Wirus blokuje przeglądanie stron i antywirusa

**Posty:** 151 · przez **matix56** 27 Gru 2015, 23:00

Witam
Na laptopie koleżanki w przeglądarce google chrome nie działają żadne strony oprócz facebooka i stron powiązanych z google(po wpisaniu innej strony wyświetla się komunikat strona jest niedostępna) a antywirus Microsoft Security Essentials nie potrafi przejść w tryb aktywny.
Nie potrafię zrobić logow programem gmer bo pokazuje się błąd Problem. C:\windows\system32\config\system: Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces.

OTL:
http://wklej.org/id/1888426/

Extras:
http://wklej.org/id/1888427/

Z góry dziękuję

**Posty:** 4765 · przez **ordynat** 27 Gru 2015, 23:06

1) Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

2) Zrób log z TDSSKiller http://www.fixitpc.pl/topic/8-dezynfekcja-zbi%C3%B3r-narz%C4%99dzi-usuwaj%C4%85cych/#entry173210
Jeśli wykryje C:\Windows\SysNative\drivers\17fc8417725d5b71.sys -- (17fc8417725d5b71)
- to niech od razu usunie.

3) Zrób logi z FRST > http://forum.programosy.pl/frst-otl-zoek-vt139692.html
Przed skanem zaznacz "Addition.txt"

-----------------------------------------------------------------------

Error - 2015-12-27 16:16:00 | Computer Name = Kasia-Komputer | Source = WinMgmt | ID = 10
Description =

Aby automatycznie rozwiązać ten problem, kliknij > Fix.it. na stronie http://support2.microsoft.com/kb/2545227/en-us
Następnie kliknij przycisk Uruchom w oknie dialogowym Pobieranie pliku i wykonaj kroki w kreatorze Fix.it.
(Link zapasowy > http://www.mediafire.com/download/6hwcm6b77098cbb/MicrosoftFixit50688.msi )
.

**Posty:** 151 · przez **matix56** 27 Gru 2015, 23:47

Log z Adw-Cleanera : http://wklej.org/id/1888451/

Log z TDssKiller : http://wklej.org/id/1888477/

Log z FRST : http://wklej.org/id/1888482/
Log Addition : http://wklej.org/id/1888481/

Odnośnie TDSSKiller program znalazł 2 problemy i usunąłem , możliwe że coś pomyliłem z logiem z tego programu

**Posty:** 4765 · przez **ordynat** 27 Gru 2015, 23:52

log z TDSSKiller jest dziwnie krótki

SafeFinder (HKLM-x32\...\{025E05CF-F7FC-4C04-977D-508B1454CB78}) (Version: 1.0.0.0 - Linkury) <==== UWAGA

spróbuj odinstalować ten program

Otwórz Notatnik i wklej w nim:

DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{025E05CF-F7FC-4C04-977D-508B1454CB78}
Task: {00BB6620-8DBD-4490-BB8A-83D230D9A6BD} - System32\Tasks\psv_Hotis => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Soltom.reg" & del "C:\ProgramData\Plusron\Soltom.reg" & SCHTASKS /Delete /TN "psv_Hotis" /F <==== UWAGA
Task: {016F42D9-4B15-49A6-9E3C-E1B4989BCD4A} - System32\Tasks\psv_Contraxcore => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Triocore.reg" & del "C:\ProgramData\Plusron\Triocore.reg" & SCHTASKS /Delete /TN "psv_Contraxcore" /F <==== UWAGA
Task: {099F0564-C784-4EDA-AFE4-29907B89ADA4} - System32\Tasks\psv_Hotlux => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\LamSandox.reg" & del "C:\ProgramData\Plusron\LamSandox.reg" & SCHTASKS /Delete /TN "psv_Hotlux" /F <==== UWAGA
Task: {0A2E39B6-00C1-4E67-9591-6664E1C76EDC} - System32\Tasks\psv_Truefix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Jaybam.reg" & del "C:\ProgramData\Plusron\Jaybam.reg" & SCHTASKS /Delete /TN "psv_Truefix" /F <==== UWAGA
Task: {0B0BF936-56D9-49E9-A38B-1A315C719A13} - System32\Tasks\psv_Saltfax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Roundtom.reg" & del "C:\ProgramData\Plusron\Roundtom.reg" & SCHTASKS /Delete /TN "psv_Saltfax" /F <==== UWAGA
Task: {0B48F37C-FFD5-4628-B205-BD193B27AB1D} - System32\Tasks\psv_Stimtip => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Fin-Core.reg" & del "C:\ProgramData\Plusron\Fin-Core.reg" & SCHTASKS /Delete /TN "psv_Stimtip" /F <==== UWAGA
Task: {0FB67C85-5B35-42F0-9355-F0E49911D815} - System32\Tasks\psv_Ecokix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\ZoneIty.reg" & del "C:\ProgramData\Plusron\ZoneIty.reg" & SCHTASKS /Delete /TN "psv_Ecokix" /F <==== UWAGA
Task: {10C6A520-01E3-4D5F-AEF8-3F1D3880C050} - System32\Tasks\psv_Iceex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Quadphase.reg" & del "C:\ProgramData\Plusron\Quadphase.reg" & SCHTASKS /Delete /TN "psv_Iceex" /F <==== UWAGA
Task: {14E09D0E-CE0C-4EA9-8954-C98ECAC957E6} - System32\Tasks\psv_Alphatrax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Strongkeytough.reg" & del "C:\ProgramData\Plusron\Strongkeytough.reg" & SCHTASKS /Delete /TN "psv_Alphatrax" /F <==== UWAGA
Task: {18EAE43B-418C-47D0-93FB-CE3BE543E330} - System32\Tasks\psv_Cofcom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Superfresh.reg" & del "C:\ProgramData\Plusron\Superfresh.reg" & SCHTASKS /Delete /TN "psv_Cofcom" /F <==== UWAGA
Task: {1DCB9DB2-8943-4D9E-BA5F-D44A217D6CCA} - System32\Tasks\psv_Warmkix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Sildom.reg" & del "C:\ProgramData\Plusron\Sildom.reg" & SCHTASKS /Delete /TN "psv_Warmkix" /F <==== UWAGA
Task: {1F43890C-C4F9-422B-8DA9-C194DC5B90D9} - System32\Tasks\psv_Zotlex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\BlackHotfix.reg" & del "C:\ProgramData\Plusron\BlackHotfix.reg" & SCHTASKS /Delete /TN "psv_Zotlex" /F <==== UWAGA
Task: {2003E1F5-15C4-41ED-BD8F-2A686F19DEA7} - System32\Tasks\psv_Saostock => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Inchis.reg" & del "C:\ProgramData\Plusron\Inchis.reg" & SCHTASKS /Delete /TN "psv_Saostock" /F <==== UWAGA
Task: {212E536C-AB58-4CC2-9938-6CE95AA95354} - System32\Tasks\psv_Fixfan => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Quozamla.reg" & del "C:\ProgramData\Plusron\Quozamla.reg" & SCHTASKS /Delete /TN "psv_Fixfan" /F <==== UWAGA
Task: {253D3E7E-3FF4-45B2-8843-7D4BFB07F4E9} - System32\Tasks\psv_Isdomlex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\LabIn.reg" & del "C:\ProgramData\Plusron\LabIn.reg" & SCHTASKS /Delete /TN "psv_Isdomlex" /F <==== UWAGA
Task: {2E83942C-8A6A-4521-9999-5AF75C03B6E2} - System32\Tasks\psv_Hatdom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Silvernamstock.reg" & del "C:\ProgramData\Plusron\Silvernamstock.reg" & SCHTASKS /Delete /TN "psv_Hatdom" /F <==== UWAGA
Task: {2FE7AF07-9A3A-4EDE-9BCC-022D773D4399} - System32\Tasks\psv_TranSing => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Redin.reg" & del "C:\ProgramData\Plusron\Redin.reg" & SCHTASKS /Delete /TN "psv_TranSing" /F <==== UWAGA
Task: {31DC2726-B124-47B3-BC86-A99D7F4F651B} - System32\Tasks\psv_Sail-Lam => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Faxzuntip.reg" & del "C:\ProgramData\Plusron\Faxzuntip.reg" & SCHTASKS /Delete /TN "psv_Sail-Lam" /F <==== UWAGA
