Elektroda.com
Elektroda.com
X

[Solved] Ads in Bottom Right Corner & Wireless Headphones Connection Issue on Computer - Help Needed

mrrobson111 21921 12
This content has been translated flag-pl » flag-en View the original version here.
  • #1
    mrrobson111
    Level 8  
    Hello
    I am asking for support in my computer there are advertisements in the lower right corner and wireless headphones do not connect with my computer.
    greetings
    robert

    Added after 13 [minutes]:

    attached frsty
  • #2
    Grzegorz740
    Level 37  
    Does the antivirus program have an up-to-date virus database? You scanned the computer with it. He detected some viruses etc. garbage.

    You can still try to scan your computer with an antivirus program launched from a Live CD, DVD.
  • #3
    mrrobson111
    Level 8  
    I went adwcleanerem and malwerbyt and I do not have anti-viruses on my CDs
  • #4
    krzychupar
    Level 43  
    Open the system notebook and paste:

    CloseProcesses:
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ database.accdb: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ desktop.ini: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [194]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ Downloads: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [194]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ IMG_20180629_0003.pdf: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ IMG_20180701_0001.pdf: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ IMG_20180708_0001.pdf: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ IMG_20180710_0001.pdf: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ Drivers.accdb: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [66]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ Custom Office templates: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [194]
    AlternateDataStreams: C: \ Users \ jaros \ OneDrive \ Documents \ Zoom: $ {3D0CE612-FDEE-43f7-8ACA-957BEC0CCBA0} .Metadata [194]
    hosts:
    CHR HKLM-x32 \ ... \ Chrome \ Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps: //clients2.google.com/service/update2/crx
    S2 MBAMScheduler; "C: \ Program Files (x86) \ Malwarebytes Anti-Malware \ mbamscheduler.exe" [X]
    S2 MBAMService; "C: \ Program Files (x86) \ Malwarebytes Anti-Malware \ mbamservice.exe" [X]
    S3 MBAMProtector; \ ?? \ C: \ WINDOWS \ system32 \ drivers \ mbam.sys [X]
    S3 MBAMWebAccessControl; \ ?? \ C: \ WINDOWS \ system32 \ drivers \ mwac.sys [X]
    EmptyTemp:

    Save the file under the name fixlist.txt and place it in the folder where you have FRST.exe.
    Start FRST and click on Fix / Repair.
  • #5
    Kolobos
    IT specialist
    Wykonaj taki Fixlist.txt dla FRST:
    Task: {15DCD592-0AD4-43F7-ACB4-53F0B4D894F9} - System32\Tasks\CryptoTabUpdateTaskUserS-1-5-21-3451780722-1727213981-1364317048-1001Core => C:\Users\jaros\AppData\Local\CRYPTOCOMPANY\Update\CryptoTabUpdate.exe [2018-09-22] (CRYPTOCOMPANY OU)
    Task: {D5B91467-8D44-4C9D-BA4D-B8C5451248D8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [2015-07-31] (Microsoft Corporation)
    Task: {F2F85B91-3310-4F88-9D7E-A25DC9DE7ADF} - System32\Tasks\CryptoTabUpdateTaskUserS-1-5-21-3451780722-1727213981-1364317048-1001UA => C:\Users\jaros\AppData\Local\CRYPTOCOMPANY\Update\CryptoTabUpdate.exe [2018-09-22] (CRYPTOCOMPANY OU)
    Hosts:
    HKU\S-1-5-21-3451780722-1727213981-1364317048-1001\...\Run: [CryptoTab Update] => C:\Users\jaros\AppData\Local\CRYPTOCOMPANY\Update\1.3.99.0\CryptoTabUpdateCore.exe [609320 2018-09-22] (CRYPTOCOMPANY OU)
    HKU\S-1-5-21-3451780722-1727213981-1364317048-1001\...\Run: [CryptoTab Browser] => C:\Users\jaros\AppData\Local\CryptoTab Browser\Application\browser.exe [1551400 2018-09-27] (The Chromium and CryptoTab Browser Authors)
    CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx
    S3 MBAMProtector; \??\C:\WINDOWS\system32\drivers\mbam.sys [X]
    S3 MBAMWebAccessControl; \??\C:\WINDOWS\system32\drivers\mwac.sys [X]
  • #6
    mrrobson111
    Level 8  
    repair done, ads continue to show
  • #7
    krzychupar
    Level 43  
    On what browser do these ads show up? A photo would be useful as it looks.
  • #8
    g107r
    Level 41  
    Similar ? https://www.google.com/search?q=a433.com&clie...AgCEAE&biw=1440&bih=746#imgrc=x7oTTqyrhLD97M:

    Quote:
    (Using the Hosts directive: in the fixlist, the Hosts file will be reset.)

    2018-08-28 16:47 - 2018-09-21 08:52 - 000001336 _____ C: \ WINDOWS \ system32 \ Drivers \ etc \ hosts

    127.0.0.2 www.mefeedia.com
    127.0.0.1 delivery.anchorfree.us/land.php
    127.0.0.1 anchorfree.net
    127.0.0.1 rss2search.com
    127.0.0.1 techbrowsing.com
    127.0.0.1 box.anchorfree.net
    127.0.0.1 a433.com
    127.0.0.3 www.anchorfree.net
    127.0.0.1 rpt.anchorfree.net
    127.0.0.1 hsselite.com
    127.0.0.1 www.hsselite.com


    Insert the results of the re-scan, this marked entry, Google quite directly identifies with the ads.
    Torrents, hamsters ... Since when does it pop up?
    Did he do something, install something at the time?
  • #9
    Kolobos
    IT specialist
    @ g107r so much that the entry 127.0.0.1 means localhost, so the page is blocked.

    @ mrrobson111 What are the ads?

    After closing:
    (BitTorrent Inc.) C: \ Users \ jaros \ AppData \ Roaming \ uTorrent \ uTorrent.exe
    (Valve Corporation) C: \ Program Files (x86) \ Steam \ Steam.exe
    (CANON INC.) C: \ Program Files (x86) \ Canon \ IJ Network Scanner Selector EX \ CNMNSST.exe
    (CANON INC.) C: \ Program Files (x86) \ Canon \ Quick Menu \ CNQMMAIN.EXE
    (CANON INC.) C: \ Program Files (x86) \ Canon \ Quick Menu \ CNQMUPDT.EXE

    Are you still displaying?
  • #10
    mrrobson111
    Level 8  
    I have to wait to take a shot because they appear every now and then
    yesterday I wrote out the desktop and I do not remember what I installed

    Added after 37 [minutes]:

    attached advertisement
  • #13
    mrrobson111
    Level 8  
    I disconnected something and it probably helped, because it is not present.
    Many thanks, best regards.