Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
CloseProcesses:
CreateRestorePoint:
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM-x32\...\Run: [] => [X]
ShellExecuteHooks: - {D05DB088-9EBF-11E6-B6CD-64006A5CFC23} - Brak pliku [ ]
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
FF Extension: (Aliexpress Shopping Assistant) - C:\Users\piotr\AppData\Roaming\Mozilla\Firefox\Profiles\vdal9brr.default\Extensions\[email protected] [2016-11-19]
R2 ZAMSvc; C:\Program Files (x86)\Zemana AntiLogger\ZAM.exe [13823216 2016-10-04] (Zemana Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
S3 ALSysIO; \??\C:\Users\piotr\AppData\Local\Temp\ALSysIO64.sys [X]
U3 aswRdr; Brak ImagePath
U3 aswStm; Brak ImagePath
U0 aswVmm; Brak ImagePath
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]
C:\ProgramData\WinSAPSvc
C:\Users\piotr\AppData\Local\UCBrowser
C:\ProgramData\ChelfNotify
C:\Program Files (x86)\WinArcher
C:\Program Files (x86)\t5g6fdw9
C:\Program Files (x86)\{4479AF42-18F1-4D40-8B73-8CEE8C5E0749}
C:\Program Files (x86)\{4CB03681-503B-4B77-AB0C-D48CE80FE7CF}
C:\Program Files (x86)\cdi21j33
C:\Program Files (x86)\{1623F948-C703-4E9A-B2B5-56CC9C7E5B86}
C:\Program Files (x86)\do00e8f9
C:\Program Files (x86)\{A3A9E402-4D02-4E2C-AF3D-07DC6D29BC2D}
C:\Program Files (x86)\f09er35s
C:\Program Files (x86)\{20BFC786-B234-4A6D-A468-597C946146EA}
C:\Program Files (x86)\dcsi2zie
C:\Program Files (x86)\6pecdsvw
C:\Program Files (x86)\3iwovoem
C:\Users\Public\Thunder Network
ProgramData\Avg
C:\Program Files (x86)\Dowetraduge
C:\Users\piotr\AppData\Local\Ajodom
C:\TOSTACK
C:\found.000
C:\SeaTemp
C:\d3654deac9bba76487d3cd60
C:\Users\piotr\AppData\LocalLow\Temp
C:\MSOCache
C:\Program Files (x86)\Temp
C:\Program Files (x86)\Zemana AntiLogger
C:\Windows\ZAM_Guard.krnl.trace
C:\Windows\ZAM.krnl.trace
C:\Users\piotr\AppData\Local\Zemana
C:\Windows\system32\Drivers\KeyCrypt64.sys
C:\ProgramData\fontcacheev1.dat
Tcpip\..\Interfaces\{C7DF5FA6-9D5D-4E8D-8CD2-7B28EF96E89F}: [NameServer] 188.120.241.135,8.8.8.8
Task: {2CD3DC73-E7C2-4608-A2AF-D42DF2B34927} - System32\Tasks\ChelfNotify Task => C:\ProgramData\ChelfNotify\BrowserUpdate.exe [2016-06-30] (Tencent) <==== UWAGA
Task: {53AD2A54-42CD-467C-9DFF-3A3B53975CA8} - System32\Tasks\PasswordBoss_Desktop_24h_piotr-Komputer_piotr => C:\Programy\PasswordBoss\PasswordBoss.exe [2016-11-17] () <==== UWAGA
Task: {64980730-22A9-4200-9E30-A21424D5CECF} - System32\Tasks\PasswordBoss_Desktop_HealthChk_piotr-Komputer_piotr => C:\Programy\PasswordBoss\PasswordBoss.exe [2016-11-17] () <==== UWAGA
Task: {6C10A41F-8C3A-434C-86B6-4AF961ACF4DE} - Brak ścieżki do pliku
Task: {7E8325E9-CF39-422B-8A30-2A4EEC2AAF25} - System32\Tasks\PasswordBoss_Desktop => C:\Programy\PasswordBoss\PasswordBoss.exe [2016-11-17] () <==== UWAGA
Task: {AC5BFD95-9CD6-4091-968C-45B51BA750AD} - System32\Tasks\2c9d9e339999c7c157828a17266b5419 => Rundll32.exe "C:\Program Files (x86)\Origin Games\zyensi.dll",e62dc6c6547f46bda862da2d05af6862 <==== UWAGA
Task: {BD1F283E-EB4A-4077-8C38-6C3EFFFEE543} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-11-08] (Adobe Systems Incorporated)
Task: {D74EF6AA-E8F6-4B88-A64D-10B79E3D5226} - System32\Tasks\GyazoUpdateTaskMachineDaily => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-11-10] ()
Task: {FD07EC54-5FAF-4208-9455-6E114752BDC6} - System32\Tasks\GyazoUpdateTaskMachine => C:\Program Files (x86)\Gyazo\GyazoUpdate.exe [2016-11-10] ()
