki, zarejestruj się tutaj]
ADDITION:
[Aby zobaczyć linki, zarejestruj się tutaj]
Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
HKLM-x32\...\Run: [] - [x]
HKCU\...\Run: [NextLive] - C:\windows\SysWOW64\rundll32.exe "C:\Users\Media\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
HKCU\...\Policies\system: [LogonHoursAction] 2
HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Dom\...\Policies\system: [LogonHoursAction] 2
HKU\Dom\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = aboutblank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://nmd.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = aboutblank
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://startsear.ch/?aff=1&src=sp&cf=9b234d4c-5b0b-11e1-b323-20cf30bb6a4d&q={searchTerms}
BHO-x32: IE5BarLauncherBHO Class - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} -No File
Toolbar: HKLM-x32 - StartSearchToolBar - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} -No File
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
CHR HKCU\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Media\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx
CHR HKLM-x32\...\Chrome\Extension: [bildoibdboopgomcbiplincneeicgipj] - C:\Program Files (x86)\StartSearch plugin\startsplg.crx
CHR HKLM-x32\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Media\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx
CHR HKLM-x32\...\Chrome\Extension: [pbiamblgmkgbcgbcgejjgebalncpmhnp] - C:\Program Files (x86)\StartSearch plugin\vshareplg.crx
R2 HPSLPSVC; C:\Users\Media\AppData\Local\Temp\7zS632E\hpslpsvc64.dll [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
C:\$WINDOWS.~BT
C:\ProgramData\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}
C:\Users\Media\Desktop\Thumbs.db
C:\Users\Media\AppData\Local\genienext
C:\Users\Media\AppData\Local\Mobogenie
C:\Users\Media\AppData\Local\cache
C:\Users\Media\daemonprocess.txt
Task: {1CFE12A2-674D-4B23-9C13-22155EABC218} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - \Microsoft\Windows\Time Synchronization\SynchronizeTime No Task File
Task: {088482FA-65B8-4E17-9ABF-1DCD48E8D373} - \Microsoft\Windows\Tcpip\IpAddressConflict1 No Task File
Task: {0894A31E-C2DA-4035-89ED-A6910C4B0BF8} - \{84401AC9-A2FE-4554-B5BE-A373E3839ECC} No Task File
Task: {09F06BFE-A3C8-40E3-846A-6E6F4000C238} - \Microsoft\Windows\Tcpip\IpAddressConflict2 No Task File
Task: {142DBB3A-51BB-4657-9928-1ACC77BD7A34} - \User_Feed_Synchronization-{ACFF6B63-3079-4D67-B5FE-13AA5C8E19D1} No Task File
Task: {1A561FD3-67EC-4637-B02E-D8E2E158EB96} - \SidebarExecute No Task File
Task: {1AC56524-4DDC-4DF3-A0D7-20843B635ACA} - \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector No Task File
Task: {1B7420B9-4D3B-4289-8F68-C551CDD98B87} - \{74A6BCE8-3464-42C1-BB0C-DCC42B9E69A4} No Task File
Task: {1CFE12A2-674D-4B23-9C13-22155EABC218} - System32\Tasks\RegClean Pro => C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe <==== ATTENTION
Task: {1F7B7221-AE8F-44F3-BA82-F7D260F51964} - \Microsoft\Windows\Task Manager\Interactive No Task File
Task: {2150DC96-66B3-42BA-9FBC-5ACCCCF024DB} - \AutoKMS No Task File
Task: {2470470F-2634-478E-B181-571E98A789BB} - \Microsoft\Windows\Multimedia\SystemSoundsService No Task File
Task: {28011108-68DF-4C73-B91B-57427D501BBA} - \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Manual) No Task File
Task: {2DF5411E-C198-4729-B77E-9022AB81DFD5} - \CreateChoiceProcessTask No Task File
Task: {2F57269B-1E09-4E2D-AB1E-B0FDAC7D279C} - \Microsoft\Windows\WindowsBackup\ConfigNotification No Task File
Task: {2FE4AA8B-00DD-488A-B8CF-26354E0E89CA} - \{209983FE-0CEA-4A06-AB5C-76AF95DAB4DD} No Task File
Task: {322135D0-E2D7-451E-AB17-B58273B22016} - \Microsoft\Windows\Media Center\PeriodicScanRetry No Task File
Task: {34EC131E-72DB-4B6B-A20B-74FCC8EBDEE5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-27] (Google Inc.)
