witam proszę o receptę na sysmenu.dll
myślałem że to przez programy iobita
ale w końcu nie wiem co to pojawiło się po instalacji AVG
Odinstaluj Akamai NetSession Interface.Otwórz notatnik systemowy i wklej:
Task: {09B0E571-2119-4702-B68F-30DC47DA85BA} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1414971955-2827422992-4120328547-1001UA = C:\Users\Maciej\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {1A35D82D-D87A-448B-9A3A-F5888B532247} - System32\Tasks\SPBIW_UpdateTask_Time_313037363931363931392d5b4a4a416c34232a2a6c555a = Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 ==== ATTENTION
Task: {2FC3D01B-1169-448F-9762-17C576947746} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1414971955-2827422992-4120328547-1001Core = C:\Users\Maciej\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-08-05] (Facebook Inc.)
Task: {31C1AE1B-DA30-4C60-9429-C83F7C21C10E} - System32\Tasks\Microsoft\Window
s\Maintenance\SMupdate2 = Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 ==== ATTENTION
Task: {69767521-B4AD-438A-A00F-DAFF5DED313B} - System32\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805} = C:\ProgramData\cisD8BE.exe ==== ATTENTION
Task: {769FF1C1-FCA7-4441-99DA-A7236FC378CD} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 = Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 ==== ATTENTION
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1414971955-2827422992-4120328547-1001Core.job = C:\Users\Maciej\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-1414971955-2827422992-4120328547-1001UA.job = C:\Users\Maciej\AppData\Local\Facebook\Update\FacebookUpdate.exe
HKLM-x32\...\Run: [mbot_pl_164] = [X]
HKU\S-1-5-21-1414971955-2827422992-4120328547-1001\...\Run: [Akamai NetSession Interface] = C:\Users\Maciej\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1414971955-2827422992-4120328547-1001\...\Policies\Explorer: []
HKU\S-1-5-21-1414971955-2827422992-4120328547-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={CF396BB3-2C09-4037-B56B-381FEE9C410B}mid=2384e9fe106a47d29c8f0580a98914d6-d18151482c5aa28b802bc1c4fe0584a1aa945d79lang=plds=AVGcoid=avgtbavgcmpid=0215tbpr=frd=2015-03-08 16:05:43v=4.1.0.411pid=wtusg=sap=hp
URLSearchHook: HKLM-x32 - (No Name) - {5d9968c3-101c-4944-ba71-72d77393322d} - No File
SearchScopes: HKLM - {E28F34B5-EDC1-404D-8E65-F62762A24A3A} URL = http://www.amazon.co.uk/s/ref=azs_osd_ieauk?ie=UTF-8tag=hp-uk3-vsb-21link%5Fcode=qsindex=apsfield-keywords={searchTerms}
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1414971955-2827422992-4120328547-1001 - {98748FED-07AA-4D29-8059-0F5F90DD0E70} URL = http://search.yahoo.com/search?fr=chr-greentree_ieei=utf-8ilc=12type=402027p={searchTerms}
BHO-x32: No Name - {5d9968c3-101c-4944-ba71-72d77393322d} - No File
Toolbar: HKLM - No Name - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - No File
Toolbar: HKU\S-1-5-21-1414971955-2827422992-4120328547-1001 - No Name - {5D9968C3-101C-4944-BA71-72D77393322D} - No File
Handler: http - No CLSID Value
FF Homepage: https://mysearch.avg.com/?cid={CF396BB3-2C09-4037-B56B-381FEE9C410B}mid=2384e9fe106a47d29c8f0580a98914d6-d18151482c5aa28b802bc1c4fe0584a1aa945d79lang=plds=AVGcoid=avgtbavgcmpid=0215tbpr=frd=2015-03-08 16:05:43v=4.1.0.411pid=wtusg=sap=hp
FF Keyword.URL: hxxp://badoo.com/startpage/?source=bsbq=
CHR Extension: (AVG Secure Search) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\chfdnecihphmhljaaejmgoiahnihplgn [2015-03-22]
OPR Extension: (No Name) - C:\Users\Maciej\AppData\Roaming\Opera Software\Opera Stable\Extensions\gnjbfdmiommbcdfigaefehgdndnpeech [2014-12-31]
S2 Autodesk Content Service; No ImagePath
R2 WtuSystemSupport; No ImagePath
S2 SPDRIVER_1456.0.0.0; No ImagePath
R3 cpuz138; \\C:\WINDOWS\TEMP\cpuz138\cpuz138_x64.sys [X]
U4 Messenger; No ImagePath
U4 vsserv; No ImagePath
2015-03-22 16:26 - 2014-12-31 15:20 - 00000000 ____ D () C:\AdwCleaner
2014-12-31 11:32 - 2014-12-31 11:32 - 1980392 _____ (Object Browser) C:\Users\Maciej\AppData\Roaming\DYXPLILW.exe
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.