Task: {370ACEB6-7106-4C9C-85F5-E787E3FFE8FA} - System32\Tasks\psv_TouchQuadtip => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\AlphaAir.reg" & del "C:\ProgramData\Plusron\AlphaAir.reg" & SCHTASKS /Delete /TN "psv_TouchQuadtip" /F <==== UWAGA
Task: {3A7AC226-7D6C-471E-9B38-7D7AA6B02E29} - System32\Tasks\psv_SanJob => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Ransing.reg" & del "C:\ProgramData\Plusron\Ransing.reg" & SCHTASKS /Delete /TN "psv_SanJob" /F <==== UWAGA
Task: {3BA78DB4-96C0-4E9E-922E-E2744B931F86} - System32\Tasks\psv_Saltlex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Lamtip.reg" & del "C:\ProgramData\Plusron\Lamtip.reg" & SCHTASKS /Delete /TN "psv_Saltlex" /F <==== UWAGA
Task: {3E6D754F-708E-4F05-8F1D-B5652ADAC3E2} - System32\Tasks\psv_BlueDex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zonetrax.reg" & del "C:\ProgramData\Plusron\Zonetrax.reg" & SCHTASKS /Delete /TN "psv_BlueDex" /F <==== UWAGA
Task: {4090D608-F7A9-42C1-AC5E-47A194F1A16C} - System32\Tasks\psv_SoftFinfresh => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Warmair.reg" & del "C:\ProgramData\Plusron\Warmair.reg" & SCHTASKS /Delete /TN "psv_SoftFinfresh" /F <==== UWAGA
Task: {41921BCF-B38F-445F-BF5F-FEF004D7FD63} - System32\Tasks\psv_Trisgotrax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Y-warm.reg" & del "C:\ProgramData\Plusron\Y-warm.reg" & SCHTASKS /Delete /TN "psv_Trisgotrax" /F <==== UWAGA
Task: {41BB8E7E-ABA8-442E-9573-64A5B91A7813} - System32\Tasks\psv_SpanZimbam => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Viafix.reg" & del "C:\ProgramData\Plusron\Viafix.reg" & SCHTASKS /Delete /TN "psv_SpanZimbam" /F <==== UWAGA
Task: {43CB48DA-504B-486A-9A80-37763EF5A727} - System32\Tasks\psv_Sailhome => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\SoftTanlux.reg" & del "C:\ProgramData\Plusron\SoftTanlux.reg" & SCHTASKS /Delete /TN "psv_Sailhome" /F <==== UWAGA
Task: {4829C3F1-FB1B-4412-9097-174E9C346E37} - System32\Tasks\psv_Techdex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Fixcom.reg" & del "C:\ProgramData\Plusron\Fixcom.reg" & SCHTASKS /Delete /TN "psv_Techdex" /F <==== UWAGA
Task: {49249DB0-797B-4429-8338-A867EF4D5C88} - System32\Tasks\psv_Alphain => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Tipcof.reg" & del "C:\ProgramData\Plusron\Tipcof.reg" & SCHTASKS /Delete /TN "psv_Alphain" /F <==== UWAGA
Task: {4AC89833-AB82-4C68-B15C-537EBB0F4DED} - System32\Tasks\psv_Fasefix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Gold-Nix.reg" & del "C:\ProgramData\Plusron\Gold-Nix.reg" & SCHTASKS /Delete /TN "psv_Fasefix" /F <==== UWAGA
Task: {4D59EAF9-F2B1-4F37-B756-DF86728D7638} - System32\Tasks\psv_Stocktough => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Ronlight.reg" & del "C:\ProgramData\Plusron\Ronlight.reg" & SCHTASKS /Delete /TN "psv_Stocktough" /F <==== UWAGA
Task: {56913F1C-01BB-4009-B260-443256AAC7B2} - System32\Tasks\psv_Viatouch => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Ventolight.reg" & del "C:\ProgramData\Plusron\Ventolight.reg" & SCHTASKS /Delete /TN "psv_Viatouch" /F <==== UWAGA
Task: {5721CF15-B3DA-4901-963E-8723918D7932} - System32\Tasks\psv_Solowarm => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Apla.reg" & del "C:\ProgramData\Plusron\Apla.reg" & SCHTASKS /Delete /TN "psv_Solowarm" /F <==== UWAGA
Task: {59E5878A-00AE-4078-BAE5-F5BCE30CB794} - System32\Tasks\psv_Doubleruntip => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Viahold.reg" & del "C:\ProgramData\Plusron\Viahold.reg" & SCHTASKS /Delete /TN "psv_Doubleruntip" /F <==== UWAGA
Task: {5C6B73C5-5FA9-4BD7-9C90-33D72FC37E5F} - System32\Tasks\psv_Plusis => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Tampstrong.reg" & del "C:\ProgramData\Plusron\Tampstrong.reg" & SCHTASKS /Delete /TN "psv_Plusis" /F <==== UWAGA
Task: {5D323565-EC06-49EE-8B00-79A64ADDEB8A} - System32\Tasks\psv_ZooHotron => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Softlam.reg" & del "C:\ProgramData\Plusron\Softlam.reg" & SCHTASKS /Delete /TN "psv_ZooHotron" /F <==== UWAGA
Task: {61D937E1-E7A8-47D7-BF0C-04CF3E695B04} - System32\Tasks\psv_Ecodex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Goodtough.reg" & del "C:\ProgramData\Plusron\Goodtough.reg" & SCHTASKS /Delete /TN "psv_Ecodex" /F <==== UWAGA
