Witam, od pewnego czasu mam problem z wirusami. Co jakiś czas włączam anti-malware i wykrywa za każdym razem podobne pliki, Proszę o pomoc. Załączam logi z FRST Dodam, że posiadam Kaspersky anti-virus 2015.
Otwórz notatnik systemowy i wklej:
HKLM-x32\...\Run: [HP Software Update] = C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] = [X]
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) ==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) ==== ATTENTION
ShellIconOverlayIdentifiers: [00avast] - {472083B0-C522-11CF-8763-00608CC02F24} = No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction ======= ATTENTION
HKU\S-1-5-21-1289683217-2149490515-3648894009-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction ======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF HKU\S-1-5-21-1289683217-2149490515-3648894009-1000\...\Firefox\Extensions: [eran@whoislive.com] - C:\Users\Domino\AppData\Local\Temp\whoislive.xpi
S3 BT; system32\DRIVERS\btnetdrv.sys [X]
S3 BTCOM; system32\DRIVERS\btcomport.sys [X]
S3 Btcsrusb; System32\Drivers\btcusb.sys [X]
S3 catchme; \\C:\ComboFix\catchme.sys [X]
S3 IvtComBusSrv; System32\Drivers\btcombus.sys [X]
S3 wanatw; system32\DRIVERS\wanatw64.sys [X]
S3 WinRing0_1_2_0; \\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]
S3 xhunter1; \\C:\Windows\xhunter1.sys [X]
2015-05-12 00:48 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-05-12 00:48 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-05-12 00:48 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-05-12 00:48 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-05-12 00:48 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-05-12 00:48 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-05-12 00:48 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-05-12 00:48 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-05-12 00:47 - 2015-05-12 01:01 - 00000000 ___DC () C:\Qoobox
2015-05-12 00:42 - 2015-05-12 00:42 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Domino\Downloads\SpyHunter-Installer.exe
2015-05-11 22:35 - 2015-05-11 22:36 - 00000000 ___DC () C:\AdwCleaner
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Odinstaluj Chrome zaznaczając usunięcie danych przeglądania.
nie wiem gdzie umieścić ten plik. Gdy go tam wkładam pisze, że nie ma takiego pliku.