Wirus reklamowy + oczyszczenie

[arehiba]

Witam! Na mój komputer wkradł się jakiś wirus, który bez przerwy wyświetla jakieś reklamy, nawet ciężko miałem napisać tutaj tego posta. Proszę o pomoc. Chciałbym także nieco oczyścić system, ponieważ ma już 5 lat i komputer zaczął nieco "mulić".

FRST: http://wklej.org/id/1818002/
Addition: http://wklej.org/id/1818004/
Shortcut: http://wklej.org/id/1818005/

OTL: http://wklej.org/id/1818006/
Extras: http://wklej.org/id/1818008/

[ordynat]

Otwórz Notatnik i wklej w nim:

C:\Users\Beata\AppData\Local\6C580542-BC3B-4097-B969-4EAC3B533CB
HKLM\...\Policies\Explorer\Run: [Policies] => C:\Users\Beata\AppData\Roaming\install\server.exe
C:\Users\Beata\AppData\Roaming\install\server.exe
C:\Users\Beata\AppData\Roaming\install
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
FirewallRules: [{68DC18BF-6533-4501-B028-AFE8649D3A44}] => (Allow) C:\Program Files (x86)\MyBrowser\MyBrowser\Application\mybrowser.exe
Task: {00731B9C-9CEE-4DAD-8F10-FECEDA75A15B} - System32\Tasks\{07A4DA89-49C0-41A7-933F-D4207EF7B8DF} => pcalua.exe -a C:\Users\Beata\Downloads\vbrun60sp5.exe -d C:\Users\Beata\Downloads
Task: {528ED77F-5DC6-4DA0-8BFF-14F2D63F9253} - System32\Tasks\{A101D0D7-F4BA-4005-B051-36DC9A3273C0} => C:\Users\Beata\Documents\Tubenoia.exe
Task: {52BCE734-9FDB-4CC0-9B6C-038B2786725D} - System32\Tasks\{9DF94BAF-8FF1-451E-84AD-5D12AB4D48CA} => pcalua.exe -a C:\Users\Beata\Downloads\WC2002\RegSetup.exe -d C:\Users\Beata\Downloads\WC2002
Task: {757F83E7-FB3B-44A2-BF2E-A0742B9D0B40} - System32\Tasks\{452F056B-D32A-4C52-806E-777D79369353} => pcalua.exe -a H:\Setup\Setup.exe -d H:\Setup
Task: {7979372D-A4B6-499B-B7BB-8C05CD5007C2} - System32\Tasks\{18A9B99B-8725-431F-92FE-DDD260AA69B4} => pcalua.exe -a F:\ZTEEasyGuider\EasyGuider.exe -d F:\ZTEEasyGuider
Task: {799F2B3B-34C2-4B92-9295-C442C02905C3} - System32\Tasks\{92E028A3-7D5B-4A60-81B9-C441F048E02C} => pcalua.exe -a C:\Users\Beata\Downloads\vanbasco_polish.exe -d C:\Users\Beata\Downloads
Task: {7DB6D155-FD29-471E-9AA7-5935CA2854D0} - System32\Tasks\{E6F6564E-6A7B-4D2F-B58E-E9E89AA7AC69} => pcalua.exe -a D:\Documents\B2CAppSetup.exe -d D:\Documents
Task: {7EEC7495-96DB-4666-91DC-26A7317DFB36} - System32\Tasks\{98EF181D-2706-4B11-BA02-E9AA6FCD6E6B} => pcalua.exe -a C:\Users\Beata\Desktop\wwp_vista_win7_fix_v1.4.exe -d C:\Users\Beata\Desktop
Task: {83FF09AF-C41D-4FB9-A5E0-D31582173830} - System32\Tasks\{FE0A8649-92DA-4B5E-B1FA-9A3FA2808B33} => pcalua.exe -a C:\Users\Beata\Documents\WinSetupFromUSB_0-2-3.exe -d C:\Users\Beata\Documents
Task: {8572568B-2727-4FC8-AAEB-6C548B98B608} - System32\Tasks\{B5127F47-DA24-4AE3-9669-F67DC7AC719C} => pcalua.exe -a "C:\Program Files\Broadcom\Broadcom 802.11\Driver\bcmwlu00.exe" -d "C:\Program Files\Broadcom\Broadcom 802.11\Driver"
Task: {8DA6C59E-B8C3-44A2-8C38-AC1DCDF342A2} - System32\Tasks\{93A93095-4F81-4888-81C9-04BD14578279} => pcalua.exe -a "G:\Potrzebne programy\111\Atomix.Virtual.DJ.Pro.5.0.7\Portable VDJ Skin Resizer V2.4.exe" -d "G:\Potrzebne programy\111\Atomix.Virtual.DJ.Pro.5.0.7"
Task: {A5377A13-F10D-4D26-B203-74D80E2CCE76} - System32\Tasks\{7188D554-3403-4F09-9A61-4C3F45C0C333} => pcalua.exe -a G:\Setup\Setup.exe -d G:\Setup
Task: {B035697C-5EFE-4B67-A83D-512A1F4D3C36} - System32\Tasks\6C580542-BC3B-4097-B969-4EAC3B533CB => C:\Users\Beata\AppData\Local\6C580542-BC3B-4097-B969-4EAC3B533CB\6C580542-BC3B-4097-B969-4EAC3B533CB.exe <==== UWAGA
Task: {B931B67A-1227-4877-A27F-71CF3115AEC5} - System32\Tasks\{0319E8F6-9DDD-45ED-A48E-73F34F4CB387} => pcalua.exe -a C:\Users\Beata\Downloads\vkaraoke.exe -d C:\Users\Beata\Downloads
Task: {BA2B7B7D-FFAD-46B0-9E58-57400ED70176} - System32\Tasks\{428C9E0A-2C86-4662-AFEE-4D63DE6A168F} => pcalua.exe -a "C:\ZTE usb driver\setup.exe" -d "C:\ZTE usb driver"
Task: {C5147739-7F61-49D7-9C5F-C96608931C7C} - System32\Tasks\{83376B3B-41AA-49DD-9E18-1251E407854A} => pcalua.exe -a E:\Programy\OJ4500vG510a-f_Full_13.exe -d E:\Programy
Task: {D3E868FB-AF95-465F-A2F9-78A0B4A8EFFE} - System32\Tasks\{BF52A84D-2C8E-43E1-A79C-E12C86F8A94C} => pcalua.exe -a "C:\Program Files (x86)\IncrediMail\Bin\ImSetup.exe" -c /uninstallProduct /addon:incredimail
