przez Jarkenzi 22 Lip 2015, 15:15
FRST.txtprzez ordynat 22 Lip 2015, 16:18
D:\Users\Marta\AppData\Local\Temp*.html
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
EmptyTemp:
przez Jarkenzi 22 Lip 2015, 16:38
http://www.mysearch123.com/?type=hp&ts=1437483319&z=d49117f712bda4cc5fe61c2g7z4c6m9z7bac1c0gfb&from=ient06122&uid=3219913727_67194_EC47CF49 FRST.txt Addition.txtprzez ordynat 22 Lip 2015, 19:42
FF SelectedSearchEngine: delta-homes
S3 EagleNT; \??\D:\Windows\system32\drivers\EagleNT.sys [X]
S3 EagleXNt; \??\D:\Windows\system32\drivers\EagleXNt.sys [X]
S3 ipswuio; System32\DRIVERS\ipswuio.sys [X]
S3 XDva375; \??\D:\Windows\system32\XDva375.sys [X]
S3 XDva380; \??\D:\Windows\system32\XDva380.sys [X]
S3 XDva383; \??\D:\Windows\system32\XDva383.sys [X]
S3 ADSMService; D:\Program Files\ASUS\ASUS Data Security Manager\ADSMSrv.exe [X]
S3 spmgr; C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe [X]
S2 StarWindServiceAE; D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [X]
S2 Stereo Service; D:\Windows\System32\nvSCPAPISvr.exe [X]
D:\ProgramData\netdislw.pad
testsigning: ==> testsigning is on. Check for possible unsigned rootkit driver <===== ATTENTION!
nointegritychecks: ==> Integrity Checks is disabled <===== ATTENTION!
EmptyTemp:
przez Jarkenzi 22 Lip 2015, 20:29
Search.txt Fixlog.txtprzez ordynat 22 Lip 2015, 20:59
Może wywalić zaimportowane zakładki z ffoxa?
przez Jarkenzi 22 Lip 2015, 22:00
<!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml"><head><base target="_blank"><meta http-equiv="Content-Type" content="text/html; charset=utf-8"><title>mysearch123</title><link rel="stylesheet" href="../local/css/simple2.css?version=20150722a00231"><script type="text/javascript">
try{cpmSeq;}catch(e){cpmSeq=Math.floor(Math.random()*(new Date()).valueOf());}
var elex=window.elex||{};
elex.datacache=true;
elex.pageName = "simple_index_new";
elex.common={
get_domain:function(){
var matches = window.location.hostname.match(/([^\.]+).(com|net|me|org)$/);
if(matches!=null){
return matches[1];
}else{
return null;
}
},
set_cookie:function(key,val,expires){
var _this=this;
var date = new Date();
date.setTime(date.getTime() + 30 * 24 * 60 * 60 * 1000);
document.cookie = key+'='+encodeURIComponent(val)+'; domain=.'+_this.get_domain()+'.com; path=/; expires='+date.toGMTString();
},
get_cookie:function(key){
var value = document.cookie.match('(?:^|;)\\s*' + key + '=([^;]*)');
return (value) ? decodeURIComponent(value[1]) : null;
}
};
elex.tabTypes=["web","image","video","news"];
var conf = window.conf || {};
(function(){
window.properties = {};
elex.langs={
"ar":"العربية",
"de":"Deutsch",
"es":"Español",
"fa":"فارسی",
"fr":"Français",
"he":"עברית",
"hi":"हिन्दी",
"it":"Italiano",
"ja":"日本語",
"nl":"Nederlands",
"pl":"Polski",
"pt":"Português",
"ro":"Română",
"ru":"Русский",
"th":"ภาษาไทย",
"tr":"Türkçe",
"zh":"繁體中文",
"en":"English"
};
elex.lang3nation = {
"de":"de",
"es":"es",
"fr":"fr",
"it":"it",
"nl":"nl",
"pl":"pl",
"pt":"br",
"th":"th",
"tr":"tr",
"zh":"tw",
"en":"us"
};
properties["lang"] = "en";
if(elex.common.get_cookie("language") && (elex.common.get_cookie("language") in elex.langs)){
properties["lang"] = elex.common.get_cookie("language");
}
if(elex.common.get_cookie("set-language") && (elex.common.get_cookie("set-language") in elex.langs)){
properties["lang"] = elex.common.get_cookie("set-language");
}
})();
document.write("<script type='text/javascript' src='/global/js/lang/"+properties["lang"]+".js'><\/scr"+"ipt>");
