SafeGroup

SafeGroup > Bezpieczeństwo > Pomoc po zainfekowaniu > Niechciane reklamy oraz ping w grach
Pełna wersja: Niechciane reklamy oraz ping w grach
Aktualnie przeglądasz uproszczoną wersję forum. Kliknij tutaj, by zobaczyć wersję z pełnym formatowaniem.

Pikor

13.02.2015, 19:54
Wyskakujące reklamy w przeglądarce[na przeglądanej stronie oraz w nowych kartach a także oknach].Od pewnego czasu mam problem z pingiem w grach [Counter Strike,League Of Legends] nvm czy może być to spowodowane jakimś wirusem lub programem który ciągnie internet.Proszę o sprawdzenie i z góry bardzo dziękuję Smile


Wykonywane działania:brak
Opisz czym był skanowany komputer, jakie posiada oprogramowanie ochronne brak

Logi:
FRST:

[Aby zobaczyć linki, zarejestruj się tutaj]

ADDITION:

[Aby zobaczyć linki, zarejestruj się tutaj]

SHORTCUT:

[Aby zobaczyć linki, zarejestruj się tutaj]

tachion

14.02.2015, 18:59
Do notatnika wklej i zapisz jako fixlist.txt

Kod:
CloseProcesses:
CreateRestorePoint:
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKLM-x32\...\Run: [mbot_pl_177] => [X]
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dspp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=vtt&utm_campaign=install_ie&utm_content=ds&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&ts=1423340614&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=vtt&utm_campaign=install_ie&utm_content=ds&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&ts=1423340614&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://www.mystartsearch.com/web/?utm_source=b&utm_medium=vtt&utm_campaign=install_ie&utm_content=ds&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&ts=1423340614&type=default&q={searchTerms}
BHO: BlockAndSurf -> {18DF26D6-6B9D-817F-4EAE-46A28C8809C0} -> C:\Program Files (x86)\ver1BlockAndSurf\187_x64.dll No File
BHO-x32: BlockAndSurf -> {18DF26D6-6B9D-817F-4EAE-46A28C8809C0} -> C:\Program Files (x86)\ver1BlockAndSurf\187.dll No File
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Strong Signal -> {c723a437-2eaf-466d-a95b-3fa0966bf88c} -> C:\Program Files (x86)\Strong Signal\Extensions\c723a437-2eaf-466d-a95b-3fa0966bf88c.dll ()
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1423340563&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Firefox\Extensions: [{6B4C08E2-F5F4-AE43-E8BE-74483102D0CE}] - C:\Program Files (x86)\ver1BlockAndSurf\187.xpi
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hppp&ts=1423340592&from=vtt&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149"
CHR DefaultSearchKeyword: Default -> bing.com
CHR DefaultNewTabURL: Default -> https://www.bing.com/chrome/newtab?setmkt=pl-PL
CHR DefaultSuggestURL: Default -> http://api.bing.com/osjson.aspx?query={searchTerms}&language={language}
CHR Extension: (Strong Signal) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\fepampipjplnigjhkaijlbeppicakggl [2015-02-08]
OPR StartupUrls: "hxxp://www.gazeta.pl/0,0.html?p=156"
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-08] (globalUpdate) [File not signed]
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [68608 2015-02-08] (globalUpdate) [File not signed]
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 Service Mgr StrongSignal; C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugincontainer.exe [577272 2015-02-13] ()
R2 Update Mgr StrongSignal; C:\Program Files (x86)\Common Files\0780f478-67ce-4ec3-98db-39a65f4618ce\updater.exe [384760 2015-02-13] ()
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [487056 2015-02-07] (SysTool PasSame LIMITED)
R2 wpsvc_1.10.0.6; C:\Program Files (x86)\WordProser_1.10.0.6\Service\wpsvc.exe [277584 2015-01-07] (Word Proser)
S2 serverjo; C:\Users\Krzysztof\AppData\Roaming\VOPackage\JOSrv.exe [X]
S2 Update Cyti Web; "C:\Program Files (x86)\Cyti Web\updateCytiWeb.exe" [X]
R2 webinstrNHKT; C:\windows\system32\Drivers\webinstrNHKT.sys [50800 2015-02-08] ()
R1 wpnfd_1_10_0_6; C:\Windows\System32\drivers\wpnfd_1_10_0_6.sys [58240 2015-01-07] (Word Proser)
R1 {9af88319-349c-4a59-9f9b-a7b8def2b718}Gw64; C:\Windows\System32\drivers\{9af88319-349c-4a59-9f9b-a7b8def2b718}Gw64.sys [48784 2015-02-07] (StdLib)
R1 {c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64; C:\Windows\System32\drivers\{c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64.sys [48832 2015-02-07] (StdLib)
C:\Users\Krzysztof\Downloads\ReimageRepair.exe
C:\Users\Krzysztof\Downloads\CCleaner(13061)-dp.exe
C:\windows\system32\Drivers\{c0915853-fd66-4086-a9ce-b80496d49b3f}Gw64.sys
C:\Users\Krzysztof\AppData\Local\nsoE8C8.tmp
C:\windows\patsearch.bin
C:\windows\system32\Drivers\webinstrNHKT.sys
C:\Users\Krzysztof\AppData\Local\SmartWeb
C:\Users\Krzysztof\AppData\Local\nscCCE5.tmp
C:\Users\Krzysztof\AppData\Roaming\AnyProtectEx
C:\ProgramData\d511600c00001f76
C:\Users\Krzysztof\AppData\Roaming\QuickScan
C:\Users\Krzysztof\AppData\Local\globalUpdate
C:\Users\Krzysztof\AppData\Roaming\systweak
C:\windows\system32\roboot64.exe
C:\Users\Krzysztof\AppData\Local\mbot_pl_177
C:\windows\system32\Drivers\{9af88319-349c-4a59-9f9b-a7b8def2b718}Gw64.sys
C:\ProgramData\WindowsMangerProtect
C:\ProgramData\IHProtectUpDate
C:\Users\Krzysztof\Downloads\setup_e-pity2014 (3).exe
C:\Users\Krzysztof\Downloads\setup_e-pity2014 (2).exe
C:\Users\Krzysztof\Downloads\setup_e-pity2014 (1).exe