Task: {3732D38D-57D6-4C06-85F8-7A24F4AF5EA6} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask No Task File
Task: {3A46EFEE-4965-42E2-AD74-4FD704E5D3BD} - \Microsoft\Windows\Media Center\StartRecording No Task File
Task: {3B00B4F5-5F0A-474E-9373-273E613EEFD7} - \Microsoft\Windows\MobilePC\HotStart No Task File
Task: {40EC09B2-FA76-4BC1-B811-6113637234F9} - \{8DA30FB4-460D-42AD-904D-550B2CEEA142} No Task File
Task: {45F75B38-C2E5-4563-86EB-6307BC72D03B} - \{4346610B-19AB-42C8-9006-5BDDF19A0426} No Task File
Task: {47536D45-EEEC-4BDC-8183-A4DC1F8DA9E4} - \Microsoft\Windows\Customer Experience Improvement Program\UsbCeip No Task File
Task: {486D715E-6AA2-44CF-BC48-B6990CBB53C6} - \Microsoft\Windows\Shell\WindowsParentalControlsMigration No Task File
Task: {4A486ED9-271C-461E-A651-4B9343323353} - \RealDownloaderDownloaderScheduledTaskS-1-5-21-394936792-4148099325-2900050880-1000 No Task File
Task: {4C8B01A2-11FF-4C41-848F-508EF4F00CF7} - \Microsoft\Windows\TextServicesFramework\MsCtfMonitor No Task File
Task: {54FC7133-43A9-4716-BB8B-0754A6B17D60} - \Program aktualizacji online firmy HP No Task File
Task: {5602A963-CC7F-42FF-99B6-F9C09D053254} - \Games\UpdateCheck_S-1-5-21-394936792-4148099325-2900050880-1000 No Task File
Task: {5A3FB933-5908-4358-B67F-50E08CCE4E91} - \Microsoft\Windows\Media Center\RecordingRestart No Task File
Task: {5A40E926-9E86-4B89-9CFD-B12311724371} - \Microsoft\Windows\UPnP\UPnPHostConfig No Task File
Task: {5B42DD9C-5A26-4F27-BB95-34603F0997E5} - \Microsoft\Windows\Shell\WindowsParentalControls No Task File
Task: {5C0AEEEA-C154-45BE-8499-BEA5F11BAFF6} - \Microsoft\Windows\Defrag\ScheduledDefrag No Task File
Task: {5C8CF6DC-B0EF-4CC0-8A20-670772A090B7} - \AdobeAAMUpdater-1.0-Media-Komputer-Media No Task File
Task: {5F5A18EB-DC73-4E45-A11C-B59043598412} - \Microsoft\Windows\CertificateServicesClient\SystemTask No Task File
Task: {613612BA-897D-44CE-8DC1-8FC283F9FD51} - \Microsoft\Windows\Active Directory Rights Management Services Client\AD RMS Rights Policy Template Management (Automated) No Task File
Task: {62F4C81B-4E95-40B4-9765-14B2617FB184} - \Microsoft\Windows\Media Center\ObjectStoreRecoveryTask No Task File
Task: {63CA7599-AA36-48C9-A665-7D4CE4062DE0} - \Microsoft\Windows\Media Center\mcupdate_scheduled No Task File
Task: {64E856EE-F5D6-468F-827B-445B0C4098B3} - \RealDownloaderRealUpgradeScheduledTaskS-1-5-21-394936792-4148099325-2900050880-1000 No Task File
Task: {6738BA6E-EA75-4B6B-B8B8-71F0336DD8EF} - \Microsoft\Windows\User Profile Service\HiveUploadTask No Task File
Task: {6748FF08-0A4B-42DA-8875-2FDE24EF459E} - \Microsoft\Windows\SideShow\SystemDataProviders No Task File
Task: {689CBF0A-3F98-40DB-A41C-BE411491D650} - \Apple\AppleSoftwareUpdate No Task File
Task: {6A4F11CC-8C35-42BE-8F02-193AE8C23A2B} - \Microsoft\Windows\Media Center\UpdateRecordPath No Task File
Task: {6DECF7F7-5D0F-4A5B-8913-527864AC0090} - \Microsoft\Windows\SideShow\SessionAgent No Task File
