Odinstaluj:
McAfee LiveSafe
WebAdvisor firmy McAfee
Wykonaj Fixlist.txt:
CloseProcesses:
C:\Users\celin\AppData\Roaming\InfoInstall\
C:\Users\celin\AppData\Roaming\Snetchball\
(explorer.exe ->) () [Brak podpisu cyfrowego] C:\Users\celin\AppData\Roaming\InfoInstall\InfoInstall.exe
HKU\S-1-5-21-490397018-1989883600-1930552721-1001\...\Run: [InfoInstall] => C:\Users\celin\AppData\Roaming\InfoInstall\InfoInstall.exe [324608 2022-01-18] () [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-490397018-1989883600-1930552721-1001\...\Run: [Snetchball] => C:\Users\celin\AppData\Roaming\Snetchball\Snetchball.exe [183808 2021-07-12] () [Brak podpisu cyfrowego] <==== UWAGA
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
Task: {19D2D279-1FC4-4639-8FBD-8278C9B010C3} - System32\Tasks\Opera scheduled Autoupdate 1642939672 => C:\Users\celin\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Brak pliku)
Task: {71A2D6FF-2374-40F5-A02D-6AD45A4C61E7} - System32\Tasks\NcEAcjyIhxymCQHZQ2 => rundll32 "C:\Program Files (x86)\afUxMmbyerORshbkmXR\MUGkLIB.dll",#1
Task: {AEC17003-CB55-4FFB-9CCE-5D3BE0C180C4} - System32\Tasks\GYZVzvvLwMfkAQ => rundll32 "C:\Program Files (x86)\NiamukyBLHCU2\SrCQTZXmFHmnv.dll",#1
Task: {B82AE205-4B4C-4C51-9C65-2848ACECB2FE} - System32\Tasks\kYYExRHlKiAvgQn2 => rundll32 "C:\Program Files (x86)\abSxNhfAU\rQZmHn.dll",#1
Task: {B937CB42-6992-408D-A34D-F49502C69081} - System32\Tasks\EfqQZpbYoXzSFwJgpKO2 => rundll32 "C:\Program Files (x86)\XTiZKNtlHQwBC\POVsNue.dll",#1
Task: {BBF88012-D421-47D4-8FAA-A151FAAF2BDA} - System32\Tasks\sRujuHLpHiEvN2 => C:\Windows\system32\wscript.exe "C:\ProgramData\QqvCaKLGpyCUkBVB\tdMcDZF.wsf"
C:\Users\celin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odbmjgikedenicicookngdckhkjbebpd
Edge Extension: (T-Сashback — кэшбэк-сервис) - C:\Users\celin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\odbmjgikedenicicookngdckhkjbebpd [2022-02-01]
Edge HKLM-x32\...\Edge\Extension: [odbmjgikedenicicookngdckhkjbebpd]
CHR Notifications: Default -> hxxps://best-loan-info.com; hxxps://ccleaner-download.xyz; hxxps://mail-notification.info; hxxps://mnthor.xyz; hxxps://pinghauz.xyz; hxxps://s-tracking.xyz; hxxps://supertopfreegames.com; hxxps://www.o2.pl; hxxps://zarabotok-online.xyz
CHR HomePage: Default -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: Default -> "hxxps://find-it.pro/?utm_source=distr_m","hxxp://www.google.pl/"
C:\Users\celin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe
CHR Extension: (Adblocker for Youtube™) - C:\Users\celin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe [2022-08-26] [UpdateUrl:hxxps://clients67.google.com/service/update2/crx] <==== UWAGA
C:\Users\celin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig
CHR Extension: (Find-it.Pro Search) - C:\Users\celin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig [2022-09-01]
CHR HomePage: System Profile -> hxxps://find-it.pro/?utm_source=distr_m
CHR StartupUrls: System Profile -> "hxxps://find-it.pro/?utm_source=distr_m"
CHR DefaultSearchKeyword: System Profile -> cdn
CHR DefaultSuggestURL: System Profile -> hxxps://www.google.ru/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&q={searchTerms}
