Virtual WiFi Router i niespodzianka

[cavarr]

Cześć,

Po zainstalowaniu tego syfu http://www.virtualwifirouter.com/p/downlooad.html komp mi zaczął wyłączać chrome, odpalać reklamy popup.

 

W chrome po włączeniu odpala się:

 

Wcześniej było milion syfów (reklamy popup), ale po skanowaniu malwerebytes usunął 777 błędów (w załączeniu log).

 

W załączeniu logi. Z góry dzięki za pomoc w przeanalizowaniu wykrytych problemów.

malverbytes.txt

gmer1.txt

Shortcut.txt

FRST.txt

Addition.txt

[picasso]

Jest tu jeszcze co czyścić, m.in. aktywne adware YouTube Accelerator w Winsock oraz zmodyfikowane skróty LNK przeglądarek kierujące na oursurfing.com. Do przeprowadzenia:

 

1. Odinstaluj adware Mouthpiece Notification.

 

2. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
CreateRestorePoint:
Task: {05CA4F16-C41D-4D20-BD7F-E9441B371280} - \SmartWeb Upgrade Trigger Task No Task File 
Task: {5B94828A-0A3B-41FB-B8C3-1A14834725BF} - \ShopperPro No Task File 
Task: {8F956E02-2741-4228-A6CC-5CB77BBC2A30} - \ShopperProJSUpd No Task File 
Task: {9D71992D-A317-4AF6-B938-96B59FDE380C} - \SPDriver No Task File 
Task: {AA26E772-EE3E-4FFC-A036-8FBE613FCBBD} - System32\Tasks\Microsoft\Windows\GroupPolicy\{3E0A038B-D834-4930-9981-E89C9BFF83AA}
Task: {AAAFAB6D-90C9-4D43-B6CF-2320B8C88B76} - System32\Tasks\YTAUpdate => C:\PROGRA~2\YOUTUB~1\Updater.exe 
Task: {B4C04B14-090D-4E1F-A49A-B3DE9F0F367D} - \APSnotifierPP3 No Task File 
Task: {DAD458BB-568B-4946-9F45-2F9133517EF8} - \SPBIW_UpdateTask_Time_323238373130313733372d4a5b5b345a417845455a376c No Task File 
Task: {DBF4784D-234D-489F-A322-15800626ECAB} - System32\Tasks\YTAUpdate_logon => C:\PROGRA~2\YOUTUB~1\Updater.exe 
S2 YouTubeAcceleratorService; C:\PROGRA~2\YOUTUB~1\YouTubeAcceleratorService.exe -start -scm [X]
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [WinCheck] => C:\Users\Administrator\AppData\Local\F5A708FF-1432679338-11E3-9673-CE39E75C1B10\bnsh7D3E.exe [861696 2015-05-26] ()
HKU\S-1-5-21-3325632279-856947495-1742326175-500\...\Run: [Virtual WiFi Router] => ""
HKU\S-1-5-21-3325632279-856947495-1742326175-500\...\RunOnce: [CleanupUninstallerTemp] => cmd.exe /c del /F /Q "%temp%\updater_uninstall.exe" /f
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction 
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\Users\Administrator\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.oursurfing.com/?type=sc&ts=1432672679&z=6e1253d79318ef88d43923cg8z0c6o7qem2odqftce&from=cmi&uid=SamsungXSSDX840XEVOX250GB_S1DBNSBF300055N
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\S-1-5-21-3325632279-856947495-1742326175-500 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
StartMenuInternet: FIREFOX.EXE - firefox.exe
StartMenuInternet: Google Chrome - Chrome.exe
C:\Program Files (x86)\4269711e-b00b-412b-9fd9-d13df3fdba78
C:\Program Files (x86)\8d843763-d167-4df4-ab9a-d24ccbd91ac1
C:\Program Files (x86)\globalUpdate
C:\Program Files (x86)\YouTube Accelerator
C:\ProgramData\TEMP
C:\Users\Administrator\AppData\Local\F5A708FF-1432679338-11E3-9673-CE39E75C1B10
C:\Users\Administrator\AppData\Local\globalUpdate
C:\Users\Administrator\Downloads\Virtual WiFi Router 3.0.1.2 Setup.exe
C:\Users\Public\Documents\GOOBZO
RemoveDirectory: C:\Users\admin.p
RemoveDirectory: C:\Users\lol
DisableService: Mobile Partner. RunOuc
CMD: netsh advfirewall reset
CMD: netsh winsock reset
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

3. Zrób nowy log FRST z opcji Scan (bez Addition i Shortcut). Dołącz też plik fixlog.txt.

[cavarr]

Nowe logi.

FRST.txt

Fixlog.txt