Wejdz do katalogu C:\Program Files (x86)\MPC Cleaner i uruchom uninstall z prawami administratora.
Fixlist.txt dla FRST:
Task: {277D885B-2044-4873-8C03-2A054F0FA7B2} - System32\Tasks\Reujosestogle Community => C:\Program Files (x86)\Reujosestogle\ReujosestogleCmmTes.exe [2016-06-18] ()
Task: {4FE9E5F1-E959-426E-9C18-DE529FD6D096} - System32\Tasks\{31DDBD37-5DB7-4030-8064-10B0CAA806C3} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2016-06-16] (COMODO)
Task: {5313DC65-B668-43EC-B66F-72C7288DCC9E} - System32\Tasks\{B2EB44AC-7DAC-48D3-8EE9-934C52C6A1F3} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Stringkix\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\Stringkix\uninstall.dat" -a uninstallme FAF73296-965C-4B64-AD1D-38410E97B114 DeviceId=af8b9e1c-56c5-3470-1643-f832d2eb86c4 BarcodeId=51107003 ChannelId=3 DistributerName=APSFClickMeIn
Task: {555F959A-3E0B-40FE-9982-D943895B87D5} - System32\Tasks\{B2B6AFE0-CE4D-472D-8E3E-941123F3530A} => pcalua.exe -a "D:\Programy\a\USB Drivers\Uninstall.exe" -d "D:\Programy\a\USB Drivers"
Task: {7C5C32AF-8808-42E7-8D65-147DA33A84B6} - System32\Tasks\{6ED7A628-D4EB-45C0-8BC8-7F99871FE947} => pcalua.exe -a "C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\removeAdAppMgr.exe"
Task: {B8D1CBC3-3F44-4F0F-BC93-50EB3995BD17} - System32\Tasks\Praosh Nodifier => C:\Program Files (x86)\Praosh\PraoshnodifierTask.exe [2016-06-18] () <==== UWAGA
Task: {E640AD2F-47B3-4687-A159-59C45152A620} - System32\Tasks\{6CDB358C-808D-4787-AD0F-294227472718} => pcalua.exe -a "E:\Gry\X3 Albion Prelude\X3AP.exe" -d "E:\Gry\X3 Albion Prelude"
ShortcutWithArgument: C:\Users\CE Design\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\CE Design\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\CE Design\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\CE Design\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\CE Design\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> %SNP%
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
2016-06-18 14:32 - 2016-06-18 14:32 - 00170496 _____ () C:\Users\CE Design\AppData\Roaming\Siossa\Siossa.exe
2016-06-18 14:32 - 2016-06-18 14:32 - 00668672 _____ () C:\Users\CE Design\AppData\Roaming\Siossa\Jygogiula.dlll
2016-06-18 14:32 - 2016-06-18 14:32 - 00112128 _____ () C:\Users\CE Design\AppData\Roaming\Siossa\Inaaui.exe
2016-06-18 14:32 - 2016-06-18 14:32 - 00143872 _____ () C:\Users\CE Design\AppData\Roaming\Siossa\Jygogiula.exe
2016-06-18 14:32 - 2016-06-18 14:32 - 00258560 _____ () C:\Users\CE Design\AppData\Roaming\Siossa\Inaaui.dll
Hosts:
() C:\Users\CE Design\AppData\Roaming\Siossa\Siossa.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe
() C:\Users\CE Design\AppData\Roaming\Siossa\Inaaui.exe
() C:\Users\CE Design\AppData\Roaming\Siossa\Jygogiula.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCTray.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCTray64.exe
HKLM\...\Run: [gplyra] => C:\Users\CE Design\AppData\Roaming\gplyra\gplyra\start.cmd