Task: {E8E682BF-679D-403F-A4A6-5E9505967183} - System32\Tasks\{8A8A3EB1-ECA9-4827-B894-650D4E3B0573} => pcalua.exe -a C:\Users\Beata\Downloads\oxyforensic35_trial_setup.exe -d C:\Users\Beata\Downloads
Task: {FCA5DAE9-BE69-4BB5-9826-F1C5780899B5} - System32\Tasks\{5ED2F338-07A7-4473-B45E-D80370C7BC66} => pcalua.exe -a C:\Users\Beata\Downloads\the_settlers_7_1.10full.exe -d C:\Users\Beata\Downloads
C:\Users\Beata\Documents\Tubenoia.exe
C:\Program Files (x86)\MyBrowser
HKU\S-1-5-21-3756977198-2539240120-1013761767-1000\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== UWAGA
ShellExecuteHooks-x32: - UPB:{B5A7F190-DDA6-4420-B3BA-52453494E6CD} - Brak pliku [ ]
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3756977198-2539240120-1013761767-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO-x32: Brak nazwy -> {7725817f-ce31-45f6-9866-c553935641ab} -> => Brak pliku
FF Extension: devtoolsmenuAccessFirefoxorg - C:\Users\Beata\AppData\Roaming\Mozilla\Firefox\Profiles\mjgk7nmh.default\Extensions\devtoolsmenu@AccessFirefox.org [2015-10-16]
FF Extension: jmarcos14gmailcom - C:\Users\Beata\AppData\Roaming\Mozilla\Firefox\Profiles\mjgk7nmh.default\Extensions\jmarcos14@gmail.com [2015-10-16]
FF Extension: Magical Find - C:\Users\Beata\AppData\Roaming\Mozilla\Firefox\Profiles\mjgk7nmh.default\Extensions\{fa6f6587-af95-4782-afc5-89c87f90b314}.xpi [2015-08-20]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\browser\defaults\preferences\prefs.js [2015-10-16] <==== UWAGA (Linkuje do pliku *.cfg)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\cfg [2015-10-16] <==== UWAGA
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - <Brak Path/update_url>
CHR Extension: (fadgflmigmogfionelcpalhohefbnehm) - C:\Users\Beata\AppData\Local\Google\Chrome\User Data\Default\Extensions\fadgflmigmogfionelcpalhohefbnehm [2015-10-16]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\fadgflmigmogfionelcpalhohefbnehm [2015-10-16]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\fijhlnmmmgflacagjecncpmpnhjieggk [2015-10-12]
OPR Extension: (Magical Find) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\gpldhheklgibbpaffbhogechiifdhboi [2015-08-20]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\hdhmofnopkgkpgnpggloijpbnaonhplc [2015-10-12]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\hkhggnncdpfibdhinjiegagmopldibha [2015-10-16]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\kfgaibfbmkjgmimhbbaikfnpkkjkpoan [2015-10-12]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-10-12]
OPR Extension: (Brak nazwy) - C:\Users\Beata\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-10-12]
StartMenuInternet: (HKLM) Opera - C:\Program Files (x86)\Opera\Opera.exe hxxp://www.mystartsearch.com/?type=sc&ts=1444659297&z=b6dfcbb18a8f30c5aa7b139g0z8zfz9qdw2t5e1m0w&from=cmi&uid=HitachiXHTS725050A9A364_100520PCK404VLHVRB6JX
S3 dump_wmimmc; \??\C:\Program Files (x86)\Rappelz\GameGuard\dump_wmimmc.sys [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-10-12 15:44 - 2015-10-12 15:44 - 00004216 _____ C:\Windows\System32\Tasks\6C580542-BC3B-4097-B969-4EAC3B533CB
2015-10-12 15:43 - 2015-10-12 16:08 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-10-12 15:43 - 2015-10-12 15:43 - 00000000 ____D C:\Users\Beata\AppData\Roaming\NetService
C:\Windows\assembly\tmp
C:\ProgramData\Microsoft\Windows\Start Menu\µTorrent.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FL Studio 11.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyNoMore\SpyNoMore.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyNoMore\Uninstall.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyNoMore\Website.lnk
C:\Users\Beata\Desktop\Eusing Free Registry Cleaner.lnk
C:\Users\Beata\Desktop\SpyNoMore.lnk
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

.
=================

Jeśli natomiast problem nie zniknie, to przeinstalujesz przeglądarkę, na której to jeszcze będzie.
.

[arehiba]

Tylko tyle? Nie trzeba nic więcej czyścić? Bo komputer strasznie wolno chodzi teraz...

[ordynat]

Mulenie to nie moja specjalność.
Ale, na wszelki wypadek, zrób nowe logi FRST - może w międzyczasie pojawiło się coś nowego?
Zobaczymy.
.