Wyskakujące zakładki

[trucizna]

Witam,

na chromie wyskakują zbędne zakładki, komputer wolno chodzi. Logi przesyłam w załączniku

 

 

Addition.txt

FRST.txt

Shortcut.txt

gmer.txt

[jessica]

1) Odinstaluj niepotrzebny Akamai NetSession Interface

 

2) Odinstaluj ten program:

YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version:  - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== UWAGA

 

3) Spy Hunter nie jest zaufany.

spróbuj odinstalować w ten sposób:
kliknij na tę ikonkę C:\Users\nazwa Użytkownika\Start Menu\Programs\SpyHunter\Uninstall.lnk (czyli >>START >>Programy>>SpyHunter>>Uninstall)
wyskoczy okienko, ale zamiast klikać wielki zielony guzik "continue" kliknij "no, thanks". To drugie odinstalowuje.

 

4) Otwórz Notatnik i wklej w nim:

 

Task: {07E8B3AE-37D6-4E8C-8239-6E0DEFC8BED8} - \UncheckitUpdateTaskDB -> Brak pliku <==== UWAGA
Task: {1DF34F65-F932-4B0E-BE37-CA047A347C8D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
Task: {2101B008-2BFA-4566-874F-E47F2465E5D4} - \UncheckitTaskMN -> Brak pliku <==== UWAGA
Task: {24C95A65-5061-4935-8B20-F8DB0D5B3285} - \UncheckitUpdateTaskC -> Brak pliku <==== UWAGA
Task: {1DF34F65-F932-4B0E-BE37-CA047A347C8D} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
Task: {2101B008-2BFA-4566-874F-E47F2465E5D4} - \UncheckitTaskMN -> Brak pliku <==== UWAGA
Task: {24C95A65-5061-4935-8B20-F8DB0D5B3285} - \UncheckitUpdateTaskC -> Brak pliku <==== UWAGA
Task: {250911F7-C70B-40E3-8F22-49C791440772} - System32\Tasks\vreXjvXBrowserUpdateUA => C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe [2016-04-27] () <==== UWAGA
Task: {2764BDCE-31E9-4B70-8909-452ECDCD6B34} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA
Task: {2827EC29-4B6F-46D4-92B2-1F8AA5FBA51C} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA
Task: {30C51003-00B7-4599-89B4-E26BE747F965} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA
Task: {3CF3FD99-B59D-44D6-BC74-A91BBA436BAB} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA
Task: {453FE55E-5B4B-4145-B500-5B1387386570} - \Microsoft\Windows\Setup\gwx\rundetector -> Brak pliku <==== UWAGA
Task: {46730A57-41CB-4FA1-A2DE-614D7A051D6E} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA
Task: {52BCC920-7F28-4C82-8651-6A262F1F996E} - System32\Tasks\vreXjvXBrowserUpdateCore => C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe [2016-04-27] () <==== UWAGA
Task: {53141078-4B8B-4C50-BC4E-B10A3E638794} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA
Task: {72A8CB6F-9509-45DD-8033-392C83A1E60F} - \Microsoft\Windows\Setup\GWXTriggers\OnIdle-5d -> Brak pliku <==== UWAGA
Task: {896193AD-4AF7-47EC-AADA-D083ED0D9F99} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeReminderTime -> Brak pliku <==== UWAGA
Task: {9AAE0A45-87BE-49F4-8214-F857C25BDAE8} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA
Task: {B5C6BD10-85A1-4FAB-B1C5-0528D6C59C45} - System32\Tasks\vreXjvXCheckTask => C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe [2016-04-27] () <==== UWAGA
Task: {B81DF18C-C030-4A76-B1CC-932EBC51C66F} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA
Task: {BB5F6E9A-5534-4C9A-A911-12D7D30AE4FE} - \Microsoft\Windows\Setup\GWXTriggers\Time-Weekend -> Brak pliku <==== UWAGA
Task: {CB2641A7-1822-4C33-B781-CD90704030FE} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA
Task: {F03FBB5D-2FF9-492C-83D1-DE031960970E} - \Microsoft\Windows\Setup\GWXTriggers\ScheduleUpgradeTime -> Brak pliku <==== UWAGA
Task: C:\WINDOWS\Tasks\vreXjvXBrowserUpdateCore.job => C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe <==== UWAGA
Task: C:\WINDOWS\Tasks\vreXjvXCheckTask.job => C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\vreXjvX
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\vreXjvX\vreXjvX\chrome.exe (The vreXjvX Authors)
RemoveDirectory: C:\Program Files (x86)\Elex-tech
Reg: reg delete HKU\S-1-5-21-804795095-2449412092-3202539057-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Akamai NetSession Interface /f
FirewallRules: [uDP Query User{BF47FC17-FD1E-45AD-BE13-144E83AB1E42}C:\users\justynaa\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\justynaa\appdata\local\akamai\netsession_win.exe
FirewallRules: [TCP Query User{60A942D3-D720-48B4-9B7F-1BC94952A641}C:\users\justynaa\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\justynaa\appdata\local\akamai\netsession_win.exe
FirewallRules: [{8B63614C-8AD8-43A0-AD8A-17815491AE8A}] => (Allow) C:\Program Files (x86)\vreXjvX\vreXjvX\chrome.exe
FirewallRules: [{5507996E-7315-4C01-85C6-A4A9F51A1477}] => (Allow) C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe
FirewallRules: [{CD2FE1C5-AB00-4909-88DC-D27EFC48159E}] => (Allow) C:\ProgramData\vreXjvX\protect\protect.exe
RemoveDirectory: C:\Program Files (x86)\Enigma Software Group
HKU\S-1-5-21-804795095-2449412092-3202539057-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Justynaa\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
C:\Users\Justynaa\AppData\Local\Akamai\netsession_win.exe
HKU\S-1-5-21-804795095-2449412092-3202539057-1001\...\Policies\Explorer: []
