Strona startowa sama się zmienia

Dla specjalistów Bezpieczeństwo
#1

itam…

#2

Użyj --> AdwCleaner

#3

Przenoszę do działu Bezpieczeństwo.

#4

Zrobione tak jak napisałeś

Addition.txt

FRST.txt

Shortcut.txt

AdwCleanerS4.txt

#5

Otwórz notatnik systemowy i wklej:

Task: {39C1AEA5-F935-45AF-9899-83F899A59381} - System32\Tasks\DLL-files.com Fixer_UPDATES = C:\Program Files (x86)\Dll-Files.com Fixer\DLLFixer.exe
Task: {40D7E244-F1AA-46E3-9545-5A3A1AC70C29} - System32\Tasks\{13C108D0-FFE2-4173-B0B9-EAAD909C5F5F} = pcalua.exe -a C:\Users\chudz_000\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cor
HKU\S-1-5-21-1334280985-1057134081-386612253-1001\...\RunOnce: [Report] = C:\AdwCleaner\AdwCleaner[S3].txt [1403 2015-08-11] ()
ShellIconOverlayIdentifiers: [01UnsuppModule] - {AEB16659-2125-4ADA-A4AB-45EE21E86469} = No File
ShellIconOverlayIdentifiers: [02SyncingModule] - {48AB5ADA-36B1-4137-99C9-2BD97F8788AB} = No File
ShellIconOverlayIdentifiers: [03SyncedModule] - {472CE1AD-5D53-4BCF-A1FB-3982A5F55138} = No File
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction ======= ATTENTION
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1334280985-1057134081-386612253-1001 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
S3 cmiqk; E:\Program Files\ophcrack\pwdump\servpw.exe [X]
S3 tcmdxtgoh; E:\Program Files\ophcrack\pwdump\servpw.exe [X]
S3 NvStreamKms; \\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [X]
2015-08-11 09:37 - 2015-08-11 09:37 - 00003152 _____ C:\WINDOWS\System32\Tasks\{13C108D0-FFE2-4173-B0B9-EAAD909C5F5F}
2015-08-11 13:35 - 2014-07-20 08:53 - 00000000 ____ D C:\AdwCleaner
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

Odinstaluj Chrome zaznaczając usunięcie danych przeglądania.

#6

OK dla chroma pomogło ale w  Internet explorerze dalej jest to samo

 

 

 

Backup systemy z przed tygodnia może rozwiązać sprawę?

Pomoże ktoś?

#7

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\2K Games\Mafia II\Mafia II Launcher.lnk -> D:\Program Files (x86)\2K Games\Mafia II\launcher.exe () -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder\WarThunder.lnk -> D:\Program Files (x86)\WarThunder\launcher.exe (Gaijin Entertainment) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\chudz_000\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\69639df789022856\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> "hxxp://yourwebing.com/?ssid=1439248400"
ShortcutWithArgument: C:\Users\Public\Desktop\WarThunder.lnk -> D:\Program Files (x86)\WarThunder\launcher.exe (Gaijin Entertainment) -> "hxxp://yourwebing.com/?ssid=1439248400"

Uruchom FRST i kliknij Fix. Później skasuj folder C:\FRST

#8

Dzięki Wielki za pomoc