Niechciane stronki w Operze

[tom615]

Witam

Mam problem z Operą. Co jakiś czas pojawiają się mi się niechciane stronki. Co lepsze, nie mogłem ostatnio otwierać stronek internetowych mających w nazwie malware. Blokowało mi to programy typu MalwareBytes i Addcleanera i CCleanera.Problem częściowo się poprawił, gdy odinstalowałem Opere, lecz znowu powrócił.

Proszę o Pomoc

Pozdrawiam

Tom

FRST.txt

Shortcut.txt

Addition.txt

[jessica]

Task: {2B87AB99-A8EE-4A5C-997E-C6E3DA42A2DB} - System32\Tasks\{A67399B2-2EA6-CB9B-711E-3A1FBAD96062} => C:\Users\user\AppData\Roaming\fDEkXxWIiizuu.exe [2018-04-12] (Microsoft Corporation) <==== UWAGA

Jest popularna ostatnio infekcja.

 

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.

Otworzy się Notatnik - wklej do niego:

 

Task: {2B87AB99-A8EE-4A5C-997E-C6E3DA42A2DB} - System32\Tasks\{A67399B2-2EA6-CB9B-711E-3A1FBAD96062} => C:\Users\user\AppData\Roaming\fDEkXxWIiizuu.exe [2018-04-12] (Microsoft Corporation) <==== UWAGA

Task: {68978E08-734C-469F-AFEC-D8A055FEFD2F} - System32\Tasks\{5CAC1F87-4D16-F4F3-A201-AC6FDCAB5419} => C:\WINDOWS\YAGyUri.exe [2018-04-12] (Microsoft Corporation)

C:\WINDOWS\SysWOW64\GoJyKeHEcrUa.exe

C:\Users\user\AppData\Roaming\fDEkXxWIiizuu.exe

C:\Users\user\oBUHOOUyUYvuj.exe

C:\WINDOWS\YAGyUri.exe

C:\Users\user\oAOotgo.exe

C:\Users\user\oBUHOOUyUYvuj.exe

C:\Users\user\WQyIAXivBECau.exe

C:\Program Files (x86)\yvairoEuIDiO.exe

C:\Program Files (x86)\Common Files\cyiudPaqEre.exe

C:\Users\user\AppData\Roaming\fDEkXxWIiizuu.exe

FirewallRules: [{A2F11096-2035-410B-9C3B-0D1AC30ACCE3}] => (Allow) C:\WINDOWS\SysWOW64\msiexec.exe

FirewallRules: [{5C099E8F-3DF5-49FA-B198-DD695AE8D65D}] => (Allow) C:\WINDOWS\SysWOW64\GoJyKeHEcrUa.exe

FirewallRules: [{F6305413-0AFC-488B-9A35-BD534528E9E2}] => (Allow) C:\Users\user\oBUHOOUyUYvuj.exe

FirewallRules: [{51314561-0A27-4C9F-AC49-B85FB3FFFA9C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{900D4C60-DF49-49CC-9456-AE6124305BBA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{228E988A-DFC5-47F4-82DE-C8997B6087FC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{89442083-E0EE-4FA7-A19E-9E6C0556357D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{D4D0B14B-8EFE-4CF5-89FF-9BB196D6BCB2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{9EF434FF-0985-4B75-A804-4A00ABF02F44}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{788B7297-6305-41B2-BF49-8F09AB3F7A48}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{7348D3A3-C638-4B62-B1E6-FE692D81A9A4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{B697C8C9-653A-4767-BC5D-8E28B6022E2E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{5C6790AD-6AA1-4726-A785-B513A6D57A9A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{3D582D17-74C3-4A07-BB9E-CA3B3A40E596}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{C40192C5-ED5C-4E40-8FD5-B3DA7216E893}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{D5A9F070-7C83-4988-8783-7107E73A8FCC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{B0E9C33C-A954-4F4C-AA1C-AD8D0D5B0836}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{025AA760-0894-4ADB-8932-27427A69042F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{55F13BFD-EA42-410F-965B-F9CAD816F2A9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{41AFD95E-73A5-4310-A2A9-364495932EF3}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{3E8CADB0-4A53-427E-A536-9E826C0DC3BE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{BDEB5217-2219-44F6-8136-4BAA0684F5C5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{C90B4C4B-BD8A-4F2E-8027-AAF389C21B0F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{1566B519-D2B1-4A54-B3DE-D721FA00957F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{30E1A72E-7E54-4732-9665-A0CD196B7C94}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{F8B1683C-58C1-4680-B17E-99F3D3EF7089}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{2FCB9659-6142-4B18-82EA-AAB13CC09A02}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{5BC1B1D9-E92E-411C-ACE3-05C129E0EE82}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{35198A39-D82A-4C30-AE35-5917C66DB49D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{FE039CA2-012D-4DBF-A2AD-2F7A9A600DA1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{1CD5F035-8218-486D-9CB8-4687EEEE305D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{F9B075B1-FC41-41FA-BDBD-9EF7409BBE60}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{0119FC55-B77F-4426-99E7-674346382734}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{E5491618-FBC9-43D5-AE2B-4AACB876B0BA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{D595A49B-2EAA-4EF1-8B4A-993D01630D2F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{49873520-8CC3-4DDA-ADFB-2ED75A713367}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{5391D7AA-A6A1-4283-856F-FEAF16B517A8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{DD56CF53-5BD7-4A0E-B9B4-2C733091F287}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{A151778A-2422-47FC-B6C0-C8E76A6C97E8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{8B3407FC-16F6-4CE7-8F63-FF765C07F14C}] => (Allow) C:\WINDOWS\SysWOW64\msiexec.exe

