Otwórz notatnik systemowy i wklej:
CloseProcesses:
Task: {8A017D6C-4F91-4F06-898D-AFD871C7DB2E} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
Task: {FC60DBEB-4591-4E9F-AF8C-0F0BA476A957} - System32\Tasks\Opera scheduled Autoupdate 1495301215 => C:\Program Files\Opera\launcher.exe (Opera Software AS -> Opera Software)
Task: {FBB0AE6D-51E4-4C2C-8781-F52F3676A4EB} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe (AVG Technologies USA, Inc. -> AVG Technologies CZ, s.r.o.)
ShortcutWithArgument: C:\Users\izabe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks\WorldofTanks.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://go.playmmogames.com/aff_c?offer_id=174&aff_id=1034
ShortcutWithArgument: C:\Users\izabe\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder\WarThunder.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://go.playmmogames.com/aff_c?offer_id=698&aff_id=1034&source=2&click_id=0d0c8224873a4c023ab382f272c765c622ecadc7
ShortcutWithArgument: C:\Users\izabe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WarThunder.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://go.playmmogames.com/aff_c?offer_id=698&aff_id=1034&source=2&click_id=0d0c8224873a4c023ab382f272c765c622ecadc7
ShortcutWithArgument: C:\Users\izabe\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\WorldofTanks.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://go.playmmogames.com/aff_c?offer_id=174&aff_id=1034
AlternateDataStreams: C:\Users\Public\AppData:CSM [486]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [484]
HKLM-x32\...\Run: [AVGUI.exe] => "C:\Program Files\AVG\Antivirus\AvLaunch.exe" /gui
HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-2117601921-515735716-3738733453-1001\...\MountPoints2: {7fb8f79f-7925-11e6-990f-806e6f6e6963} - "E:\autorun.exe"
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter"
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
AutoConfigURL: [S-1-5-21-2117601921-515735716-3738733453-1001] => hxxp://biggertodayyes.com/settings/index.js?id=44B55B20A67A1134
ManualProxies: 0hxxp://biggertodayyes.com/settings/index.js?id=44B55B20A67A1134
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?bcutc=sp-118-756&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-118-756&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2117601921-515735716-3738733453-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2117601921-515735716-3738733453-1001 -> {97ED1C83-B720-415B-8A20-AAE84F23A83F} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2117601921-515735716-3738733453-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?bcutc=sp-118-756&q={searchTerms}
FF Extension: (Bing Search) - C:\Users\izabe\AppData\Roaming\Mozilla\Firefox\Profiles\b4sg1ppy.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-11-28] [Przestarzałe]
CHR HomePage: Default -> hxxp://www.nav-pl.com/
CHR StartupUrls: Default -> "hxxp://www.nav-pl.com/"
CHR DefaultSearchURL: Default -> hxxp://www.nav-pl.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> szukaj
CHR HKLM-x32\...\Chrome\Extension: [mbckjcfnjmoiinpgddefodcighgikkgn] - hxxps://clients2.google.com/service/update2/crx
2019-03-03 19:59 - 2019-03-03 19:59 - 000000000 ____D C:\AdwCleaner
2019-03-04 14:32 - 2019-03-04 14:32 - 001388432 _____ () C:\Users\Public\VOIP.dat
2016-11-28 16:28 - 2018-09-13 14:32 - 000000184 ____C () C:\Users\izabe\AppData\Roaming\sp_data.sys
2018-07-10 00:02 - 2019-02-24 12:54 - 000000212 ____C () C:\Users\izabe\AppData\Roaming\WB.CFG
2019-03-03 10:14 - 2019-03-03 10:14 - 000140800 ____C () C:\Users\izabe\AppData\Local\installer.dat
2019-03-03 10:14 - 2019-03-03 20:08 - 000722944 ____C () C:\Users\izabe\AppData\Local\sha.db
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść w folderze, gdzie masz FRST.exe.
Uruchom FRST i kliknij w Fix/Napraw.
