MatiQ112

Logi z FRST są nieaktualne, bo po ich zrobieniu użyłeś Adw-Cleaner - a kolejność miała być odwrotna.

 

Otwórz Notatnik i wklej w nim:

HKU\S-1-5-21-2127561691-812862515-3127793605-1000\...\ChromeHTML: -> "C:\Program Files (x86)\Fishhas\Application\chrome.exe" "%1" <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\Fishhas
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Ujjdmedia
DeleteKey: HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Udgtmedia
RemoveDirectory: C:\Users\Komp1\AppData\Local\Undbmedia
RemoveDirectory: C:\Users\Komp1\AppData\Local\Ujjdmedia
2017-01-22 16:15 - 2017-01-22 16:15 - 00000040 _____ C:\Program Files (x86)\settings.dat
2017-01-22 16:15 - 2017-01-22 16:15 - 00000000 ____D C:\Program Files (x86)\reports
2017-01-22 16:15 - 2017-01-22 16:15 - 00000000 _____ C:\Program Files (x86)\metadata
2017-01-22 16:12 - 2016-11-24 14:53 - 00000000 _____ C:\Users\Public\Documents\temp.dat
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

----------------------
Jeśli będzie OK, to będziemy kończyć:
Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST. Uruchom FRST i kliknij w Fix (NAPRAW).
przez SHIFT+DEL usuń pozostały folder C:\FRST.

W Adw-Cleaner kliknij u góry po lewej na PLIK, potem na ODINSTALUJ.

.

1) Spróbuj odinstalować ten program:

amuleC (HKLM-x32\...\{19539992-061C-4E8B-9053-07B175303AF4}) (Version: 1.0.1 - amuleC) <==== UWAGA

 

2) CHR Profile: C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-01-07] <==== UWAGA

Uruchom Google Chrome
> Naciśnij klawisze: lewy Alt+F i kliknij przycisk Ustawienia >
> Sekcja: OSOBY
>zaznacz (wybierz): user0
kliknij znaczek X znajdujący się po prawej stronie

 

3) Działają u Ciebie przeglądarki, które wyglądają jak Google Chrome oraz Mozilla Firefox, ale w rzeczywistości to Trojany.

Daję je do usuwania, i także skróty, które przekierowują na nie.

Potem zrobisz sobie nowe skróty Mozili i Chrome'a.

 

Otwórz Notatnik i wklej w nim:

DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{19539992-061C-4E8B-9053-07B175303AF4}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{19539992-061C-4E8B-9053-07B175303AF4}
Task: {CA1007BE-8FB3-4A51-819B-3B74C2D14488} - System32\Tasks\WinTOOL => C:\ProgramData\wintools\WintoolUprI.exe [2017-01-18] ()
Task: {CEDBE78A-BC47-49BC-98B8-838604780613} - System32\Tasks\2c9d9e339999c7c157828a17266b5419 => Rundll32.exe "C:\Program Files (x86)\Java\owrkt0.dll",e62dc6c6547f46bda862da2d05af6862 <==== UWAGA
C:\Program Files (x86)\Common Files\Services\iThemes.dll
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\Windows\system32\drivers:x64 [360536]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1156450]
MSCONFIG\startupreg: app => C:\Program Files (x86)\wanttoxiamen\uc.exe
RemoveDirectory: c:\program files (x86)\gubed
RemoveDirectory: C:\Program Files (x86)\wanttoxiamen
RemoveDirectory: C:\Users\Komp1\AppData\Local\Undbmedia
RemoveDirectory: C:\Users\Komp1\AppData\Local\Ujjdmedia
RemoveDirectory: C:\Program Files (x86)\Fishhas
RemoveDirectory: C:\Program Files (x86)\Firefox
MSCONFIG\startupreg: svchost0 => C:\Program Files (x86)\wanttoxiamen\uc.exe
MSCONFIG\startupreg: Udgtmedia => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Komp1\AppData\Local\Undbmedia\symcrtServices.dll
MSCONFIG\startupreg: Ujjdmedia => regsvr32.exe C:\Users\Komp1\AppData\Local\Ujjdmedia\symcrtServices.dll
MSCONFIG\startupreg: Undbmedia => C:\Users\Komp1\AppData\Local\Undbmedia\4ee9eec868cba7357454a1538a2e0bd9.exe
FirewallRules: [{D3766CB3-95B5-4F90-9818-38658186162D}] => C:\Program Files (x86)\Fishhas\Application\chrome.exe
FirewallRules: [{78B26909-1D37-4E2A-B2F8-0FED11710180}] => C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
FirewallRules: [{F96F5528-F091-4FBB-907E-685A7675B1BC}] => C:\Program Files (x86)\Firefox\Firefox.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-2127561691-812862515-3127793605-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== UWAGA
HKU\S-1-5-18\...\Run: [] => 0
HKLM\...\Providers\1ufe4nuj: C:\1\local64spl.dll
HKLM\...\Providers\1ysm3bvu: P:\GIMP\\local64spl.dll
HKLM\...\Providers\38javz7u: P:\GIMP\\local64spl.dll
HKLM\...\Providers\6ma92wo7: C:\1\local64spl.dll
HKLM\...\Providers\8goldu3w: P:\NFSW\\local64spl.dll
HKLM\...\Providers\b5ykv2f2: P:\Program Files\UDPdp\UDPnp4\\local64spl.dll
HKLM\...\Providers\b69bu78m: C:\\local64spl.dll
HKLM\...\Providers\b6blfsst: C:\\local64spl.dll
HKLM\...\Providers\b6niomg7: P:\GIMP1\local64spl.dll
HKLM\...\Providers\bnaqpwpt: P:\Program Files\UDPdp\UDPnp4\\local64spl.dll
HKLM\...\Providers\ctn4sgwi: P:\NFSW\\local64spl.dll
HKLM\...\Providers\cxdsisto: P:\NFSW\\local64spl.dll
HKLM\...\Providers\doliyt2s: P:\Program Files\UDPdp\UDPnp41\local64spl.dll
HKLM\...\Providers\e12vvmqh: P:\aktu1\local64spl.dll
HKLM\...\Providers\etxqmgfo: P:\Gry - Steam\\local64spl.dll
HKLM\...\Providers\ge118pvl: P:\GIMP1\local64spl.dll
HKLM\...\Providers\hdqfi91o: P:\aktu1\local64spl.dll
HKLM\...\Providers\i5nubbpx: P:\Gry - Steam1\local64spl.dll
HKLM\...\Providers\j82tiyuo: P:\Program Files\UDPdp\UDPnp41\local64spl.dll
HKLM\...\Providers\jwunmjw4: P:\Program Files\UDPdp\UDPnp4\\local64spl.dll
HKLM\...\Providers\n0o4ciq4: P:\Program Files\UDPdp\UDPnp41\local64spl.dll
HKLM\...\Providers\p0kmtxo2: P:\NFSW1\local64spl.dll
HKLM\...\Providers\q1dh6x5l: P:\Gry - Steam\\local64spl.dll
HKLM\...\Providers\v3rlxe8x: P:\NFSW1\local64spl.dll
HKLM\...\Providers\wup9y1yd: P:\aktu\\local64spl.dll
HKLM\...\Providers\x2esm3pd: P:\Gry - Steam1\local64spl.dll
HKLM\...\Providers\y904s2xq: P:\aktu\\local64spl.dll
HKLM\...\Providers\yjz9ew9q: P:\NFSW1\local64spl.dll
IFEO\MRT.exe: [Debugger] C:\Windows\TEMP\wea1824.tmp\Gubed.exe -Yrrehs
ShellExecuteHooks: Brak nazwy - {D05DB088-9EBF-11E6-B6CD-64006A5CFC23} -  -> Brak pliku
C:\1\local64spl.dll
P:\GIMP\\local64spl.dll