C:\Program Files (x86)\GUTD22D.tmp
C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log
C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log
C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
Reg: reg delete HKCU\Software\Mozilla /f
Reg: reg delete HKCU\Software\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\Mozilla /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\mozilla.org /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\MozillaPlugins /f
Reg: reg delete HKLM\SOFTWARE\Wow6432Node\qone8Software /f
Task: {000AF142-BE72-4586-9B3E-729D178EF6B3} - System32\Tasks\globalUpdateUpdateTaskMachineCore => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-08] (globalUpdate) <==== ATTENTION
Task: {08D8594F-DA34-4ECC-BF4C-60A888E3DD5F} - System32\Tasks\globalUpdateUpdateTaskMachineUA => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe [2015-02-08] (globalUpdate) <==== ATTENTION
Task: {0C612D28-E1EF-4E83-A186-F7F3206325FB} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-10_user => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-10.exe [2015-02-08] (OB) <==== ATTENTION
Task: {1D36978C-117C-44A6-B182-709EBE0E05AB} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {30FD675C-1D13-478A-A43E-8ED2F1A769A5} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5.exe [2015-02-08] (OB) <==== ATTENTION
Task: {44BABAA7-B89D-4EFE-B693-D7E6C7F7B536} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-6 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-6.exe [2015-02-08] (OB) <==== ATTENTION
Task: {646C33E8-FCFE-44D9-A109-8743CA5B5BE8} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {64980BCA-670A-4E39-93E7-90FA2018AEFE} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-7 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-7.exe [2015-02-08] (OB) <==== ATTENTION
Task: {867DED35-18D7-40A2-9A84-D053F3BEE353} - No Task path could be read. Access denied.
Task: {93D4B961-45C4-45B5-A0EB-DA7A1DE07A4C} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {A39304E4-1254-40F6-80ED-BB6F33A1E8A5} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5_user => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5.exe [2015-02-08] (OB) <==== ATTENTION
Task: {B057A721-B533-4547-AB8C-2C52EDECD583} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-7 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-7.exe [2015-02-08] (OB) <==== ATTENTION
Task: {BE55CCA4-063E-4AB0-9932-4FF6B6121793} - System32\Tasks\BlockAndSurf Update => C:\Program Files (x86)\ver1BlockAndSurf\J6BlockAndSurfR79.exe <==== ATTENTION
Task: {C3B1F36C-C6B7-471D-B97D-FFB1A64F394A} - System32\Tasks\{9FC38E68-1AF2-4C1C-BCCD-4F090A13340F} => pcalua.exe -a C:\Users\Krzysztof\AppData\Roaming\mystartsearch\UninstallManager.exe -c-ptid=vtt
Task: {C7F7092F-C1DD-4C71-90FE-228C07951C30} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-6 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-6.exe [2015-02-08] (OB) <==== ATTENTION
Task: {EE77FE3A-66C5-4C87-9946-FC42B20B05B8} - System32\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-11 => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-11.exe [2015-02-08] (OB) <==== ATTENTION
Task: {F790F50E-5027-42E1-89C3-126820841627} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2011-03-29] (SEC)
Task: C:\windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\windows\Tasks\BlockAndSurf Update.job => C:\Program Files (x86)\ver1BlockAndSurf\J6BlockAndSurfR79.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-6.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-6.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-7.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-1-7.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-10_user.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-10.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-11.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-11.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5_user.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-5.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-6.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-6.exe <==== ATTENTION
Task: C:\windows\Tasks\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-7.job => C:\Program Files (x86)\SavePass 1.1\ea1eba0b-5b03-470c-97f5-2c0c93503ed2-7.exe <==== ATTENTION
Task: C:\windows\Tasks\globalUpdateUpdateTaskMachineCore.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Task: C:\windows\Tasks\globalUpdateUpdateTaskMachineUA.job => C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe <==== ATTENTION
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2 /f
CMD: netsh advfirewall reset
EmptyTemp:

Zapisany skrypt umieść obok ściągniętego programu FRST
Następnie w programie kliknij Fix,po wykonaniu pokaż raport z tego działania.

Odinstaluj:

SavePass 1.1
Strong Signal
Word Proser 1.10.0.6

Google Chrome

Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję "Zresetuj ustawienia przeglądarki".

Opera
usuń dodatek (SavePass 1.1)

Ściągnij program

[Aby zobaczyć linki, zarejestruj się tutaj]

kliknij Szukaj i następnie Usuń
Pokaż raport z niego.

Zrób nowe logi i przedstaw z FRST.txt > Addition.txt
SafeGroup > Bezpieczeństwo > Pomoc po zainfekowaniu > Niechciane reklamy oraz ping w grach