Od dwóch dni mam problem z samoczynnym instalowaniem się wyszukiwarek typu mystartsearch, games deskop itp. Jest to bardzo uciążliwe, zastosowanie adwcleanera nie dało rezultatu. Poniżej logi:
FRST http://www.wklej.org/id/1790235/
Addition http://www.wklej.org/id/1790236/
Shortcut http://www.wklej.org/id/1790237/
W panelu sterowania odinstaluj GamesDesktop 008.005010080 i globalupdate Helper.
Pobierz i uruchom AdwCleaner Kliknij Scan i później Cleaning.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CloseProcesses:
HKLM-x32\...\Run: [mbot_pl_014010078] => [X]
HKLM-x32\...\Run: [gmsd_pl_006010073] => [X]
HKLM-x32\...\Run: [gmsd_pl_005010078] => [X]
HKLM-x32\...\Run: [gmsd_en_6] => [X]
HKLM-x32\...\Run: [gmsd_pl_005010080] => C:\Program Files (x86)\gmsd_pl_005010080\gmsd_pl_005010080.exe [3982480 2015-09-04] ()
HKLM-x32\...\RunOnce: [upgmsd_pl_005010080.exe] => C:\Users\Kinga\AppData\Local\gmsd_pl_005010080\upgmsd_pl_005010080.exe [3310736 2015-09-04] ()
HKU\S-1-5-21-3969419137-3636577129-1821681494-1000\...\Run: [GoogleChromeAutoLaunch_E6CBCF9A477C7013945169A8EE36AD4A] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
GroupPolicy: Zasady grupy Chrome wykryto <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Zasada ograniczeń <======= UWAGA
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
R2 buleresi; C:\Program Files (x86)\26311315-1441274806-EBEC-C26C-46B99475B474\knsc61ED.tmp [775168 2015-09-04] () [Brak podpisu cyfrowego]
S4 jimocoso; C:\Program Files (x86)\26311315-1441274806-EBEC-C26C-46B99475B474\jnsh83D0.tmp [227328 2015-09-03] () [Brak podpisu cyfrowego]
S4 totyseku; C:\Program Files (x86)\26311315-1441274806-EBEC-C26C-46B99475B474\hnsm9B19.tmp [137728 2015-09-03] () [Brak podpisu cyfrowego]
2015-09-04 22:24 - 2015-09-04 22:24 - 00001300 _____ C:\Users\Kinga\Desktop\Continue Games Desktop.lnk
2015-09-04 22:07 - 2015-09-04 22:13 - 00000000 ____ D C:\Users\Kinga\AppData\Local\gmsd_pl_005010080
2015-09-04 22:07 - 2015-09-04 22:07 - 00000000 ____ D C:\ProgramData\iWdsManProi
2015-09-04 22:07 - 2015-09-04 22:07 - 00000000 ____ D C:\Program Files (x86)\gmsd_pl_005010080
2015-09-03 16:59 - 2015-09-03 18:02 - 00000000 ____ D C:\ProgramData\DWdsManProD
2015-09-03 16:59 - 2015-09-03 17:11 - 00000000 ____ D C:\Users\Kinga\AppData\Local\gmsd_pl_005010079
2015-09-03 16:59 - 2015-09-03 17:02 - 00000000 ____ D C:\Program Files (x86)\gmsd_pl_005010079
2015-09-03 15:08 - 2015-09-03 15:08 - 00000000 ____ D C:\ProgramData\XWdsManProX
2015-09-03 13:35 - 2015-09-03 13:46 - 00000000 ____ D C:\Users\Kinga\AppData\Local\gmsd_pl_002030078
2015-09-03 13:35 - 2015-09-03 13:38 - 00000000 ____ D C:\Program Files (x86)\gmsd_pl_002030078
2015-09-03 12:55 - 2015-09-03 12:56 - 00000000 ____ D C:\ProgramData\SWdsManProS
2015-09-03 12:18 - 2015-09-03 12:18 - 00000000 ____ D C:\ProgramData\cWdsManProc
2015-09-03 12:16 - 2015-09-03 12:16 - 00000000 ____ D C:\ProgramData\rWdsManPror
2015-09-03 12:11 - 2015-09-03 12:11 - 00000000 _____ C:\Windows\SysWOW64\RENEB0B.tmp
2015-09-03 12:07 - 2015-09-03 12:18 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-09-03 12:07 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-09-03 12:06 - 2015-09-04 15:42 - 00000000 ____ D C:\Program Files (x86)\26311315-1441274806-EBEC-C26C-46B99475B474
2015-09-03 12:06 - 2015-09-03 13:46 - 00000000 ____ D C:\Users\Kinga\AppData\Local\mbot_pl_014010078
2015-09-03 12:06 - 2015-09-03 13:40 - 00000000 ____ D C:\Program Files (x86)\mbot_pl_014010078
2015-09-03 12:05 - 2015-09-04 22:07 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-09-03 12:05 - 2015-09-03 12:06 - 00000000 ____ D C:\ProgramData\7WdsManPro7
2015-09-04 22:09 - 2015-07-31 23:48 - 00000000 ____ D C:\AdwCleaner
2015-09-03 12:18 - 2015-09-03 12:18 - 0613255 _____ (CMI Limited) C:\Users\Kinga\AppData\Local\nsw1AF9.tmp
Task: {4419B6E3-A314-49AF-B4A6-59CB5CE61D02} - System32\Tasks\{EC85246B-B2D2-4688-9910-006F80F56A78} => pcalua.exe -a C:\Users\Kinga\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=face
Task: {5D04D085-6961-4A8B-8D29-BC6C653EB587} - System32\Tasks\{233D3256-5E9A-4E95-875C-CC83388E78BD} => pcalua.exe -a C:\Users\Kinga\AppData\Roaming\oursurfing\UninstallManager.exe -c -ptid=amt
Task: {A9713CC9-59B0-455C-BC92-F68962F8BBC3} - System32\Tasks\klcp_update => C:\Program Files (x86)\K-Lite Codec Pack\Tools\CodecTweakTool.exe [2015-08-03] ()
EmptyTemp:
Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.
Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.