Zamykanie się cmd

[decz]

Witam, ostatnio kiedy próbuje odpalić wiersz poleceń on się na chwilę włącza i zamyka.

Jak to naprawić?

Tutaj logi z frst.

Shortcut.txtPobieranie informacji ... FRST.txtPobieranie informacji ... Addition.txtPobieranie informacji ...

[jessica]

To wina szkodliwego Soundmixera.

 

ale to nie jedyna infekcja.

 

1) Odinstaluj ten program:

ProxyGate version 3.0.0.1180 (HKLM-x32\...\{1EC095EE-8CA3-43D6-B9F5-0C55B82ED3D7}}_is1) (Version: 3.0.0.1180 - Gold Click Ltd) <==== UWAGA

 

2) Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

  Pokaż ukrytą zawartość

HKU\S-1-5-21-2259425977-1803134885-2901167585-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-2259425977-1803134885-2901167585-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\zende\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\zende\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
RemoveDirectory: C:\Users\zende\AppData\Roaming\Microsoft\SoundMixer
Online Application (HKLM-x32\...\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}) (Version: 2.7.0 - Microleaves) Hidden <==== UWAGA
Task: {5F3A094D-422D-4A81-A622-CFB22099CC94} - System32\Tasks\Online Application V2G4 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [199864 2017-11-02] (MICROLEAVES LTD -> ) <==== UWAGA
Task: {5FF7D534-CFE0-42AB-BA51-040AD5621697} - System32\Tasks\Online Application V2G1 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [199864 2017-11-02] (MICROLEAVES LTD -> ) <==== UWAGA
Task: {19640299-D730-4BD5-9D3A-4D95663CADE5} - System32\Tasks\Online Application V2G3 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [199864 2017-11-02] (MICROLEAVES LTD -> ) <==== UWAGA
Task: {68084880-B602-41E4-B7A2-C463A3F06E71} - System32\Tasks\Online Application V2G6 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [199864 2017-11-02] (MICROLEAVES LTD -> ) <==== UWAGA
Task: {A5FA15D6-4157-4AD8-B4AD-0A159CBCD29A} - System32\Tasks\Updater_Online_Application => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe [908144 2017-11-02] (MICROLEAVES LTD -> Microleaves) <==== UWAGA
Task: {D61DFE4D-C832-4C11-9873-F8FDC50981BB} - System32\Tasks\Online Application V2G5 => C:\Program Files (x86)\Microleaves\Online Application\Version 2.6.0\Online-Guardian.exe [199864 2017-11-02] (MICROLEAVES LTD -> ) <==== UWAGA
S3 mracsvc; C:\WINDOWS\System32\mracsvc.exe [11569424 2018-11-16] (Mail.Ru LLC -> LLC Mail.Ru)
C:\WINDOWS\System32\mracsvc.exe
S2 pgt_svc; C:\Program Files (x86)\ProxyGate\MainService.exe [2285664 2017-02-22] (GOLD CLICK LIMITED -> Gold Click Ltd) <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\ProxyGate
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [10782936 2018-11-16] (Mail.Ru LLC -> LLC Mail.Ru)
C:\WINDOWS\System32\drivers\mracdrv.sys
AlternateDataStreams: C:\Users\zende\AppData\Local\0og82iISqrr:STyRnSiw2ADUY1Ru6bzas [2574]
AlternateDataStreams: C:\Users\zende\AppData\Local\Temporary Internet Files:rUGYEutZNQOBfZD9xoGfT [2510]
C:\Users\zende\AppData\Roaming\Launcher_01.exe
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
S3 OverwolfUpdater; "C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM [X]
S2 QMEmulatorService; "D:\Program Files\TxGameAssistant\AppMarket\QMEmulatorService.exe" [X]
S2 aow_drv; \??\D:\Program Files\TxGameAssistant\UI\2.0.6383.123\aow_drv_x64_ev.sys [X]
S3 Guijiuzchin; \??\C:\WINDOWS\system32\Guijiuzchin.sys [X]
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S.
W FRST kliknij na Fix (NAPRAW).

 

3) Odinstaluj program:

Online Application (HKLM-x32\...\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}) (Version: 2.7.0 - Microleaves) Hidden <==== UWAGA

 

4) Zrób nowe logi FRST.

 

jessi