Task: {72DB7465-BC54-491B-A92A-4637A28C9BBF} - \Microsoft\Windows\AppID\VerifiedPublisherCertStoreCheck No Task File
Task: {753C47AE-EC5E-44B3-95A9-2C8E553F0E39} - \Microsoft\Windows\Windows Media Sharing\UpdateLibrary No Task File
Task: {7857E916-0DCD-41D1-B281-A6C58FE845CA} - \Microsoft\Windows Live\SOXE\Extractor Definitions Update Task No Task File
Task: {7AFCC0CA-7121-422A-AB45-B0E8D599FF08} - \Microsoft\Windows\CertificateServicesClient\UserTask No Task File
Task: {7E54D9C1-E207-48CF-B2D4-1D04A475264C} - \Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver No Task File
Task: {7F372F21-938C-4723-9A8F-BF97F91F6761} - \Microsoft\Windows\Media Center\MediaCenterRecoveryTask No Task File
Task: {81540B9F-B5BF-47EB-9C95-BE195BF2C664} - \Microsoft\Windows\NetTrace\GatherNetworkInfo No Task File
Task: {8CBE389B-2C1E-4539-B139-93B4089069E1} - \Microsoft\Windows\Media Center\PBDADiscoveryW1 No Task File
Task: {8F026DD0-3AC2-486B-9F66-11BE6D191A84} - \Microsoft\Windows\SideShow\GadgetManager No Task File
Task: {9435F817-FED2-454E-88CD-7F78FDA62C48} - \Microsoft\Windows\WDI\ResolutionHost No Task File
Task: {944D3E19-BD52-49C9-A512-8A2776ACBFFF} - \RealDownloaderRealUpgradeLogonTaskS-1-5-21-394936792-4148099325-2900050880-1000 No Task File
Task: {95D8A2F5-6001-4A9F-A3D5-018C73DA6AFA} - \Microsoft\Windows\Media Center\RegisterSearch No Task File
Task: {962FD73A-C1D1-4B84-BEC7-DB03BACBFA78} - \Microsoft\Windows\Media Center\mcupdate No Task File
Task: {994C86AD-A929-4B2C-88A0-4E25A107A029} - \Microsoft\Windows\SystemRestore\SR No Task File
Task: {9979CB83-103A-4105-9E5D-C74B0AF6D198} - \Microsoft\Windows\CertificateServicesClient\UserTask-Roam No Task File
Task: {A35BB7A6-5F0C-4C9F-8450-2B3BED532D51} - \Microsoft\Windows\WindowsColorSystem\Calibration Loader No Task File
Task: {A48CABBF-24C8-4B87-B00F-9261807C3B43} - \Microsoft\Windows\AppID\PolicyConverter No Task File
Task: {A571E209-F796-44AB-80DC-FBB6C856D8C6} - \Microsoft\Windows\Media Center\InstallPlayReady No Task File
Task: {A6AF9377-77CE-47AB-AD7D-EC32CAD0C82D} - \Microsoft\Windows\Location\Notifications No Task File
Task: {A7B98401-0D41-4BCF-B5ED-1F0E6A56335F} - \Microsoft\Windows\SideShow\AutoWake No Task File
Task: {A7C73732-9F11-4281-8D19-764D4EC9D94D} - \Microsoft\Windows\Application Experience\ProgramDataUpdater No Task File
Task: {AA536C7E-ED94-4D72-98F4-AB95C657BE18} - \Microsoft\Windows\Media Center\DispatchRecoveryTasks No Task File
Task: {ABF44B01-5C00-4D42-B51C-9645699B4CB4} - \OfficeSoftwareProtectionPlatform\SvcRestartTask No Task File
Task: {AC3F4F24-F926-4E90-B90C-7B7A3973849D} - \Program aktualizacji online produktu Real Player. No Task File
Task: {AC4E5ACF-89F7-4220-BA21-81EE183975E2} - \Microsoft\Windows\Application Experience\AitAgent No Task File
Task: {AC668097-4D6B-4093-AC14-014C09DBF820} - \Microsoft\Windows\Ras\MobilityManager No Task File
Task: {ACFF71B7-78C2-48AE-BABC-2914E75F970B} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)