HKLM-x32\...\Run: [NPSStartup] => [X]
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\Run: [EEDSpeedLauncher] => rundll32.exe C:\Windows\system32\eed_ec.dll,SpeedLauncher
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\Policies\Explorer: []
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {0f3b2fe3-cb15-11e5-8446-5c93a2f8f932} - "F:\AutoRun.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {40c78f9f-e110-11e5-846c-5c93a2f8f932} - "G:\AutoRun.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {40c79008-e110-11e5-846c-5c93a2f8f932} - "G:\AutoRun.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {8673a3f7-1ca5-11e5-831e-5c93a2f8f932} - "G:\Setup.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {8673a43d-1ca5-11e5-831e-5c93a2f8f932} - "G:\Setup.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\...\MountPoints2: {8673a440-1ca5-11e5-831e-5c93a2f8f932} - "G:\Setup.exe"
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02S81flKgKm6hoWlp_ueJqC3I4KKhcJ_8IR0Ov7WfmpAEmMR0h85-WLIIXjd_kWmEuJZo_AOu5TPzW1rCibDtVdFKsSZ08LwdN8AOI06trDrlQCIvTufyW1kbtMQ_pEPQ9WbYFfgfjByiXPNFFh&q={searchTerms}
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://webalta.ru/search
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02S81flKgKm6hoWlp_ueJqC3I4KKhcJ_8IR0Ov7WfmpAEmMR0h85-WLIIXjd_kWmEuJZo_AOu5TPzW1rCibDtVdFKsSZ08LwdN8AOI06trDrlQCIvTufyW1kbtMQ_pEPQ9WbYFfgfjByiXPNFFh&q={searchTerms}
HKU\S-1-5-21-3363964104-859107209-3002857023-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02S81flKgKm6hoWlp_ueJqC3I4KKhcJ_8IR0Ov7WfmpAEmMR0h85-WLIIXjd_kWmEuJZo_AOu5TPzW1rCibDtVdFKsSZ08LwdN8AOI06trDrlQCIvTufyW1kbtMQ_pEPQ9WbYFfgfjByiXPNFFh&q={searchTerms}
URLSearchHook: [S-1-5-21-3363964104-859107209-3002857023-1001] UWAGA => Brak domyślnego URLSearchHook
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKU\S-1-5-21-3363964104-859107209-3002857023-1001 -> {61EB20A4-D4D5-4276-A2C9-DCCE8CE9F633} URL = hxxp://webalta.ru/search?q={searchTerms}&from=IE
SearchScopes: HKU\S-1-5-21-3363964104-859107209-3002857023-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO-x32: Brak nazwy -> {8984B388-A5BB-4DF7-B274-77B879E179DB} -> Brak pliku
FF NewTab: C:\ProgramData\Lamzap\ff.NT
FF DefaultSearchEngine: hohosearch
FF SelectedSearchEngine: hohosearch
FF Homepage: C:\ProgramData\Lamzap\ff.HP
FF SearchPlugin: C:\Users\CE Design\AppData\Roaming\Mozilla\Firefox\Profiles\0whn66ih.default\searchplugins\2jm84x37.xml [2016-06-18]
FF SearchPlugin: C:\Users\CE Design\AppData\Roaming\Profiles\gfigl4le.default\searchplugins\mc9yl3qr.xml [2016-06-18]
FF SearchPlugin: C:\Users\CE Design\AppData\Roaming\Profiles\ydrezume.default\searchplugins\2jm84x37.xml [2016-06-18]
FF SearchPlugin: C:\Users\CE Design\AppData\Roaming\Profiles\ydrezume.default\searchplugins\mc9yl3qr.xml [2016-06-18]
