Otwórz notatnik systemowy i wklej:
HKLM-x32\...\Run: [SunJavaUpdateSched] = C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
HKU\S-1-5-21-2801050983-2944418763-3651977678-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
HKU\S-1-5-21-2801050983-2944418763-3651977678-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKU\S-1-5-21-2801050983-2944418763-3651977678-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
HKU\S-1-5-21-2801050983-2944418763-3651977678-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsppts=1423770434from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347q={searchTerms}
SearchScopes: HKU\S-1-5-21-2801050983-2944418763-3651977678-1000 - DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347ts=1423770448type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2801050983-2944418763-3651977678-1000 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347ts=1423770448type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2801050983-2944418763-3651977678-1000 - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347ts=1423770448type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2801050983-2944418763-3651977678-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347ts=1423770448type=defaultq={searchTerms}
SearchScopes: HKU\S-1-5-21-2801050983-2944418763-3651977678-1000 - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=butm_medium=smtutm_campaign=install_ieutm_content=dsfrom=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347ts=1423770448type=defaultq={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=scts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
CHR HomePage: Default - hxxp://www.mystartsearch.com/?type=hpts=1423770403from=smtuid=WDCXWD10EZRX-00L4HB0_WD-WCC4J187734777347
S2 eamonm; system32\DRIVERS\eamonm.sys [X]
2015-02-22 21:32 - 2015-02-22 21:32 - 00000000 ____ D () C:\Users\Popeye\AppData\Roaming\ESET
2015-02-22 21:32 - 2015-02-22 21:32 - 00000000 ____ D () C:\Users\Popeye\AppData\Local\ESET
2015-02-22 21:31 - 2015-02-22 21:48 - 00000000 ____ D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-02-16 22:35 - 2015-02-16 22:35 - 00003400 _____ () C:\Windows\System32\Tasks\{4B8E72A3-D034-45A4-95A0-C0F58AC78CAB}
2015-02-12 20:47 - 2015-02-20 09:23 - 00000000 ____ D () C:\ProgramData\WindowsMangerProtect
2015-02-12 20:47 - 2015-02-12 20:47 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
