Wyłączony antywirus, nie daje się włączyć

[Limen]

Wczoraj zauważyłem, że Avira ma wyłączoną ochronę, otwierając okienko programu i klikając "włącz" lub "rozwiąż problem", nie działo się nic lub wyskakiwał komunikat o odmowie dostępu. Ściągnąłem Avast, ale również nie ma możliwości włączenia ochrony (brak reakcji na przycisk włączenia).
Szukając rozwiązania, ściągnąłem ComboFix, otworzyłem go, jednak wyświetlał się tylko komunikat o braku wsparcia dla Windows 2000 (mój system to Windows 8.1 64-bit).
GMER pod koniec skanowania wyświetlił dwa komunikaty (załączam screeny).

Addition.txt

FRST.txt

gmer.txt

Shortcut.txt

[jessica]

Process  C:\Users\Mateusz\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe (*** suspicious ***) @ C:\Users\Mateusz\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe [2616] (Microsoft® Volume Shadow Copy Service/Microsoft Corporation)(2015-06-23 12:48:18)  0000000000400000

 

Jest winowajca

 

1) Wejdź w Tryb Awaryjny (F8 przed startem Systemu).

 

2) Otwórz Notatnik i wklej w nim:

 

R2 VSSS; C:\Users\Mateusz\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe [104751744 2015-06-23] (Microsoft Corporation) [File not signed] <==== ATTENTION

C:\Users\Mateusz\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe

Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f

Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f

Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f

CustomCLSID: HKU\S-1-5-21-4109652526-3747850710-83083684-1002_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Mateusz\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-4109652526-3747850710-83083684-1002_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Mateusz\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-4109652526-3747850710-83083684-1002_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Mateusz\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File

CCustomCLSID: HKU\S-1-5-21-4109652526-3747850710-83083684-1002_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Mateusz\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File

CustomCLSID: HKU\S-1-5-21-4109652526-3747850710-83083684-1002_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Mateusz\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

Task: {0E0D1772-56FF-4B9A-B9FF-19897CB630C4} - \AdobeFlashPlayerUpdate No Task File <==== ATTENTION

Task: {C5DE164D-F51D-441F-ABE5-997209D99D6A} - \AdobeFlashPlayerUpdate 2 No Task File <==== ATTENTION

Task: {C9021965-F56E-4584-86B4-9755381A72E8} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect <==== ATTENTION

Task: {E49FBE4E-9127-485A-AC9C-75F140F917CD} - System32\Tasks\Express FilesUpdate => C:\Program Files (x86)\ExpressFiles\EFUpdater.exe <==== ATTENTION

C:\Program Files (x86)\ExpressFiles\EFUpdater.exe

HKU\S-1-5-21-4109652526-3747850710-83083684-1002\Software\Classes\.exe: exefile =>  <===== ATTENTION!

HKU\S-1-5-21-4109652526-3747850710-83083684-1002\Software\Classes\exefile:  <===== ATTENTION!

HKLM\...\Policies\Explorer\Run: [564675125] => C:\ProgramData\msnckgfm.exe [102346752 2014-11-21] ()

HKLM\...\Policies\Explorer\Run: [1885449592] => C:\ProgramData\msogmzjr.exe [93585408 2014-11-21] ()

HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1

HKLM\...\Policies\Explorer: [HideSCAHealth] 1

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-4109652526-3747850710-83083684-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION

HKU\S-1-5-21-4109652526-3747850710-83083684-1002\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.qone8.com/?type=hp&ts=1383208129&from=cor&uid=ST1000LM024XHN-M101MBB_S2RQJ9EC924237

SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =

SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =

SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> DefaultScope {A18BA569-169B-4C1D-828A-8DC7E616026C} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=888596&p={searchTerms}

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&affID=119816&babsrc=SP_ss&mntrId=7e9fe951000000000000c68508e575ff

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> {A18BA569-169B-4C1D-828A-8DC7E616026C} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=888596&p={searchTerms}

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://mystart.incredibar.com/mb128/?search={searchTerms}&loc=IB_DS&a=6R8P0bU1QC&i=26

SearchScopes: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> {F663D89E-C743-42FC-B8D2-C301C321BB54} URL =

BHO-x32: SweetPacks Browser Helper -> {EEE6C35C-6118-11DC-9C72-001320C79847} -> C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2012-07-04] (SweetIM Technologies Ltd.)