Task: {6340ABFB-30E0-4465-85E9-9E90DBF6D06C} - System32\Tasks\psv_Viasaofresh => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Voyatouch.reg" & del "C:\ProgramData\Plusron\Voyatouch.reg" & SCHTASKS /Delete /TN "psv_Viasaofresh" /F <==== UWAGA
Task: {6597FA9A-9234-48DC-ACFE-B8C6479294B0} - System32\Tasks\psv_An-La => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zimplus.reg" & del "C:\ProgramData\Plusron\Zimplus.reg" & SCHTASKS /Delete /TN "psv_An-La" /F <==== UWAGA
Task: {6866094B-E445-43E6-AE06-4A7CEC731ADD} - System32\Tasks\psv_Ining => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zon-Trax.reg" & del "C:\ProgramData\Plusron\Zon-Trax.reg" & SCHTASKS /Delete /TN "psv_Ining" /F <==== UWAGA
Task: {6E33331D-0172-444B-BA4B-AFBBD60F2C23} - System32\Tasks\psv_Lamzumdox => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\S-ex.reg" & del "C:\ProgramData\Plusron\S-ex.reg" & SCHTASKS /Delete /TN "psv_Lamzumdox" /F <==== UWAGA
Task: {717FD7AE-6D39-433A-8AEF-42506BFAA19F} - System32\Tasks\psv_Gravecom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Soloplus.reg" & del "C:\ProgramData\Plusron\Soloplus.reg" & SCHTASKS /Delete /TN "psv_Gravecom" /F <==== UWAGA
Task: {71F85C73-64A0-4187-BC8F-B17466884AC8} - System32\Tasks\psv_VilaJob => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Qvotough.reg" & del "C:\ProgramData\Plusron\Qvotough.reg" & SCHTASKS /Delete /TN "psv_VilaJob" /F <==== UWAGA
Task: {7574A2B2-D0B8-4412-8C3D-74D7F540B176} - System32\Tasks\psv_SaltLotlex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Vivadox.reg" & del "C:\ProgramData\Plusron\Vivadox.reg" & SCHTASKS /Delete /TN "psv_SaltLotlex" /F <==== UWAGA
Task: {7A94AD13-EF76-48C8-BE45-052234645AFF} - System32\Tasks\psv_Fase-String => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Hotin.reg" & del "C:\ProgramData\Plusron\Hotin.reg" & SCHTASKS /Delete /TN "psv_Fase-String" /F <==== UWAGA
Task: {7BE03441-24CD-4452-8043-6D83066DB303} - System32\Tasks\psv_Softity => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Vialight.reg" & del "C:\ProgramData\Plusron\Vialight.reg" & SCHTASKS /Delete /TN "psv_Softity" /F <==== UWAGA
Task: {7BE3E36E-5574-4BA9-A3D8-D3D3FE81C7D8} - System32\Tasks\psv_Techin => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Haykix.reg" & del "C:\ProgramData\Plusron\Haykix.reg" & SCHTASKS /Delete /TN "psv_Techin" /F <==== UWAGA
Task: {7D14BB3D-8C86-497D-A820-F7B5ECDFC549} - System32\Tasks\psv_Treenix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zenplus.reg" & del "C:\ProgramData\Plusron\Zenplus.reg" & SCHTASKS /Delete /TN "psv_Treenix" /F <==== UWAGA
Task: {7DDA0DEC-9B68-4B0B-A68B-09BA7B9B63E6} - System32\Tasks\psv_S-warm => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Hotdox.reg" & del "C:\ProgramData\Plusron\Hotdox.reg" & SCHTASKS /Delete /TN "psv_S-warm" /F <==== UWAGA
Task: {7E423474-78FB-4E4E-BBA5-57CFACDFE41A} - System32\Tasks\psv_Saootzap => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Ecoit.reg" & del "C:\ProgramData\Plusron\Ecoit.reg" & SCHTASKS /Delete /TN "psv_Saootzap" /F <==== UWAGA
Task: {817AF76A-92D7-4673-A076-A51CFCE78A58} - System32\Tasks\psv_Inchity => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\FreeTouch.reg" & del "C:\ProgramData\Plusron\FreeTouch.reg" & SCHTASKS /Delete /TN "psv_Inchity" /F <==== UWAGA
Task: {83794F07-AD9F-4766-BF5C-9AED124F062A} - System32\Tasks\psv_Strongflex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Redzap.reg" & del "C:\ProgramData\Plusron\Redzap.reg" & SCHTASKS /Delete /TN "psv_Strongflex" /F <==== UWAGA
Task: {84E7D67F-5A0E-4016-B49F-6C82AA7BF254} - System32\Tasks\psv_Hayhold => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\LaEx.reg" & del "C:\ProgramData\Plusron\LaEx.reg" & SCHTASKS /Delete /TN "psv_Hayhold" /F <==== UWAGA
Task: {870858C8-2B58-440D-8259-DF6D07C7CA7A} - System32\Tasks\psv_Sail-Kix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Flex-Fan.reg" & del "C:\ProgramData\Plusron\Flex-Fan.reg" & SCHTASKS /Delete /TN "psv_Sail-Kix" /F <==== UWAGA
Task: {8A4DB6A3-1848-41A5-BFB9-91218C0C666A} - System32\Tasks\psv_Blueovejob => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Quoflex.reg" & del "C:\ProgramData\Plusron\Quoflex.reg" & SCHTASKS /Delete /TN "psv_Blueovejob" /F <==== UWAGA
