Spyware w systemie

[tachion]

Potencjalny ukryty kandydat to Mediaplayer8

Do notatnika wklej i zapisz jako fixlist.txt

Kod:

CloseProcesses:
CreateRestorePoint:
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\...\Run: [mterm] => C:\Users\Edyta\AppData\Local\MediaPlayer8\mmups.exe [852480 2015-03-24] ()
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [173288 2008-12-26] (Acer Corp.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vp32&d=0815&m=aspire_5738
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vp32&d=0815&m=aspire_5738
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vp32&d=0815&m=aspire_5738
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://global.acer.com
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://global.acer.com
HKU\S-1-5-21-3765691210-32358212-2027813495-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
SearchScopes: HKLM -> DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKLM -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
RemoveDirectory: C:\Users\Edyta\AppData\Local\MediaPlayer8
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
RemoveDirectory: C:\AdwCleaner
CMD: netsh advfirewall reset
EmptyTemp:

Zapisany skrypt umieść obok ściągniętego programu FRST
Następnie w programie kliknij Napraw. Po wykonaniu pokaż raport z tego działania.

rób nowe logi i przedstaw z FRST.txt > Addition.txt