P:\NFSW\\local64spl.dll
P:\Program Files\UDPdp\UDPnp4\\local64spl.dll
C:\\local64spl.dll
P:\GIMP1\local64spl.dll
P:\Gry - Steam\\local64spl.dll
P:\aktu1\local64spl.dll
P:\NFSW1\local64spl.dllP:\aktu\\local64spl.dll
ShellIconOverlayIdentifiers: [KzShlobj2] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F3} =>  -> Brak pliku
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
Tcpip\..\Interfaces\{5A840FED-9075-49A4-B566-32A8B1FA277E}: [NameServer] 188.120.241.135,8.8.8.8
Tcpip\..\Interfaces\{AD912212-D013-4EAA-81B6-56D7B9B0C894}: [NameServer] 188.120.241.135,8.8.8.8
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
HKU\S-1-5-21-2127561691-812862515-3127793605-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
HKU\S-1-5-21-2127561691-812862515-3127793605-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.amisites.com/?type=hp&ts=1484063254&z=44cdac3f47131e1d1594899g1z7bdzaeaq3c3o0w7q&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
SearchScopes: HKU\S-1-5-21-2127561691-812862515-3127793605-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2127561691-812862515-3127793605-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.amisites.com/search/?type=ds&ts=1480503129&z=5bc3047abfa72c1d0deddecgczbb4e2wde5c5g7gbb&from=archer1028&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX&q={searchTerms}
FF Homepage: Firefox\Firefox\Profiles\dbg7p6fn.default -> hxxp://www.searchinme.com/?type=hp&ts=1484840704758&z=&from=official&uid=TOSHIBAXDT01ACA050_Z5GY4KXASXXZ5GY4KXASX
FF Extension: (FF Adr) - C:\Users\Komp1\AppData\Roaming\Firefox\Firefox\Profiles\dbg7p6fn.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-01-18] [Brak podpisu cyfrowego]
FF Extension: (English (US) Language Pack) - C:\Users\Komp1\AppData\Roaming\Firefox\Firefox\Profiles\dbg7p6fn.default\Extensions\langpack-en-US@firefox.mozilla.org.xpi [2017-01-19] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Komp1\AppData\Roaming\Firefox\Firefox\Profiles\dbg7p6fn.default\searchplugins\searchinme.xml [2017-01-18]
CHR Profile: C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-01-07] <==== UWAGA
CHR Extension: (Prezentacje Google) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-11-11]
CHR Extension: (Dysk Google) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-01-24]
CHR Extension: (YouTube) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-01-24]
CHR Extension: (Adblock Plus) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-11-11]
CHR Extension: (Background Theme Changer (NO ADs)) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\cnoidmlhdpcdlmnkdecpdalonkmgcodd [2016-11-11]
CHR Extension: (Google Search) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-01-24]
CHR Extension: (Tampermonkey) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-11-11]
CHR Extension: (Slither.io) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\dmplapbomebhmdffmlhgbelgcnfajapj [2016-04-24]
CHR Extension: (Avast SafePrice) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-11-11]
CHR Extension: (Dokumenty Google offline) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Avast Online Security) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-11-11]
CHR Extension: (jquery-injector) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\indebdooekgjhkncmgbkeop[beeep]ofdoid [2016-04-03]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Enhanced Steam) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\okadibdjfemgnhjiembecghcbfknbfhg [2016-11-11]
CHR Extension: (Gmail) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-01-24]
CHR Extension: (Chrome Media Router) - C:\Users\Komp1\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-11-11]
R2 GubedZL; C:\Program Files (x86)\Gubed\GubedZL.dll [124416 2017-01-19] () [Brak podpisu cyfrowego]
