Zmien Adobe Reader 9.1 - Polish na najnowsza wersje AR lub na Foxit:
http://ninite.com/foxit/ Odinstaluj:
Popcorn Time
Reimage Repair <- uwazaj co instalujesz, to szkodliwy program.
xp-AntiSpy <- jest raczej dla XP, a nie dla nowszych systemow.
Webroot SecureAnywhere
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
ContextMenuHandlers1: [Advanced SystemCare] -> {2803063F-4B8D-4dc6-8874-D1802487FE2D} => C:\Program Files (x86)\IObit\Advanced SystemCare\ASCExtMenu_64.dll -> Brak pliku
Task: {0C378703-64ED-494E-A449-01E59203A19E} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2017-09-11] (Reimage®) <==== UWAGA
HKU\.DEFAULT\Software\Classes\exefile: "%1" %* <==== UWAGA
HKU\.DEFAULT\Software\Classes\.exe: exefile => "%1" %* <==== UWAGA
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\Software\Classes\exefile: "%1" %* <==== UWAGA
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\Software\Classes\.exe: exefile => "%1" %* <==== UWAGA
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {17ba0db9-bfcb-11e7-8608-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {26e32f6b-c123-11e6-8578-a7aee15c3a73} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {329a9670-89fd-11e7-8065-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {45179752-8e27-11e7-8c87-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {485feb4a-67fa-11e7-8563-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {5526aa46-789f-11e7-87cc-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {6f68ed5b-9c85-11e7-87c8-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {84394b1e-67d5-11e7-8d53-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {84394b26-67d5-11e7-8d53-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {a703776d-e326-11e6-819b-d925dc7b9516} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {a7037776-e326-11e6-819b-d925dc7b9516} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {aec856de-0bc8-11e7-87fd-6cf0490cd7b3} - K:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {b1791ae7-d99d-11e6-b6cb-e873b718e2fe} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {b3b2a2fe-edd8-11e4-aaf5-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {b3b2a33c-edd8-11e4-aaf5-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {c5f31629-c659-11e6-801c-811416646c75} - K:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {dac9460f-7077-11e7-8d51-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {e889b5ef-890e-11e7-9ef5-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\MountPoints2: {e889b648-890e-11e7-9ef5-6cf0490cd7b3} - E:\AutoRun.exe
HKU\S-1-5-18\...\Run: [Norton Download Manager{NIS2281014-SHPD-FSD57026}] => C:\Users\Public\Downloads\Norton\{NIS2281014-SHPD-FSD57026}\NISFSD.exe [1107280 2016-11-25] (Symantec Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2013-04-04] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk [2017-11-19]
ShortcutTarget: Install LastPass FF RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Brak pliku)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk [2017-11-19]
ShortcutTarget: Install LastPass IE RunOnce.lnk -> C:\Program Files (x86)\Common Files\wruninstall.exe (Brak pliku)
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.pcf.pl
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> Brak pliku
Toolbar: HKU\S-1-5-21-3925417875-1663420367-2437402739-1000 -> Brak nazwy - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Brak pliku
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\91vx7ugv.default\user.js [2016-11-01]
FF HKU\S-1-5-21-3925417875-1663420367-2437402739-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi => nie znaleziono
CHR HKLM\...\Chrome\Extension: [ngkhgikojglcgnckopipfdajaifmmnnc] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ikaooahnheaoeceaipjcmnamnoleeblk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [kjeghcllfecehndceplomkocgfbklffd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ngkhgikojglcgnckopipfdajaifmmnnc] - hxxp://clients2.google.com/service/update2/crx
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [8602992 2017-09-11] (Reimage®)
S4 sgbupt; C:\Program Files (x86)\SuperBoost\SuperBoost Software Updater\SuperBoostUpdater.exe [X]
S3 cpuz138; \??\C:\Users\User\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X] <==== UWAGA
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]
2017-11-19 13:17 - 2017-11-19 13:17 - 000000000 ____D C:\Users\User\Desktop\FRST-OlderVersion
2017-11-19 13:16 - 2017-11-19 13:16 - 000781312 _____ C:\Users\User\Desktop\delfix_1.010.exe
2017-11-19 12:22 - 2017-11-19 12:22 - 000000000 _____ C:\Users\User\Desktop\antimalwaresetup.exe
2017-11-19 12:20 - 2017-11-19 12:20 - 006625600 _____ (Zemana Ltd. ) C:\Users\User\Desktop\Zemana.AntiMalware.Setup.exe
2017-11-19 12:03 - 2017-11-19 12:03 - 001061680 _____ (Webroot) C:\Users\User\Desktop\wsainstall.exe
2017-11-19 12:00 - 2017-11-19 12:01 - 000000000 ____D C:\rei
2017-11-19 12:00 - 2017-11-19 12:01 - 000000000 ____D C:\ProgramData\Reimage Protector
2017-11-19 12:00 - 2017-11-19 12:00 - 000004282 _____ C:\Windows\System32\Tasks\ReimageUpdater
2017-11-19 12:00 - 2017-11-19 12:00 - 000001939 _____ C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2017-11-19 12:00 - 2017-11-19 12:00 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2017-11-19 12:00 - 2017-11-19 12:00 - 000000000 ____D C:\Program Files\Reimage
2017-11-19 11:59 - 2017-11-19 12:01 - 000000150 _____ C:\Windows\Reimage.ini
2017-11-19 11:59 - 2017-11-19 11:59 - 000605424 _____ (Reimage) C:\Users\User\Desktop\ReimageRepair.exe
2017-11-19 11:27 - 2017-11-19 11:34 - 000000000 ____D C:\AdwCleaner
2017-11-19 11:24 - 2017-11-19 11:25 - 000000534 _____ C:\DelFix.txt
2017-11-19 11:23 - 2017-11-19 11:38 - 000002154 _____ C:\Users\User\Desktop\Rkill.txt
2017-11-19 11:23 - 2017-11-19 11:23 - 001792640 ____N (Bleeping Computer, LLC) C:\Users\User\Desktop\rkill_2.9.1.0.exe
2017-11-19 11:23 - 2017-11-19 11:23 - 000983168 ____N (Bleeping Computer, LLC) C:\Users\User\Desktop\rkill_2.9.1.064.exe
2017-11-04 02:41 - 2017-11-04 02:41 - 000000000 ____D C:\Spacekace
2017-11-04 01:36 - 2010-01-06 09:47 - 000000000 ____D C:\ProgramData\Norton
2017-11-04 01:33 - 2015-04-28 21:52 - 000000000 ____D C:\ProgramData\ProductData
2017-11-04 01:27 - 2010-01-06 09:46 - 000000000 ____D C:\Program Files (x86)\NortonInstaller
C:\Users\User\AppData\Local\Temp*.html
Po wykonaniu usun katalog C:\FRST i to wszystko.
