Zglaszam sie z prosba o sprawdzenie logow. Od okolo dwoch tygodni obserwuje obnizona wydolnosc komputera. Tasm Manager nie uruchamia sie przez zadna znana mi metode. W miedzyczasie pojawil sie MPC Cleaner, ktorego choc zdolalem usunac, to nie wiem czy czasem nie tylko teoretycznie. Opera po uruchomieniu za kazdym razem pyta czy chce by byla defaultowa. Ponizej linki do logow:
http://www.wklej.org/id/2476995/
http://www.wklej.org/id/2476997/
http://www.wklej.org/id/2476998/
Oczywiscie przepraszam za brak polskich znakow.
Atis
30 Maj 2016 18:59
#2
Po co pokazujesz stare logi 17-05-2016.AdwCleaner Kliknij Skanuj (Scan) i później Usuń (Cleaning).
Atis
30 Maj 2016 20:16
#4
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CMD: sfc /scanfile=C:\Windows\System32\taskmgr.exe AppInit_DLLs: C:\ProgramData\UltimateSecurityPackage\Ozerdax.dll => C:\ProgramData\UltimateSecurityPackage\Ozerdax.dll [361984 2016-05-07] () HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION SearchScopes: HKLM-x32 -> DefaultScope value is missing SearchScopes: HKU\S-1-5-21-3990279609-2261685871-835125438-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = CHR DefaultSearchURL: Default -> hxxp://www-searching.com/search.aspx?s=g57zamobl19040bo,f0956068-5dee-48bc-b31c-b7778ff7ed47,&prd=smw&q={searchTerms} CHR DefaultSearchKeyword: Default -> www-searching.com CHR DefaultSuggestURL: Default -> hxxp://api.searchpredict.com/api/?rqtype=ffplugin&siteID=8661&dbCode=1&command={searchTerms} CHR HKLM…\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi CHR HKLM-x32…\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi S3 intaud_WaveExtensible; \SystemRoot\system32\drivers\intelaud.sys [X] S3 iwdbus; \SystemRoot\System32\drivers\iwdbus.sys [X] S1 MpKsl4f031d3a; ??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates{C07A566F-6722-47A8-8121-0902D0D249C3}\MpKsl4f031d3a.sys [X] 2016-05-30 20:14 - 2016-05-30 20:14 - 00000000 ____D C:\Users\Michael s\Downloads\FRST-OlderVersion 2016-05-17 18:42 - 2016-05-17 19:07 - 00000000 ____D C:\Users\Michael s\AppData\Local\PleatsLonesomes 2016-05-17 18:42 - 2016-05-17 19:01 - 00000000 ____D C:\Users\Michael s\AppData\Roaming\PriceFountainUpdateVer 2016-05-13 02:22 - 2016-05-30 20:09 - 00000000 ____D C:\AdwCleaner 2016-05-13 01:40 - 2016-05-13 02:03 - 00000000 ____D C:\Users\Michael s\Doctor Web 2016-05-07 17:09 - 2016-05-07 17:09 - 00005120 _____ C:\Users\Michael s\AppData\Roaming\GiftBag.db 2016-05-07 17:08 - 2016-05-07 17:08 - 00000000 ____D C:\ProgramData\19a87fa1ec024bbcbb41931263354405 2016-05-07 17:05 - 2016-05-07 17:05 - 00000000 ____D C:\Users\Public\Thunder Network 2016-05-07 17:05 - 2016-05-07 17:05 - 00000000 ____D C:\ProgramData\Thunder Network 2016-05-07 17:04 - 2016-05-13 02:09 - 00000000 ____D C:\ProgramData\UltimateSecurityPackage 2016-05-07 17:04 - 2016-05-07 17:04 - 00000000 ____D C:\ProgramData\UltimateSecurityPackages 2016-05-06 20:44 - 2016-05-06 20:44 - 00563712 _____ C:\WINDOWS\system32\bitst.exe 2016-05-30 20:11 - 2015-05-04 15:07 - 00000380 _____ C:\Users\Michael s\AppData\Roaming\sp_data.sys 2016-05-07 17:04 - 2016-05-07 17:04 - 6494208 _____ () C:\Users\Michael s\AppData\Roaming\agent.dat 2016-05-07 17:04 - 2016-05-07 17:04 - 0065568 _____ () C:\Users\Michael s\AppData\Roaming\Config.xml 2016-05-07 17:09 - 2016-05-07 17:09 - 0005120 _____ () C:\Users\Michael s\AppData\Roaming\GiftBag.db 2016-05-07 17:04 - 2016-05-07 17:04 - 0016416 _____ () C:\Users\Michael s\AppData\Roaming\InstallationConfiguration.xml 2016-05-07 17:04 - 2016-05-07 17:04 - 0127488 _____ () C:\Users\Michael s\AppData\Roaming\Installer.dat 2016-05-07 17:04 - 2016-05-07 17:04 - 0018432 _____ () C:\Users\Michael s\AppData\Roaming\Main.dat 2016-05-07 17:04 - 2016-05-07 17:04 - 0005568 _____ () C:\Users\Michael s\AppData\Roaming\md.xml 2016-05-07 17:04 - 2016-05-07 17:04 - 0126464 _____ () C:\Users\Michael s\AppData\Roaming\noah.dat 2016-05-07 17:04 - 2016-05-07 17:04 - 39633304 _____ (COMODO) C:\Users\Michael s\AppData\Roaming\Silfresh.bin 2016-05-07 17:04 - 2016-05-07 17:04 - 0362341 _____ () C:\Users\Michael s\AppData\Roaming\Sonfind.bin 2015-05-04 15:07 - 2016-05-30 20:11 - 0000380 _____ () C:\Users\Michael s\AppData\Roaming\sp_data.sys 2016-05-07 17:06 - 2016-05-07 17:06 - 0032038 _____ () C:\Users\Michael s\AppData\Roaming\uninstall_temp.ico 2016-05-07 17:04 - 2016-05-07 17:04 - 0949248 _____ () C:\Users\Michael s\AppData\Roaming\VolHattop.exe 2016-05-07 17:04 - 2016-05-07 17:04 - 1626777 _____ () C:\Users\Michael s\AppData\Roaming\VolHattop.tst C:\ProgramData*.log Task: {66CDED01-4C7B-4EBB-8E2F-786772505CFD} - {35A3ECB8-780D-199B-5A28-253182BE96AA} -> No File <==== ATTENTION Task: {71029190-C1A2-4F52-8B40-AD1F9DAC53C0} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {A8671382-D6D8-40F6-AF81-B86B3B6A556F} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe Task: {B4895BA6-9EA3-4095-9813-9CDABC29AF3A} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: {ED90019F-A51F-4789-AD40-6B9A5074728D} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe Task: C:\WINDOWS\Tasks{35A3ECB8-780D-199B-5A28-253182BE96AA}.job => C:\Users\MICHAE~1\AppData\Roaming\PRICEF~1\updater.exe HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => “”=“Service” EmptyTemp:
Uruchom FRST i kliknij Napraw (Fix). Pokaż raport z usuwania Fixlog.
Atis
30 Maj 2016 21:28
#6
Skasuj folder C:\FRSTPrzywracanie systemu i kopie w tle Malwarebytes Anti-Malware KLIK KLIK - KLIK - KLIK
Dziekuje bardzo, wyglada na to, ze temat do zamkniecia. Czy moglbys mi krotko powiedziec co bylo nie tak, prosze?
