Proszę o sprawdzenie loga

[jelon1]

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:53:09, on 2015-10-19
Platform: Unknown Windows (WinNT 6.02.1008)
MSIE: Internet Explorer v11.0 (11.00.9600.17840)


Boot mode: Normal

Running processes:
C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
c:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.EXE
C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Windows\SysWOW64\RunDll32.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Users\Sylwia\Downloads\HijackThis_2.0.4.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1438193145&z=ffc5d9f7afa6fae9a913ac7g5z1cfbdg6tac6gce6g&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS&q={searchTerms}
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1438193145&z=ffc5d9f7afa6fae9a913ac7g5z1cfbdg6tac6gce6g&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS&q={searchTerms}
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dspp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS&q={searchTerms}
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dspp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS&q={searchTerms}
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1438193172&z=61635131b6372d47561354ag0zbcbb8gdteceg5o2b&from=cornl&uid=TOSHIBAXMQ01ABD075_Y37AS2WSSXXY37AS2WSS
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\Sony\MSS\3.8.141\McAfeeMSS_IE.dll
O2 - BHO: GoodTab Class - {1F91A9A1-01BA-4c81-863D-3BA0751E1419} - C:\Program Files (x86)\MiuiTab\SupTab.dll
O2 - BHO: Skype for Business Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~1\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [PMBVolumeWatcher] "C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe"
O4 - HKLM\..\Run: [Adobe ARM] "c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
O4 - HKCU\..\Run: [HP Deskjet 5520 series (NET)] "C:\Program Files\HP\HP Deskjet 5520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2A61B0QP05SX:NW" -scfn "HP Deskjet 5520 series (NET)" -AutoStart 1
O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe" "sleep"
O4 - HKCU\..\Run: [ALLPlayer WiFi Remote] C:\Program Files (x86)\ALLPlayer Remote\ALLPlayerRemoteControl.exe
O4 - HKCU\..\Run: [Napisy24.pl] "C:\Program Files (x86)\Napisy24\Napisy24.exe" AutoStart
O4 - HKUS\S-1-5-18\..\RunOnce: [Application Restart #0] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Application Restart #0] C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe /Crashed (User 'Default user')
O4 - Startup: Powiadomienia monitorowania tuszu - HP Deskjet 5520 series (sieć).lnk = ?
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~1\MICROS~1\Office15\ONBttnIE.dll/105
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Lync — kliknij, aby połączyć - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync — kliknij, aby połączyć - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\Windows\SysWOW64\nvinit.dll
O23 - Service: Adobe Active File Monitor V12 (AdobeActiveFileMonitor12.0) - Adobe Systems Incorporated - c:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avast Antivirus (avast! Antivirus) - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: @oem12.inf,%BlueBcmBtRSupport.SVCNAME%;Bluetooth Driver Management Service (BcmBtRSupport) - Unknown owner - C:\Windows\system32\BtwRSupportService.exe (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - c:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
O23 - Service: Intel(R) Content Protection HECI Service (cphs) - Intel Corporation - C:\Windows\SysWow64\IntelCpHeciSvc.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Ser

[kolobos]

Skad Ci przyszlo do glowy zeby wklejac ten bezuzyteczny log? Nie mowiac juz o zamieszczenu go w tresci!

Wroc jak juz uda Ci sie przeczytac podwieszony watek i zastosowac sie do niego.

[jelon1]

No tak wiedziałem że coś pomieszam.
Już wiele lat nie korzystałem z pomocy na tym forum i chyba a raczej na pewno zapomniałem jak to się robi z tym logiem a niestety jestem laikiem w tych sprawach.
A czy kolega jest w stanie mi pomóc tzn. Poprowadzć krok po kroku co mam robić

[Gość: Kolobos]

Przeciez wisi: forum.gazeta.pl/forum/w,430,158577428,158577428,Prosze_przeczytac_PRZED_napisaniem_.html wystarczy przeczytac i sie zastosowac. Ale po co, jak mozna wkleic byle co i byle jak...

[jelon1]

To nie tak że byle co i byle jak. Porostu nie zauważyłem. A wkleiłem tak jak mi się wydawało że robiłem kiedyś przez program Hijack This. No ale nie ważne. Mój błąd.
Mam nadzieję, że teraz będzie OK
wklej.org/id/1821781/

[kolobos]

Obok frst.exe utworz plik fixlist.txt z zawartoscia:
(tsvr.com) C:\Users\Sylwia\AppData\Roaming\TSv\TSvr.exe
HKLM-x32\...\Run: [NPSStartup] => [X]
)URLSearchHook: [S-1-5-21-460541274-1978445107-2237203190-1001] UWAGA => Brak domyślnego URLSearchHook
R2 IhPul; C:\Users\Sylwia\AppData\Roaming\TSv\TSvr.exe [396944 2015-09-21] (tsvr.com)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
2015-10-19 21:26 - 2015-10-21 11:32 - 00000000 ____D C:\AdwCleaner
2015-10-19 21:01 - 2015-10-19 20:52 - 00388608 _____ (Trend Micro Inc.) C:\Users\Sylwia\Downloads\HijackThis_2.0.4.exe
2015-10-19 20:53 - 2015-10-19 20:53 - 00014907 _____ C:\Users\Sylwia\Downloads\hijackthis.log
2015-09-21 09:27 - 2015-10-12 08:56 - 00000000 ____D C:\Users\Sylwia\AppData\Roaming\TSv
2015-08-25 18:20 - 2015-08-25 18:20 - 0000000 ____H () C:\Users\Sylwia\AppData\Local\BITC9CF.tmp
2015-10-12 08:54 - 2015-10-12 08:54 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:

W FRST wybierz Napraw.

Usun katalog C:\FRST i to wszystko.

[jelon1]

zrobione
dzięki za pomoc