Wirus? Problem z nagraniem płyty w Alcoholu [Windows 8.1]

[Zimnafuzja]

Mam problem z nagraniem płyty w programie Alcohol, wyskakuje taki komunikat:

Malwarebytes wykrył wirusy kilka dni temu. Z Google dowiedziałem się, że brakuje jakichś bibliotek, ale kompletnie nie wiem co dalej.

[Ark223]

Podeslij brakujace logi z FRST

[Zimnafuzja]

Fakt, zapomniałem dodać.

Addition.txt

FRST.txt

[jessica]

Nie sadzę, by problem był wynikiem jakiegoś "wirusa".

 

1) Otwórz Notatnik i wklej w nim:

 

Task: {7C8EEE2F-3B77-44C7-83FF-B150442228DA} - System32\Tasks\GestureControls => c:\programdata\{f2b250ba-e551-9bb4-f2b2-250bae5542eb}\rimworldalpha11win.zip.exe <==== ATTENTION
Task: {6F4A47FE-FE5E-4466-9355-08642AB8BF1C} - System32\Tasks\{5CAFEF63-DF37-4B4F-9BB0-C829456F8A6D} => pcalua.exe -a "C:\ProgramData\Battle.net\Agent\Blizzard Uninstaller.exe" -c --lang=enGB --uid=wow_engb "--displayname=World of Warcraft"
Task: {B16D68EB-816B-48F8-885D-911D92F48C50} - System32\Tasks\{6A71D823-C651-4573-B6E2-FF6BFFF250D3} => pcalua.exe -a G:\setup.exe -d G:\ -c /autorun
Task: C:\WINDOWS\Tasks\CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}.job => C:\ProgramData\cis5574.exe <==== ATTENTION
Task: C:\WINDOWS\Tasks\GestureControls.job => c:\programdata\{f2b250ba-e551-9bb4-f2b2-250bae5542eb}\rimworldalpha11win.zip.exe <==== ATTENTION
c:\programdata\{f2b250ba-e551-9bb4-f2b2-250bae5542eb}
C:\ProgramData\cis5574.exe
HKLM\...\Run: [CIS_{81EFDD93-DBBE-415B-BE6E-49B9664E3E82}] => "C:\ProgramData\cis5574.exe" --PostUninstall {81EFDD93-DBBE-415B-BE6E-49B9664E3E82}
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
S4 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
S4 X6va022; \??\C:\WINDOWS\SysWOW64\Drivers\X6va022 [X]
S3 X6va029; \??\C:\WINDOWS\SysWOW64\Drivers\X6va029 [X]
C:\ProgramData\SetStretch.VBS
Reg: reg query "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32" /s
Reg: reg query "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s
Reg: reg query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s
Reg: reg query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32" /s
Reg: reg query "HKLM\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32" /s
Reg: reg query "HKLM\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s

File: C:\Windows\System32\ExplorerFrame.dll

File: C:\Windows\SysWOW64\ExplorerFrame.dll
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.
Powstanie plik fixlog.txt.
Daj ten log.

 

2)

HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\wDJVrrp0Lax6.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatehu] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\x1SSjuc1eS7J.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update33] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\VGvFE82JnlHb.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatevF] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\vFzR7Yi3k8Gn.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatejR] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\yYGSlFIWkbby.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateQw] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\QwjzdCou1oUd.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateXL] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\hvPwmOYpEGhC.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatezl] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\zlFW6iaFLqpE.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatehJ] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\xQ8W3xPNtqWM.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update0c] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\oXgWUkI8wzQL.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateAd] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\78HIPHgybxRf.exe [691712 2015-06-21] (Piriform Ltd)

W Autostarcie są te pliki o bardzo egzotycznych nazwach.

Sprawdź je na --> JOTTI/ albo na VIRUSTOTAL
 

Uruchom FRST.
W polu SEARCH wklej:

 

{56FDF344-FD6D-11d0-958A-006097C9A090}

kliknij na przycisk "Search Registry".
Raport z tego będzie tam, gdzie jest FRST.