FirewallRules: [{0C374985-068C-456E-B0F3-8EB4D53CDE77}] => (Allow) C:\WINDOWS\YAGyUri.exe

FirewallRules: [{14549E75-4372-418A-9B09-AC97D412CDE0}] => (Allow) C:\Users\user\AppData\Roaming\fDEkXxWIiizuu.exe

FirewallRules: [{0D0FD7B5-46EC-4FFB-B26D-1543FA338C34}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

S3 cpuz143; \??\C:\WINDOWS\temp\cpuz143\cpuz143_x64.sys [X]

S3 iobit_monitor_server; \??\C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\Monitor_win10_x64.sys [X]

C:\Users\user\AppData\Local\imw.ini

C:\Users\user\AppData\Local\WMI.ini

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Speedtest By Ookla\Speedtest.lnk

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sophos\Sophos Anti-Rootkit\Release notes.lnk

C:\Users\defaultuser0\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk

Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}

EmptyTemp:

 

 

Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

 

Zrób nowe logi FRST - już bez Shortcut.

 

jessi

 

[tom615]

Dziękuję.

Podaje logi.

Addition.txt

Fixlog.txt

FRST.txt

[jessica]

Infekcji już nie ma, więc powinno być OK.

 

Kosmetyka:

UUruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

FirewallRules: [{9E0D5113-785F-46D9-9B13-9F24ECA8FD1D}] => (Allow) C:\Users\user\AppData\Local\Chrome Cleanup Tools\msiexec64.exe
FirewallRules: [{503B0143-AFD6-46B1-BE9B-46A75D1C02C2}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{3E44B827-8D0F-4B7F-970F-9D40B52D263F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{992229DA-1B44-4D5A-BEBD-1911C1A46060}] => (Allow) C:\Users\user\AppData\Local\Chrome Cleanup Tools\msiexec64.exe
FirewallRules: [{66D0DB0F-D0A3-4B24-BEEE-0B5A0F33D312}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{BB9669FC-6A6C-417F-8120-6FD69F594D66}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{EC92E2C4-1C13-414F-851C-4064E8AA0783}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1C3C7589-EF19-4FE4-8B2E-6E08B40D50F1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2BE4BA95-8917-4AFC-B05C-86856A9C5BEB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C420A846-10D8-4848-8145-0D96AC03993B}] => (Allow) C:\Users\user\AppData\Local\Chrome Cleanup Tools\msiexec64.exe
FirewallRules: [{7D0BC12A-792A-4F6D-BFC9-2D5E65664EBB}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{95A8CE97-BE79-4660-9676-1267A9E9B176}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4210400E-9364-4473-9791-13476DB52F6A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9FD2E79B-1549-4BE0-BA60-A4BF75BD6FB6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

 

jessi

[tom615]

Jeszcze raz Dziękuję.

Pozdrawiam!!!

Temat do zamknięcia.

[tom615]

Witam ponownie.

Podpinam się w ten sposób, bo znowu wywala mnie kiedy wciskam coś co ma w nazwie "malware". Nie mogę nawet włączyć FRST. Udało mi się załączyć FRST dopiero w trybie awaryjnym z siecią, ale sieci i tak brak, więc zrobiłem FRST w trybie awaryjnym systemu. Oczywiście to samo, co w poście pierwszym. Wgrałem Operę, a tu niechciane stronki, etc.. Proszę o pomoc.

Pozdrawiam

Tomasz

Shortcut.txt

FRST.txt

Addition.txt

[jessica]

Task: {20B31447-F368-429F-AE64-67D818887FC5} - System32\Tasks\{B60F496C-04AF-670A-2F42-8ED6409A1011} => C:\WINDOWS\waGkivbiHhE.exe [2018-04-12] (Microsoft Corporation)

Ta sama infekcja, tylko inne nazwy obiektów.

 

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.

