Laptop jest w posiadaniu 11-latka, więc można spodziewać się wszystkiego. Sprawdzałem MBAM-em i ADWCleanerem - znalazło trochę syfu, wszystko zostało usunięte. Logi z FRST są świeże, wykonywane po czyszczeniach.
Otwórz notatnik systemowy i wklej:
HKLM-x32\...\Run: [YouCam Mirage] = C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] = C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] = C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] = C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] = C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1453746322-4000672513-1890818042-1002\...\Run: [ALLUpdate] = C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [1379840 2011-08-16] ()
Startup: C:\Users\Kamil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2014-03-05]
ShortcutTarget: OpenOffice.org 3.3.lnk - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
GroupPolicy: Group Policy on Chrome detected ======= ATTENTION
GroupPolicyUsers\S-1-5-21-1453746322-4000672513-1890818042-1003\User: Group Policy restriction detected ======= ATTENTION
GroupPolicyUsers\S-1-5-21-1453746322-4000672513-1890818042-1002\User: Group Policy restriction detected ======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1453746322-4000672513-1890818042-1002 - {79547191-CC28-4F3D-9955-3AD859E208AB} URL =
CHR RestoreOnStartup: Default - "hxxp://search.yahoo.com/?fr=hp-ddc-bdtype=bg_616_bl-is-17 __alt__ ddc_dsssyc_bd_com"
CHR StartupUrls: Default - "hxxp://search.yahoo.com/?fr=hp-ddc-bdtype=bg_616_bl-is-17 __alt__ ddc_dsssyc_bd_com"
CHR Extension: (Bookmark Manager) - C:\Users\Lenovo\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-17]
2015-04-27 14:17 - 2015-04-27 14:17 - 00000000 ____ D () C:\WINDOWS\%LOCALAPPDATA%
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Wykonane. Coś jeszcze?
To wszystko.Skasuj folder C:\FRST