Pomoc w oczyszczeniu laptopa.

Post30 lip 2016, 10:23

FRST jest stary

Post30 lip 2016, 11:32

Emm, dziwne. Musiało mi się coś pomylić w notepadzie. Ten jest z dzisiaj FRST: Dostępne tylko dla zarejestrowanych użytkowników

Post31 lip 2016, 10:27

1. Otwórz notatnik i wklej:

CloseProcesses:
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => nie znaleziono
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus13.msn.com
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus13.msn.com
URLSearchHook: [S-1-5-21-2835298515-2183951775-1599769600-1006] UWAGA => Brak domyślnego URLSearchHook
SearchScopes: HKLM-x32 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Brak pliku
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Brak pliku
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => Brak pliku
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => Brak pliku
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => Brak pliku
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\...\MountPoints2: {1f7f83f6-4115-11e6-bf17-74d02b6121fc} - "H:\setup.exe"
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\...\MountPoints2: {669edd90-2baf-11e6-bf14-685d439c0f1c} - "H:\SETUP.EXE"
HKU\S-1-5-21-2835298515-2183951775-1599769600-1006\...\MountPoints2: {89e88bd0-3d0b-11e6-bf17-685d439c0f1c} - "G:\SETUP.EXE"
HKU\S-1-5-18\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 0
2016-06-04 09:31 - 2016-07-29 21:46 - 0000401 _____ () C:\Users\Tomaszek\AppData\Roaming\sp_data.sys
2015-11-27 17:53 - 2015-11-27 17:53 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-05-01 13:15 - 2012-09-07 13:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2013-05-01 13:15 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2013-05-01 13:15 - 2012-09-07 13:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS
Task: {03F904E6-0341-425F-BB72-989F22FAE963} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {04F92A64-9F14-4AD2-A6B7-93FA2F833DEE} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {09213795-6B7A-4DE2-B2DA-14C8337CC45A} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-09-24] (ASUS)
Task: {120A23BF-1B03-4DB7-8BAA-F614B7C8A314} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-04] (AVAST Software)
Task: {13EF89F9-1716-49EE-AB8E-CC2BBA6A0E51} - System32\Tasks\ASC9_SkipUac_Tomek => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [2015-11-30] (IObit)
Task: {25D78EBC-8839-4DC0-A014-D4AE74B91429} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-11-20] (AsusTek)
Task: {5818840A-2008-493A-A522-140228221613} - System32\Tasks\{4A9590A8-9BD7-46DD-BDB9-3D38F5D2F7D7} => Chrome.exe hxxp://ui.skype.com/ui/0/7.18.85.109/pl ... age=tsMain
Task: {69D1CFE2-5915-4F90-A6DF-8B82EC885374} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated)
Task: {6DFBDFEA-DDA8-49A9-BB96-7F1D91DEB0C5} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-08-22] (ASUSTeK Computer Inc.)
Task: {70BC1F4E-3E8E-47E7-B981-B8510F920F26} - System32\Tasks\{B6538EFB-10BE-4512-9373-C05369AE083A} => Chrome.exe hxxp://ui.skype.com/ui/0/7.17.85.105/pl ... age=tsMain
Task: {77C7FFBB-E309-45BD-BA8F-22E3177796AF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {8196EEA1-96A2-423C-B276-AEC1261D586A} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-09-18] (ASUSTek Computer Inc.)
Task: {8CFA2374-3453-485A-8A1F-4DB9E876CD73} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-11-16] (Piriform Ltd)
Task: {9640331D-BCD5-4FF8-97B0-6AA1DAE83F18} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-07-24] (Adobe Systems Incorporated)
Task: {9F797CF6-A63E-4192-BA6D-BC73E0B36E5B} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {A35A18C0-CFE4-4A9C-B86E-E50A03C88C99} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2835298515-2183951775-1599769600-1002UA => C:\Users\gabidamian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-11-16] (Facebook Inc.)
Task: {AC86B490-8D17-4FE6-A603-A887E72FF2FC} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2835298515-2183951775-1599769600-1002Core => C:\Users\gabidamian\AppData\Local\Facebook\Update\FacebookUpdate.exe [2014-11-16] (Facebook Inc.)
