Czyszczenie z rootkit itp.

[ksalem]

Witam

Proszę o pomoc w wyczyszczeniu systemu.

Objawy: samoistne uruchamianie w firefox stron.

Opis komputera: zostalem poproszony o wyczyszcenie tego komputera z Win - 7 64bit. Odinstalowalem kilka śmieciowych programów: Ask i McAfee.

Addition.txt

FRST.txt

GMER.txt

[picasso]

Detekcje "rootkit" w GMER: to obiekty Avast, infekcja wątpliwa. Natomiast tu nadal multum instalacji adware.

 

1. Otwórz Notatnik i wklej w nim:

 

() C:\Program Files (x86)\Przyspiesz Komputer\PCSUService.exe
(Just Develop It) C:\Program Files (x86)\MyPC Backup\BackupStack.exe
(ClickMeIn Limited) C:\Program Files (x86)\VuuPC\Connectivity.exe
(ClickMeIn Limited) C:\Program Files (x86)\VuuPC\RemoteEngine.exe
() C:\Users\FOD\AppData\Local\tuto4pc_pl_17\upt4pc_pl_17.exe
(Yontoo LLC) C:\Users\FOD\AppData\Roaming\Yontoo\YontooDesktop.exe
() C:\Users\FOD\Qtrax\Player\Notification.exe
(MyPCBackup.com) C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe
(SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
(SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe
(ClickMeIn Limited) C:\Program Files (x86)\VuuPC\RemoteEngineHelper.exe
(ClickMeIn Limited) C:\Program Files (x86)\VuuPC\RemoteEngineHelper.exe
R2 BackupStack; C:\Program Files (x86)\MyPC Backup\BackupStack.exe [32808 2013-05-31] (Just Develop It)
R2 PCSUService; C:\Program Files (x86)\Przyspiesz Komputer\PCSUService.exe [388912 2013-05-23] ()
R2 RemoteEngineService; C:\Program Files (x86)\VuuPC\remoteengine.exe [2967568 2013-12-14] (ClickMeIn Limited)
R2 VuuPCConnectivity; C:\Program Files (x86)\VuuPC\Connectivity.exe [4747280 2013-12-14] (ClickMeIn Limited)
HKLM-x32\...\RunOnce: [upt4pc_pl_17.exe] - C:\Users\FOD\AppData\Local\tuto4pc_pl_17\upt4pc_pl_17.exe -runonce [3154416 2013-08-26] ()
HKCU\...\Run: [Yontoo Desktop] - C:\Users\FOD\AppData\Roaming\Yontoo\YontooDesktop.exe [42784 2013-01-31] (Yontoo LLC)
HKCU\...\Run: [PCSpeedUp] - C:\Program Files (x86)\Przyspiesz Komputer\PCSUNotifier.exe [259888 2013-05-23] ()
HKCU\...\Run: [QtraxNotification] - C:\Users\FOD\Qtrax\Player\Notification.exe [118568 2013-07-30] ()
HKLM-x32\...\Run: [sweetIM] - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [115032 2012-10-04] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [sweetpacks Communicator] - C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe [231768 2012-08-15] (SweetIM Technologies Ltd.)
AppInit_DLLs-x32: c:\progra~3\bitguard\261694~1.246\{c16c1~1\bitguard.dll [ ] ()
Startup: C:\Users\FOD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=3ECE50E5493C72E6&affID=119357&tt=180613_ndtc&tsp=4919
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?babsrc=HP_ss_wls&mntrId=3ECE50E5493C72E6&affID=125034&tsp=5032
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10005&barid={DA375A44-74BD-4BB4-8ED6-1AED8DA86794}
SearchScopes: HKLM-x32 - {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=HJxdm007YYpl&ptnrS=HJxdm007YYpl&si=CKCOtoDu47ECFYaEDgodOmgA7A&ptb=ADF357F2-C7C7-4C75-8024-7752B892308A&ind=2012081703&n=77edee27&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10005&barid={DA375A44-74BD-4BB4-8ED6-1AED8DA86794}
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3ECE50E5493C72E6&affID=120699&tsp=5032
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3ECE50E5493C72E6&affID=120699&tsp=5032
SearchScopes: HKCU - {B141C441-159A-4D64-BC8D-DE9CBB3E1A91} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=&apn_ptnrs=^U3&apn_dtid=^YYYYYY^YY^PL&apn_uid=B355F912-CFBF-4F9E-900E-55B40591A659&apn_sauid=129A21FC-8240-476B-B1F5-1356B16A8092
SearchScopes: HKCU - {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=HJxdm007YYpl&ptnrS=HJxdm007YYpl&si=CKCOtoDu47ECFYaEDgodOmgA7A&ptb=ADF357F2-C7C7-4C75-8024-7752B892308A&ind=2012081703&n=77edee27&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={DA375A44-74BD-4BB4-8ED6-1AED8DA86794}
BHO: GBHO.BHO - {45d30484-7ded-43d9-957a-d2fd1f046511} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO-x32: searchgol Helper Object - {8F547BDD-FCD4-48F8-A06F-573D6F404A3C} - C:\Program Files (x86)\searchgol\searchgol\1.8.16.19\bh\searchgol.dll (Montera Technologeis LTD)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)
BHO-x32: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
BHO-x32: Yontoo - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
Toolbar: HKLM - Smart Recovery 2 - {1d09c093-f71e-43c3-b948-19316cbd695e} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)
Toolbar: HKLM-x32 - searchgol Toolbar - {00078E95-3A4A-4137-8DE7-2824908D1C17} - C:\Program Files (x86)\searchgol\searchgol\1.8.16.19\searchgolTlbr.dll (Montera Technologeis LTD)
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
FF HKLM-x32\...\Firefox\Extensions: [{C7AE725D-FA5C-4027-BB4C-787EF9F8248A}] - C:\Program Files (x86)\RelevantKnowledge\firefox
FF Extension: RelevantKnowledge - C:\Program Files (x86)\RelevantKnowledge\firefox
FF HKCU\...\Firefox\Extensions: [{dde15e35-c9b3-4c30-b055-730c5f4a45d3}] - C:\Program Files (x86)\Lyrmix\133.xpi
CHR HKLM-x32\...\Chrome\Extension: [aipfmkinhleccnodemkoofnnofpbbpac] - C:\Users\FOD\AppData\Roaming\BabSolution\CR\searchgol.crx
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\FOD\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\FOD\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx
CHR HKLM-x32\...\Chrome\Extension: [kidmhllhjmmmnpbiaihafgchacpmokof] - C:\Program Files (x86)\Lyrmix\133.crx
CHR HKLM-x32\...\Chrome\Extension: [mkndcbhcgphcfkkddanakjiepeknbgle] - C:\Program Files (x86)\RelevantKnowledge\rlcm.crx
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Program Files (x86)\Yontoo\YontooLayers.crx
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\FOD\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
Task: {11A9A023-3135-470C-9440-C80C8286E749} - System32\Tasks\QtraxPlayer => C:\Program Files (x86)\Microsoft Silverlight\sllauncher.exe [2013-09-13] (Microsoft Corporation)
Task: {1F89FFFC-A5E8-44A9-AF9F-52DEE575EB3F} - System32\Tasks\VuuPCUpdate => C:\Program Files (x86)\VuuPC\VuuPCUpdater.exe [2013-12-14] (VuuPC Limited)
Task: {5CC3B2C2-B003-4CE5-9320-C2326D01ABB1} - System32\Tasks\VuuPCUpdateLogin => C:\Program Files (x86)\VuuPC\VuuPCUpdater.exe [2013-12-14] (VuuPC Limited)
Task: {729985D6-8FD4-4BCC-B832-BB9C7995884C} - System32\Tasks\PC SpeedUp Service Deactivator => C:\Program Files (x86)\Przyspiesz Komputer\PCSUSD.exe [2013-05-23] ()
Task: {99CC96BC-2EFD-4BB3-AEB7-01BB72F67B15} - System32\Tasks\0 => Chrome.exe
Task: {A9FF3C90-9ADE-4338-8782-3D0C281C363C} - System32\Tasks\DSite => C:\Users\FOD\AppData\Roaming\DSite\UpdateProc\UpdateTask.exe [2013-06-20] ()
Task: {B244BD93-63B6-4B6F-90C8-9D8E3B9B0B49} - System32\Tasks\EPUpdater => C:\Users\FOD\AppData\Roaming\BabSolution\Shared\BabMaint.exe [2013-10-08] ()
Task: {F95ECDE9-5185-4C1E-AC38-F8FABA9C32D4} - \Lyrmix Update No Task File
Task: {FA3456A7-750D-44B2-8475-F7D4D97E4B30} - System32\Tasks\BitGuard => Sc.exe start BitGuard
Task: C:\Windows\Tasks\DSite.job => C:\Users\FOD\AppData\Roaming\DSite\UPDATE~1\UPDATE~1.EXE
Task: C:\Windows\Tasks\Lyrmix Update.job => C:\Program Files (x86)\Lyrmix\LymxUD.exe
Task: C:\Windows\Tasks\PC SpeedUp Service Deactivator.job => C:\Program Files (x86)\Przyspiesz Komputer\PCSUSD.exe
2013-12-11 14:17 - 2013-10-11 08:26 - 00000000 ____D C:\Users\FOD\AppData\Local\eorezo