CHR Extension: (Adblocker for Youtube™) - C:\Users\celin\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe [2022-08-26] [UpdateUrl:hxxps://clients88.google.com/service/update2/crx] <==== UWAGA
C:\Users\celin\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\iddmabhekhhonkmomaklnflhhgbfnioe
CHR Extension: (Find-it.Pro Search) - C:\Users\celin\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig [2022-01-23]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
C:\Users\celin\AppData\Local\Google\Chrome\User Data\System Profile\Extensions\meejmcfbiapijdfaadackoblffmidlig
OPR DefaultSearchKeyword: Opera Stable -> find-it.pro
OPR DefaultSuggestURL: Opera Stable -> hxxps://suggest.yandex.ru/suggest-ya.cgi?v=4&part={searchTerms}&l10n={language}
C:\Users\celin\AppData\Roaming\Opera Software\Opera Stable\Extensions\idimnjcjkopkcbalclocjcbcmkkcfpec
OPR Extension: (Adblocker for Youtube™) - C:\Users\celin\AppData\Roaming\Opera Software\Opera Stable\Extensions\idimnjcjkopkcbalclocjcbcmkkcfpec [2022-08-26]
OPR Extension: (Find-it.Pro Search) - C:\Users\celin\AppData\Roaming\Opera Software\Opera Stable\Extensions\meejmcfbiapijdfaadackoblffmidlig [2022-01-23]
C:\Users\celin\AppData\Roaming\Opera Software\Opera Stable\Extensions\meejmcfbiapijdfaadackoblffmidlig
C:\ProgramData\DiskOptimizer\
S2 DiskOptimizer; C:\ProgramData\DiskOptimizer\DiskOptimizer.exe [4022272 2022-01-23] () [Brak podpisu cyfrowego] <==== UWAGA
S2 gupdate; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [4022272 2022-01-23] () [Brak podpisu cyfrowego]
S3 gupdatem; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [4022272 2022-01-23] () [Brak podpisu cyfrowego]
2022-09-03 10:34 - 2022-09-03 10:34 - 000000000 ____D C:\Users\celin\Downloads\FRST-OlderVersion
2022-08-26 21:30 - 2022-08-26 21:30 - 000003356 _____ C:\Windows\system32\Tasks\GYZVzvvLwMfkAQ
2022-08-26 21:30 - 2022-08-26 21:30 - 000003044 _____ C:\Windows\system32\Tasks\sRujuHLpHiEvN2
2022-08-26 21:30 - 2022-08-26 21:30 - 000003034 _____ C:\Windows\system32\Tasks\NcEAcjyIhxymCQHZQ2
2022-08-26 21:30 - 2022-08-26 21:30 - 000003026 _____ C:\Windows\system32\Tasks\EfqQZpbYoXzSFwJgpKO2
2022-08-26 21:30 - 2022-08-26 21:30 - 000003008 _____ C:\Windows\system32\Tasks\kYYExRHlKiAvgQn2
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\ProgramData\QqvCaKLGpyCUkBVB
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\Program Files (x86)\XTiZKNtlHQwBC
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\Program Files (x86)\SUCsmtYqQdUn
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\Program Files (x86)\NiamukyBLHCU2
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\Program Files (x86)\afUxMmbyerORshbkmXR
2022-08-26 21:30 - 2022-08-26 21:30 - 000000000 ____D C:\Program Files (x86)\abSxNhfAU
2022-09-03 10:34 - 2022-01-23 14:41 - 000000004 _____ C:\ProgramData\rc.dat
2022-09-03 10:34 - 2022-01-23 14:40 - 000000004 _____ C:\ProgramData\lock.dat
2022-09-03 10:34 - 2022-01-23 14:12 - 000000000 ____D C:\Users\celin\AppData\Roaming\Snetchball
2022-01-23 14:40 - 2022-01-23 14:40 - 000000008 _____ () C:\ProgramData\ts.dat
Zrob tez skan przy pomocy mbam oraz adwcleaner i usun to co wykryja.