Task: {B083A9FD-6A43-4DDC-923B-82E508649CC7} - \Microsoft\Windows\Wininet\CacheTask No Task File
Task: {B0CBAB43-44FC-469B-A4CE-87426761FDCE} - \Microsoft\Windows\PerfTrack\BackgroundConfigSurveyor No Task File
Task: {B40F508F-D0A4-4A17-8B81-20A62F84D4CC} - \Program aktualizacji online firmy Adobe. No Task File
Task: {B86D2DC1-C27F-49AD-B3EB-F4F011E0C45E} - \Microsoft\Windows\Media Center\PvrRecoveryTask No Task File
Task: {BE669C13-8165-4536-96D0-6D6C39292AAE} - \Microsoft\Windows\Diagnosis\Scheduled No Task File
Task: {BF897D04-57B9-4358-9DA5-51229A8EBAA7} - \Microsoft\Windows\Media Center\ReindexSearchRoot No Task File
Task: {C016366B-7126-46CA-B36B-592A3D95A60B} - \Microsoft\Windows\Customer Experience Improvement Program\Consolidator No Task File
Task: {C5143E5B-DB72-4A4B-B43E-5F815AE0B8A0} - \Microsoft\Windows\Media Center\ehDRMInit No Task File
Task: {C6A272E4-7856-4F0A-B984-D65ED7F33420} - \Microsoft\Windows\Media Center\OCURDiscovery No Task File
Task: {CA4B8FF2-A4D2-4D88-A52E-3A5BDAF7F56E} - \Microsoft\Windows\Registry\RegIdleBackup No Task File
Task: {CB3D64BF-C0C9-45FF-BFB0-FF1A8F680186} - \Microsoft\Windows\RemoteAssistance\RemoteAssistanceTask No Task File
Task: {CEE64558-E1A7-4D9D-80A7-2001912BE5B5} - \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector No Task File
Task: {D0250F3F-6480-484F-B719-42F659AC64D5} - \Microsoft\Windows\Windows Error Reporting\QueueReporting No Task File
Task: {D7B6E81D-3CF4-432C-84D2-24213F4316E6} - \Microsoft\Windows\Autochk\Proxy No Task File
Task: {D878A98D-9BA9-4F92-AA98-134706B4235D} - \Microsoft\Windows\Media Center\ConfigureInternetTimeService No Task File
Task: {DA41DE71-8431-42FB-9DB0-EB64A961DEAD} - \Microsoft\Windows\Maintenance\WinSAT No Task File
Task: {DA966A8C-2D91-435C-B67A-3230D42DC2E0} - \Microsoft\Windows\Media Center\PBDADiscoveryW2 No Task File
Task: {DB3527C0-62DC-458B-93CB-2AEBCF2DCA2C} - \{6D9D60AD-1BCD-4CBF-BF1A-BF399CA7E062} No Task File
Task: {DD9F510C-95F4-499A-90C8-BAC5BC372FF4} - \Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask No Task File
Task: {DF302DC7-4058-4AA8-B71F-8D3B1F2D01ED} - \Nero\Nero Info No Task File
Task: {E22A8667-F75B-4BA9-BA46-067ED4429DE8} - \Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange No Task File
Task: {E3163C33-301D-4730-A266-5518C5ED3967} - \Microsoft\Windows\Bluetooth\UninstallDeviceTask No Task File
Task: {E36C1934-F59E-49B4-84CC-341E01CEB3BA} - \Microsoft\Windows\Media Center\ActivateWindowsSearch No Task File
Task: {E5CEF458-0FB1-4DBF-87E9-7B35D8BAE6DF} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline No Task File
Task: {E6F60AF8-02F1-4FA3-B295-C717D64DAFEC} - \Microsoft\Windows\Media Center\PvrScheduleTask No Task File
Task: {EA8ED8F5-172B-4E96-B08A-2071FB5B133F} - \Microsoft\Windows\Media Center\SqlLiteRecoveryTask No Task File
Task: {EACA24FF-236C-401D-A1E7-B3D5267B8A50} - \Microsoft\Windows\RAC\RacTask No Task File
Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove No Task File