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.mystartsearch.com/web/?type=ds&ts=1447270622&z=e2cb69ccab6c0cc909189ccg2z8z9m3o4mde5q4o9o&from=cor&uid=st1000lm024xhn-m101mbb_s32xj9df505011&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1447270622&z=e2cb69ccab6c0cc909189ccg2z8z9m3o4mde5q4o9o&from=cor&uid=st1000lm024xhn-m101mbb_s32xj9df505011&q={searchTerms}
HKU\S-1-5-21-804795095-2449412092-3202539057-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1465991588&z=1c0dd5b688ce072365a3804g9zdq5w6tetagfw5b1o&from=wpm0614&uid=ST1000LM024XHN-M101MBB_S32XJ9DF505011&q={searchTerms}
HKU\S-1-5-21-804795095-2449412092-3202539057-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1465991588&z=1c0dd5b688ce072365a3804g9zdq5w6tetagfw5b1o&from=wpm0614&uid=ST1000LM024XHN-M101MBB_S32XJ9DF505011&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1447270622&z=e2cb69ccab6c0cc909189ccg2z8z9m3o4mde5q4o9o&from=cor&uid=st1000lm024xhn-m101mbb_s32xj9df505011&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1447270622&z=e2cb69ccab6c0cc909189ccg2z8z9m3o4mde5q4o9o&from=cor&uid=st1000lm024xhn-m101mbb_s32xj9df505011&q={searchTerms}
SearchScopes: HKU\S-1-5-21-804795095-2449412092-3202539057-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.mystartsearch.com/web/?type=ds&ts=1447270622&z=e2cb69ccab6c0cc909189ccg2z8z9m3o4mde5q4o9o&from=cor&uid=st1000lm024xhn-m101mbb_s32xj9df505011&q={searchTerms}
BHO-x32: Brak nazwy -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> Brak pliku
CHR HomePage: Default -> hxxp://www.nicesearches.com?type=hp&ts=1465199186&from=d1e20606&uid=st1000lm024xhn-m101mbb_s32xj9df505011&z=6555f3b557b008097c4f3d3g3z2q2w2gct3t7g6bdz
CHR StartupUrls: Default -> "hxxp://www.nicesearches.com?type=hp&ts=1465199186&from=d1e20606&uid=st1000lm024xhn-m101mbb_s32xj9df505011&z=6555f3b557b008097c4f3d3g3z2q2w2gct3t7g6bdz"
CHR DefaultSearchURL: Default -> hxxp://www.nicesearches.com/search.php?type=ds&ts=1465199186&from=d1e20606&uid=st1000lm024xhn-m101mbb_s32xj9df505011&z=6555f3b557b008097c4f3d3g3z2q2w2gct3t7g6bdz&q={searchTerms}
CHR DefaultSearchKeyword: Default -> nice
S2 DeskTop_F; C:\ProgramData\desktopfind\desktop34.exe [236728 2016-03-16] (DeskTopService)
RemoveDirectory: C:\ProgramData\desktopfind
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2016-05-23] (Elex do Brasil Participações Ltda)
R2 SpyHunter 4 Service; C:\Program Files (x86)\Enigma Software Group\SpyHunter\SH4Service.exe [770432 2014-01-09] (Enigma Software Group USA, LLC.)
S2 vreXjvX_protect; C:\ProgramData\vreXjvX\protect\protect.exe [303000 2016-04-27] ()
S2 vreXjvX_update; C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe [472984 2016-04-27] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-08-17] ()
S3 EsgScanner; C:\Windows\SysWOW64\DRIVERS\EsgScanner.sys [19984 2012-06-22] ()
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [55056 2016-05-23] (Elex do Brasil Participações Ltda)
S1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [52440 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda)
2016-08-17 22:45 - 2016-08-17 22:45 - 00002365 _____ C:\Users\Justynaa\Desktop\SpyHunter.lnk
2016-08-17 22:45 - 2016-08-17 22:45 - 00000000 ____D C:\WINDOWS\AF54923662584AC6A0435B5B89C6EB61.TMP
2016-08-17 22:45 - 2016-08-17 22:45 - 00000000 ____D C:\Users\Justynaa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2016-08-17 22:45 - 2016-08-17 22:45 - 00000000 ____D C:\sh4ldr
2016-08-17 22:45 - 2016-08-17 22:45 - 00000000 ____D C:\Program Files (x86)\Enigma Software Group
2016-08-17 22:44 - 2016-08-17 22:44 - 00000000 ____D C:\Users\Justynaa\Desktop\SpyHunter 4.17.6.4336
2016-08-17 22:37 - 2016-08-17 22:33 - 44862875 _____ C:\Users\Justynaa\Desktop\SpyHunter 4.17.6.4336.rar
2016-08-17 18:11 - 2016-08-17 18:11 - 00022704 _____ C:\WINDOWS\system32\Drivers\EsgScanner.sys
2016-08-17 18:09 - 2016-08-17 18:10 - 03516080 _____ (Enigma Software Group USA, LLC.) C:\Users\Justynaa\Downloads\SpyHunter-Installer.exe
C:\ProgramData\boost_interprocess
2016-07-27 19:35 - 2016-05-23 04:41 - 00055056 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeKrnlBoot.sys
2016-07-27 19:35 - 2016-05-19 08:42 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\WINDOWS\system32\Drivers\iSafeNetFilter.sys
C:\Users\Justynaa\AppData\Roaming\TSv
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qksee
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uncheckit
C:\Users\Justynaa\Desktop\SpyHunter.lnk
C:\Users\Justynaa\Desktop\LABSB\DOSBox 0.74.lnk
C:\Users\Justynaa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
C:\Users\Justynaa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome\Google Hangouts.lnk
C:\Users\Justynaa\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome (2).lnk
ShortcutWithArgument: C:\Users\Justynaa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter\SpyHunter Emergency Startup.lnk -> C:\Windows\explorer.exe (Microsoft Corporation) -> "%PROGRAMFILES%\Enigma Software Group\SpyHunter\SH4.com"
ShortcutWithArgument: C:\Users\Justynaa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter\Uninstall SpyHunter.lnk -> C:\Windows\SysWOW64\msiexec.exe (Microsoft Corporation) -> /X {AF549236-6258-4AC6-A043-5B5B89C6EB61}
HOSTS:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

