Gorszej strony juz chyba nie mogles wybrac...
Logi miales dac w ZALCZNIKU.
Obok frst.exe utworz plik fixlist.txt z zawartoscia:
Task: {063292CD-6D4E-4139-AA82-B35CF8C2A4E0} - \Adobe Acrobat Update Task No Task File <==== ATTENTION
Task: {2FDAD180-220D-46FE-9F6B-1052CCC10299} - \GoogleUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {666D9B31-2B0F-45B9-B6E1-455F6F57B2E2} - \GoogleUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {9D1B53DA-48E8-433E-BE7B-5D7BC65F321D} - \CCleanerSkipUAC No Task File <==== ATTENTION
Task: {9E6B5FD9-207F-49A5-9BD9-9A14306EE713} - System32\Tasks\newSI_618 => C:\Users\Sebek\AppData\Roaming\newSI_618\s_inst.exe [2014-12-03] ()
Task: {AEA43756-0223-4D58-8082-B2CBB38C1DCC} - \{2807DF79-009C-4B41-AC93-E4134034B054} No Task File <==== ATTENTION
Task: C:\Windows\Tasks\newSI_618.job => C:\Users\Sebek\AppData\Roaming\newSI_618\s_inst.exe
HKLM\...\Winlogon: [Userinit] C:\Windows\SysWOW64\userinit.exe,
HKU\S-1-5-21-3499695330-1870665420-3261934126-1000\...\Run: [Ukzmedia] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Sebek\AppData\Local\Evtion\ASMlopt120I.dll
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3499695330-1870665420-3261934126-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
CHR DefaultSearchKeyword: Default ->
CHR DefaultSearchURL: Default ->
http://isearch.omigaweb/?type=dspp&q={searchTerms}
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
OPR Extension: (TheTorntvs V10 1.1 +) - C:\Users\Sebek\AppData\Roaming\Opera Software\Opera Stable\Extensions\pmijnggdaadccmmmoofgdcaikjmkiglk [2014-12-09]
S2 HPSLPSVC; C:\Users\Sebek\AppData\Local\Temp\7zS476D\hpslpsvc64.dll [X]
S2 PEVSystemStart; "C:\ComboFix\pev.3XE" EXEC /i "C:\ComboFix\REGT.3XE" /S "C:\ComboFix\CregB.dat"
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2015-01-30 19:50 - 2015-01-30 19:53 - 00000000 ____D () C:\AdwCleaner
2015-01-14 15:28 - 2015-01-14 15:28 - 00000000 ____D () C:\Users\Sebek\AppData\Roaming\SetMyHomePage
2015-01-14 15:27 - 2015-01-30 19:55 - 00000412 _____ () C:\Windows\Tasks\newSI_618.job
2015-01-14 15:27 - 2015-01-14 15:27 - 00003100 _____ () C:\Windows\System32\Tasks\newSI_618
2015-01-14 15:27 - 2015-01-14 15:27 - 00000000 ____D () C:\Users\Sebek\AppData\Roaming\newSI_618
2015-01-18 09:55 - 2014-12-09 11:38 - 00000000 ____D () C:\Users\Sebek\AppData\Local\Evtion
2015-01-18 09:54 - 2014-12-09 11:38 - 00000000 ____D () C:\Users\Sebek\AppData\Local\Ugjmedia
EmptyTemp:
W FRST wybierz Fix.
Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
