Skanowałem Avirą i nie wykrył wirusów poniżej logi i w załączniku bbszukaj.
Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.
Odinstaluj Akamai NetSession Interface.Otwórz notatnik systemowy i wklej:
Task: {0C6AB832-A9D9-42DF-A567-CE81FBA2E611} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5_user = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5.exe ==== ATTENTION
Task: {1EE83FC9-AE68-4AFB-A9CB-9C004064E76A} - System32\Tasks\APSnotifierPP3 = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: {39115708-0DDB-4588-8D42-6A0817AA835A} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-5_user = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-5.exe ==== ATTENTION
Task: {65F5B317-F517-4638-A51D-B950293D6269} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5 = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5.exe ==== ATTENTION
Task: {6CA1E9F4-7D66-456F-B2BC-E436DF77E072} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-2 = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-2.exe ==== ATTENTION
Task: {75DDAD15-EC7D-4942-B714-373EA8008709} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-11 = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-11.exe ==== ATTENTION
Task: {92EBD219-4A7C-4459-BAEB-A37A3D5009E5} - System32\Tasks\APSnotifierPP1 = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: {996A7222-CD2B-48D7-A316-D5CD7CFCC05B} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-1 = C:\Program Files (x86)\Apps Hat\Apps Hat-codedownloader.exe ==== ATTENTION
Task: {9AE083B4-8E54-4A04-84C8-66D4CBDFB941} - System32\Tasks\APSnotifierPP2 = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: {A73D91E0-C3E7-469A-9363-40055133818D} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-4 = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-4.exe ==== ATTENTION
Task: {ADB33EF7-60E6-4A98-A55B-31DC6F5152F5} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-1 = C:\Program Files (x86)\Senses\Senses-codedownloader.exe ==== ATTENTION
Task: {B07FDF1B-B53F-4E6E-A610-76F4FDBFBB7B} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-11 = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-11.exe ==== ATTENTION
Task: {B3855060-C196-433A-AAFD-8FA3E2677BBE} - System32\Tasks\{7181F838-6757-4AA1-B04E-C24A9FC0317C} = pcalua.exe -a "C:\Program Files (x86)\YouTube Accelerator\YTAUninstall.exe"
Task: {DC7A57E0-4161-47A5-91F2-466EBFE309FA} - System32\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-2 = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-2.exe ==== ATTENTION
Task: {DE134056-A8E0-41D6-913E-5D683157AA9D} - System32\Tasks\FZM = C:\Users\asus\AppData\Roaming\FZM.exe ==== ATTENTION
Task: {DF1993F4-9B22-4FCF-BBD1-C9CFB80D037C} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-5 = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-5.exe ==== ATTENTION
Task: {EF013BED-E930-4D70-95DA-6E81A1A7E7C5} - System32\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-4 = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-4.exe ==== ATTENTION
Task: {FEF2C75B-49D1-46CD-812C-75D711E4F91A} - System32\Tasks\ELHEXRH = C:\Users\asus\AppData\Roaming\ELHEXRH.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-1.job = C:\Program Files (x86)\Apps Hat\Apps Hat-codedownloader.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-11.job = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-11.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-2.job = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-2.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-4.job = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-4.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-5.job = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-5.exe ==== ATTENTION
Task: C:\Windows\Tasks\07050b38-1064-4757-a89c-fb7383a998f7-5_user.job = C:\Program Files (x86)\Apps Hat\07050b38-1064-4757-a89c-fb7383a998f7-5.exe ==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP1.job = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job = C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-1.job = C:\Program Files (x86)\Senses\Senses-codedownloader.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-11.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-11.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-2.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-2.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-3.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-3.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-4.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-4.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5.exe ==== ATTENTION
Task: C:\Windows\Tasks\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5_user.job = C:\Program Files (x86)\Senses\d1aa8a69-fe44-4fdd-9cd0-80ae8344c39b-5.exe ==== ATTENTION
Task: C:\Windows\Tasks\ELHEXRH.job = C:\Users\asus\AppData\Roaming\ELHEXRH.exe ==== ATTENTION
Task: C:\Windows\Tasks\FZM.job = C:\Users\asus\AppData\Roaming\FZM.exe ==== ATTENTION
HKLM-x32\...\Run: [mbot_pl_118] = [X]
HKLM-x32\...\Run: [TkBellExe] = C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295072 2015-01-25] (RealNetworks, Inc.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\S-1-5-21-3508166105-2581622923-2598914484-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: No Name - {11111111-1111-1111-1111-110611191115} - No File
BHO: No Name - {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} - No File
BHO-x32: No Name - {11111111-1111-1111-1111-110411851159} - No File
BHO-x32: No Name - {11111111-1111-1111-1111-110611191115} - No File
FF HKU\S-1-5-21-3508166105-2581622923-2598914484-1000\...\Firefox\Extensions: [wcapturex@deskperience.com] - C:\Program Files (x86)\WordWeb\WCaptureMoz
FF Extension: WordWeb one-click lookup - C:\Program Files (x86)\WordWeb\WCaptureMoz [2014-12-05]
OPR Extension: (iWebar) - C:\Users\asus\AppData\Roaming\Opera Software\Opera Stable\Extensions\gnjbfdmiommbcdfigaefehgdndnpeech [2014-10-26]
OPR Extension: (Senses) - C:\Users\asus\AppData\Roaming\Opera Software\Opera Stable\Extensions\jhapbopfchfogphiimjbhodmgnppoigk [2014-10-26]
OPR Extension: (Apps Hat) - C:\Users\asus\AppData\Roaming\Opera Software\Opera Stable\Extensions\pbffpbffjfiigoledmkcibcbadpbenec [2014-10-26]
S1 ttnfd; system32\drivers\ttnfd.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2014-09-01 09:18 - 2014-09-01 09:18 - 0001248 _____ () C:\Users\asus\AppData\Roaming\ELHEXRH
2014-09-01 09:18 - 2014-09-01 09:18 - 0002086 _____ () C:\Users\asus\AppData\Roaming\FZM
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
dzięki pomogłeś mi Acorus
Skasuj folder C:\FRST
W AdwCleaner użyj opcji Odinstaluj.
Niestety pocieszyłem się na zapas, nie wiem dlaczego na facebooku mam rozmyty obraz i strony nadal się przekierowują na facebook jednakże wracają z powrotem na pierwotną stronę, proszę o pomoc, co mam zrobić? dziękuje!.