Task: {8B696D3A-1E9D-4822-A6EB-2E8127AEF039} - System32\Tasks\psv_DripRunlex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Sunlamtam.reg" & del "C:\ProgramData\Plusron\Sunlamtam.reg" & SCHTASKS /Delete /TN "psv_DripRunlex" /F <==== UWAGA
Task: {910A7E8C-6B90-48B6-8DBE-3264E43AE698} - System32\Tasks\psv_Ventohotit => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Superzap.reg" & del "C:\ProgramData\Plusron\Superzap.reg" & SCHTASKS /Delete /TN "psv_Ventohotit" /F <==== UWAGA
Task: {92BD66C5-178C-40D3-AC0F-5817A2F27B0D} - System32\Tasks\psv_StringZap => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Cof-Tough.reg" & del "C:\ProgramData\Plusron\Cof-Tough.reg" & SCHTASKS /Delete /TN "psv_StringZap" /F <==== UWAGA
Task: {93E47BF8-EBBE-4289-AE2D-E2B64ECB35F9} - System32\Tasks\psv_Goldfind => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Geotop.reg" & del "C:\ProgramData\Plusron\Geotop.reg" & SCHTASKS /Delete /TN "psv_Goldfind" /F <==== UWAGA
Task: {A1684121-1B08-4CBE-BCAE-A96AA21F886F} - System32\Tasks\{17A26E37-9117-423E-90BE-7B6D786D6E0D} => pcalua.exe -a C:\Users\Kasia\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cor
Task: {A17DE485-7874-4326-99C6-7DF4CD866CD7} - System32\Tasks\psv_Biodubwarm => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Scottex.reg" & del "C:\ProgramData\Plusron\Scottex.reg" & SCHTASKS /Delete /TN "psv_Biodubwarm" /F <==== UWAGA
Task: {A31C79B9-7878-4D78-B587-4023315ED0C3} - System32\Tasks\psv_Zotphase => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Alphadoning.reg" & del "C:\ProgramData\Plusron\Alphadoning.reg" & SCHTASKS /Delete /TN "psv_Zotphase" /F <==== UWAGA
Task: {A34D2676-33ED-4D4F-A4C9-1322A3A510C4} - System32\Tasks\psv_Ranfax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Fase-Tax.reg" & del "C:\ProgramData\Plusron\Fase-Tax.reg" & SCHTASKS /Delete /TN "psv_Ranfax" /F <==== UWAGA
Task: {A3B95663-44C8-451D-AFC9-EBF96ABB53A5} - System32\Tasks\{6FC9BDBF-A64C-4ACB-9C8F-04B384B4076D} => pcalua.exe -a C:\Users\Kasia\AppData\Roaming\istartsurf\UninstallManager.exe -c -ptid=cornl
Task: {A3CF043A-8628-4AF2-8911-01DBAB37C08B} - System32\Tasks\psv_Voyafix => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\JoyLab.reg" & del "C:\ProgramData\Plusron\JoyLab.reg" & SCHTASKS /Delete /TN "psv_Voyafix" /F <==== UWAGA
Task: {A3D679BF-D2CE-4C54-978B-6765B29BD69A} - System32\Tasks\psv_Keytone => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Groovecore.reg" & del "C:\ProgramData\Plusron\Groovecore.reg" & SCHTASKS /Delete /TN "psv_Keytone" /F <==== UWAGA
Task: {A5517C40-2D3F-43B8-B29D-61A0F5CF7C8B} - System32\Tasks\psv_Betaplus => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Matcom.reg" & del "C:\ProgramData\Plusron\Matcom.reg" & SCHTASKS /Delete /TN "psv_Betaplus" /F <==== UWAGA
Task: {AA371827-0015-4D25-8986-89A14E51BCA1} - System32\Tasks\psv_Unatough => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Roundlam.reg" & del "C:\ProgramData\Plusron\Roundlam.reg" & SCHTASKS /Delete /TN "psv_Unatough" /F <==== UWAGA
Task: {ACDFF6FD-CA6C-433D-B1F5-CC0DD9FE98D5} - System32\Tasks\psv_Zensunit => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Subsing.reg" & del "C:\ProgramData\Plusron\Subsing.reg" & SCHTASKS /Delete /TN "psv_Zensunit" /F <==== UWAGA
Task: {B45ACC8D-3AC7-47AD-9167-8B92C479A4E1} - System32\Tasks\psv_HotTom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Betastatcore.reg" & del "C:\ProgramData\Plusron\Betastatcore.reg" & SCHTASKS /Delete /TN "psv_HotTom" /F <==== UWAGA
Task: {B6F1307A-BF07-4D08-9663-8C795E680701} - System32\Tasks\psv_Lam-Tone => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Redit.reg" & del "C:\ProgramData\Plusron\Redit.reg" & SCHTASKS /Delete /TN "psv_Lam-Tone" /F <==== UWAGA
Task: {B88E3F14-7061-431C-8D1E-4176175D6210} - System32\Tasks\psv_Y-it => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Trandax.reg" & del "C:\ProgramData\Plusron\Trandax.reg" & SCHTASKS /Delete /TN "psv_Y-it" /F <==== UWAGA
Task: {B8F106A8-9BA1-4C23-9B68-34AAAF751359} - System32\Tasks\psv_Stringtom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Damin.reg" & del "C:\ProgramData\Plusron\Damin.reg" & SCHTASKS /Delete /TN "psv_Stringtom" /F <==== UWAGA
Task: {B9EF803D-2EF6-4DD8-92A3-FE8279529005} - System32\Tasks\psv_Siltax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zummadamwarm.reg" & del "C:\ProgramData\Plusron\Zummadamwarm.reg" & SCHTASKS /Delete /TN "psv_Siltax" /F <==== UWAGA