CHR HomePage: ChromeDefaultData2 -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02S81flKgKm6hoWlp_ueJqC3I4KKhcJ_8IR0Ov7WfmpAEmMR0h85-WLIIXjd_kWmEuJZpQNKVw2Cszc1ogzTwx0RaprHeGgDgkeqOQLkCsk0hdziwaDIRn1Z2EzOpISyhhSnRTYOK0j0SfwiKi0
CHR StartupUrls: ChromeDefaultData2 -> "hxxp://d2ucfwpxlh3zh3.cloudfront.net/?ts=AHEqBX8rAHEtBk..&v=20160615&uid=116D2DBE6BEA419DD15ACA2136CF29C6&ptid=ftp&mode=loadm"
CHR DefaultSearchURL: ChromeDefaultData2 -> hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYSttY34mamef947lyuLH2byhed3g02S81flKgKm6hoWlp_ueJqC3I4KKhcJ_8IR0Ov7WfmpAEmMR0h85-WLIIXjd_kWmEuJZpg2kEWoEdZatWAFwQE6RWUOEaiix-M5wWJTQPsPwIq-eQyPicgioVeLc6UZEQwqDP65PFPufLs7FFC-&q={searchTerms}
CHR DefaultSearchKeyword: ChromeDefaultData2 -> feed.sonic-search.com
CHR DefaultSuggestURL: ChromeDefaultData2 -> hxxps://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command={searchTerms}
CHR HKLM-x32\...\Chrome\Extension: [ajkpgdiejopejkllbihfkpcbmgclpkij] - C:\Users\CE Design\AppData\Roaming\Neiron\chrome.crx [2012-07-15]
R2 Amimi; C:\Users\CE Design\AppData\Roaming\Siossa\Siossa.exe [170496 2016-06-18] () [Brak podpisu cyfrowego]
R2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-06-18] (DotC United Inc)
S2 Ihunfoa; "C:\Users\CE Design\AppData\Roaming\XaunjUamyaq\Jonbab.exe" -cms [X]
S2 PraoshnodifierService; "C:\Program Files (x86)\Praosh\PraoshnodifierService.html5" {79740E79-A383-47A7-B513-3DF6563D007F} {8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83} [X]
R2 ReujosestogleCmmS; "C:\Program Files (x86)\Reujosestogle\ReujosestogleCmmS.xhtm5" {79740E79-A383-47A7-B513-3DF6563D007F} {8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83} [X]
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-06-18] (DotC United Inc)
S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]
S3 ew_usbenumfilter; \SystemRoot\System32\drivers\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
S3 hwdatacard; \SystemRoot\system32\DRIVERS\ewusbmdm.sys [X]
S3 pccsmcfd; \SystemRoot\system32\DRIVERS\pccsmcfdx64.sys [X]
2016-06-18 22:33 - 2016-06-18 22:33 - 00001741 _____ C:\Users\Public\Desktop\MPC Cleaner.lnk
2016-06-18 22:33 - 2016-06-18 22:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
2016-06-18 22:11 - 2016-06-18 22:31 - 00000000 ____D C:\AdwCleaner
2016-06-18 19:57 - 2016-06-18 19:57 - 00003588 _____ C:\Windows\System32\Tasks\{B2EB44AC-7DAC-48D3-8EE9-934C52C6A1F3}
2016-06-18 19:53 - 2016-06-18 19:53 - 00000000 ____D C:\Windows\system32\ira
2016-06-18 19:41 - 2016-06-18 19:41 - 06867968 _____ C:\Users\CE Design\AppData\Roaming\agent.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 01760384 _____ C:\Users\CE Design\AppData\Roaming\Alpha-Tom.tst
2016-06-18 19:41 - 2016-06-18 19:41 - 01106432 _____ C:\Users\CE Design\AppData\Roaming\Alpha-Tom.exe
2016-06-18 19:41 - 2016-06-18 19:41 - 00126464 _____ C:\Users\CE Design\AppData\Roaming\noah.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 00069072 _____ C:\Users\CE Design\AppData\Roaming\Config.xml
