Kłopot z cosstminn

[nomysz]

Proszę o pomoc w usunięciu wirusa, który skutecznie uprzykrza korzystanie z internetów. Dołączam wyniki skanowanie FRST.

[ordynat]

1) Użyj >Adw-cleaner
najpierw kliknij na SZUKAJ, a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ, to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt

2) Otwórz Notatnik i wklej w nim:

HKLM-x32\...\Run: [] => [X]
Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
BHO-x32: SearchNewTab -> {71F7A47B-458C-BA04-3095-1643C29EDA41} -> C:\ProgramData\SearchNewTab\51d32b9e53f20.dll ()
C:\ProgramData\SearchNewTab
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
CHR Extension: (cosstminn) - C:\Users\baciuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\dphbknkhfmnejgaebdkpfhhfgcdkklgj
C:\Users\baciuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\dphbknkhfmnejgaebdkpfhhfgcdkklgj
CHR Extension: (cosstminn) - C:\Users\baciuki\AppData\Local\Google\Chrome\User Data\Default\Extensions\dphbknkhfmnejgaebdkpfhhfgcdkklgj\2.0
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S4 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S4 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
S2 tvnserver; "C:\Program Files (x86)\Common Files\Comodo\tvnserver.exe" -service [X]
C:\ProgramData\19f46d57f0b0d78d
C:\Users\baciuki\AppData\Local\Temp\3859nua.exe
C:\Users\baciuki\AppData\Local\Temp\6_Offer_4.exe
C:\Users\baciuki\AppData\Local\Temp\7hcuupdv.dll
C:\Users\baciuki\AppData\Local\Temp\AskPIP_FF_.exe
C:\Users\baciuki\AppData\Local\Temp\ev7nf7lk.dll
C:\Users\baciuki\AppData\Local\Temp\Extract.exe
C:\Users\baciuki\AppData\Local\Temp\f.exe
C:\Users\baciuki\AppData\Local\Temp\FP_AX_MSI_INSTALLER.exe
C:\Users\baciuki\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit-1.exe
C:\Users\baciuki\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe
C:\Users\baciuki\AppData\Local\Temp\gm0o2j1h.dll
C:\Users\baciuki\AppData\Local\Temp\googlebooksdownloadersetup.exe
C:\Users\baciuki\AppData\Local\Temp\HPHelpUpdater.exe
C:\Users\baciuki\AppData\Local\Temp\htmlayout.dll
C:\Users\baciuki\AppData\Local\Temp\i4jdel0.exe
C:\Users\baciuki\AppData\Local\Temp\i4jdel1.exe
C:\Users\baciuki\AppData\Local\Temp\install_flash_player.exe
C:\Users\baciuki\AppData\Local\Temp\jn_rresv.dll
C:\Users\baciuki\AppData\Local\Temp\mpaf3jqs.dll
C:\Users\baciuki\AppData\Local\Temp\MyClaroTB.exe
C:\Users\baciuki\AppData\Local\Temp\otikeruw.dll
C:\Users\baciuki\AppData\Local\Temp\qoykctjx.dll
C:\Users\baciuki\AppData\Local\Temp\Resource.exe
C:\Users\baciuki\AppData\Local\Temp\sfamcc00001.dll
C:\Users\baciuki\AppData\Local\Temp\sfamcc00002.dll
C:\Users\baciuki\AppData\Local\Temp\sfareca00002.dll
C:\Users\baciuki\AppData\Local\Temp\sfextra.dll
C:\Users\baciuki\AppData\Local\Temp\SHSetup.exe
C:\Users\baciuki\AppData\Local\Temp\SkypeSetup.exe
C:\Users\baciuki\AppData\Local\Temp\sp54620.exe
C:\Users\baciuki\AppData\Local\Temp\SP54630.exe
C:\Users\baciuki\AppData\Local\Temp\SP54841.exe
C:\Users\baciuki\AppData\Local\Temp\SP54900.exe
C:\Users\baciuki\AppData\Local\Temp\SP54999.exe
C:\Users\baciuki\AppData\Local\Temp\SP55101.exe
C:\Users\baciuki\AppData\Local\Temp\SP55102.exe
C:\Users\baciuki\AppData\Local\Temp\SP55104.exe
C:\Users\baciuki\AppData\Local\Temp\SP55107.exe
C:\Users\baciuki\AppData\Local\Temp\SP55109.exe
C:\Users\baciuki\AppData\Local\Temp\SP55152.exe
C:\Users\baciuki\AppData\Local\Temp\SP56878.exe
C:\Users\baciuki\AppData\Local\Temp\SP56929.exe
C:\Users\baciuki\AppData\Local\Temp\SP57090.exe
C:\Users\baciuki\AppData\Local\Temp\SP57232.exe
C:\Users\baciuki\AppData\Local\Temp\sp58915.exe
C:\Users\baciuki\AppData\Local\Temp\SP59542.exe
C:\Users\baciuki\AppData\Local\Temp\sp64126.exe
C:\Users\baciuki\AppData\Local\Temp\t.dll
C:\Users\baciuki\AppData\Local\Temp\toolbar43313739.exe
C:\Users\baciuki\AppData\Local\Temp\toolbar458347065.exe
C:\Users\baciuki\AppData\Local\Temp\toolbar458349381.exe
C:\Users\baciuki\AppData\Local\Temp\toolbar458353529.exe
C:\Users\baciuki\AppData\Local\Temp\toolbar458354249.exe
C:\Users\baciuki\AppData\Local\Temp\uninst1.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall-updater128840278.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall128854094.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall128960562.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall128962320.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall128962351.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall128962367.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall389799.exe
C:\Users\baciuki\AppData\Local\Temp\uninstall389815.exe
C:\Users\baciuki\AppData\Local\Temp\UninstallHPSA.exe
C:\Users\baciuki\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\baciuki\AppData\Local\Temp\wmkinutf.dll
C:\Users\baciuki\AppData\Local\Temp\ydetect.exe
C:\Users\baciuki\AppData\Local\Temp\zoytgyon.dll
C:\Users\baciuki\AppData\Local\Temp\{C83801EC-E10F-411D-AD68-74AA68C22281}-30.0.1599.101_30.0.1599.69_chrome_updater.exe
Reboot:

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix. Powstanie plik fixlog.txt. Daj ten log.

Napisz, czy problem minął?
.

Autor postu otrzymał pochwałę

[nomysz]

Zadziałało podaje logi z Ad i FRST

[ordynat]

W takim razie kończymy:

W Adw-Cleaner kliknij na przycisk Odinstaluj (UNINSTALL).

Otwórz Notatnik i wklej w nim:

DeleteQuarantine:

Plik zapisz pod nazwą fixlist.txt i umieść obok narzędzia FRST. Uruchom FRST i kliknij w Fix.
przez SHIFT+DEL usuń pozostały folder C:\FRST
.