Task: {BE46D3E7-62F2-48C4-8A0C-363A4E94C39F} - System32\Tasks\psv_Candomtop => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Softfind.reg" & del "C:\ProgramData\Plusron\Softfind.reg" & SCHTASKS /Delete /TN "psv_Candomtop" /F <==== UWAGA
Task: {BFDAC33D-51C3-4D4E-A15B-B7C3330387AF} - System32\Tasks\psv_Groovelax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Opentancof.reg" & del "C:\ProgramData\Plusron\Opentancof.reg" & SCHTASKS /Delete /TN "psv_Groovelax" /F <==== UWAGA
Task: {C0DF0728-C0F3-45AA-895E-043997BF3745} - System32\Tasks\psv_GoldIn => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\HayTrax.reg" & del "C:\ProgramData\Plusron\HayTrax.reg" & SCHTASKS /Delete /TN "psv_GoldIn" /F <==== UWAGA
Task: {C10A70D6-3005-4F5B-9E36-765C50D967F6} - System32\Tasks\{820BF6B5-3C01-4E43-B97B-AC74377E1FD5} => pcalua.exe -a C:\Users\Kasia\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cor
Task: {C808B9EF-5D96-4A81-A4CC-F876A70A0B86} - System32\Tasks\psv_TrueZoosoft => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Mednix.reg" & del "C:\ProgramData\Plusron\Mednix.reg" & SCHTASKS /Delete /TN "psv_TrueZoosoft" /F <==== UWAGA
Task: {C90C3290-6992-4A38-AC0F-2DCCC640722A} - System32\Tasks\psv_Yearlax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Matnix.reg" & del "C:\ProgramData\Plusron\Matnix.reg" & SCHTASKS /Delete /TN "psv_Yearlax" /F <==== UWAGA
Task: {CC2FECEC-A3E8-43AD-B616-920F60D45E8B} - System32\Tasks\psv_Zaamstring => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Y-Ovetrax.reg" & del "C:\ProgramData\Plusron\Y-Ovetrax.reg" & SCHTASKS /Delete /TN "psv_Zaamstring" /F <==== UWAGA
Task: {CD3B05AF-343A-4177-840E-7118E385D455} - System32\Tasks\psv_Techtop => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Bioity.reg" & del "C:\ProgramData\Plusron\Bioity.reg" & SCHTASKS /Delete /TN "psv_Techtop" /F <==== UWAGA
Task: {CE41A757-9153-408F-BD03-D4C5B1D10CB3} - System32\Tasks\psv_Whitetouch => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\StrongTraxtom.reg" & del "C:\ProgramData\Plusron\StrongTraxtom.reg" & SCHTASKS /Delete /TN "psv_Whitetouch" /F <==== UWAGA
Task: {CE81F73C-E2B6-4D2D-9916-DD4348216B08} - System32\Tasks\psv_Domlab => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Lacore.reg" & del "C:\ProgramData\Plusron\Lacore.reg" & SCHTASKS /Delete /TN "psv_Domlab" /F <==== UWAGA
Task: {D0390790-8933-4858-BD09-BBCBCFF925C9} - System32\Tasks\psv_Templex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\StatLax.reg" & del "C:\ProgramData\Plusron\StatLax.reg" & SCHTASKS /Delete /TN "psv_Templex" /F <==== UWAGA
Task: {D512ED51-CA3A-47DD-ABA0-8E924DEFD080} - System32\Tasks\psv_Zundax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\KinSaillight.reg" & del "C:\ProgramData\Plusron\KinSaillight.reg" & SCHTASKS /Delete /TN "psv_Zundax" /F <==== UWAGA
Task: {D7849BAF-406E-4755-B2CB-5D124A27A5F5} - System32\Tasks\psv_InchHold => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Solofax.reg" & del "C:\ProgramData\Plusron\Solofax.reg" & SCHTASKS /Delete /TN "psv_InchHold" /F <==== UWAGA
Task: {DC3B6265-1884-43D3-A0C1-A38D7E61155D} - System32\Tasks\psv_Faselab => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Dontone.reg" & del "C:\ProgramData\Plusron\Dontone.reg" & SCHTASKS /Delete /TN "psv_Faselab" /F <==== UWAGA
Task: {E24F8D32-4319-4870-86D9-144E4317A485} - System32\Tasks\psv_Tiptam => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\CanRemfind.reg" & del "C:\ProgramData\Plusron\CanRemfind.reg" & SCHTASKS /Delete /TN "psv_Tiptam" /F <==== UWAGA
Task: {E377B3C7-D856-432C-87DA-E8E2C31FB4C0} - System32\Tasks\psv_Med-Dex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Zenex.reg" & del "C:\ProgramData\Plusron\Zenex.reg" & SCHTASKS /Delete /TN "psv_Med-Dex" /F <==== UWAGA
Task: {E38BF607-D940-4C9C-8637-711B74053E0A} - System32\Tasks\psv_Dentocom => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Rontech.reg" & del "C:\ProgramData\Plusron\Rontech.reg" & SCHTASKS /Delete /TN "psv_Dentocom" /F <==== UWAGA
Task: {E541F364-4A57-45D3-8EE7-191CAE3095E2} - System32\Tasks\psv_Ranphase => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\SolFlex.reg" & del "C:\ProgramData\Plusron\SolFlex.reg" & SCHTASKS /Delete /TN "psv_Ranphase" /F <==== UWAGA