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt.

 

2. Przez Panel sterowania odinstaluj adware:

 

BitGuard, ConvertAd, Delta Chrome Toolbar, Delta toolbar, Google Chrome Extension Updater, Internet Explorer Toolbar 4.6 by SweetPacks, MyPC Backup, Przyspiesz Komputer, Qtrax Connection Manager, Qtrax Player, RelevantKnowledge, Search-Gol Chrome Toolbar, searchgol toolbar, SweetIM for Messenger 3.7, SweetPacks bundle uninstaller, tuto4pc_pl_17, tuto4pc_pl_32, Update for Word Viewer, Update Manager for SweetPacks 1.1, VuuPC, You're Always a Click Away!, Word Viewer Packages, Yontoo 1.10.02.

 

3. Wyczyść Google Chrome:

• Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie Włącz.
• Ustawienia > karta Rozszerzenia > odinstaluj Ask Toolbar, Delta Toolbar, Search-Gol Toolbar, SweetIM for Facebook, SweetPacks Chrome Extension. Nie wiem co to jest InfoBird Pro, jeśli nie instalowany celowo, to też usuń.
• Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję Zresetuj ustawienia przeglądarki
• Ustawienia > karta Historia > wyczyść

4. Uruchom AdwCleaner. Zastosuj Szukaj, a po tym Usuń. Powstanie folder C:\AdwCleaner z raportem z usuwania.

 

5. Uruchom TFC - Temp Cleaner.

 

6. Zrób nowy skan FRST (bez Addition). Dołącz plik fixlog.txt i log z AdwCleaner.

 

 

 

.

[ksalem]

Dzięki za instrukcje ale będę miał dostęp do tego PC po nowym roku. Mam tylko nadzieje, że nie naśmiecą tam bardziej.

Pozdrawiam i wesołych świąt.