Wirus Safefinder - jak usunąć złośliwe oprogramowanie?

Cytat:

Task: C:\WINDOWS\Tasks\schedule!567381930.job => C:\Documents and Settings\All Users\Dane aplikacji\BetterSoft\OptimizerPro\OptimizerPro.exen/schedule /profile c:\documents and settings\all users\dane aplikacji\bettersoft\optimizerpro\567381930.ini <==== UWAGA
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [19522592 2010-03-26] (Realtek Semiconductor Corp.)
HKLM\...\Run: [ISUSPM Startup] => C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
HKLM\...\Run: [ISUSScheduler] => C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation)
HKLM\...\Run: [NWEReboot] => [X]
HKLM\...\Run: [tray_ico] => [X]
HKLM\...\Run: [tray_ico2] => [X]
HKLM\...\Run: [tray_ico3] => [X]
HKLM\...\Run: [tray_ico4] => [X]
HKLM\...\Run: [ROC_ROC_NT] => "C:\Program Files\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT
AppInit_DLLs: C:\DOCUME~1\ALLUSE~1\DANEAP~1\Zonzap\ZoomTofresh.dll => C:\Documents and Settings\All Users\Dane aplikacji\Zonzap\ZoomTofresh.dll [320512 2015-10-22] ()
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
CHR HKU\S-1-5-21-1123561945-115176313-1801674531-1003\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1435573817&z=60ac02829841dfe0299ac16g8zbccw4w6m8c1bbo1o&from=ient06292&uid=ST3500418AS_9VMKXZELXXXX9VMKXZEL
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQcLmwmqdqie4N5mRJp9cdZS5t0_zWGm_Xd8MZml2W_A4NtIGxlHhqUclnOaSIgX_VXVXMoNV_XcAQ,,
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQcLmwmqdqie4N5mRJp9cdZS5t0_zWGm_Xd8MZml2W_A4NtIGxlHhqUclnOaSIgX_VXVXMoNV_XcAQ,,
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=dspp&ts=1420902684&from=cor&uid=ST3500418AS_9VMKXZELXXXX9VMKXZEL&q={searchTerms}
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQcLmwmqdqie4N5mRJp9cdZS5t0_zWGm_Xd8MZml2W_A4NtIGxlHhqUclnOaSIgX_VXVXMoNV_XcAQ,,
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1435573817&z=60ac02829841dfe0299ac16g8zbccw4w6m8c1bbo1o&from=ient06292&uid=ST3500418AS_9VMKXZELXXXX9VMKXZEL
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://go.microsoft.com/fwlink/?LinkID=226786&Mkt=pl-PL&Src=MSE&Tid=0003446E&OHP=http%3A%2F%2Fwww.delta%2Dhomes.com%2F%3Ftype%3Dhp%26ts%3D1435573817%26z%3D60ac02829841dfe0299ac16g8zbccw4w6m8c1bbo1o%26from%3Dient06292%26uid%3DST3500418AS%5F9VMKXZELXXXX9VMKXZEL&OSP=http%3A%2F%2Fdo%2Dsearch.com%2Fweb%2F%3Futm%5Fsource%3Db%26utm%5Fmedium%3D%26utm%5Fcampaign%3Dinstall%5Fie%26utm%5Fcontent%3Dds%26from%3D%26uid%3DST500DM002%2D1BC142%5FW2A27G6AXXXXW2A27G6A%26ts%3D1420373293%26type%3Ddefault%26q%3D%7BsearchTerms%7D
HKU\S-1-5-21-1123561945-115176313-1801674531-1003\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKLM -> {20F5AB16-9F2E-4E92-93F2-ECB9ABB0EC42} URL = hxxp://search.foxtab.com/?q={searchTerms}&s=1&chnl=tst01&cd=2XzutAtN2Y1L1QzutC0CyC0FyCyDtB0C0DtB0AtC0AyCtAzytCtN0D0TzutBtDtCtCtCtCtDyB&cr=529680164
SearchScopes: HKLM -> {7F075DCB-1889-4B73-992C-203D089B11C0} URL = hxxp://www.tangosearch.com/?q={searchTerms}&a=SEARCH
SearchScopes: HKU\S-1-5-19 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKU\S-1-5-19 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKU\S-1-5-20 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> {20F5AB16-9F2E-4E92-93F2-ECB9ABB0EC42} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> {23DC8189-F530-4174-B98E-3D52DF22BE70} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> {7055C098-EBD8-4DDF-AFCB-FD9F08C32FAE} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> {7F075DCB-1889-4B73-992C-203D089B11C0} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=&utm_campaign=install_ie&utm_content=ds&from=&uid=ST500DM002-1BC142_W2A27G6AXXXXW2A27G6A&ts=1420373293&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1123561945-115176313-1801674531-1003 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQtghj4WvEEDIfbQZfaNechzi7tbW2BFfTS96EaNhocXwFxjlc73h4WQLT4Q31Ufr745CRZWUFs29A,,&q={searchTerms}
