Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
CloseProcesses:
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKU\S-1-5-21-3169123204-2067826769-2117173749-1000\...\Run: [svchost] => C:\ProgramData\svchost\dtdasndku.exe [38182400 2014-09-04] (Telerik)
HKU\S-1-5-21-3169123204-2067826769-2117173749-1000\...\Run: [AdobeBridge] => [X]
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413386078&from=cor&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT&q={searchTerms}
URLSearchHook: HKCU - (No Name) - {8ba2cfef-a1bc-4964-aadc-33be1ae5a33c} - C:\Program Files (x86)\WeatherBlink\bar\1.bin\gcSrcAs.dll No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://aartemis.com/?type=sc&ts=1385924777&from=obw&uid=TOSHIBAXMQ01ABD032_52UWT2GJTXX52UWT2GJT
SearchScopes: HKLM-x32 - {597b1823-7ff0-4cd3-8095-9d8cba514992} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^XN^xdm246^YYA^pl&si=CH_WEAT_INTL_POL_44&ptb=AA80D755-6E18-4FF3-B0A8-318F27E7290E&psa=&ind=2013111021&st=sb&n=77fda2ed&searchfor={searchTerms}
SearchScopes: HKCU - {597b1823-7ff0-4cd3-8095-9d8cba514992} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^XN^xdm246^YYA^pl&si=CH_WEAT_INTL_POL_44&ptb=AA80D755-6E18-4FF3-B0A8-318F27E7290E&psa=&ind=2013111021&st=sb&n=77fda2ed&searchfor={searchTerms}
BHO-x32: No Name -> {9b9dcae3-be34-424c-8d73-75e305a9e091} ->No File
CHR HKLM-x32\...\Chrome\Extension: [lhmiofmipcpmhgihiecmpiekcacigpgb] - C:\ProgramData\Anvisoft\Anvi Smart Defender 2\extensions\chrome.crx []
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-10-15] (Cherished Technololgy LIMITED)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",SVC
S2 Update Framed Display; "C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe" [X]
R1 {c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64; C:\Windows\System32\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}Gw64.sys [61584 2014-08-11] (StdLib)
C:\ProgramData\IePluginServices
C:\Users\Paweł\AppData\Roaming\newnext.me
C:\Users\Paweł\AppData\Local\genienext
Task: {38EE80EA-62E9-4F4E-BEC3-79DFAC2ABA30} - System32\Tasks\SaveSense => C:\Users\PAWE~1\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {4833088E-3775-4FE1-8BF5-5813E65C811D} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: {6B56CD56-47EB-4E87-BCFC-05391044F470} - System32\Tasks\BonanzaDealsUpdate => C:\Program <==== ATTENTION
Task: {832C13C5-63A3-4F21-9B25-31EA9D6EAA86} - System32\Tasks\Optimizer Pro Schedule => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe <==== ATTENTION
Task: {901137EC-9F85-4C1F-9857-BBAE69F47AA3} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: {92E7A3DB-8C1D-411F-85B6-0ED6640C9785} - System32\Tasks\DTReg => C:\Users\Paweł\AppData\Roaming\defaulttab\defaulttab\DTReg.exe <==== ATTENTION
Task: {9DC8915D-B669-4BEB-B68B-D894364B3A22} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineCore => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-11-08] (BonanzaDeals) <==== ATTENTION
Task: {C82FB864-0B27-4772-8924-4B2088D743A3} - System32\Tasks\DTChk => C:\Users\Public\Util\DTChk.exe <==== ATTENTION
Task: {D0EB2A3A-9B3D-4B81-8213-668C1D56F2CD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {DFFC2AAD-F596-49A6-9942-3C154124A47C} - System32\Tasks\BonanzaDealsLiveUpdateTaskMachineUA => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe [2013-11-08] (BonanzaDeals) <==== ATTENTION
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\Norton Security Scan for Paweł.job => C:\PROGRA~2\NORTON~2\Engine\401~1.16\Nss.exe
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\PAWE~1\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
CMD: netsh advfirewall reset
EmptyTemp:
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Fix,po wykonaniu pokaż raport z tego działania.
Odinstaluj:
McAfee Security Scan Plus
Codec Package Packages
Optimizer Pro v3.2
Update for Codec Package
W przeglądarce
Firefox
Otwórz menu w górnym rogu po prawej stronie > otwórz menu pomoc oznaczone czerwoną ramką.
[Aby zobaczyć linki, zarejestruj się tutaj]
Informacje dla pomocy technicznej > Zresetuj program Firefox. Reset nie naruszy zakładek i haseł.
Ściągnij program
[Aby zobaczyć linki, zarejestruj się tutaj]
kliknij
Szukaj i następnie
Usuń
Pokaż raport z niego.
Wklej na stronę raport z
SecurityCheck
[Aby zobaczyć linki, zarejestruj się tutaj]
Uruchom kliknij w dowolny klawisz,poczekaj aż program zakończy działanie.
Zrób nowe logi i przedstaw z FRST.txt > Addition.txt,Shortcut.txt+ OTL ale bez extras
