Do notatnika wklej i zapisz jako
fixlist.txt
Kod:
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
() c:\programdata\companynotset\sw-booster\SW-Booster.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
(APN) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
HKLM-x32\...\Run: [ApnTBMon] => C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1956760 2014-06-24] (APN)
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Run: [Facebook Update] => C:\Users\Krzysztof\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-03-09] (Facebook Inc.)
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Run: [Optimizer Pro] => C:\Program Files (x86)\Optimizer Pro\OptProLauncher.exe [135160 2014-01-28] (PC Utilities Software Limited)
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Run: [LiveSupport] => "C:\Program Files (x86)\LiveSupport\LiveSupport.exe" /noshow /log
HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Run: [Tiny download manager] => "C:\Users\Krzysztof\AppData\Local\DM\TinyDM.exe" /M
AppInit_DLLs: C:\PROGRA~3\ASSIST~1\ASSIST~2.DLL => C:\ProgramData\Assistant\Assistant_x64.dll [4319744 2014-04-02] ()
AppInit_DLLs-x32: c:\progra~3\assist~1\assist~1.dll => C:\ProgramData\Assistant\Assistant.dll [4116480 2014-04-02] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk
ShortcutTarget: LOLRecorder.lnk -> C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (No File)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1402591539&from=wpm0612&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=128
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1402591539&from=wpm0612&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1395575888&from=wpc&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1402591539&from=wpm0612&uid=WDCXWD3200BPVT-35JJ5T0_WD-WX11E81KA149KA149&q={searchTerms}
BHO: YoutubeAdblocker - {1ACF8B45-1665-9443-CBBA-6C87E8593AAD} - C:\Program Files (x86)\YoutubeAdblocker\O.x64.dll ()
BHO: safeweb - {1CBC68A0-022C-CA9F-1FDB-78BA7CC39BF2} - C:\Program Files (x86)\safeweb\DI2t5aqqB.x64.dll ()
BHO: CoupExtennsion - {29A19EC1-AAFA-839E-AE1A-FC6A0FA520C6} - C:\ProgramData\CoupExtennsion\YMSkuqJx.x64.dll ()
BHO: ShoPDrop - {4A0A103D-DF62-99BF-C321-AB3F187222C9} - C:\ProgramData\ShoPDrop\6JJW9yl0.x64.dll ()
BHO: EnjoYCoupoon - {4DEAF795-42A5-E4DF-1FC9-E64B93FFC889} - C:\ProgramData\EnjoYCoupoon\Zd87Jhbez.x64.dll ()
BHO: BitSaaVEr - {CF290722-F095-408B-F916-F731907D5927} - C:\ProgramData\BitSaaVEr\stS3gSo.x64.dll ()
BHO-x32: YoutubeAdblocker - {1ACF8B45-1665-9443-CBBA-6C87E8593AAD} - C:\Program Files (x86)\YoutubeAdblocker\O.dll ()
BHO-x32: safeweb - {1CBC68A0-022C-CA9F-1FDB-78BA7CC39BF2} - C:\Program Files (x86)\safeweb\DI2t5aqqB.dll ()
BHO-x32: CoupExtennsion - {29A19EC1-AAFA-839E-AE1A-FC6A0FA520C6} - C:\ProgramData\CoupExtennsion\YMSkuqJx.dll ()
BHO-x32: ShoPDrop - {4A0A103D-DF62-99BF-C321-AB3F187222C9} - C:\ProgramData\ShoPDrop\6JJW9yl0.dll ()
BHO-x32: EnjoYCoupoon - {4DEAF795-42A5-E4DF-1FC9-E64B93FFC889} - C:\ProgramData\EnjoYCoupoon\Zd87Jhbez.dll ()
BHO-x32: NetCrawl - {769a91da-209f-47fe-88b9-b0321b0982c8} - C:\Program Files (x86)\NetCrawl\NetCrawlbho.dll (NetCrawl)
BHO-x32: BitSaaVEr - {CF290722-F095-408B-F916-F731907D5927} - C:\ProgramData\BitSaaVEr\stS3gSo.dll ()
CHR HKLM-x32\...\Chrome\Extension: [pljcgbedjplidkdjahbaalanadmjfgop] - C:\ProgramData\AskPartnerNetwork\Toolbar\ORJ-V7C\CRX\ToolbarCR.crx [2014-06-25]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 699fd52f; C:\ProgramData\Assistant\AssistantSvc.dll [178000 2014-04-02] ()
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [165784 2014-06-24] (APN LLC.)