 

jessi

[Zimnafuzja]

Folder Updates jest pusty, ale w momencie kiedy wchodzę do folderu Roaming, Malwarebytes wykrywa mi wirusa.

Fixlog.txt

Search.txt

[jessica]

To, co wykrył MBAM - to rzeczywiscie bylo do usuniecia, bo w tej lokalizacji nie powinno być żadnego pliku *exe.

 

Otwórz Notatnik i wklej w nim:

 

HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\wDJVrrp0Lax6.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatehu] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\x1SSjuc1eS7J.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update33] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\VGvFE82JnlHb.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatevF] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\vFzR7Yi3k8Gn.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatejR] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\yYGSlFIWkbby.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateQw] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\QwjzdCou1oUd.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateXL] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\hvPwmOYpEGhC.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatezl] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\zlFW6iaFLqpE.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updatehJ] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\xQ8W3xPNtqWM.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [update0c] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\oXgWUkI8wzQL.exe [691712 2015-06-21] (Piriform Ltd)
HKU\S-1-5-21-682190183-1733021988-2840179151-1001\...\Run: [updateAd] => C:\Users\Jimi Hendrix\AppData\Roaming\Updates\78HIPHgybxRf.exe [691712 2015-06-21] (Piriform Ltd)
C:\Users\Jimi Hendrix\AppData\Roaming\Updates
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix.

 

 

========= reg query "HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s =========


HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32



========= End of Reg: =========


========= reg query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s =========


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32



========= End of Reg: =========


========= reg query "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32" /s =========




========= End of Reg: =========


========= reg query "HKLM\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32" /s =========


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\explorerframe.dll
    ThreadingModel    REG_SZ    Apartment



========= End of Reg: =========


========= reg query "HKLM\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}" /s =========


HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}
    (Default)    REG_SZ    Task Bar Communication

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\explorerframe.dll
    ThreadingModel    REG_SZ    Apartment



========= End of Reg: =========


========================= File: C:\Windows\System32\ExplorerFrame.dll ========================

MD5: 711D110F426EF6C2E705AE1E749F8F02
Creation and modification date: 2015-07-15 11:17 - 2015-05-07 19:00
Size: 3109376
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: ExplorerFrame
Original Name: ExplorerFrame.dll.mui
Product Name: System operacyjny Microsoft® Windows®
Description: ExplorerFrame
File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
Product Version: 6.3.9600.16384
Copyright: © Microsoft Corporation. Wszelkie prawa zastrzeżone.

====== End of File: ======


========================= File: C:\Windows\SysWOW64\ExplorerFrame.dll ========================

MD5: 00E077C85F64897F5A4B093DD45CDE93
Creation and modification date: 2015-07-15 11:17 - 2015-05-07 18:12
Size: 2706432
Attributes: ----A
Company Name: Microsoft Corporation
Internal Name: ExplorerFrame
Original Name: ExplorerFrame.dll.mui
Product Name: System operacyjny Microsoft® Windows®
Description: ExplorerFrame
File Version: 6.3.9600.16384 (winblue_rtm.130821-1623)
Product Version: 6.3.9600.16384
Copyright: © Microsoft Corporation. Wszelkie prawa zastrzeżone.

====== End of File: ======

te dane z "fixlog.txt" zostawiam dla osoby, która zajmie się Twoim głównym problemem, czyli wyskakiwaniem komunikatu przy próbie nagrania płyty.

Natomiast biblioteki "ExplorerFrame.dll" wyglądaja na OK.

 

TAeraz pozostaje Ci czekanie, aż @Picasso albo sama zajmie się problemem, albo przesunie temat do odpowiedniego działu forum.

Niestety, nie wiadomo, kiedy @Picasso będzie w stanie pomagac (długotrwała choroba).

 

jessi