Cześć,
niestety ten spyware wkradł mi się na komputer. W załączniku zamieszkam logi z FRST. Proszę o pomoc 
Cześć,
niestety ten spyware wkradł mi się na komputer. W załączniku zamieszkam logi z FRST. Proszę o pomoc
Otwórz notatnik systemowy i wklej:
ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969 <==== UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&...51XMX2X2280X128GB_S1D2NYAG419969419969&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursites123.com/?type=sc&ts=1...SSDXPM851XMX2X2280X128GB_S1D2NYAG419969419969
S3 PrintNotify; C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll [X]
2015-12-12 12:40 - 2015-12-12 12:40 - 00000001 _____ C:\Windows\SysWOW64\pl.html
2015-12-09 11:26 - 2015-12-09 11:27 - 00000000 ____D C:\ProgramData\ZWdMZ
2015-12-09 11:25 - 2015-12-09 11:25 - 00000000 ____D C:\ProgramData\UWdMU
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
C:\Users\Public\GROUP.dat
2015-10-26 23:23 - 2015-10-26 23:23 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-11-03 11:25 - 2015-11-03 18:10 - 0004111 _____ () C:\ProgramData\hpzinstall.log
2015-11-25 21:34 - 2015-11-25 21:34 - 0004912 _____ () C:\ProgramData\lbogtyso.zat
2015-11-25 21:34 - 2015-11-25 21:34 - 0000016 _____ () C:\ProgramData\mntemp
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Uruchom FRST i kliknij w Fix/Napraw.
@jf14 do fixlist.txt dodaj jeszcze:
Task: {076B7068-802E-4411-A2AB-04837C6054B8} - System32\Tasks\{68E393EB-2F96-4510-A58F-C68918B08BD9} => pcalua.exe -a C:\Users\Użytkownik\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cor
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9695
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9733
AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:9831
(TFuns LIMITED) C:\ProgramData\ZWdMZ\WdMan.exe
R2 WdMan; C:\ProgramData\ZWdMZ\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
@krzychupar nadal pomijasz za kazdym razem:
(TFuns LIMITED) C:\ProgramData\ZWdMZ\WdMan.exe
R2 WdMan; C:\ProgramData\ZWdMZ\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
Czy mozesz zwracac na to uwage?