5) Zrób nowe logi FRST.

Przed skanem zaznacz "Addition.txt" oraz "Shortcut.txt"

 

jessi

[trucizna]

Nie wiem jak usunąć YAC

Logi w załączniku.

 

Addition.txt

FRST.txt

Shortcut.txt

[jessica]

Otwórz Notatnik i wklej w nim:

 

CustomCLSID: HKU\S-1-5-21-804795095-2449412092-3202539057-1001_Classes\CLSID\{0D327DA6-B4DF-4842-B833-2CFF84F0948F}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2017\acad.exe /Automation => Brak pliku
CustomCLSID: HKU\S-1-5-21-804795095-2449412092-3202539057-1001_Classes\CLSID\{720DB9AF-D62C-4ED0-A377-429C22312852}\localserver32 -> C:\Program Files\Autodesk\AutoCAD 2017\acad.exe => Brak pliku
Task: {2DB85D82-6D97-4998-883A-64DB035C48C4} - \vreXjvXBrowserUpdateUA -> Brak pliku <==== UWAGA
Task: {D207C03E-F5C7-4F5C-A475-885E6C1175CD} - \vreXjvXBrowserUpdateCore -> Brak pliku <==== UWAGA
Task: {DA336410-E77E-4885-A1F0-A8EBEB7D64F5} - \vreXjvXCheckTask -> Brak pliku <==== UWAGA
FirewallRules: [{2AE25233-330A-422D-A089-6F8F2A9C12BF}] => (Allow) C:\ProgramData\vreXjvX\protect\protect.exe
FirewallRules: [{B26FF75D-6375-4B73-884F-E924D991BF36}] => (Allow) C:\Program Files (x86)\vreXjvX\vreXjvX\chrome.exe
FirewallRules: [{F894A007-D7D8-4B9E-B42D-84D33A3DAD22}] => (Allow) C:\Program Files (x86)\vreXjvX\vreXjvX\bin\vreXjvX_server.exe
RemoveDirectory: C:\Program Files (x86)\vreXjvX
C:\Users\Public\Desktop\qksee.lnk
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

 

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

 

jessi