Pojawiająca się informacja o błedzie C:\PROGRA~1\COMMON~1\System\SysMenu.dll podczas włączenia kompu

Dla specjalistów Bezpieczeństwo
#1

Witam, mam ten sam problem. Wyskakuje mi ta sama informacja co koledze, i to nawet w 3 oknach, po uruchomieniu komputera. Chciałbym zapytać, czy ta komenda którą podał @Atis jest uniwersalna, czy do każdego problemu trzeba inaczej ją formułować? Podeśle linki do FRST i zdj błędów.

 

Additional: http://wklej.to/RuiMC

FRST: http://wklej.to/qee4b

 

Z góry dziękuję za pomoc :wink:

post-273126-0-63406600-1422729586_thumb.

#2

Wydzielono z http://forum.dobreprogramy.pl/pojawiająca-się-informacja-o-błedzie-cprogra1common1systemsysmenudll-podczas-włączenia-komputera-t481780

#3

Odinstaluj WindowsMangerProtect20.0.0.722.Otwórz notatnik systemowy i wklej:

Task: {1C707B23-E080-4A8E-9F17-3A2FC207F995} - System32\Tasks\YTDownloader = C:\Program Files (x86)\YTDownloader\YTDownloader.exe ==== ATTENTION
Task: {30BB23B6-49B3-4B17-8067-2A71D540E1D7} - System32\Tasks\Microsoft\1566399a36603a3dca6f12b9d3bc1a01 = C:\Users\Salsi\AppData\Roaming\DownloadManager\Loader.exe ==== ATTENTION
Task: {4D1C7261-3843-4F40-BA67-87F118E2F524} - System32\Tasks\SW-Booster-S-792098896 = c:\programdata\trusted publisher\sw-booster\SW-Booster.exe ==== ATTENTION
Task: {688D2B11-BFE5-418A-A9F5-A1BDA2F299BD} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 = Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 ==== ATTENTION
Task: {7E8E5768-8AF8-4FF5-A12A-FE0578EEBA7D} - System32\Tasks\SMupdate1 = Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update1 ==== ATTENTION
Task: {8AE88C35-FE69-4862-9ED1-3CD32E571425} - \Microsoft\a3d90235e1136671ab1195c6078184ff No Task File ==== ATTENTION
Task: {C2E532E3-1904-46E3-AE76-B061642AD90D} - System32\Tasks\ShopperProJSUpd = C:\Program Files (x86)\ShopperPro\updater.exe ==== ATTENTION
Task: {D761022C-595F-4E7F-9FA5-69A54AAC2505} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 = Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 ==== ATTENTION
Task: C:\Windows\Tasks\SW-Booster-S-792098896.job = c:\programdata\trusted publisher\sw-booster\SW-Booster.exe ==== ATTENTION
HKU\S-1-5-21-1838175104-386611516-1700320828-1000\...\Run: [ASRockXTU] = [X]
HKU\S-1-5-21-1838175104-386611516-1700320828-1000\...\Run: [zASRockInstantBoot] = [X]
GroupPolicy: Group Policy on Chrome detected ======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hpts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hpts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
HKU\S-1-5-21-1838175104-386611516-1700320828-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.yahoo.com?fr=fp-comodo
HKU\S-1-5-21-1838175104-386611516-1700320828-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hpts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
SearchScopes: HKU\S-1-5-21-1838175104-386611516-1700320828-1000 - DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}fr=chr-comodo
SearchScopes: HKU\S-1-5-21-1838175104-386611516-1700320828-1000 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=dsts=1411937088from=wpcuid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409q={searchTerms}
SearchScopes: HKU\S-1-5-21-1838175104-386611516-1700320828-1000 - {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}fr=chr-comodo
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=scts=1410362119from=mp3uid=WDCXWD10EFRX-68PJCN0_WD-WCC4J335140951409
FF SelectedSearchEngine: Yahoo
FF Keyword.URL: hxxp://pl.search.yahoo.com/search?fr=ytff-comodop=
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\istartsurf.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Salsi\AppData\Roaming\Mozilla\Firefox\Profiles\vapaa7aw.default\extensions\faststartff@gmail.com
CHR Extension: (NexttCoup) - C:\Users\Salsi\AppData\Local\Google\Chrome\User Data\Default\Extensions\djfbkfkjbgbijggaebifkfknijhcgmma [2014-09-28]
CHR Extension: (GoSaiVe) - C:\Users\Salsi\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlfloklbmojcnjefnmndnpolodnaeiph [2014-09-28]
CHR Extension: (No Name) - C:\Users\Salsi\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjefgkhmchopegjeicnblodnidbammed [2014-10-02]
CHR Extension: (Webbingg) - C:\Users\Salsi\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbnofaabnfkddlmdagdionkaobbljmpk [2014-09-28]
CHR Extension: (Flash Savings) - C:\Users\Salsi\AppData\Local\Google\Chrome\User Data\Default\Extensions\niloccemoadcdkdjlinkgdfekeahmflj [2014-09-28]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#4

Problem znikł :wink: Dziękuję za pomoc i serdecznie pozdrawiam :wink:

#5

Skasuj folder C:\FRST