Task: {E6A971DC-F644-4E2C-B49B-50D4AF740FD7} - System32\Tasks\psv_Blackotdox => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Contax.reg" & del "C:\ProgramData\Plusron\Contax.reg" & SCHTASKS /Delete /TN "psv_Blackotdox" /F <==== UWAGA
Task: {F082EDF0-026E-4544-92BD-71B4CCEC981F} - System32\Tasks\psv_Domfintip => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Injob.reg" & del "C:\ProgramData\Plusron\Injob.reg" & SCHTASKS /Delete /TN "psv_Domfintip" /F <==== UWAGA
Task: {F1231995-D390-426C-B592-07F4204B7966} - System32\Tasks\psv_Greeneco => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Donlight.reg" & del "C:\ProgramData\Plusron\Donlight.reg" & SCHTASKS /Delete /TN "psv_Greeneco" /F <==== UWAGA
Task: {F28FCE6B-3406-4217-9598-810590D8A820} - System32\Tasks\psv_Xxx-string => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Rankdex.reg" & del "C:\ProgramData\Plusron\Rankdex.reg" & SCHTASKS /Delete /TN "psv_Xxx-string" /F <==== UWAGA
Task: {F4CC434D-1503-4D87-9EC9-127708ED5FD2} - System32\Tasks\psv_Finex => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Tipzap.reg" & del "C:\ProgramData\Plusron\Tipzap.reg" & SCHTASKS /Delete /TN "psv_Finex" /F <==== UWAGA
Task: {F6A55DE4-CE94-4A60-80C7-82AFF231633B} - System32\Tasks\psv_Jaytough => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Tandox.reg" & del "C:\ProgramData\Plusron\Tandox.reg" & SCHTASKS /Delete /TN "psv_Jaytough" /F <==== UWAGA
Task: {F7BB76E2-4716-45F9-9B59-9B6C44C9E642} - System32\Tasks\psv_Sum-Dax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Haystring.reg" & del "C:\ProgramData\Plusron\Haystring.reg" & SCHTASKS /Delete /TN "psv_Sum-Dax" /F <==== UWAGA
Task: {FC1BA70E-BA36-421B-A2DB-3E70E79B5C55} - System32\Tasks\psv_Big-Ing => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\CofCanstrong.reg" & del "C:\ProgramData\Plusron\CofCanstrong.reg" & SCHTASKS /Delete /TN "psv_Big-Ing" /F <==== UWAGA
Task: {FDD15953-76BE-48B0-97D0-72D3470920C9} - System32\Tasks\psv_TrustDanlax => cmd.exe /c regedit.exe /s "C:\ProgramData\Plusron\Dontouch.reg" & del "C:\ProgramData\Plusron\Dontouch.reg" & SCHTASKS /Delete /TN "psv_TrustDanlax" /F <==== UWAGA
AppInit_DLLs: C:\ProgramData\Plusron\X-ity.dll => C:\ProgramData\Plusron\X-ity.dll [805376 2015-12-24] ()
AppInit_DLLs-x32: C:\ProgramData\Plusron\Matphase.dll => C:\ProgramData\Plusron\Matphase.dll [257536 2015-12-24] ()
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
C:\ProgramData\Plusron
HKU\S-1-5-21-2389162506-1018299209-953398408-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csuRBClYKurOPOVCPlzEb8EH80VanSbkLIm5TkJPpF5vX3tNkl1NzNzdiiZFNwK29WdsENexZiXSjIg6I3am7wlhAQHAcQXEsvqZ1YM2NaftBfc0ByP1eac1S4FOajVBJSBc4ifY459hEw,,&q={searchTerms}
HKU\S-1-5-21-2389162506-1018299209-953398408-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csuRBClYKurOPOVCPlzEb8EH80VanSbkLIm5TkJPpF5vX3tNkl1NzNzdiiZFNwK29WvHWQYndyrlF3tTujHHxCppbf2TW_9zDi5Iyks9ugeb3sBH_IviqHFNm0xrUDhou91byO9smQS7KA,,
HKU\S-1-5-21-2389162506-1018299209-953398408-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csuRBClYKurOPOVCPlzEb8EH80VanSbkLIm5TkJPpF5vX3tNkl1NzNzdiiZFNwK29WdsENexZiXSjIg6I3am7wlhAQHAcQXEsvqZ1YM2NaftBfc0ByP1eac1S4FOajVBJSBc4ifY459hEw,,&q={searchTerms}
HKU\S-1-5-21-2389162506-1018299209-953398408-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csuRBClYKurOPOVCPlzEb8EH80VanSbkLIm5TkJPpF5vX3tNkl1NzNzdiiZFNwK29WdsENexZiXSjIg6I3am7wlhAQHAcQXEsvqZ1YM2NaftBfc0ByP1eac1S4FOajVBJSBc4ifY459hEw,,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
BHO-x32: Brak nazwy -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> Brak pliku
CHR Extension: (PageEdit) - C:\Users\Kasia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ebkclgoaabaibghklgknnjdemknjaeic [2015-12-27]
CHR Extension: (PageEdit) - C:\Users\Kasia\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ebkclgoaabaibghklgknnjdemknjaeic [2015-12-27]
CHR Extension: (Bing) - C:\Users\Kasia\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\fcfenmboojpjinhpgggodefccipikbpd [2015-12-27]
OPR Extension: (Filter Results) - C:\Users\Kasia\AppData\Roaming\Opera Software\Opera Stable\Extensions\cenzura! [2015-08-25]
S2 Plusron; C:\ProgramData\\Plusron\\Plusron.exe -f "C:\ProgramData\\Plusron\\Plusron.dat" -l -a
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).
Powstanie plik fixlog.txt.
Daj ten log.

