Wyskakujące reklamy w nowych oknach, logi

[mturek28]

Witam, Proszę o sprawdzenie logów z tych programów. Problem jest taki, że przy użyciu przeglądarek wyskakują mi non-stop reklamy w nowych oknach.

OTL: http://www.wklej.eu/index.php?id=f63b26e58f
EXTRAS: http://www.wklej.eu/index.php?id=8ca91a672e
GMER: http://www.wklej.eu/index.php?id=49c51f8f03

[mateo8898]

Odinstaluj fst_pl_14. Następnie:

Uruchom OTL w oknie Własne opcje skanowania/skrypt wklej:

:OTL
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE:64bit: - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.dosearches.com/web/?utm_source=b&utm_medium=cor&utm_campaign=rg&utm_content=ds&from=cor&uid=WDCXWD5000BPVT-22A1YT0_WD-WXK1CB1K8193K8193&ts=1383917812&type=default&q={searchTerms}
IE - HKLM\..\SearchScopes\{C9F3D128-A874-4E85-8A46-4AB11412B8A5}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&crg=3.1010000.10025&barid={E9DF1927-2452-11E2-A37D-E840F2757C7C}
IE - HKU\S-1-5-21-953864326-834876565-2029926443-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www2.delta-search.com/?babsrc=HP_ss&mntrId=A440BEB70DC3A10A&affID=119357&tsp=4990
IE - HKU\S-1-5-21-953864326-834876565-2029926443-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=A440BEB70DC3A10A&affID=119357&tsp=4990
IE - HKU\S-1-5-21-953864326-834876565-2029926443-1000\..\SearchScopes\{352AC9B4-12DA-4E10-A6D1-2E4347E887F1}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=^U3&apn_dtid=^OSJ000^YY^PL&apn_uid=B495D3AE-54FA-4A45-BAAB-F18D693CD303&apn_sauid=2ED7FA3C-C667-421D-AAE0-218883EFAE1C
IE - HKU\S-1-5-21-953864326-834876565-2029926443-1000\..\SearchScopes\{C9F3D128-A874-4E85-8A46-4AB11412B8A5}: "URL" = http://search.sweetim.com/search.asp?src=6&q={searchTerms}&st=6&barid={E9DF1927-2452-11E2-A37D-E840F2757C7C}
FF - prefs.js..browser.search.defaultengine: "Web Search"
[2013-06-30 18:56:33 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\user\AppData\Roaming\mozilla\Firefox\Profiles\kg7muiy1.default\extensions\[email protected]
[2012-11-29 16:11:59 | 000,002,308 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\kg7muiy1.default\searchplugins\askcom.xml
[2013-02-10 20:26:05 | 000,001,294 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\kg7muiy1.default\searchplugins\delta.xml
[2012-12-30 13:32:23 | 000,002,117 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\kg7muiy1.default\searchplugins\Startsear.xml
[2012-12-24 01:12:53 | 000,003,983 | ---- | M] () -- C:\Users\user\AppData\Roaming\mozilla\firefox\profiles\kg7muiy1.default\searchplugins\sweetim.xml
O4 - HKLM..\Run: [fst_pl_14] C:\Program Files (x86)\fst_pl_14\fst_pl_14.exe ()
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe File not found
O4 - HKLM..\Run: [TaskTray] File not found
O4 - HKU\S-1-5-21-953864326-834876565-2029926443-1000..\Run: [NextLive] C:\Users\user\AppData\Roaming\newnext.me\nengine.dll (NewNextDotMe)
O4 - HKU\S-1-5-21-953864326-834876565-2029926443-1000..\Run: [RGSC] F:\GTA 4\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
O4 - HKU\S-1-5-21-953864326-834876565-2029926443-1002..\Run: [AVG-Secure-Search-Update_JUNE2013_HP] "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_HP.exe" /PROMPT /CMPID=JUNE2013_HP File not found
O4 - HKU\S-1-5-21-953864326-834876565-2029926443-1002..\Run: [AVG-Secure-Search-Update_JUNE2013_TB] "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB File not found
O4 - HKLM..\RunOnce: [upfst_pl_14.exe] C:\Users\user\AppData\Local\fst_pl_14\upfst_pl_14.exe ()
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-953864326-834876565-2029926443-1002..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Heroes of Might & Magic 5.LNK = File not found
O8:64bit: - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8:64bit: - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~1\MICROS~2\Office14\ONBttnIE.dll/105 File not found
[2013-12-29 12:42:51 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\fst_pl_14
[2013-12-29 12:42:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\fst_pl_14
[2013-12-29 12:38:02 | 000,000,000 | ---D | C] -- C:\Users\user\.android
[2013-12-29 12:38:00 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\newnext.me
[2013-12-29 12:38:00 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\genienext
[2013-12-16 20:51:16 | 000,000,000 | ---D | C] -- C:\Users\user\Documents\Mobogenie
[2013-12-16 20:51:16 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Mobogenie
[2014-01-11 14:54:38 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
[2014-01-11 14:54:38 | 000,000,350 | ---- | M] () -- C:\Windows\tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
[2014-01-11 14:49:19 | 000,000,284 | ---- | M] () -- C:\Windows\tasks\FoxTab.job
[2013-02-10 20:25:37 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\Babylon