</script></head><body><div id="container" class="container"><div class="hd" monkey="hd_tabs"><div id="translateWord" class="translate-word"><a class="translate selected">Web</a> <a class="translate">Images</a> <a class="translate">Videos</a> <a class="translate">News</a> <a href="http://www.gaggame.com/" class="downchecked games-en translate">Games</a></div></div><div class="s-box"></div><div id="search" class="search-box"><form action="/web" id="searchForm" target="_blank" search-type="web"><input name="q" type="text" class="q" autocomplete="off" autofocus><input id="nation" type="hidden" name="nation" value><input id="sq" name="s" type="submit" value="Search" class="btn"></form></div><div id="iframe-ad" class="iframe-ad"></div><div id="footer" monkey="foot_infor" class="footList"><div class="langs" monkey="change_lang" id="langs"></div><span id="license"><a href="/license_agreement.html" target="_blank">License Agreement</a> <a href="/privacy_policy.html" target="_blank">Privacy</a></span></div></div><script id="j-tmpl" type="text/template">{{ for (var i = 0, l = it.data.length; i < l; i++) { }} <li> <a href="{{=it.data[i].link}}"> <i> <img class="lazyload" src="http://b.thanksearch.com/ftpup/images/me/n2/deafault_img.png" _src="{{=it.data[i].img}}"> </i>{{=it.data[i].title}} </a> </li> {{ } }}</script><script src="/global/js/jquery.js?version=20150722a"></script><script src="/local/js/simple2.js?version=20150722a00233"></script><div class="ads-lazyload" id="nextPage" adsid="bottomRightAds"><script type="text/template" id="bottomRightAds"><iframe width="200" height="180" frameborder="0" allowtransparency="true" scrolling="no" vspace="0" hspace="0" marginheight="0" marginwidth="0" src="/global/ad/adplus.html?z=7&pl=85&cpmsize=200x180&seq={{=cpmSeq}}&u={{=$.cookie('uid')}}"></iframe></script></div><div class="ads-lazyload2" id="humorHidden" adsid="humorHidden-ad" style="display:none;"><script type="text/template" id="humorHidden-ad"><iframe src="http://adplus.goo.mx/gif.php?z=71&pl=1641&seq={{=cpmSeq}}&cpmsize=130x130&u={{=$.cookie('uid')}}" width="130" height="130" marginwidth="0" marginheight="0" hspace="0" vspace="0" frameborder="0" scrolling="no" allowTransparency="true"></iframe></script></div></body></html>przez ordynat 23 Lip 2015, 01:10
FoxTab PDF Creator (HKU\S-1-5-21-1523295428-1799490930-4272077155-1000\...\FoxTab PDF Creator) (Version: - ) <==== ATTENTION
D:\Program Files\SFK
HKLM\...\Run: [ProxyCap] => D:\PROGRA~1\PROXYL~1\ProxyCap\pcapui.exe
D:\PROGRA~1\PROXYL~1
R2 SSFK; D:\Program Files\SFK\SSFK.exe [459464 2015-07-21] (TODO: <公司名>)
Task: {1E52E687-2E53-47CB-809F-F762ED956554} - System32\Tasks\{B191907A-7902-47B4-93E6-063F11BADFA3} => pcalua.exe -a D:\Silkroadd\phhh\vcredist_x86.exe -d D:\Silkroadd\phhh
Task: {2C251256-3D3B-4A24-8DD8-22937B539728} - System32\Tasks\{10A6334B-B78F-4312-BED1-F11A1D2572B4} => pcalua.exe -a D:\Users\Marta\Downloads\WindowsPhone.exe -d D:\Users\Marta\Downloads
Task: {3B6724B4-DD18-4E64-B8EF-DF5B50D9C255} - System32\Tasks\{BA0FC847-0824-4D01-90A3-12C97C12E4DF} => pcalua.exe -a D:\Users\Marta\AppData\Roaming\key-find\UninstallManager.exe -c -ptid=cor
Task: {3E3213CE-0989-4877-B1B5-2513F114CD9F} - System32\Tasks\{0AEF1765-F185-4B4F-B6EC-BB833D333E49} => pcalua.exe -a "D:\Program Files\Avast4\aswRunDll.exe" -c "D:\Program Files\Avast4\Setup\setiface.dll",RunSetup
Task: {4559D6D2-26ED-4B46-B078-A6726ECC66D1} - System32\Tasks\{EC673295-7C78-486E-8A4F-E886A134C837} => pcalua.exe -a E:\Software\ASUS\eManual\setup.exe -d E:\Software\ASUS\eManual
Task: {B0DACFBC-F0C7-4712-9C65-CBABF6467EDE} - \Microsoft\Windows\Windows Activation Technologies\ValidationTaskDeadline No Task File <==== ATTENTION
Task: {C611B365-1B81-4BEC-923E-7BA74D37AAAC} - \Microsoft\Windows\Windows Activation Technologies\ValidationTask No Task File <==== ATTENTION
Task: {FC2DB068-ED0E-4898-A8D6-435F7AE15401} - System32\Tasks\{7ED5BD78-29A1-4066-8B1F-2A10F7B61F4F} => pcalua.exe -a "F:\Marta\Firefox Setup 3.6.3.exe" -d F:\Marta
EmptyTemp:
przez Jarkenzi 23 Lip 2015, 09:50
. Fixlog.txtprzez ordynat 23 Lip 2015, 10:55
DeleteQuarantine:
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 4 gości