Zrób nowe logi FRST.
.

Autor postu otrzymał pochwałę

**Posty:** 151 · przez **matix56** 28 Gru 2015, 00:16

Fixlog: http://wklej.org/id/1888506/

Nowe logi
Addiction : http://wklej.org/id/1888509/
Frst: http://wklej.org/id/1888510/

**Posty:** 4765 · przez **ordynat** 28 Gru 2015, 00:27

Otwórz Notatnik i wklej w nim:

testsigning: ==> Ustawiony "Tryb testu". Sprawdź obecność niepodpisanego sterownika <===== UWAGA
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

To powyższe jest efektem tego Rootkita, który już został usunięty przez TDSSKillera.

zrób nowe logi FRST - zobaczymy, czy "testsigning" się naprawi?
.

C:\Windows\SysWOW64\svchost.exe BRAK <==== UWAGA

natomiast brak tego pliku Systemowego nie naprawi się.

Uruchom FRST.
W polu SEARCH (SZUKAJ) wklej:

svchost.exe

kliknij na przycisk "Search Files (Szukaj Plików)".
Raport z tego będzie tam, gdzie jest FRST.
.

.

Autor postu otrzymał pochwałę

**Posty:** 151 · przez **matix56** 28 Gru 2015, 00:40

Fixlog : http://wklej.org/id/1888529/

Nowe logi
Addiction: http://wklej.org/id/1888541/
Frst: http://wklej.org/id/1888542/
Z brakiem pliku systemowego mogę coś zrobić ?
Wgrać go manualnie ?

Log search: http://wklej.org/id/1888545/

**Posty:** 4765 · przez **ordynat** 28 Gru 2015, 01:01

Widzę, że są zapasowe pliki, ale nie wiem, który z nich jest do Systemu 64 bit - ja nie mam takiego Systemu, więc nie mam możliwości porównania tego.
Nic tu nie wymyślę.
Ale na Systemie 32 bit wszystko powinno już być OK.
.

Autor postu otrzymał pochwałę

**Posty:** 151 · przez **matix56** 28 Gru 2015, 01:02

ok czyli już wszystko dobrze oprócz tego brakującego pliku ?

**Posty:** 4765 · przez **ordynat** 28 Gru 2015, 01:19

tak, OK

Kto jest na forum