Witam. Proszę o pomoc w usunięciu tego wirusa. Odinstalowałam go w panelu sterowania a on i tak panoszy się na każdej stronie. Poczytałam wcześniejsze porady i zastosowałam się do wskazówek ACORUSA:
Pobierz Farbar Recovery Scan Tool http://www.bleepingc…very-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.
Uruchom FRST i kliknij Scan. Pokaż raport FRST i Addition.
Oto linki:
Nie wiem co dalej i proszę o pomoc.
Pobierz i uruchom AdwCleaner Kliknij Scan i później Cleaning.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CloseProcesses:
BootExecute: autocheck autochk *
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-1624614489-1438924107-3198493719-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1422994274&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHM250HI_S20TJ9BZ348390&ts=1422994290&type=default&q={searchTerms}
BHO: No Name -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> No File
Toolbar: HKU\S-1-5-21-1624614489-1438924107-3198493719-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF HKLM\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\Ewar\AppData\Roaming\Mozilla\Firefox\Profiles\fhcirodf.default\extensions\fftoolbar2014@etech.com
OPR Extension: (Game BOX) - C:\Users\Ewar\AppData\Roaming\Opera Software\Opera Stable\Extensions\mibfbmhijjgpkmobcfdlelpccpeafoom [2014-10-31]
R3 Service Mgr PositiveFinds; C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe [577272 2015-02-14] ()
R3 Update Mgr PositiveFinds; C:\Program Files\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe [384760 2015-02-14] ()
S3 CLVirtualBus01; system32\DRIVERS\CLVirtualBus01.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 MBAMSwissArmy; \??\C:\windows\system32\drivers\MBAMSwissArmy.sys [X]
2015-02-06 17:49 - 2015-02-06 17:49 - 00000000 ____ D () C:\Program Files\Enigma Software Group
2015-02-03 21:12 - 2015-02-14 19:20 - 00000000 ____ D () C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-03 21:12 - 2015-02-14 14:59 - 00000000 ____ D () C:\Program Files\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602
2015-02-03 21:12 - 2015-02-07 01:23 - 00000000 ____ D () C:\Program Files\Positive Finds
2015-02-03 21:11 - 2015-02-07 01:49 - 00000000 ____ D () C:\Program Files\XTab
2015-02-03 21:11 - 2015-02-03 21:11 - 00000000 ____ D () C:\ProgramData\IHProtectUpDate
2015-02-14 19:20 - 2012-02-15 21:47 - 00000000 ___DC () C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}
C:\ProgramData\*.log
Task: {4BD94C56-2A23-4F10-8E37-017979FCB990} - System32\Tasks\{25D0554C-DD1B-4435-ACB3-EFE53EB823C7} => Chrome.exe
Task: {39697BC3-53ED-4CB5-8891-2B3A06C6DFFC} - System32\Tasks\{EC3116FB-18EE-46C5-BEAA-79BC18ED2EB4} => Chrome.exe
Task: {2C951F85-B68E-4191-90D2-4B927F1945B4} - System32\Tasks\{AF3F90C9-DC2B-4332-9F6C-D8BF3F58D2AF} => Chrome.exe
Task: {C73733AF-252A-42BB-8D26-D777756D126F} - System32\Tasks\{C2348F8C-4E18-4434-AF71-4D8D2ACC9E63} => Chrome.exe
Task: {D273CB1D-F3BC-4B6F-867C-D54227A5022C} - System32\Tasks\{3341941B-05E0-41D7-A762-72BEA422A80C} => Chrome.exe
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
EmptyTemp:
Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.
Kliknij Scan i pokaż nowy raport z FRST bez Addition.
Resetowanie ustawień przeglądarki
Jeżeli nadal będzie problem to odinstaluj Chrome zaznaczając usunięcie danych przeglądania.
Najpierw możesz wyeksportować zakładki: https://support.google.com/chrome/answer/96816?hl=pl
Geek Uninstaller free: http://www.geekuninstaller.com/geek.zip
Później zainstaluj: https://www.google.pl/chrome/browser/desktop/
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
2015-02-14 23:59 - 2015-02-15 00:43 - 00000000 ____ D () C:\AdwCleaner
2012-12-28 20:30 - 2012-12-28 20:30 - 0000673 _____ () C:\Users\Ewar\AppData\Local\PDLSetup.20121228.203005.txt
2012-12-28 20:30 - 2012-12-28 20:30 - 0001498 _____ () C:\Users\Ewar\AppData\Local\PDLSetup.20121228.203008.txt
2012-12-28 20:30 - 2012-12-28 20:30 - 0001217 _____ () C:\Users\Ewar\AppData\Local\PDLSetup.20121228.203019.txt
2013-06-20 22:41 - 2013-06-20 22:43 - 0002432 _____ () C:\Users\Ewar\AppData\Local\TempVu5064.html
2013-06-20 22:41 - 2013-06-20 22:43 - 0002089 _____ () C:\Users\Ewar\AppData\Local\TempZG5064.html
DeleteQuarantine:
Uruchom FRST i kliknij Fix. Skasuj folder C:\FRST
Usuń stare punkty przywracania: Aby usunąć wszystkie punkty przywracania
Dysk przeskanuj ESET Online Scanner
Przeczytaj w jaki sposób należy instalować programy: KLIK - KLIK - KLIK - KLIK
Dziękuję. Biorę się do roboty. Dam znać jak poszło.