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r (64-bit).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Int?rn?t ???l?r?r.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Int?rn?t ???l?r?r (N? ?dd-?ns).lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\G??gl? ?hr?m?.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Int?rn?t ???l?r?r.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\??zill? Fir?f??.lnk -> C:\programy\Mozilla Firefox\firefox.exe (Mozilla Corporation) <===== Cyrillic
Shortcut: C:\Users\piotr\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\???r?.lnk -> C:\programy\Opera\launcher.exe (Opera Software) <===== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G??gl? ?hr?m?.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <===== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\??zill? Fir?f??.lnk -> C:\programy\Mozilla Firefox\firefox.exe (Mozilla Corporation) <===== Cyrillic
Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\???r?.lnk -> C:\programy\Opera\launcher.exe (Opera Software) <===== Cyrillic
Shortcut: C:\Users\Public\Desktop\G??gl? ?hr?m?.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) <===== Cyrillic
Shortcut: C:\Users\Public\Desktop\??zill? Fir?f??.lnk -> C:\programy\Mozilla Firefox\firefox.exe (Mozilla Corporation) <===== Cyrillic
Shortcut: C:\Users\Public\Desktop\???r?.lnk -> C:\programy\Opera\launcher.exe (Opera Software) <===== Cyrillic
AlternateDataStreams: C:\Windows\system32\drivers:ucdrv-x64.sys [80850]
AlternateDataStreams: C:\Windows\system32\drivers:x64 [360536]
AlternateDataStreams: C:\Windows\system32\drivers:x86 [1156450]
AlternateDataStreams: C:\Windows\system32\hpbcoins32.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\hpbcoins64.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\HPCP1020LM.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\hppdcompio.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\HPSIsvc.exe:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\mvusbews.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\WdfCoInstaller01009.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\SysWOW64\hppccompio.dll:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\mvusbews.sys:$CmdTcID [64]
AlternateDataStreams: C:\Windows\system32\Drivers\tap0901.sys:$CmdTcID [64]
AlternateDataStreams: C:\Users\piotr\Downloads\HPSupportSolutionsFramework-12.5.26.37.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\piotr\Downloads\HPSupportSolutionsFramework-12.5.26.37.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\piotr\Downloads\KGen Cyprus.rar:$CmdTcID [64]
AlternateDataStreams: C:\Users\piotr\Downloads\KGen Cyprus.rar:$CmdZnID [26]
AlternateDataStreams: C:\Users\piotr\Downloads\LTspiceIV.exe:$CmdTcID [64]
AlternateDataStreams: C:\Users\piotr\Downloads\LTspiceIV.exe:$CmdZnID [26]
AlternateDataStreams: C:\Users\piotr\Downloads\NewGuide2j.rar:$CmdTcID [64]
AlternateDataStreams: C:\Users\piotr\Downloads\NewGuide2j.rar:$CmdZnID [26]
Hosts:
EmptyTemp:
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Napraw. Po wykonaniu pokaż raport z tego działania.
Odinstaluj całkowicie Google Chrome, przy deinstalacji zaznacz opcję Usuń także dane przeglądarki. Po deinstalacji przez SHIFT+DEL (omija Kosz) skasuj całkowicie z dysku poniższy folder:
C:\Users\piotr\AppData\Local\Google
Zainstaluj ponownie Google Chrome i sprawdź czy poprawnie działa Password Boss
