Cześ, proszę o pomoc w usunięciu wirusa
Moje raporty
FRST http://www.wklej.org/id/1759742/
Addition http://www.wklej.org/id/1759743/
Shortcut http://www.wklej.org/id/1759744/
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
HKU\S-1-5-21-3405250672-3439492625-1666742989-1001\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF SearchPlugin: C:\Users\Bugaj\AppData\Roaming\Mozilla\Firefox\Profiles\rjr1z8jr.default\searchplugins\webssearches.xml [2015-07-19]
FF Extension: Default SearchProtected - C:\Users\Bugaj\AppData\Roaming\Mozilla\Firefox\Profiles\rjr1z8jr.default\Extensions\defsearchp@gmail.com.xpi [2015-07-15]
OPR Extension: (Filter Results) - C:\Users\Bugaj\AppData\Roaming\Opera Software\Opera Stable\Extensions\hkkdkembhhmcflpmfcdjlkfkjahklkag [2015-07-14]
OPR Extension: (Sale Clipper) - C:\Users\Bugaj\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkcnnaeninjibhdcknedboclpfkhgjej [2015-06-25]
2015-07-19 21:34 - 2015-07-19 21:36 - 00000000 ____ D C:\AdwCleaner
2015-07-14 13:24 - 2015-07-14 13:46 - 00002880 _____ C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini
2015-07-14 13:24 - 2015-07-14 13:46 - 00002880 _____ C:\Windows\system32\LavasoftTcpServiceOff.ini
2015-07-14 13:24 - 2015-07-14 13:24 - 00422400 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll
2015-07-14 13:24 - 2015-07-14 13:24 - 00342016 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll
2015-06-25 20:57 - 2015-06-25 20:57 - 00843240 _____ (Generic Internet Program ) C:\Users\Bugaj\Downloads\RegSeeker(12055)-dp.exe
2015-06-25 20:34 - 2015-06-25 20:34 - 00857360 _____ () C:\Users\Bugaj\Downloads\yet_another_cleaner_nee.exe
CustomCLSID: HKU\S-1-5-21-3405250672-3439492625-1666742989-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Bugaj\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
Task: {0489AE11-1E92-4D76-9885-C5168702FF6D} - \{52FBF659-15CE-4B9A-90D9-C161A5F70F58} No Task File <==== ATTENTION
Task: {88B8C8FB-1135-476A-8AB8-4669696AAC49} - System32\Tasks\{D78456DB-09F3-40B5-B141-1062AAC17ACA} => pcalua.exe -a C:\Users\Bugaj\Downloads\OverwolfInstaller.exe -d C:\Users\Bugaj\Downloads
Task: {C8393506-4A2C-46AF-97A3-72445CD635F7} - \{E17EFB30-924C-423F-9BA1-0654DF0080FE} No Task File <==== ATTENTION
Task: {D905C3A7-1881-41E3-893B-9009EF8064A3} - System32\Tasks\{A549EDB4-D8D2-4360-98E2-A0A94B7D3174} => pcalua.exe -a D:\DOWNLOADS\epson374893eu.exe -d D:\DOWNLOADS
EmptyTemp:
Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.
Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
2015-07-14 13:25 - 2015-07-19 21:15 - 00000000 ____ D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft
DeleteQuarantine:
Uruchom FRST i kliknij Fix. Skasuj folder C:\FRST
Usuń stare punkty przywracania: Aby usunąć wszystkie punkty przywracania
Przeczytaj w jaki sposób należy instalować programy: KLIK - KLIK - KLIK
Odinstaluj Adobe Shockwave Player 12.1 i Java 8 Update 45.
Zainstaluj Java 8 Update 51
Dziękuje za pomoc