Po włączeniu komputera włącza się ta stronka
http://gameorplay.info/nextpage.html
Proszę o pomoc jak sobie z tym poradzić
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist:
HKU\S-1-5-21-29079470-672811852-2171392520-1000\...\Run: [Paweł] => explorer.exe hxxp://ozirizsoos.info <==== UWAGA
CHR HKU\S-1-5-21-29079470-672811852-2171392520-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
U3 idsvc; Brak ImagePath
2017-11-25 11:34 - 2014-11-10 20:53 - 000000000 ____D C:\AdwCleaner
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku
ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku
Task: {154B28A2-C2E4-494C-A179-B4A80AEEA3D8} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {15F9446B-32C1-4FA2-B02A-C23F7DBA87C0} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {1FFEE88B-0D98-4506-8DE4-BBBE009573D1} - System32\Tasks\Paweł => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Paweł /t REG_SZ /d "explorer.exe hxxp://ozirizsoos.info" <==== UWAGA
Task: {2C663EAC-3F70-4A7A-B7C8-7910599B659B} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {2F3B2586-0A8D-4F80-BC35-6352E8B83767} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\WINDOWS\ehome\mcupdate.exe
Task: {3207FA3B-6E85-4121-98C0-37CD786247CC} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {3D8C9704-DCB7-4237-A72F-91033A259BC5} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\WINDOWS\ehome\ehrec.exe
Task: {45732817-6604-49F0-A0ED-A06D46DF3F1D} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {4E8D6D15-56BC-415E-856E-EC9C6337C0D4} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {5CA36C3E-2640-4A7D-B228-79F1CB841D3A} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {57FFE157-523B-4ED0-8C8D-E14141C49AED} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\WINDOWS\ehome\MCUpdate.exe
Task: {62B6EF54-95AC-4617-AB8A-3FC9AB26A315} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {69CF06E0-FA50-43A5-8237-D497C68767E6} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\WINDOWS\ehome\mcupdate.exe
Task: {6E4D311B-4BF0-4AA2-B211-08642C9F611A} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {897F90B5-B7AF-4A3A-A5AE-59E89548F43F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {8A65E95E-A795-46E6-B870-32ECB69F8A31} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\WINDOWS\ehome\ehrec.exe
Task: {94951D36-7B8A-4744-AC99-CF4C713FE34C} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {9B50F0F7-92AF-4733-BADD-E93A750FEA20} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {A0CDED99-EB12-42BA-8ADA-B8351137E0D8} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {AB5BE5B8-AE01-44F3-8FFB-9AB06765E2A2} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {ADEA71A1-5134-4870-A30F-8ADE87572991} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {BDE35034-ED69-4164-8155-4DC12C1B411E} - System32\Tasks\{EEB451C5-5356-4B03-BCC1-B587F9FE4CA8} => C:\Windows\system32\pcalua.exe -a C:\Users\Paweł\Downloads\pbsetup.exe -d C:\Users\Paweł\Downloads
Task: {CBB2360E-010B-4768-89D5-06E250F5C9A4} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\WINDOWS\ehome\mcupdate.exe
Task: {CD26132C-CD14-48E6-8E73-3FE5022C8D63} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
Task: {F650A057-E21E-4EAF-9C58-5740687D5604} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\WINDOWS\ehome\ehPrivJob.exe
EmptyTemp:Uruchom FRST i kliknij Napraw (Fix). Pokaż raport z usuwania Fixlog.
Kliknij Skanuj (Scan) i pokaż nowy raport z FRST bez Addition i Shortcut.
Nie zostało usunięte, bo w Fixlist brakuje polskich znaków, a w mojej odpowiedzi wszystko jest prawidłowo.
czyli co mam zrobić?
skopiowałem tak jak jest
Może spróbować z kodowaniem pliku fixlist.txt Unicode / UTF-8.
Zapisując Fixlist kodowanie ustaw na UTF-8
1 polubienie
ustawiłem na unicode i po odpaleniu komputera stronka się nie pokazała już
I o to chodziło.Skasuj folder C:\FRST
skasowany