2016-06-18 19:41 - 2016-06-18 19:41 - 00018432 _____ C:\Users\CE Design\AppData\Roaming\Main.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 00005568 _____ C:\Users\CE Design\AppData\Roaming\md.xml
2016-06-18 19:39 - 2016-06-18 19:53 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-06-18 19:39 - 2016-06-18 19:39 - 00060136 ____N (DotC United Inc) C:\Windows\system32\Drivers\MPCKpt.sys
2016-06-18 19:39 - 2016-06-18 19:39 - 00000000 ____D C:\Users\CE Design\AppData\Roaming\Siossa
2016-06-18 19:39 - 2016-06-18 19:39 - 00000000 ____D C:\Users\CE Design\AppData\Local\Tempfolder
2016-06-18 19:38 - 2016-06-18 21:53 - 00000000 ____D C:\Program Files (x86)\Anonetionjse
2016-06-18 19:38 - 2016-06-18 19:43 - 00000000 ____D C:\Program Files (x86)\Reeoentrveent
2016-06-18 19:38 - 2016-06-18 19:39 - 00000000 ____D C:\Program Files (x86)\Reofesy
2016-06-18 19:38 - 2016-06-18 19:39 - 00000000 ____D C:\Program Files (x86)\Praosh
2016-06-18 19:38 - 2016-06-18 19:38 - 01106432 _____ C:\Users\CE Design\AppData\Roaming\Tiptam.exe
2016-06-18 19:38 - 2016-06-18 19:38 - 00848437 _____ C:\Users\CE Design\AppData\Roaming\GrooveIt.bin
2016-06-18 19:38 - 2016-06-18 19:38 - 00128512 _____ C:\Users\CE Design\AppData\Roaming\Installer.dat
2016-06-18 19:38 - 2016-06-18 19:38 - 00018288 _____ C:\Users\CE Design\AppData\Roaming\InstallationConfiguration.xml
2016-06-18 19:38 - 2016-06-18 19:38 - 00008974 _____ C:\Windows\System32\Tasks\Reujosestogle Community
2016-06-18 19:38 - 2016-06-18 19:38 - 00000000 ____D C:\Program Files (x86)\Reujosestogle
2016-06-18 19:38 - 2016-06-18 19:38 - 00000000 ____D C:\Program Files (x86)\Pheqeght
2016-06-18 19:41 - 2016-06-18 19:41 - 6867968 _____ () C:\Users\CE Design\AppData\Roaming\agent.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 1106432 _____ () C:\Users\CE Design\AppData\Roaming\Alpha-Tom.exe
2016-06-18 19:41 - 2016-06-18 19:41 - 1760384 _____ () C:\Users\CE Design\AppData\Roaming\Alpha-Tom.tst
2016-06-18 19:41 - 2016-06-18 19:41 - 0069072 _____ () C:\Users\CE Design\AppData\Roaming\Config.xml
2016-06-18 19:38 - 2016-06-18 19:38 - 0848437 _____ () C:\Users\CE Design\AppData\Roaming\GrooveIt.bin
2016-06-18 19:38 - 2016-06-18 19:38 - 0018288 _____ () C:\Users\CE Design\AppData\Roaming\InstallationConfiguration.xml
2016-06-18 19:38 - 2016-06-18 19:38 - 0128512 _____ () C:\Users\CE Design\AppData\Roaming\Installer.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 0018432 _____ () C:\Users\CE Design\AppData\Roaming\Main.dat
2016-06-18 19:41 - 2016-06-18 19:41 - 0005568 _____ () C:\Users\CE Design\AppData\Roaming\md.xml
2016-06-18 19:41 - 2016-06-18 19:41 - 0126464 _____ () C:\Users\CE Design\AppData\Roaming\noah.dat
2016-06-18 19:38 - 2016-06-18 19:38 - 1106432 _____ () C:\Users\CE Design\AppData\Roaming\Tiptam.exe
2016-04-09 09:53 - 2016-04-09 09:53 - 0000000 ____H () C:\Users\CE Design\AppData\Local\BIT8EB3.tmp
EmptyTemp:
Po wykonaniu zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ oraz zamiesc nowe logi z FRST, ze skanowania.