Otworzy się Notatnik - wklej do niego:

 

Task: {20B31447-F368-429F-AE64-67D818887FC5} - System32\Tasks\{B60F496C-04AF-670A-2F42-8ED6409A1011} => C:\WINDOWS\waGkivbiHhE.exe [2018-04-12] (Microsoft Corporation)

C:\WINDOWS\waGkivbiHhE.exe

Task: {820CD630-BAE6-4900-9A74-94FF9070A160} - System32\Tasks\{AEC598ED-DDD6-0F72-0232-50A61013A113} => C:\Users\user\AppData\Local\DxuNjOTAr.exe [2018-04-12] (Microsoft Corporation)

C:\Users\user\AppData\Local\DxuNjOTAr.exe

Task: {FEB12FB7-F118-4602-AC0C-E841B647EB0B} - System32\Tasks\{13B3F0A8-AD45-B783-95F0-781EEA833ECD} => "" [Argument = http://kotcatk.com/cl/?guid=acnh6nmeinggitzcalycfizcdx5vhr2i&prid=1&pid=4_1324_0]

FirewallRules: [{FB2169F1-6488-4365-A29D-23904391F429}] => (Allow) C:\WINDOWS\SysWOW64\msiexec.exe

FirewallRules: [{D79D7731-37A6-4458-A0DF-6E7E7C7563DF}] => (Allow) C:\Users\user\AppData\Local\DxuNjOTAr.exe

FirewallRules: [{7A7463C7-D8C4-40AB-B2C8-8046E02B771A}] => (Allow) C:\WINDOWS\waGkivbiHhE.exe

FirewallRules: [{53255991-BEAA-4CA7-BF15-247D2F2D8A60}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{6E7428CE-9EDC-4E2C-B15D-EF1FB792845E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{BCFBA1AC-39BA-4A37-8DD2-0A84276C11CB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{643A14F2-5E48-48E7-A12D-E7E4E3162A37}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{613C99EB-A95F-4B3A-BB0D-8F9437310A50}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{CA47635A-ABA6-44FC-9C8B-6D7ED61C042D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{7E793BCB-895F-47E2-846F-5FAA4CEAB936}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{1D196E31-F53C-4C18-A15A-D5BE9FAA5167}] => (Allow) C:\Users\user\AppData\Local\Peer.Net\msiexec64.exe

FirewallRules: [{31BDCB37-7E12-4277-8295-3C2E8C5A2421}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{E27F076A-D254-4E43-BEA8-947B1846515B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{16B51C06-31EC-4FAF-B0DD-2EF0C5F79F14}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{BBB59C7F-7470-47FE-A05F-4963408A1B23}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{8E510D8A-A23E-4293-BFFD-24D5E1464B0B}] => (Allow) C:\Users\user\AppData\Local\Peer.Net\msiexec64.exe

FirewallRules: [{D1D47E15-4DA9-47FF-9BD4-6BFE1F35B02B}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{4670290B-3FD9-4BFC-9798-12DC4E3BE1B1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{A5D98140-C83F-479B-82C6-2482132AA209}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{3FD7E9B6-F496-4DE1-A5B2-69368C4EF6AD}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{F8C96061-9A5F-47D6-BAA3-98B32DA6851E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{1E21D633-2F77-4DBA-B6AC-34CE399AED0A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{192ABAB2-DD87-4A06-A810-CE109912CE4B}] => (Allow) C:\Users\user\AppData\Local\Peer.Net\msiexec64.exe

FirewallRules: [{F8065A36-2A67-406A-91A7-5FCB493A207D}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{18D7DBA1-9957-44BE-8954-DBFB5E120E2E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{6E82225E-E9D5-465F-8EDA-728F12D0C27E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{FFDB8385-DCF5-4CD7-964F-9505B63AF2FF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{10130D5A-8DE8-4BDE-8171-AB4AB18E03F5}] => (Allow) C:\Users\user\AppData\Local\Peer.Net\msiexec64.exe

FirewallRules: [{CE8FD7BF-652F-485B-B5F6-C2DA52F89400}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{C0D8F17A-97AF-4970-B896-334AAECB6AB6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{DE7855A2-3DD4-4F15-B5E5-91D5CFD82EA6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{6583ABAB-262F-4212-9E2F-F2E33E94C01E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{9B5E068E-4ACB-4859-B443-86F23B58405C}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe

FirewallRules: [{CEDE8E01-A223-4266-A053-0D79726FD0C2}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{D37FDC1D-ACA3-4A63-969C-0AB9CDB80E7F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{94669044-C027-4FD4-8625-3CA5F64D544E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{44F29435-4FE5-4FC0-A9F7-E9FCDD7CE226}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{E063A937-E6B0-42FD-8D22-476B99D88F5D}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe

