OMIGA w firefox

[ukss23 (Ukaszgradziuk)]

Witam, brat wczoraj zaśmiecił komputer OMIGA… prosze o pomoc

[Atis]

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [mbot_pl_171] => [X]
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
FF Plugin HKU\S-1-5-21-879209078-858111711-2773681902-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: No Name - C:\Users\DELL\AppData\Roaming\Mozilla\Firefox\Profiles\zwv6u8lf.default-1421191097689\Extensions\1421619658_xpi [2015-01-18]
S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X]
2015-01-13 23:48 - 2015-01-25 12:35 - 00000000 ____ D () C:\AdwCleaner
2015-01-24 23:43 - 2013-03-23 03:50 - 00000000 ____ D () C:\ProgramData\McAfee
2014-09-30 19:14 - 2014-09-30 19:27 - 0005120 _____() C:\Users\DELL\AppData\Local\file__0.localstorage
 C:\ProgramData\*.log
Task: {024F1DD3-3DC3-47E7-B20C-1A46B3643882} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {897A5DD1-BB5C-4DE3-A9FD-60602D297417} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {CCEDFC94-C1FC-48EB-8263-6DB399259190} - System32\Tasks\{44846442-34B8-452D-AE22-42111888416A} => pcalua.exe -a C:\Users\DELL\AppData\Roaming\omiga-plus\UninstallManager.exe -c -ptid=cor <==== ATTENTION
Task: {F8C09B6A-23B1-44A7-AFA9-0FF3C28B68A1} - System32\Tasks\avastBCLRestartS-1-5-21-879209078-858111711-2773681902-1001 => Firefox.exe 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.

[krzych5610]

Wklej do systemowego notatnika: Zapisz jako fixlist. Umieść w folderze obok FRST. Uruchom FRST i wykonaj polecenie FIX

  HKLM-x32…\Run: [mbot_pl_171] => [X] HKLM…\Policies\Explorer: [NoFolderOptions] 0 HKLM…\Policies\Explorer: [NoControlPanel] 0 HKU\S-1-5-21-879209078-858111711-2773681902-1001…\MountPoints2: {0df61433-935e-11e2-be65-806e6f6e6963} - “D:\Autorun.exe” HKU\S-1-5-21-879209078-858111711-2773681902-1001…\MountPoints2: {4a02b0cd-703d-11e4-be88-74867a0690b4} - “E:\AutoRun.exe” HKU\S-1-5-21-879209078-858111711-2773681902-1001…\MountPoints2: {6cce9ece-5ff7-11e3-be7c-b8763f2af484} - “E:\AutoRun.exe” HKU\S-1-5-21-879209078-858111711-2773681902-1001…\MountPoints2: {8d91d66f-67b2-11e4-824f-74867a0690b4} - “F:\AutoRun.exe” CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKU.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = FF Plugin HKU\S-1-5-21-879209078-858111711-2773681902-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File CHR dev: Chrome dev build detected! <======= ATTENTION S3 BTATH_LWFLT; \SystemRoot\system32\DRIVERS\btath_lwflt.sys [X] 2015-01-13 23:48 - 2015-01-25 12:35 - 00000000 ____D () C:\AdwCleaner 2015-01-25 12:40 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2015-01-25 12:36 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2015-01-24 23:43 - 2013-03-23 03:50 - 00000000 ____D () C:\ProgramData\McAfee 2015-01-10 00:18 - 2014-09-24 15:35 - 00808198 _____ () C:\WINDOWS\system32\perfh015.dat 2015-01-10 00:18 - 2014-09-24 15:35 - 00164014 _____ () C:\WINDOWS\system32\perfc015.dat C:\Users\DELL\AppData\Local\Temp\AutoRun.exe C:\Users\DELL\AppData\Local\Temp\AutoRunGUI.dll C:\Users\DELL\AppData\Local\Temp\bbicabfcced.exe C:\Users\DELL\AppData\Local\Temp\E1246211-E4A1-C8D7-5281-66618C7846FB.dll C:\Users\DELL\AppData\Local\Temp\eauninstall.exe C:\Users\DELL\AppData\Local\Temp\First15.exe C:\Users\DELL\AppData\Local\Temp\ikonkasims3.exe C:\Users\DELL\AppData\Local\Temp\ins_ytd.exe C:\Users\DELL\AppData\Local\Temp\Quarantine.exe C:\Users\DELL\AppData\Local\Temp\sciagnij-dodatki.exe C:\Users\DELL\AppData\Local\Temp\setup.exe C:\Users\DELL\AppData\Local\Temp\SimBundD.exe C:\Users\DELL\AppData\Local\Temp\sims 1 full version pc__10924_i1451558742_il2494573.exe C:\Users\DELL\AppData\Local\Temp\sims3-instalator.exe C:\Users\DELL\AppData\Local\Temp\SoftonicAssistant_v0-1-6.exe C:\Users\DELL\AppData\Local\Temp\sqlite3.dll C:\Users\DELL\AppData\Local\Temp\The Sims 2_uninst.exe C:\Users\DELL\AppData\Local\Temp\tu17p84.exe C:\Users\DELL\AppData\Local\Temp\utt9A3E.tmp.exe C:\Users\DELL\AppData\Local\Temp\VP6Install.exe C:\Users\DELL\AppData\Local\Temp\VP6VFW.dll Shared C Run-time for x64 (HKLM…{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee) Task: {024F1DD3-3DC3-47E7-B20C-1A46B3643882} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION Task: {897A5DD1-BB5C-4DE3-A9FD-60602D297417} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION Task: {CCEDFC94-C1FC-48EB-8263-6DB399259190} - System32\Tasks{44846442-34B8-452D-AE22-42111888416A} => pcalua.exe -a C:\Users\DELL\AppData\Roaming\omiga-plus\UninstallManager.exe -c  -ptid=cor <==== ATTENTION HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => “”="" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => “”="" EmptyTemp:   Po restarcie pokaż raport FIXLOG i aktualny FRST.

[ukss23 (Ukaszgradziuk)]

FRST http://wklej.org/id/1608270/

[krzych5610]

Pobierz i uruchom Dr.WEB CureIt!

  http://www.dobreprogramy.pl/Dr.WEB-CureIt,Program,Windows,12976.html

Wykonaj pełny skan. Pokaż raport ze skanowania. Pokaż aktualny FRST.