R2 Update NetCrawl; C:\Program Files (x86)\NetCrawl\updateNetCrawl.exe [318752 2014-07-02] ()
R2 Util NetCrawl; C:\Program Files (x86)\NetCrawl\bin\utilNetCrawl.exe [318752 2014-07-02] ()
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [540304 2014-06-11] (Cherished Technololgy LIMITED)
R1 {57f143ae-1ecd-493d-9ddb-32c45a3cecd5}Gw64; C:\Windows\System32\drivers\{57f143ae-1ecd-493d-9ddb-32c45a3cecd5}Gw64.sys [61112 2014-06-27] (StdLib)
R1 {6fcd6092-9615-4f7f-8898-8df53980e5d2}Gw64; C:\Windows\System32\drivers\{6fcd6092-9615-4f7f-8898-8df53980e5d2}Gw64.sys [61112 2014-06-30] (StdLib)
C:\windows\SysWOW64\shoC920.tmp
C:\Users\Krzysztof\AppData\Local\AskPartnerNetwork
C:\ProgramData\AskPartnerNetwork
C:\Program Files (x86)\AskPartnerNetwork
C:\ProgramData\APN
C:\ProgramData\BitSaaVEr
C:\ProgramData\d95a7c6c0d61e263
C:\ProgramData\WPM
C:\Users\Krzysztof\AppData\Local\Temp\12226-MofikiAutoClickerPremium_sciagnij.exe
C:\Users\Krzysztof\AppData\Local\Temp\APNSetup.exe
C:\Users\Krzysztof\AppData\Local\Temp\ggdrive-menu.exe
C:\Users\Krzysztof\AppData\Local\Temp\ggdrive-overlay.exe
C:\Users\Krzysztof\AppData\Local\Temp\installstats.exe
C:\Users\Krzysztof\AppData\Local\Temp\LiveSupport_setup.exe
Task: {418208EF-7B58-407E-A30D-EB19FE561E99} - System32\Tasks\WOT WMON1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {48F98643-7466-48E9-83AB-8A577164F7A8} - System32\Tasks\SW-Booster-S-963476232 => c:\programdata\companynotset\sw-booster\SW-Booster.exe [2014-03-23] ()
Task: {4C6B35E9-051A-46D7-B323-40CD22584DFE} - System32\Tasks\WOT WW2 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {532B1115-FAD5-426E-819E-D68654EE8A3E} - System32\Tasks\WOT WTUE1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {6E8DA1B7-849D-401E-AE86-28E9360BB09A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3103525249-1077354125-3941522485-1000Core => C:\Users\Krzysztof\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-03-09] (Facebook Inc.)
Task: {7BD4954E-0124-43BA-A901-F59C3196972C} - System32\Tasks\WOT WTHUR1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {C2CAB781-9C48-4701-A18F-EF1BC2D0BB38} - System32\Tasks\WOT WFRI1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {CB15B05A-FF34-492D-90E5-9BEF7C6EF4A6} - System32\Tasks\WOT W2 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {CEFCC751-DC16-4D28-A808-34E55DD31A86} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3103525249-1077354125-3941522485-1000UA => C:\Users\Krzysztof\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-03-09] (Facebook Inc.)
Task: {DC5D8CE9-578E-4390-9FAB-DC6F2F35E7AF} - System32\Tasks\WOT WWED1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {EB1973AF-FE4C-4449-BBA7-CB284CFA5142} - System32\Tasks\WOT WW1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: {FFE2B7AC-5FD6-4713-BD8B-C0B39CA6D805} - System32\Tasks\WOT W1 => Iexplore.exe http://mmotraffic.com/catalog/goplay/1327/MTE3NjYvLy8xMzI3/
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3103525249-1077354125-3941522485-1000Core.job => C:\Users\Krzysztof\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3103525249-1077354125-3941522485-1000UA.job => C:\Users\Krzysztof\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\SW-Booster-S-963476232.job => c:\programdata\companynotset\sw-booster\SW-Booster.exe
AlternateDataStreams: C:\ProgramData\Temp:373E1720
Reboot:
Zapisany skrypt umieść obok ściągniętego programu
FRST
Następnie w programie kliknij
Fix,po wykonaniu pokaż raport z tego działania.
Odinstaluj:
Ask Toolbar jeśli nie został już odinstalowany
Assistant
BitSaaVEr
EnjoYCoupoon
Optimizer Pro v3.2 jeśli nie został już odinstalowany
ShoPDrop
sweet-page uninstaller
W przeglądarce Firefox -menu Pomoc > Informacje dla pomocy technicznej > Zresetuj program Firefox. Reset nie naruszy zakładek i haseł
Google Chrome
Ustawienia > karta Rozszerzenia > odinstaluj Ask Toolbar,DIsccoUnTExteensi,Extended Protection,YoutubeAdblocker,DigiSSaver,saafeawweb,Search YouTube,GReatoSuAvee44U,Zwinky
Ustawienia > karta Ustawienia > Po uruchomieniu > usuń adres delta-homes.com, przestaw na "Otwórz stronę nowej karty"
Ustawienia > karta Ustawienia > Wyszukiwanie przestaw na Google > Zarządzanie wyszukiwarkami,usuń jeśli widoczne search.ask.com
Ustawienia > karta Ustawienia > Wygląd i zaznacz "Pokaż przycisk strony startowej" > klik w Zmień i usuń jeśli widoczne search.ask.com
Ustawienia > karta Historia > wyczyść
Zresetuj cache wtyczek. W pasku adresów wpisz chrome://plugins i ENTER. Na liście wtyczek wybierz dowolną i kliknij Wyłącz. Następnie wtyczkę ponownie włącz.
Ustawienia > karta Ustawienia > Pokaż ustawienia zaawansowane > zjedź na sam spód i uruchom opcję "Zresetuj ustawienia przeglądarki".
Ściągnij program
[Aby zobaczyć linki, zarejestruj się tutaj]
kliknij
Szukaj i następnie
Usuń
pokaż raport
Ściągnij
[Aby zobaczyć linki, zarejestruj się tutaj]
i kliknij Start.
Wklej na stronę raport z
SecurityCheck
[Aby zobaczyć linki, zarejestruj się tutaj]
Uruchom kliknij w dowolny klawisz,poczekaj aż program zakończy działanie.
Zrób nowe logi i przedstaw z FRST.txt > Addition.txt + OTL ale bez extras.