FirewallRules: [{770D4373-C58B-4758-ADCC-BB9465E3A949}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{28D28D23-B888-49DF-BA4C-5DD272E02C1F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{6A151DC1-0EBA-40F6-B41E-B0AEC3478C48}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{DCD08AC0-BEC9-4802-94CA-D34EBEFB06B6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{46561B34-4CAD-45AD-8456-C137E386B87D}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe

FirewallRules: [{34B2D7A0-3EFA-4837-979F-5C84A933FC57}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{4FFAD4F7-2EB9-426C-90E9-188C8CECE6AF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{FD7CCBB0-6050-4BA1-AA55-FCF7CA3142DB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{53CF8E75-BE24-4D3A-ABB3-A8A58EF4A757}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{8CA7F7B6-6981-48CB-9DA9-14EEDDCA0BFB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{E6FC954A-ED38-4F30-BDFC-8A8F3B7DD7A8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{36AD4E67-A740-4A10-8F3A-B83939375C04}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{B48FC13E-97B5-4B51-AE19-0F39D4EF556A}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe

FirewallRules: [{AEE0F7D7-EBE9-4627-A36C-C4FBC05C4B3D}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{2F469B4C-67A6-4874-8633-638B25EA86CE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{E75B27E0-67BF-41F6-B68C-BBB82CE95746}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{0B81B2FA-FCDD-4841-A7B4-DECC73AD2376}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{A5FD9816-7AB4-4DF6-A272-69D7A1ED6695}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{22FD30A2-AEBC-4C9D-ADA5-F058F9257C34}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe

FirewallRules: [{71759FCF-FC7F-40AE-BC5A-CBC07FD5D408}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe

FirewallRules: [{4C3D6457-9568-4CFF-9043-0E363F14EDE8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{A62AE9C5-C2C5-4515-920D-B6E1CE5E60EB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

FirewallRules: [{E83145BA-54CD-489F-9A5A-FC2FE54B80C2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe

EmptyTemp:

 

 

Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

 

Zrób nowe logi FRST.

 

Napisz, jaki efekt po tym usuwaniu?

 

jessi

[tom615]

Dziękuję.

 Ale nie daję radę coś. Będę potem. Muszę iść do pracy. Dam znać, bo to pomaga na chwile, co to za robak czy co? ech

Pozdrawiam

Tomasz

Razem damy radę, przede wszystkim Ty.

[jessica]

Bez względu na efekt zrób nowe logi FRST.

 

jessi

[tom615]

Witam

Podaje logi.

Shortcut.txt

Addition.txt

FRST.txt

Fixlog.txt

[jessica]

Infekcji w nowych logach nie widzę.

Są ślady działalności infekcji, widoczne w ustawieniach firewalla, i nic więcej.

 

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

FirewallRules: [{94BE069D-F5A0-45EB-A502-B1632525076D}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe
FirewallRules: [{05E0425A-45BF-4592-95E6-F4F09531DD87}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{E782BD2F-F425-46BE-A5E6-49C7C11B27DF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A8A66DB6-3F18-4A56-B87A-F37E6011E86C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4949EB66-23E3-4D53-A693-D841BA9883AB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A77B7C2A-F86F-4E04-A778-6D375F92FFB4}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe
FirewallRules: [{ABBDD00F-BC4A-4EFE-A3B5-99DE4A71CAEE}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{7EF501D9-E341-49DD-9ED6-7B1F2A881FDF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7AC3C910-7739-4AC5-AF76-60834AB6E8DB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{976521F3-C247-4E14-A6CB-10993C42BBFA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{80770149-5009-40CD-AAD1-7E84875E1AE8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B12630E0-C1CA-4204-A409-1B7AFD9959E7}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe
FirewallRules: [{40232E2B-0DC0-4F7A-ABF2-99B3AA83BE77}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{924A977E-B0A3-4E27-99F6-0396439B704A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9D3ED3A7-9C45-42C7-B1CB-533D8EC0427E}] => (Allow) C:\Users\user\AppData\Local\NET.Framework SDK\msiexec64.exe
FirewallRules: [{AF209C51-348C-439A-B471-C6DACC8842A8}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{0FDBE953-728C-4582-8995-361B267649F3}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{819C2EE4-3AB2-424E-87DD-E8B45F566A90}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{95783195-6F82-459D-812D-A67E6FE5BBF0}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
C:\WINDOWS\Minidump\072318-33734-01.dmp
C:\Users\user\AppData\Local\imw.ini
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

 

Czy dalej jest problem?

 

jessi

[tom615]

Witam

 

Problem zniknął.

 

Dziękuję i Pozdrawiam

Edytowane 25 Lipca 2018 przez Miszel03
Temat zamykam - w przypadku chęci ponownego otwarcia proszę o prywatną wiadomość. //Miszel03