Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja:12-12-2015 01
Uruchomiony przez Lenovo-PC (2015-12-12 20:40:21) Run:1
Uruchomiony z C:\Users\Lenovo-PC\Desktop
Załadowane profile: Lenovo-PC (Dostępne profile: Lenovo-PC)
Tryb startu: Normal
==============================================

fixlist - zawartość:
*****************
CloseProcesses:
CreateRestorePoint:
R2 IhPul; C:\Users\Lenovo-PC\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [170144 2015-11-27] (TODO: <???>)
R2 WdMan; C:\ProgramData\5WdM5\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
ShortcutWithArgument: C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.omniboxes.com/?type=sc&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.omniboxes.com/?type=sc&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958 <==== UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
HKU\S-1-5-21-622813587-3895099335-1296654335-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
HKU\S-1-5-21-622813587-3895099335-1296654335-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKU\S-1-5-21-622813587-3895099335-1296654335-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.omniboxes.com/?type=hp&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
HKU\S-1-5-21-622813587-3895099335-1296654335-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1448351026&z=578139254da48c1b65cf6d0g6z0zcbdc3wdgbe8ocb&from=ient07031&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKU\S-1-5-21-622813587-3895099335-1296654335-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
SearchScopes: HKU\S-1-5-21-622813587-3895099335-1296654335-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
BHO-x32: Sonic Train -> {0c3ddfb7-4cdb-495b-b3e9-d59725b43dfc} -> C:\Program Files (x86)\Sonic Train\Extensions\0c3ddfb7-4cdb-495b-b3e9-d59725b43dfc.dll => Brak pliku
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mystartsearch.com/?type=sc&ts=1443819225&z=fb9ebbf736721c8c112ae5bg5z4z4ccb1g0t0e4o8w&from=cor&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\Lenovo-PC\AppData\Roaming\Mozilla\Firefox\Profiles\5jsk89mv.default\extensions\defsearchp@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Lenovo-PC\AppData\Roaming\Mozilla\Firefox\Profiles\5jsk89mv.default\extensions\deskCutv2@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Lenovo-PC\AppData\Roaming\Mozilla\Firefox\Profiles\5jsk89mv.default\extensions\default_newtabff@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\Lenovo-PC\AppData\Roaming\Mozilla\Firefox\Profiles\5jsk89mv.default\extensions\yahooprotected@gmail.com => nie znaleziono
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
CHR HomePage: Default -> hxxp://www.yoursites123.com/?type=hp&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
CHR StartupUrls: Default -> "hxxp://www.yoursites123.com/?type=hp&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958"
CHR DefaultSearchURL: Default -> hxxp://www.yoursites123.com/web/?type=ds&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958&q={searchTerms}
CHR DefaultSearchKeyword: Default -> yoursites123
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-12-06]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1449856463&z=6ab0e21243cdd679478ff83g4z8z7t4b2w0q8z6q5m&from=ient07021&uid=ST750LM022XHN-M750MBB_S2R9JX0F100958
Task: {443FCE76-AD20-4A4F-9787-6B63C3FCB6AC} - System32\Tasks\{EFD5877A-9BAE-47C1-AC62-D7081DF2B4F7} => pcalua.exe -a C:\Users\Lenovo-PC\AppData\Roaming\mystartsearch\UninstallManager.exe -c -ptid=cor
Reg: reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "DAEMON Tools Lite Automount"
DeleteKey: HKCU\Software\1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1I
DeleteKey: HKCU\Software\dobreprogramy
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software
RemoveDirectory: C:\Program Files (x86)\SFK
RemoveDirectory: C:\ProgramData\5WdM5
RemoveDirectory: C:\ProgramData\lWMiniProl
RemoveDirectory: C:\Users\Lenovo-PC\AppData\Roaming\eCyber
RemoveDirectory: C:\Users\Lenovo-PC\AppData\Roaming\TSv
CMD: del /q C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
CMD: del /q "C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa.lnk"
CMD: del /q "C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Picexa (2).lnk"
CMD: del /q "C:\Users\Lenovo-PC\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\DAEMON Tools Lite.lnk"
CMD: del /q C:\Windows\SysWOW64\pl.html
CMD: del /q C:\Windows\SysWOW64\pl8.exe
EmptyTemp:
*****************

Procesy zostały pomyślnie zamknięte.