Win 7 - spowolnienie, reklamy, niechciana przeglądarka domyślna

[georgewroc]

Dzień dobry,

 

Od kilku tygodni borykam się z ciągle zmieniającą się przeglądarką domyślną w Chrome i Firefoxie: www.nicesearches.com, webssearches.com itp,  nasiliła się ilość wyskakujących okienek z reklamami i zauważyłem całościowe spowolnienie sprzętu.

Skan Avastem przed uruchomieniem systemu wykazał pliki, z którymi nie udało mu się uporać więc coś zainstalowało się na dobre.

Dołączam wymagane logi. Mam nadzieję, że uda się choć trochę wyeliminować te problemy.

 

Pozdrawiam,

Addition.txt

FRST.txt

Shortcut.txt

[jessica]

1) Spróbuj odinstalować te programy:

qksee (HKLM-x32\...\qksee) (Version:  - Taiwan Shui Mu Chih Ching Technology Limited) <==== UWAGA

YAC(Yet Another Cleaner!) (HKLM-x32\...\iSafe) (Version:  - ELEX DO BRASIL PARTICIPAÇÕES LTDA) <==== UWAGA

 

2) Otwórz Notatnik i wklej w nim:

 

Task: {7492FAD3-F1AA-4869-8829-37B444AC21C0} - System32\Tasks\Browser Updater Task(Core) => C:\Program Files (x86)\TXQQBrowser\Update\52DCC99D9D677A62792EC8BE91AEF958\Update\BrowserUpdate.exe [2016-04-25] (Tencent) <==== UWAGA
Task: {AE4D140D-E676-4258-83D6-F70DFF0B3BA5} - \WinTaske -> Brak pliku <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\TXQQBrowser
C:\Users\Grzegorz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
C:\Users\Grzegorz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
RemoveDirectory: C:\Program Files (x86)\Outlose
RemoveDirectory: C:\Program Files (x86)\WinSaber
RemoveDirectory: C:\Program Files (x86)\Elex-tech
RemoveDirectory: C:\Program Files (x86)\qksee
RemoveDirectory: C:\ProgramData\Outlose
RemoveDirectory: C:\ProgramData\yahoochrome
RemoveDirectory: C:\Program Files (x86)\duy8wvgf
RemoveDirectory: C:\Program Files (x86)\SearchesToYesbnd
RemoveDirectory: C:\Program Files (x86)\WinZipper
RemoveDirectory: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qksee
FirewallRules: [{A9902607-F65D-4F2F-96A5-B99EF5F8A30F}] => (Allow) C:\Program Files (x86)\Outlose\Update\OutloseUpdate.exe
FirewallRules: [{F57B7B2A-A014-48EB-9C0D-2DD9564ABCF6}] => (Allow) C:\Program Files (x86)\Outlose\Application\chrome.exe
FirewallRules: [{19CE6225-CC35-408F-9008-A78E593DF6E0}] => (Allow) C:\ProgramData\Outlose\Outlose.exe
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D&q={searchTerms}
HKU\S-1-5-21-3252319307-3698360240-778993358-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
HKU\S-1-5-21-3252319307-3698360240-778993358-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466709243&z=7e4be77d34f83655ff9c808g6z3q3q6m4eet0o7zcg&from=wpm0616&uid=CT250BX100SSD1_1522F008143D
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3252319307-3698360240-778993358-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKU\S-1-5-21-3252319307-3698360240-778993358-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
FF NewTab: hxxp://www.nicesearches.com?type=hp&ts=1468851208&from=43110715&uid=ct250bx100ssd1_1522f008143d&z=30606d595de9c35e12df05fg6zfq6b4b9w9g0o3e3m
FF DefaultSearchEngine: nice
FF SearchEngineOrder.1: nice
FF SelectedSearchEngine: nice
FF Homepage: hxxp://www.nicesearches.com?type=hp&ts=1468851208&from=43110715&uid=ct250bx100ssd1_1522f008143d&z=30606d595de9c35e12df05fg6zfq6b4b9w9g0o3e3m
FF user.js: detected! => C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\user.js [2016-07-18]
FF SearchPlugin: C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\searchplugins\nice.xml [2016-06-14]
FF SearchPlugin: C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\searchplugins\nuesearch.xml [2016-06-23]
FF Extension: (xRocket Toolbar) - C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\Extensions\arthurj8283@gmail.com [2016-06-14] [brak podpisu cyfrowego]
FF Extension: (Steel Cut 1.0.1) - C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\Extensions\{584b0c3e-b945-4119-b766-b130b3019d00}.xpi [2016-03-18] [brak podpisu cyfrowego]
FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\Grzegorz\AppData\Roaming\Mozilla\Firefox\Profiles\2da9qds0.default\extensions\arthurj8283@gmail.com
CHR DefaultSearchURL: Default -> hxxp://www.nicesearches.com/search.php?type=ds&ts=1472494524&from=c1980826&uid=ct250bx100ssd1_1522f008143d&z=663e614974be491f65113e1g5zam8o0zbtazaw0o6c&q={searchTerms}
CHR DefaultSearchKeyword: Default -> nice
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2016-05-23] (Elex do Brasil Participações Ltda)
R2 qkseeService; C:\Program Files (x86)\qksee\qkseeSvc.exe [789240 2016-07-14] (Qksee Pvt Ltd.)
R2 winsaber; C:\Program Files (x86)\WinSaber\WinSaber.exe [421080 2016-07-14] ()
R2 yahoochrometechnology; C:\ProgramData\yahoochrome\desktop65.exe [236768 2016-05-02] (YahooChrome)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-03-22] ()
C:\Windows\System32\DRIVERS\EsgScanner.sys
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [55056 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [52440 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2016-05-23] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda)
C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys
C:\Windows\System32\DRIVERS\iSafeNetFilter.sys
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip
C:\Users\Grzegorz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
HOSTS:
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

3) Użyj >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

 

mało prawdopodobne, bym tu jeszcze zajrzała, więc nie żądam raportów ani logów.

 

jessi

[georgewroc]

Wydaje się, że lekarstwo pomogło. Dzięki.