R3 iThemes5; C:\Program Files (x86)\Common Files\Services\iThemes.dll [583680 2017-01-19] () [Brak podpisu cyfrowego] <==== UWAGA
Reg: reg delete HKLM\SYSTEM\CurrentControlSet\Services\Themes /v DependOnService /f
S4 ed2kidle; "C:\Program Files (x86)\amuleC1\ed2k.exe" -downloadwhenidle [X]
S2 FirefoxU; "C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe" [X]
C:\Program Files (x86)\amuleC1
R1 ucdrv; C:\Windows\System32\drivers:ucdrv-x64.sys [80850 ] (UC Web Inc.) <==== UWAGA
S3 cpuz138; \??\C:\Users\Komp1\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S1 p1481293715am; \??\C:\Users\Komp1\AppData\Local\Temp\bk976F.tmp\p1481293715am.sys [X]
S1 p1481740824am; \??\C:\Users\Komp1\AppData\Local\Temp\bkC764.tmp\p1481740824am.sys [X]
S1 p1481812824am; \??\C:\Users\Komp1\AppData\Local\Temp\bkE15A.tmp\p1481812824am.sys [X]
S1 p1482162155am; \??\C:\Users\Komp1\AppData\Local\Temp\bkEA6E.tmp\p1482162155am.sys [X]
S1 p1482162218am; \??\C:\Users\Komp1\AppData\Local\Temp\bkE1D7.tmp\p1482162218am.sys [X]
S1 p1482853697am; \??\C:\Users\Komp1\AppData\Local\Temp\bk23F5.tmp\p1482853697am.sys [X]
S1 p1483113289am; \??\C:\Users\Komp1\AppData\Local\Temp\bk2D38.tmp\p1483113289am.sys [X]
S1 p1483113374am; \??\C:\Users\Komp1\AppData\Local\Temp\bk7B96.tmp\p1483113374am.sys [X]
S1 p1483459680am; \??\C:\Users\Komp1\AppData\Local\Temp\bkA286.tmp\p1483459680am.sys [X]
S1 p1483975862am; \??\C:\Users\Komp1\AppData\Local\Temp\bk82C6.tmp\p1483975862am.sys [X]
S1 p1483976003am; \??\C:\Users\Komp1\AppData\Local\Temp\bkA90B.tmp\p1483976003am.sys [X]
S1 p1484062649am; \??\C:\Users\Komp1\AppData\Local\Temp\bk5FBC.tmp\p1484062649am.sys [X]
S1 p1484062773am; \??\C:\Users\Komp1\AppData\Local\Temp\bk4450.tmp\p1484062773am.sys [X]
S1 p1484062887am; \??\C:\Users\Komp1\AppData\Local\Temp\bk187.tmp\p1484062887am.sys [X]
S1 p1484753808am; \??\C:\Users\Komp1\AppData\Local\Temp\bk4E6E.tmp\p1484753808am.sys [X]
S1 p1484840338am; \??\C:\Users\Komp1\AppData\Local\Temp\bk4E01.tmp\p1484840338am.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S1 UCGuard; system32\DRIVERS\ucguard.sys [X] <==== UWAGA
2017-01-19 16:44 - 2017-01-19 16:44 - 00000000 ____D C:\Users\Komp1\AppData\Local\Fishhas
2017-01-18 16:43 - 2017-01-18 16:43 - 00000000 ____D C:\Users\Komp1\AppData\Local\Applefat
2017-01-18 16:43 - 2017-01-18 16:43 - 00000000 ____D C:\ProgramData\wintools
2017-01-09 16:37 - 2017-01-21 13:01 - 00000000 ____D C:\Program Files (x86)\WinArcher
2017-01-09 16:37 - 2017-01-09 16:37 - 00000000 ____D C:\Users\Komp1\AppData\Local\Bigflat
2017-01-08 19:47 - 2017-01-17 17:51 - 00000000 ____D C:\Program Files (x86)\reports
2017-01-03 17:52 - 2017-01-21 16:06 - 00000040 _____ C:\Program Files (x86)\settings.dat
2017-01-03 17:52 - 2017-01-17 17:52 - 00000114 _____ C:\Program Files (x86)\metadata
2017-01-03 17:12 - 2017-01-03 17:12 - 00000000 ____D C:\Users\Komp1\AppData\Local\Zooarm
2016-12-31 10:20 - 2016-12-31 10:20 - 00000037 ___SH C:\Users\Komp1\AppData\Local\20986331705021ca58edc424.96250074
2016-12-31 10:20 - 2016-12-31 10:20 - 00000000 __SHD C:\Users\Komp1\AppData\Local\icsxml
C:\ProgramData\Ament.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\UC浏览器.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Mozilla Firefox.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\bf3a7c50bf661075\Google Chrome.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\9501e18d7c2ab92e\Google Chrome.lnk
C:\Users\Komp1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\744210bf2d2512fa\Google Chrome.lnk
HOSTS:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: UTF -8
>>Zapisz
Plik umieść w folderze C:\Users\Komp1\Downloads
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

4) Użyj >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk OCZYŚĆ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

 

5) Zrób nowe logi FRST.

przed skanem zaznacz: Additional.txt Shortcut.txt,

.