icar

Przepraszam ze odpowiadam dopiero teraz, fix mi pomógł, dziękuję Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015 Ran by icar at 2015-02-23 08:07:39 Run:2 Running from C:\Users\icar\Desktop Loaded Profiles: icar (Available profiles: icar) Boot Mode: Normal ============================================== Content of fixlist: ***************** CloseProcesses: CreateRestorePoint: CMD: ipconfig /flushdns Reg: reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f SearchScopes: HKU\S-1-5-21-1084307622-131046002-2435356648-1002 -> {73C68E13-826B-41AA-B913-A13797172EA8} URL = FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec EmptyTemp: ***************** Processes closed successfully. Restore point was successfully created. ========= ipconfig /flushdns ========= Windows IP Configuration Successfully flushed the DNS Resolver Cache. ========= End of CMD: ========= ========= reg delete "HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomylnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomylnie. ========= End of Reg: ========= ========= reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f ========= Operacja ukoäczona pomylnie. ========= End of Reg: ========= "HKU\S-1-5-21-1084307622-131046002-2435356648-1002\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{73C68E13-826B-41AA-B913-A13797172EA8}" => Key deleted successfully. HKCR\CLSID\{73C68E13-826B-41AA-B913-A13797172EA8} => Key not found. HKLM\Software\Wow6432Node\Mozilla\Thunderbird\Extensions\\msktbird@mcafee.com => value deleted successfully. C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyFree Codec => Moved successfully. EmptyTemp: => Removed 1.1 GB temporary data. The system needed a reboot. ==== End of Fixlog 08:09:42 ====

Mam komputer zainfekowany adultyum.info. Co jakiś czas iexploer oraz opera przy otwieraniu nowego okna otwiera odnośnik do tej strony. Zmieniłem w ruterze dns na 8.8.8.8. i 8.8.4.4., zresetowałem go, zmieniłem hasło i wyłączyłem zdalne sterowanie. Nie pomogło. Malware działa bardzo nieregularnie. Czasem okno otwiera się co chwilę a czasem dzień czy dwa jest w porządku. Żona korzysta z tego samego rutera i nie ma żadnych problemów. GMER.txt Shortcut.txt FRST.txt Addition.txt