:Commands
[clearallrestorepoints]
[emptytemp]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.

[mturek28]

Dzięki, nowe logi
Log z usuwania: http://www.wklej.eu/index.php?id=01a1d41b37
OTL: http://www.wklej.eu/index.php?id=f42f9c89a4
EXTRAS: http://www.wklej.eu/index.php?id=c9dddd3886

[mateo8898]

Odinstaluj Discount Dragon

Wklej w OTL:

:OTL
O2:64bit: - BHO: (Discount Dragon BHO) - {EA34C851-D481-49F5-A356-3A8B0A8F3B7E} - C:\Program Files (x86)\Discount Dragon\FrameworkBHO64.dll ()
O2 - BHO: (Discount Dragon BHO) - {EA34C851-D481-49F5-A356-3A8B0A8F3B7E} - C:\Program Files (x86)\Discount Dragon\FrameworkBHO.dll ()
[2014-01-11 17:36:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cling Clang
[2014-01-11 17:36:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\predm
[2014-01-11 17:36:04 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\BenchUpdater
[2014-01-11 17:36:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Discount Dragon
[2014-01-11 17:35:50 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Local\Discount Dragon
[2014-01-11 17:35:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bench
[2014-01-11 17:51:25 | 000,000,000 | ---D | C] -- C:\Users\user\AppData\Roaming\newnext.me
[2014-01-11 17:47:15 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\bench-sys.job
[2014-01-11 17:47:15 | 000,000,342 | ---- | M] () -- C:\Windows\tasks\bench-S-1-5-21-953864326-834876565-2029926443-1000.job
[2014-01-11 17:51:25 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\newnext.me
[2013-02-17 00:04:01 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\OpenCandy
SRV - [2014-01-10 21:09:52 | 000,097,056 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Cling Clang\updateClingClang.exe -- (Update Cling Clang)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[email protected]: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
O4 - HKLM..\RunOnce: [Discount Dragon-repairJob] C:\Users\user\AppData\Local\Discount Dragon\repair.js ()
O2 - BHO: (SquirrelWeb) - {dd86af49-1ef1-4532-89f7-41eda1dbbe6d} - C:\Program Files (x86)\SquirrelWeb\SquirrelWebBHO.dll File not found
O2 - BHO: (Cling Clang) - {aa9aa36b-5b7b-4996-b083-83ef84d53b19} - C:\Program Files (x86)\Cling Clang\ClingClangbho.dll (Cling Clang)

:Commands
[reboot]

Klikasz Wykonaj skrypt. Podajesz log z usuwania + nowe logi z OTL.

[mturek28]

usuwanie: http://www.wklej.eu/index.php?id=213ffa28e7
OTL: http://www.wklej.eu/index.php?id=bed4f09e6e
EXTRAS: http://www.wklej.eu/index.php?id=76ae236ce2

[mateo8898]

Wklej w OTL:

:OTL
O20 - AppInit_DLLs: (xC:\PROGRA~3\BROWSE~1\261562~1.220\{C16C1~1\browse~1.dll) - File not found
[2013-07-15 11:24:49 | 000,000,000 | ---D | M] -- C:\Users\user\AppData\Roaming\ESET

Klikasz Wykonaj skrypt, następnie Sprzątanie

Przeczyść dysk oraz rejestr CCleaner (zakładka Cleaner i Rejestr)

Zainstaluj SP1 http://www.instalki.pl/programy/downloa ... ack_1.html

Zaktualizuj IE do najnowszej wersji (nawet jeśli go nie używasz) http://www.instalki.pl/programy/downloa ... er_11.html

Odinstaluj starą wersję Javy:

Java 7 Update 9

i zainstaluj najnowszą http://www.instalki.pl/programy/downloa ... /Java.html

[mturek28]

Dzięki bardzo. W najbliższym czasie zrobię to co napisałeś!