Witam, mam problem, z którym nie potrafię sobie poradzić. Po starcie systemu, przeglądarka przekierowuję na stronę extendedunlimited .org. Proszę o pomoc w pozbyciu się tego. Poniżej załączam logi FRST.
Otwórz Notatnik i wklej:
Task: {70582019-0833-46C7-AD38-F558783B055F} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2910672534-4236481627-2520616424-1000UA = C:\Users\Sylwia\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-08-07] (Facebook Inc.)
Task: {A89D7A96-4DDA-4945-9B95-DA2466629A21} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2910672534-4236481627-2520616424-1000Core = C:\Users\Sylwia\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-08-07] (Facebook Inc.)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2910672534-4236481627-2520616424-1000Core.job = C:\Users\Sylwia\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2910672534-4236481627-2520616424-1000UA.job = C:\Users\Sylwia\AppData\Local\Facebook\Update\FacebookUpdate.exe
HKU\S-1-5-21-2910672534-4236481627-2520616424-1000\...\Run: [CMD] = cmd.exe /c start http://extendedunlimited.org exit ===== ATTENTION
HKU\S-1-5-21-2910672534-4236481627-2520616424-1000\...\MountPoints2: {381854c7-18c5-11e4-b166-201a0699ff5d} - F:\Autorun.exe {D2D77DC2-8299-11D1-8949-444553540000} 5.2066.1.9B05 PID_0083
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
HKU\S-1-5-21-2910672534-4236481627-2520616424-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
HKU\S-1-5-21-2910672534-4236481627-2520616424-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hpts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=scts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910672534-4236481627-2520616424-1000 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
SearchScopes: HKU\S-1-5-21-2910672534-4236481627-2520616424-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dsts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502q={searchTerms}
FF Plugin HKU\S-1-5-21-2910672534-4236481627-2520616424-1000: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
CHR Extension: (BUyNsavvE) - C:\ProgramData\fohegpoflcgbkaelcdjodkeaegbcgpan\ [2014-05-30]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=scts=1419104418from=wpcuid=WDCXWD10JPCX-24UE4T0_WD-WXF1AA3S0502S0502
S2 fc67e7a0; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\DeltaFix\DeltaFix.dll",serv ==== ATTENTION
S3 UpdaterSvcGreenerWeb; "C:\Program Files (x86)\Greener Web\updater.exe" [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2014-12-21 07:36 - 2014-12-21 07:36 - 02998656 _____ (Enigma Software Group USA, LLC.) C:\Users\Sylwia\Desktop\SpyHunter-Installer.exe
2014-12-20 20:37 - 2014-12-21 07:49 - 00000000 ____ D () C:\ProgramData\fohegpoflcgbkaelcdjodkeaegbcgpan
2014-12-20 20:37 - 2014-12-20 20:37 - 00000000 ____ D () C:\ProgramData\2515283458708792750
2014-12-20 20:37 - 2014-12-20 20:37 - 00000000 ____ D () C:\Program Files (x86)\BUyNsavvE
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Dziękuje za zainteresowanie. Zrobiłem tak, jak napisałeś, jednak podczas przeprowadzania fixa, wyskoczył błąd. Problem z uruchamianiem przeglądarki i przekierowaniem na extendedunlimited ustąpił, jednak, przy włączaniu przeglądarki od razu włącza się strona mystartsearch .com. Poniżej załączam fixlog oraz screen błędu.
Pokaż nowy log z FRST.
Naprawione, wielkie dzięki za pomoc. Temat uważam za zamknięty.