Task: {EB70C696-D7FE-4A96-B084-1CE3D2A4A164} - \WPD\SqmUpload_S-1-5-21-394936792-4148099325-2900050880-1000 No Task File
Task: {F776D91B-7CC4-4559-AE53-EF8F994ACABC} - \Microsoft\Windows\Media Center\PBDADiscovery No Task File
Task: {F9DE69D3-D4C4-4F41-81B8-76C404AB12F2} - \{040F114D-3754-4873-A1F3-F58430C98B52} No Task File
Task: {FA2BC0A6-8D4B-458A-85C8-2B8C72487513} - \Microsoft\Windows\MemoryDiagnostic\DecompressionFailureDetector No Task File
Task: {FB3C354D-297A-4EB2-9B58-090F6361906B} - \Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem No Task File
Task: {FDD56C73-F0D5-41B6-B767-6EFFD7966428} - \Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask No Task File
Task: {FE486352-854D-4330-BF81-B467BC1C36D3} - \Microsoft\Windows\Media Center\OCURActivate No Task File
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AAVService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"
CMD: netsh advfirewall reset
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Fix ,po wykonaniu pokaż raport z tego działania.
W przeglądarce firefox -menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox. Reset nie naruszy zakładek i haseł.
W Google Chrome pasku adresu wpisz chrome//settings/,następnie na dole klik pokaż ustawienia zaawansowane,zjedź ponownie na sam dół i klik zresetuj ustawienia przeglądarki.
Ściągnij program
[Aby zobaczyć linki, zarejestruj się tutaj]
kliknij
Szukaji następnie
Usuń
pokaż raport
Zapisz jako
fixlist.txti umieść obok
FRST
Fixlog:
[Aby zobaczyć linki, zarejestruj się tutaj]
fixlist:
[Aby zobaczyć linki, zarejestruj się tutaj]
Dodano: 22 sty 2014, 10:25
Mam jeszcze coś zrobić, czy to wszystko ?
Zrób ponowny skan FRST i OTL
OTL:
[Aby zobaczyć linki, zarejestruj się tutaj]
FRST:
[Aby zobaczyć linki, zarejestruj się tutaj]
Addition:
[Aby zobaczyć linki, zarejestruj się tutaj]
Dolną część usnąłem bo była zbędna.
Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
FF Plugin-x32: @ganymede/GanymedeNetPlugin,version=1.0 - C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll No File
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Extension: ArcaBit Ext. - C:\Program Files (x86)\Mozilla Firefox\extensions\[email protected] [2013-12-10]
C:\ProgramData\TuneUp Software
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Fix ,po wykonaniu pokaż raport z tego działania.
Otwórz Google Chrome. W sekcji "Po uruchomieniu" usuń z listy stron startowych:
websearch.greatresults.info
Stronę ustaw sobie na jakąś inną np.google.pl
Odinstaluj:
TuneUp Utilities Language Pack
[Aby zobaczyć linki, zarejestruj się tutaj]
Dodano: 23 sty 2014, 17:05
Ok wszystko zrobiłem, ale nie mogę odinstalować TuneUp Utilities Language Pack nigdzie tego nie ma.
Jest to część ukryta tak więc użyj tej aplikacji
[Aby zobaczyć linki, zarejestruj się tutaj]
Uruchom to narzędzie Microsoftu: KLIK. Zaakceptuj > Wykryj problemy i pozwól mi wybrać poprawki do zastosowania > Odinstalowywanie > zaznacz na liście wpisy wymienione wyżej czyli TuneUp Utilities Language Pack
Ok już udało się odinstalować.