Witam, od kilku dni mam zainfekowany komputer. W każdej przeglądarce wyskakuję mi mnóstwo reklam, strona którą chce wczytać po minucie przekierowywuje mnie na stronę z reklamą, ogólnie mega syf, wszystko się wiesi. Skanowałem komputer takimi programi jak: avast, kaspersky, potem wedle zaleceń pobrałem Anti malware, spybot oraz adwcleaner. Niestety bez skutku. Wklejam więc link do pliku txt z programu FRST:
Odinstaluj Qtrax Player,Spybot - Search & Destroy,SpyHunter 4,SubEdit-Player Packages.Otwórz notatnik systemowy i wklej:
Hosts:
Task: {6F211C5B-2C22-47CB-BBEA-2D0A198E0DF9} - \Dregol dono - Brak pliku ==== UWAGA
Task: {9EF194CD-9673-4EEC-B345-DAA2778BC48E} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates = C:\Program Files (x86)\Spybot - Search Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)
Task: {A91B0B79-F9B7-4CB5-8B1F-8282CF4D31B5} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1121961981-306854571-3797134230-1001UA = C:\Users\Damian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: {BC76287E-5DE3-4A22-8CBB-514746912927} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system = C:\Program Files (x86)\Spybot - Search Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {ECF46915-4991-49C0-A2F6-6335E4D6B894} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1121961981-306854571-3797134230-1001Core = C:\Users\Damian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: {F00FA73A-AF80-407A-BAD5-F48DBE06E5D4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization = C:\Program Files (x86)\Spybot - Search Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1121961981-306854571-3797134230-1001Core.job = C:\Users\Damian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1121961981-306854571-3797134230-1001UA.job = C:\Users\Damian\AppData\Local\Facebook\Update\FacebookUpdate.exe
AlternateDataStreams: C:\ProgramData\Microsoft:NzLkZz3EoAyDPQbYJ2
AlternateDataStreams: C:\ProgramData\Microsoft:QpFBty4ZGOLsnfgRqzG
AlternateDataStreams: C:\ProgramData\TEMP:8CE646EE
AlternateDataStreams: C:\Users\Damian\Cookies:C48YiWwTFyRAYImnabQy5Rxf
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] - {99FD978C-D287-4F50-827F-B2C658EDA8E7} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL Brak pliku
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] - {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL Brak pliku
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] - {920E6DB1-9907-4370-B3A0-BAFC03D81399} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL Brak pliku
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] - {16F3DD56-1AF5-4347-846D-7C10C4192619} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL Brak pliku
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] - {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} = C:\PROGRA~2\MICROS~2\Office14\GROOVEEX.DLL Brak pliku
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Zasady grupy Chrome wykryto ======= UWAGA
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL =
SearchScopes: HKLM - {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL =
SearchScopes: HKU\S-1-5-21-1121961981-306854571-3797134230-1001 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1121961981-306854571-3797134230-1001 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - Brak pliku
Toolbar: HKLM - Brak nazwy - !{82E1477C-B154-48D3-9891-33D83C26BCD3} - Brak pliku
Toolbar: HKLM-x32 - Brak nazwy - !{82E1477C-B154-48D3-9891-33D83C26BCD3} - Brak pliku
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
FF SelectedSearchEngine: Yahoo Search!
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
S3 SDScannerService; C:\Program Files (x86)\Spybot - Search Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
S3 SDUpdateService; C:\Program Files (x86)\Spybot - Search Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
S3 SDWSCService; C:\Program Files (x86)\Spybot - Search Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X]
2015-08-30 15:42 - 2015-08-30 18:05 - 00000000 ____ D C:\Users\Damian\AppData\Roaming\Enigma Software Group
2015-08-30 15:38 - 2015-08-30 15:38 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\Damian\Downloads\SpyHunter-Installer (1).exe
2015-08-30 13:36 - 2015-08-30 17:48 - 00001379 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-SD Start Center.lnk
2015-08-30 13:36 - 2015-08-30 17:47 - 00001373 _____ C:\Users\Public\Desktop\Spybot-SD Start Center.lnk
2015-08-30 13:36 - 2015-08-30 13:36 - 00000000 ____ D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search Destroy 2
2015-08-30 13:36 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-08-30 13:30 - 2015-08-30 18:34 - 00000000 ____ D C:\AdwCleaner
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.