Odinstaluj: McAfee WebAdvisor
Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
CloseProcesses:
(McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\servicehost.exe
(McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe
(McAfee, LLC -> McAfee, LLC) C:\Program Files\McAfee\WebAdvisor\uihost.exe
HKU\S-1-5-21-719670740-1427168331-2734735784-1000\...\Run: [AvastBrowserAutoLaunch_DD3B34B51295CA4CE249213732CEC2F8] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2023832 2020-03-09] (Avast Software s.r.o. -> AVAST Software)
HKU\S-1-5-21-719670740-1427168331-2734735784-1000\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --profile-directory=Default --flag-switches-begin --flag-switches-end --enable-audio-service-sandbox --restore-last-session --flag-switches (dane wartości zawierają 130 znaków więcej).
HKU\S-1-5-21-719670740-1427168331-2734735784-1000\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-719670740-1427168331-2734735784-1000\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
HKU\S-1-5-21-719670740-1427168331-2734735784-1001\...\Run: [AvastBrowserAutoLaunch_C6052D550A9F204BA4A4500E652659C4] => C:\Program Files (x86)\AVAST Software\Browser\Application\AvastBrowser.exe [2023832 2020-03-09] (Avast Software s.r.o. -> AVAST Software)
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {9A81652F-7355-4E1D-91C9-7125E706029B} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\User\Downloads\esetonlinescanner_enu.exe
Task: {B9CFB277-2DE2-4C7C-8AB8-387ACDDB9EDF} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\User\Downloads\esetonlinescanner_enu.exe
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2020-03-19] (McAfee, LLC -> McAfee, LLC)
BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2020-03-19] (McAfee, LLC -> McAfee, LLC)
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2020-03-19] [UpdateUrl:hxxps://www.siteadvisor.com/waffinstall/update.json]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
CHR Extension: (McAfee® WebAdvisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2020-03-19]
C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fheoggkfdfchfphceeifdbepaooicaho
CHR Extension: (McAfee® WebAdvisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2020-03-20]
C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [907224 2020-03-19] (McAfee, LLC -> McAfee, LLC)
2020-03-21 21:05 - 2020-03-21 22:24 - 000002972 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onLogOn
2020-03-21 21:05 - 2020-03-21 22:24 - 000002592 _____ C:\WINDOWS\system32\Tasks\EOSv3 Scheduler onTime
2020-03-21 07:04 - 2020-03-21 07:05 - 000000000 ____D C:\ProgramData\WinThruster
2020-03-19 19:59 - 2020-03-19 19:59 - 000000000 ____D C:\ProgramData\ByteFence
2020-03-19 19:48 - 2020-03-19 19:48 - 000000000 ____D C:\Program Files\McAfee
2020-03-19 19:47 - 2020-03-19 19:47 - 016238024 _____ (Azureus Software, Inc.) C:\Users\User\Downloads\Vuze_Installer32.exe
2020-03-19 19:47 - 2020-03-19 19:47 - 000000000 ____D C:\ProgramData\McAfee
Zapisz i w FRST wybierz Napraw.