Task: {B3F9BEDB-3CB2-40A8-9DA5-7C0CE9DF0C66} - System32\Tasks\SafeZone scheduled Autoupdate 1469443086 => D:\AVAST Software\SZBrowser\launcher.exe [2016-06-17] (Avast Software)
Task: {B6E6CE84-EFFF-4471-A31C-3EDC5FB58B35} - System32\Tasks\ASC9_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe [2015-12-03] (IObit)
Task: {BDDB72FA-17EB-4496-B355-C8B1F1E6DFAC} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-02] (Google Inc.)
Task: {C1ABA643-2C3A-4250-8DB1-F00119E3BD36} - System32\Tasks\{57137466-E930-4EA5-9678-D9CEE4C28107} => pcalua.exe -a C:\ProgramData\Microsoft\Windows\Templates\A4Tech\OscarX7Editor5Mode\Setup.exe -c uninstall
Task: {C20B515D-EF6A-465F-8D39-4B88900E5134} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2016-06-02] (Google Inc.)
Task: {C7C033E7-0CE9-4ECE-AAE5-2D7098759F4E} - System32\Tasks\cFos\Registration Tasks\Open Browser => Chrome.exe "hxxp://www.cfos.de/pl/cfosspeed/expiration.htm?sw-10.10.2238&days=-25&ret=11&raw=13&exp=102"
Task: {C8EC6ED0-C6E0-40BC-834B-6DA6DC30A3A3} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-06-07] (Microsoft Corporation)
Task: {CA5CBD13-0C43-432A-A3FA-1335C5F89653} - System32\Tasks\ASC9_SkipUac_gabidamian => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe [2015-11-30] (IObit)
Task: {E2CB9075-4A85-4C2C-825C-4524A234D964} - System32\Tasks\avast! Emergency Update => D:\AVAST Software\Avast\AvastEmUpdate.exe [2016-07-24] (AVAST Software)
Task: {EB719C40-A935-4D44-9339-F3910DAB7D37} - System32\Tasks\{DCF9E903-D685-45D0-B4B0-5A940CE10832} => Chrome.exe hxxp://ui.skype.com/ui/0/7.17.85.105/pl/eula
Task: {EF3A5680-7647-44B8-8769-82C18E1990D8} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe [2016-07-24] (Adobe Systems Incorporated)
Task: {FFD5EB5C-1573-4EF3-985A-1C38E5039702} - System32\Tasks\{84790D6A-04BD-4022-B0D5-449876678E47} => Chrome.exe hxxp://ui.skype.com/ui/0/7.17.85.105/pl ... age=tsMain
Task: C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_22_0_0_209_pepper.exe
Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\WINDOWS\Tasks\ASC9_SkipUac_gabidamian.job => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
Task: C:\WINDOWS\Tasks\ASC9_SkipUac_Tomek.job => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2835298515-2183951775-1599769600-1002Core.job => C:\Users\gabidamian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2835298515-2183951775-1599769600-1002UA.job => C:\Users\gabidamian\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\SovereignInspector-S-4267800213.job => c:\programdata\trusted publisher\terminusmaker\SovereignInspector.exeS/schedule /profile c:\programdata\trusted publisher\terminusmaker\4267800213.ini <==== UWAGA
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [322]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [322]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [322]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:NT [40]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:NT2 [322]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [322]
AlternateDataStreams: C:\ProgramData\Temp:56E2E879 [116]
AlternateDataStreams: C:\Users\gabidamian\Dane aplikacji:NT [40]
AlternateDataStreams: C:\Users\gabidamian\Dane aplikacji:NT2 [322]
AlternateDataStreams: C:\Users\gabidamian\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\gabidamian\AppData\Roaming:NT2 [322]
CMD: netsh firewall reset
EmptyTemp:

Plik fixlist.txt umieść obok narzędzia FRST. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, system zostanie zresetowany. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

2. Użyj >Dostępne tylko dla zarejestrowanych użytkowników
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt

3. Uruchom Dostępne tylko dla zarejestrowanych użytkowników. Wciśnij dowolny klawisz i czekaj, aż skończy się operacja. (UWAGA: podczas pobierania, programy mogą wskazywać, że to jest zagrożenie, proszę to zignorować). Pokaż raport.

4. Po tych wszystkich operacjach nowy komplet logów z FRST do kontroli. Podczas uruchamiania FRST ustaw żeby ponownie wykonały się Addition.txt oraz Shourtcupy.