Niechciane programy Anyprotect, Liveinstallation

[Winters303]

Witajcie, przy instalacji jakiegoś programu dodatkowo zainstalowały się jakieś program anyprotect i liveinstallation. W załącznikach obowiązkowe logi

Addition.txt

Extras.Txt

FRST.txt

OTL.Txt

Shortcut.txt

GMER.txt

AdwCleanerR0.txt

[picasso]

1. Otwórz Notatnik i wklej w nim:

 

(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
() C:\Program Files (x86)\SupTab\HpUI.exe
() C:\Program Files (x86)\SupTab\Loader64.exe
() C:\Program Files (x86)\SupTab\Loader32.exe
() C:\Users\Differ Shop\AppData\Roaming\VOPackage
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-09-01] (Cherished Technololgy LIMITED)
R2 servervo; C:\Users\Differ Shop\AppData\Roaming\VOPackage\VOsrv.exe [71680 2014-09-01] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [528896 2014-09-01] (Fuyu LIMITED) [File not signed]
S2 trntv; C:\Users\Differ Shop\AppData\Roaming\TornTV.com\TornTVSvc.exe [X]
R1 {55685567-4840-4a91-962b-49a412e9485a}Gw64; C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys [61112 2014-05-26] (StdLib)
R1 {9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64; C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys [61112 2014-05-12] (StdLib)
Task: {19E620D6-803D-44D3-A747-35F3F4790F45} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-09-01] (AnyProtect.com) 
Task: {9F9CEA17-EC23-4E54-8D6A-ED8BD347DDC3} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-09-01] (AnyProtect.com) 
Task: {B13766DF-1561-41D0-91DC-7F0B1069EB9F} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-09-01] (AnyProtect.com) 
Task: C:\WINDOWS\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: C:\WINDOWS\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
Task: C:\WINDOWS\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\RunOnce: [VOPackage] => C:\Users\Differ Shop\AppData\Roaming\VOPackage\VOPackage.exe [291146 2014-09-01] ( )
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-249513183-3251645164-300344122-1002\...\Run: [AdobeBridge] => [X]
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
ShortcutWithArgument: C:\Users\Differ Shop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
ShortcutWithArgument: C:\Users\Differ Shop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
ShortcutWithArgument: C:\Users\Differ Shop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
ShortcutWithArgument: C:\Users\Differ Shop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKLM - {E2A5A6EC-3A11-47E3-B22F-7EF96D11B6E3} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=LCJB
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9&q={searchTerms}
SearchScopes: HKCU - {E2A5A6EC-3A11-47E3-B22F-7EF96D11B6E3} URL =
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://istart.webssearches.com/?type=sc&ts=1409580948&from=ild&uid=ST1000LM014-SSHD-8GB_W380YPY9XXXXW380YPY9
C:\Users\Differ Shop\AppData\Local\nsiAA82.tmp
C:\Users\Differ Shop\AppData\Roaming\ap_logs
C:\Users\Differ Shop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
C:\Users\Differ Shop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
C:\Users\Differ Shop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
C:\Users\Differ Shop\AppData\Roaming\VOPackage
C:\Users\Differ Shop\Desktop\AnyProtect.lnk
C:\Users\Differ Shop\Desktop\Continue Live Installation.lnk
C:\Users\Differ Shop\Desktop\Torntv Downloader.lnk
C:\Windows\System32\drivers\{55685567-4840-4a91-962b-49a412e9485a}Gw64.sys
C:\Windows\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gw64.sys
Reboot:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. System zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

2. Przez Panel sterowania odinstaluj adware AnyProtect, TornTV, webssearches uninstall, WindowsMangerProtect20.0.0.722 oraz zbędnik McAfee Security Scan Plus (prawdopodobnie instalacja sponsorowana).

 

3. W Google Chrome:

• Ustawienia > karta Rozszerzenia > odinstaluj Speed Dial 2, Quick start
• Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Zresetuj ustawienia przeglądarki. Zakładki i hasła nie zostaną naruszone.
• Ustawienia > karta Ustawienia > sekcja Wyszukiwanie > klik w Zarządzanie wyszukiwarkami > skasuj z listy niedomyślne śmieci (o ile będą).
• Ustawienia > karta Historia > wyczyść
• Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie Włącz.

3. Dopiero teraz możesz uruchomić AdwCleaner. Zastosuj Szukaj, a po tym Usuń. W folderze C:\AdwCleaner powstanie raport z usuwania.

 

4. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt i log z AdwCleaner.

 

 

 

 

.

[Winters303]

Wyniki:

Fixlog.txt

FRST.txt

[picasso]

Proszę nie używaj opcji "Odpowiedz", ona cytuje cały poprzeni post (zedytowałam). Korzystaj z pola szybkiej odpowiedzi na spodzie i opcji "Napisz".

 

Podałeś mi niewłaściwy log AdwCleaner (usunięty) - to log z opcji Szukaj i to ten sam co w pierwszym poście. Poproszę o log z opcji "Usuń", czyli AdwCleanerS0.txt.

 

 

 

.