Toolbar: HKLM-x32 - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll [2012-07-04] (SweetIM Technologies Ltd.)

Toolbar: HKU\S-1-5-21-4109652526-3747850710-83083684-1002 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File

FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox

FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox

CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [cekcjpgehmohobmdiikfnopibipmgnml] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Mateusz\AppData\Roaming\BabSolution\CR\Delta.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [hbcennhacfaagdopikcegfcobcadeocj] - C:\Program Files (x86)\Common Files\Spigot\GC\saebay_1.1.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [icdlfehblmklkikfigmjhbmmpmkmpooj] - C:\Program Files (x86)\Common Files\Spigot\GC\ErrorAssistant_1.3.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [2012-12-22]

CHR HKLM-x32\...\Chrome\Extension: [mhkaekfpcppmmioggniknbnbdbcigpkk] - C:\Program Files (x86)\Common Files\Spigot\GC\coupons_2.4.crx [Not Found]

CHR HKLM-x32\...\Chrome\Extension: [pfndaklgolladniicklehhancnlgocpp] - C:\Program Files (x86)\Common Files\Spigot\GC\saamazon_1.0.crx [Not Found]

S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]

R4 KProcessHacker2; \??\C:\Program Files\kprocesshacker.sys [X]

C:\Program Files\9EJ6JLND.exe

C:\Program Files\MCEJCBD6.exe

C:\Program Files\Z3KJ9J95.exe

2015-07-05 16:27 - 2015-07-05 16:27 - 01415680 _____ (wj32) C:\Program Files\V2P3A0TD.exe

2015-07-05 16:27 - 2015-07-05 16:27 - 01415680 _____ (wj32) C:\Program Files\70D6K7KV.exe

2015-07-05 16:27 - 2015-07-05 16:27 - 01415680 _____ (wj32) C:\Program Files\3BM819EP.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\WM9ESOZP.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\NJ0T6TP9.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\KY6CKSKY.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\KVXMUE35.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\BJXT16H3.exe

2015-07-05 16:26 - 2015-07-05 16:26 - 01415680 _____ (wj32) C:\Program Files\9WY02FE4.exe

2015-07-05 16:25 - 2015-07-05 16:25 - 01415680 _____ (wj32) C:\Program Files\PRZPC10T.exe

2015-07-05 16:25 - 2015-07-05 16:25 - 01415680 _____ (wj32) C:\Program Files\LKSIKMOK.exe

2015-07-05 16:25 - 2015-07-05 16:25 - 01415680 _____ (wj32) C:\Program Files\LAILN9ED.exe

2015-07-05 16:25 - 2015-07-05 16:25 - 01415680 _____ (wj32) C:\Program Files\KMRTV27X.exe

2015-07-05 16:25 - 2015-07-05 16:25 - 01415680 _____ (wj32) C:\Program Files\69BG6GKS.exe

2015-07-05 16:24 - 2015-07-05 16:24 - 01415680 _____ (wj32) C:\Program Files\8GLHPX5R.exe

2015-07-05 16:24 - 2015-07-05 16:24 - 01415680 _____ (wj32) C:\Program Files\3WM6JU89.exe

2015-07-05 11:47 - 2015-07-05 11:47 - 01415680 _____ (wj32) C:\Program Files\7W7W4KYT.exe

2015-07-03 18:18 - 2015-07-03 18:18 - 01415680 _____ (wj32) C:\Program Files\TV0TSUWL.exe

2015-07-02 14:06 - 2015-07-02 14:06 - 01415680 _____ (wj32) C:\Program Files\KDIKMTYX.exe

