Fixlist.txt dla FRST:
Task: {69F01F45-660F-4C7E-9448-6777009B4433} - System32\Tasks\Opera scheduled Autoupdate 1443782579 => C:\Program Files (x86)\Opera\launcher.exe [2015-09-29] (Opera Software)
Task: {6D76D0BE-75EC-4870-95CE-6940FC7544D8} - System32\Tasks\{0A79C16F-971E-4293-BBFA-06A6A2232767} => pcalua.exe -a C:\Users\Ania\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cor
ShortcutWithArgument: C:\Users\Ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.omniboxes.com/?type=sc&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
ShortcutWithArgument: C:\Users\Ania\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.omniboxes.com/?type=sc&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
ShortcutWithArgument: C:\Users\Ania\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
ShortcutWithArgument: C:\Users\Ania\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
ShortcutWithArgument: C:\Users\Ania\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://www.yoursites123.com/?type=sc&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk -> C:\Program Files (x86)\Opera\launcher.exe (Opera Software) -> hxxp://www.omniboxes.com/?type=sc&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE <==== UWAGA
(tsvr.com) C:\Users\Ania\AppData\Roaming\TSv\TSvr.exe
(TODO: <公司名>) C:\Program Files (x86)\SFK\SSFK.exe
(TFuns LIMITED) C:\ProgramData\gWdMg\WdMan.exe
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448349743&z=4c17426582b04268fac9b40g6z9z9bdcczft2m8zbw&from=ient07031&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
HKU\S-1-5-21-3555186332-3959513846-3676576742-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
HKU\S-1-5-21-3555186332-3959513846-3676576742-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKU\S-1-5-21-3555186332-3959513846-3676576742-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.yahoo.com/?fr=hp-avast&type=752
HKU\S-1-5-21-3555186332-3959513846-3676576742-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
HKU\S-1-5-21-3555186332-3959513846-3676576742-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxps://search.yahoo.com/yhs/search?type=752&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-3555186332-3959513846-3676576742-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\S-1-5-21-3555186332-3959513846-3676576742-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.yoursites123.com/?type=sc&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
StartMenuInternet: (HKLM) OperaStable - C:\Program Files (x86)\Opera\Launcher.exe hxxp://www.yoursites123.com/?type=sc&ts=1449837090&z=871888b16330be3d340644cg5zfz4t3b5c0m5e8taz&from=ient07021&uid=ST500LT012-1DG142_S3P524NE
R2 IhPul; C:\Users\Ania\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [170144 2015-11-27] (TODO: <公司名>)
R2 WdMan; C:\ProgramData\gWdMg\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
S1 wfdrvr_vt_1_10_0_28; system32\drivers\wfdrvr_vt_1_10_0_28.sys [X]
2015-12-11 20:23 - 2015-12-11 20:23 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2015-12-11 13:33 - 2015-12-11 20:30 - 00000000 ____D C:\Program Files (x86)\SFK
2015-12-11 13:33 - 2015-12-11 20:28 - 00000001 _____ C:\Windows\SysWOW64\pl.html
2015-12-11 13:32 - 2015-12-11 13:33 - 00000000 ____D C:\ProgramData\gWdMg
2015-11-24 08:23 - 2015-11-28 06:32 - 00000000 ____D C:\ProgramData\vWMiniProv
2015-11-16 20:59 - 2015-11-16 20:59 - 00003152 _____ C:\Windows\System32\Tasks\{0A79C16F-971E-4293-BBFA-06A6A2232767}
Task: {B056F1F1-E58B-43C1-97CF-81A2FADCB2CD} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2015-07-08] (Lenovo)
2015-11-16 20:58 - 2015-11-16 20:58 - 00000000 ____D C:\Users\Ania\REACHit
2015-11-16 20:58 - 2015-11-16 20:58 - 00000000 ____D C:\Users\Ania\AppData\Local\Lenovo
2015-11-16 20:57 - 2015-11-16 21:00 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2015-11-16 20:57 - 2015-11-16 21:00 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-11-16 20:57 - 2015-11-16 20:58 - 00000000 ____D C:\ProgramData\1WMiniPro1
2015-12-11 13:32 - 2015-10-12 05:49 - 00000000 ____D C:\Users\Ania\AppData\Roaming\TSv
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:
W FRST wybierz Napraw.
Usun katalog C:\FRST i to wszystko.
Proszę o pomoc.
