Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
Task: {1F0D9331-D184-4C63-8D15-6AADB1FFE9CF} - System32\Tasks\Driver Booster SkipUAC (grzegorz) => C:\Program Files (x86)\IObit\Driver Booster\4.2.0\DriverBooster.exe
Task: {36A749B0-E3AF-4A95-931E-590077A555ED} - System32\Tasks\httpyoumainpageorgeaglem => Chrome.exe hxxp://youmainpage.org/eaglem
Task: {96EA2353-A86C-4E81-9922-A33689C5E937} - System32\Tasks\Server => C:\Users\grzegorz\AppData\Local\Temp/Server.exe
ShortcutWithArgument: C:\Users\grzegorz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mail.Ru.lnk -> C:\Windows\System32\rundll32.exe (Microsoft Corporation) -> url,FileProtocolHandler "hxxp://www.mail.ru/cnt/20775012?gp=811035"
2017-02-08 14:15 - 2017-02-08 14:15 - 00257024 _____ () C:\Users\grzegorz\AppData\Local\Temp\Intel(R).exe
() C:\Users\grzegorz\AppData\Local\Temp\Intel(R).exe
HKLM-x32\...\Run: [405b348eb01339f991c5aef407da353d] => C:\Users\grzegorz\AppData\Local\Temp\Intel(R).exe [257024 2017-02-08] () <===== UWAGA
HKU\S-1-5-21-826897610-2576798995-2489756959-1001\...\Run: [405b348eb01339f991c5aef407da353d] => C:\Users\grzegorz\AppData\Local\Temp\Intel(R).exe [257024 2017-02-08] () <===== UWAGA
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-02-04] (Microsoft Corporation)
Startup: C:\Users\grzegorz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\405b348eb01339f991c5aef407da353d.exe [2017-02-08] ()
GroupPolicy: Ograniczenia <======= UWAGA
GroupPolicy\User: Ograniczenia <======= UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-826897610-2576798995-2489756959-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
HKU\S-1-5-21-826897610-2576798995-2489756959-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811040
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-826897610-2576798995-2489756959-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B15D4CA08-5A1C-4CB0-AFDC-BBDF83D552C5%7D&gp=811041
SearchScopes: HKU\S-1-5-21-826897610-2576798995-2489756959-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B15D4CA08-5A1C-4CB0-AFDC-BBDF83D552C5%7D&gp=811041
CHR HomePage: Default -> mail.ru/cnt/11956636?rciguc__PARAM__
CHR StartupUrls: Default -> "hxxp://mail.ru/cnt/10445?gp=811036"
CHR HKLM-x32\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx
2017-02-09 11:45 - 2017-02-09 11:45 - 00000000 ____D C:\Users\grzegorz\Downloads\FRST-OlderVersion
2017-02-08 15:55 - 2017-02-08 15:56 - 01285720 _____ (Gokuba ) C:\Users\grzegorz\Downloads\DirectX 11 SDK.exe
2017-02-08 13:36 - 2017-02-08 13:36 - 00003642 _____ C:\Windows\System32\Tasks\httpyoumainpageorgeaglem
2017-01-31 10:14 - 2017-01-31 10:14 - 00003492 _____ C:\Windows\System32\Tasks\Server
2017-02-06 20:54 - 2015-08-15 07:00 - 00000000 ____D C:\AdwCleaner
2017-02-06 19:15 - 2017-02-02 21:51 - 0000046 _____ () C:\Users\grzegorz\AppData\Roaming\11.bat
2017-02-06 19:15 - 2017-01-06 13:00 - 4315648 _____ () C:\Users\grzegorz\AppData\Roaming\injector1.exe
2017-02-06 19:15 - 2017-02-02 21:51 - 4482836 _____ () C:\Users\grzegorz\AppData\Roaming\injector1.sfx.exe
2017-02-08 13:39 - 2017-02-08 13:41 - 00000000 ____D C:\Program Files (x86)\Mail.Ru
2017-02-08 13:37 - 2017-02-08 13:41 - 00000000 ____D C:\Users\grzegorz\AppData\Local\Mail.Ru
2017-02-08 13:37 - 2017-02-08 13:41 - 00000000 ____D C:\Users\grzegorz\AppData\Local\Amigo
2017-02-08 13:37 - 2017-02-08 13:37 - 00000000 ____D C:\ProgramData\Mail.Ru
EmptyTemp:
Po wykonaniu zamiesc nowe logi z FRST, ze skanowania.
