|
Pozdrav,
Deinstaliraj YAC(Yet Another Cleaner!)
1. Otvori Notepad (Text Document) i iskopiraj sledeći tekst unutar kod polja ispod:
createrestorepoint:
closeprocesses:
emptytemp:
C:\Program Files (x86)\Elex-tech
AlternateDataStreams: C:\Users\pavilion\Desktop\AdwCleaner.exe:BDU
AlternateDataStreams: C:\Users\pavilion\Downloads\FRST64.exe:BDU
AlternateDataStreams: C:\Users\pavilion\Downloads\yet_another_cleaner_sk_8265327.exe:BDU
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1740317049-1854649450-3315103665-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1740317049-1854649450-3315103665-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/?ocid=iehp
SearchScopes: HKLM-x32 -> DefaultScope {BB82DE59-BC4C-4172-9AC4-73315F71CFFE} URL =
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{51847878-9269-40C3-885E-855E4972D3AC}: [NameServer] 82.163.143.169,82.163.142.171
Tcpip\..\Interfaces\{51847878-9269-40C3-885E-855E4972D3AC}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{62B566F0-C9FD-438C-B88B-0CD23E0A178D}: [NameServer] 82.163.143.169,82.163.142.171
cmd: ipconfig /flushdns
R4 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2015-04-16] (Elex do Brasil Participações Ltda)
R4 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [260856 2015-05-14] (Elex do Brasil Participações Ltda)
R4 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2015-07-03] (Elex do Brasil Participações Ltda)
R4 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [60808 2015-07-27] (Elex do Brasil Participações Ltda)
R4 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2015-07-23] (Elex do Brasil Participações Ltda)
R4 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2015-04-14] (Elex do Brasil Participações Ltda)
2015-08-25 00:09 - 2015-08-25 00:09 - 00001928 _____ C:\ProgramData\Microsoft\Windows\Start Menu\YAC.lnk
2015-08-25 00:09 - 2015-08-25 00:09 - 00001922 _____ C:\Users\Public\Desktop\YAC.lnk
2015-08-25 00:09 - 2015-08-25 00:09 - 00000000 ____D C:\Windows\SysWOW64\idx
2015-08-25 00:09 - 2015-08-25 00:09 - 00000000 ____D C:\Windows\system32\log
2015-08-25 00:09 - 2015-08-25 00:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YAC
2015-08-25 00:09 - 2015-08-25 00:09 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-08-25 00:09 - 2015-04-16 10:55 - 00053568 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2015-08-25 00:09 - 2015-04-14 11:01 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2015-08-25 00:08 - 2015-08-25 00:08 - 00000000 ____D C:\Users\pavilion\AppData\Roaming\Elex-tech
2015-08-25 00:07 - 2015-08-25 00:07 - 00875472 _____ () C:\Users\pavilion\Downloads\yet_another_cleaner_sk_8265327.exe
2. Sačuvaj notepad na Desktop pod nazivom fixlist.txt
To možes uraditi i iz notepad-a => klik na File potom na Save As i u novom prozoru, dole pod File Name: staviš za naziv fixlist.txt
Napomena: Važno je da se oba fajla, FRST i fixlist nalaze na istoj lokaciji jer u suprotnom fix nece raditi.
3. Ponovo pokreni FRST/FRST64, klikni jednom na dugme Fix i sačekaj.
Ukoliko alat zatraži restart sistema, dozvoli mu i postaraj se da alat kompletira fix nakon restarta sistema.
Alat će formirati log (Fixlog.txt) na Desktop-u. Potrebno je sadržaj tog loga iskopirati u poruku.
Napomena: Ukoliko te alat upozori da postoji novija verzija, postaraj se da preuzmes i koristiš ažuriranu kopiju FRST-a.
 Skeniranje sa MalwareBytes
Preuzmi Malwarebytes Anti-Malware i sacuvaj instalaciju na Desktop.
Instaliraj program standardnim putem, samo sto na kraju instalacije mozes da iskljucis Trial verziju, ali i ne moras. Drugu opciju ostavi, MalwareBytes ce biti pokrenut i azuriran.
Nakon sto je to gotovo, klikni na Settings tab, na levoj strani izaberi Detctions & protection and obelezi Scan for rootkits ukoliko vec nije.
U istom prozoru, ispod PUP and PUM detections postavi da bude Treat detections as malware.
Zatim klikni na Scan tab, Izaberi Threat Scan i na kraju klikni na Scan Now.
Nakon sto i ukoliko je malware detektovan, klikni na Apply Actions. Zatim ce MalwareBytes krenuti sa uklanjanjem infekcije i zatrazice ti da restartujes racunar.
Nakon zavrsetka skeniranja (ili nakon restart), klikni na History tab.
Klikni na Application Logs, a zatim dvoklik na najnoviji Scan Log.
Na dnu prozora klikni na Export i izaberi Text file.
Sacuvaj izvestaj na Desktop i prikaci ga u sledecoj poruci.
|