2015-07-02 12:18 - 2015-07-02 12:18 - 01415680 _____ (wj32) C:\Program Files\TSUHJKSF.exe

2015-07-02 10:44 - 2015-07-02 10:44 - 01415680 _____ (wj32) C:\Program Files\9Y08YON0.exe

2015-06-26 19:57 - 2015-06-26 19:57 - 01415680 _____ (wj32) C:\Program Files\TY36GIKA.exe

2015-06-26 19:57 - 2015-06-26 19:57 - 01415680 _____ (wj32) C:\Program Files\E76E4RTF.exe

2015-06-26 19:57 - 2015-06-26 19:57 - 01415680 _____ (wj32) C:\Program Files\49Z43T68.exe

2015-06-26 19:56 - 2015-06-26 19:56 - 01415680 _____ (wj32) C:\Program Files\LTJLNFP9.exe

2015-06-26 19:56 - 2015-06-26 19:56 - 01415680 _____ (wj32) C:\Program Files\KSUW1R13.exe

2015-06-26 19:56 - 2015-06-26 19:56 - 01415680 _____ (wj32) C:\Program Files\JXT16HM8.exe

2015-06-26 19:56 - 2015-06-26 19:56 - 01415680 _____ (wj32) C:\Program Files\FHJLKCB4.exe

2015-06-26 19:56 - 2015-06-26 19:56 - 01415680 _____ (wj32) C:\Program Files\CBJ9EG5U.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\HNMUKUWM.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\EPOW49H3.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\E7U2A3BX.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\CHJ8VHJ5.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\98YX2RWV.exe

2015-06-26 19:55 - 2015-06-26 19:55 - 01415680 _____ (wj32) C:\Program Files\35AG5768.exe

2015-06-25 16:21 - 2015-06-25 16:21 - 01415680 _____ (wj32) C:\Program Files\D65AZMO1.exe

2015-06-24 10:04 - 2015-06-24 10:04 - 01415680 _____ (wj32) C:\Program Files\6NUEYZM6.exe

2015-06-24 10:04 - 2015-06-24 10:04 - 01415680 _____ (wj32) C:\Program Files\1OKSHMLB.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\OE13SUM5.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\JRHJOEDN.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\FKDFH46G.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\92468IKJ.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\80Z7XNPF.exe

2015-06-24 10:03 - 2015-06-24 10:03 - 01415680 _____ (wj32) C:\Program Files\4L2JEVC7.exe

2015-06-24 10:02 - 2015-06-24 10:02 - 01415680 _____ (wj32) C:\Program Files\LKTVKMOV.exe

2015-06-24 10:02 - 2015-06-24 10:02 - 01415680 _____ (wj32) C:\Program Files\KGLKD35F.exe

2015-06-24 10:02 - 2015-06-24 10:02 - 01415680 _____ (wj32) C:\Program Files\GUKY9FK3.exe

2015-06-23 14:49 - 2015-06-23 14:49 - 01415680 _____ (wj32) C:\Program Files\S346SGKE.exe

C:\ProgramData\MakeMarkerFile.exe

C:\ProgramData\msnckgfm.exe

C:\ProgramData\msogmzjr.exe

C:\Users\EasySurvey\EasySurvey.exe

EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix.

Powstanie plik fixlog.txt.

Daj ten log.

 

3) Zrób nowe logi z FRST.

 

4) Zrób log z Farbar Service Scanner >http://download.bleepingcomputer.com/farbar/FSS.exe (do skanowania zaznacz wszystko).

 

jessi

[Limen]

Wrzucam logi. Problem nie ustąpił.

FSS.txt

FRST.txt

Addition.txt

Shortcut.txt

Fixlog.txt

[jessica]

 Problem nie ustąpił.

Sadząc po logach, to jest już OK.

Z wyjątkiem brakujących plików Antywirusa.

Spróbuj go przeinstalować.

 

jessi