BHO: Brak nazwy -> {9BCF56B3-CF14-4C78-A07D-35DD410A8C11} -> Brak pliku
FF DefaultSearchEngine: webssearches
FF SelectedSearchEngine: webssearches
FF SearchPlugin: C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\searchplugins\webssearches.xml [2015-11-27]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\findit.xml [2015-12-20]
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\omiga-plus.xml [2015-01-10]
FF Extension: Default SearchProtected - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\extensions\defsearchp@gmail.com.xpi [2015-09-02] [Brak podpisu cyfrowego]
FF Extension: Default NewTab - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\extensions\default_newtabff@gmail.com [2015-10-03] [Brak podpisu cyfrowego]
FF Extension: Brak nazwy - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\Extensions\defsearchp@gmail.com [2015-10-25] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\extensions\default_newtabff@gmail.com
FF HKLM\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\extensions\defsearchp@gmail.com
FF HKLM\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Documents and Settings\USER\Dane aplikacji\Mozilla\Firefox\Profiles\y7pwpk36.default\extensions\deskCutv2@gmail.com => nie znaleziono
StartMenuInternet: FIREFOX.EXE - C:\Program Files\Mozilla Firefox\firefox.exe hxxp://www.istartsurf.com/?type=sc&ts=1445540358&z=013a7fb7abcde64c87586cegez7z0w3w7zaeeg0o2e&from=cornl&uid=ST3500418AS_9VMKXZELXXXX9VMKXZEL
CHR HomePage: Default -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7-govFQKLDC3v-wXBTX6Wbc0T__1yzDPxdAXDJMbu6d1iqlRnGp1V29ftNeI6NQt7G1-GkON8NFlsWwUgRTPfqt_UUYncCg_ingfyaMOE1jTFoSM2Wfm2lLmNAWAEk6aR1gTTgjMAVw,,
CHR HKLM\...\Chrome\Extension: [mjenhgehkhlmnlckienafbhokdjoanbl] - C:\DOCUME~1\USER\USTAWI~1\DANEAP~1\FoxTab.crx [2011-11-07]
CHR HKU\S-1-5-21-1123561945-115176313-1801674531-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\DOCUME~1\USER\USTAWI~1\DANEAP~1\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-10-22]
CHR HKU\S-1-5-21-1123561945-115176313-1801674531-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjenhgehkhlmnlckienafbhokdjoanbl] - C:\DOCUME~1\USER\USTAWI~1\DANEAP~1\FoxTab.crx [2011-11-07]
S2 d93cc0a5; "C:\WINDOWS\system32\rundll32.exe" "c:\docume~1\alluse~1\daneap~1\assist~1\AssistantSvc.dll",service
S3 rpcapd; "%ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini" [X]
S3 andnetadb; System32\Drivers\lgandnetadb.sys [X]
S3 andnetndis; system32\DRIVERS\lgandnetndis.sys [X]
U4 dwshd; \SystemRoot\System32\drivers\dwshd.sys [X]
U5 GVTDrv; C:\WINDOWS\system32\Drivers\GVTDrv.sys [24944 2011-06-19] ()
S1 hebhcjsg; \??\C:\WINDOWS\system32\drivers\hebhcjsg.sys [X]
S4 IntelIde; Brak ImagePath
U1 WS2IFSL; Brak ImagePath
2015-12-20 12:09 - 2015-10-22 19:54 - 00000000 ____D C:\Documents and Settings\All Users\Dane aplikacji\Zonzap
2011-11-07 19:01 - 2011-11-07 19:01 - 0019022 _____ () C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\FoxTab.crx
EmptyTemp:

karmel48 napisał:

Możesz też spróbować użyć opcji przywracania systemu do momentu sprzed złapania wirusa.