Farbar Recovery Scan Tool

[nitkk]

Przesyłam wyniki frst i liczę na pomoc

Shortcut.txt Addition.txt FRST.txt

[jessica]

 

Cytat

App Explorer (HKU\S-1-5-21-2913843471-1356635206-1565958684-1001\...\Host App Service) (Version: 0.273.4.386 - SweetLabs) <==== UWAGA

Odinstaluj ten program.

 

Uruchom FRST.
Skopiuj to poniższe: (ale nigdzie nie wklejaj tego!)

Spoiler

START::
Task: {D0ECC0D5-7CA4-4D9F-A36F-C056D7B67B97} - System32\Tasks\bYxgmeNmPKxnvwIHJl => C:\Users\48512\AppData\Local\Temp\xEOjRzFzELfOqmUYL\tCCPvaqDlavRIBp\rCEWDsA.exe W4 /site_id 525403 /S (Brak pliku) <==== UWAGA
2022-01-05 21:01 - 2022-01-05 21:25 - 000000000 ____D C:\Windows\SysWOW64\djxhfhfb
2022-01-05 21:01 - 2022-01-05 21:25 - 000000000 ____D C:\Users\48512\AppData\LocalLow\hJ0aK0
2022-01-05 21:01 - 2022-01-05 21:01 - 000000000 ____D C:\Users\48512\AppData\Roaming\holnon
2022-01-05 21:00 - 2022-01-05 21:01 - 000000000 ____D C:\ProgramData\ITZ80NN207G80QBU0MUI9A4PL
2022-01-05 20:59 - 2022-01-05 21:25 - 000000000 ____D C:\Program Files (x86)\Company
2022-01-05 20:59 - 2022-01-05 21:03 - 000000000 ___HD C:\Users\48512\AppData\Roaming\28291455
2022-01-05 20:59 - 2022-01-05 21:01 - 000000000 ____D C:\Program Files (x86)\lighteningplayer
2022-01-05 20:59 - 2022-01-05 21:00 - 000000526 _____ C:\Windows\Tasks\bYxgmeNmPKxnvwIHJl.job
2022-01-05 20:59 - 2022-01-05 20:59 - 001671168 _____ C:\Users\48512\AppData\LocalLow\K0zQWtaSkb
2022-01-05 20:59 - 2022-01-05 20:59 - 000003070 _____ C:\Windows\system32\Tasks\bYxgmeNmPKxnvwIHJl
2022-01-05 20:59 - 2022-01-05 20:59 - 000000000 ____D C:\Users\48512\AppData\Roaming\ProfCleaner
2022-01-05 20:59 - 2022-01-05 20:59 - 000000000 ____D C:\Users\48512\AppData\Roaming\Green
2022-01-05 20:59 - 2022-01-05 20:59 - 000000000 ____D C:\Users\48512\AppData\Local\AdvinstAnalytics
2022-01-05 20:59 - 2022-01-05 20:59 - 000000000 ____D C:\ProgramData\UEE6QS0Y250K257GA79CRYYL4
2022-01-05 20:59 - 2022-01-05 20:59 - 000000000 _____ C:\Users\48512\AppData\Roaming\F.tmp
2022-01-05 20:58 - 2022-01-05 20:59 - 000000000 ____D C:\ProgramData\8OCG99T0M08Q6GY7P01VM9F4K
2022-01-05 20:58 - 2022-01-05 20:59 - 000000000 ____D C:\ProgramData\60JZFOHZOFMZHW0PXW2L5HC0S
HKU\S-1-5-21-2913843471-1356635206-1565958684-1001\...\Run: [Music] => C:\Users\48512\AppData\Roaming\Music\Music.exe [0 2022-01-05] () [Odmowa dostępu]
Task: {29F6B4E4-C556-4E81-950B-AFED7125411D} - System32\Tasks\App Explorer => C:\Users\48512\AppData\Local\Host App Service\Engine\HostAppServiceUpdater.exe [7823408 2022-01-26] (SweetLabs Inc. -> SweetLabs, Inc) <==== UWAGA
Task: {551C79A8-1752-4BD1-AB5C-A6E1B2F831D1} - System32\Tasks\Обновление Браузера Яндекс => C:\Users\48512\AppData\Local\Yandex\YandexBrowser\Application\browser.exe --background-update --noerrdialogs (Brak pliku)
Task: {E35E2864-288C-4C26-94AB-6BEAABA7CA81} - System32\Tasks\Opera scheduled Autoupdate 1639589504 => C:\Users\48512\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Brak pliku)
FF Homepage: Mozilla\Firefox\Profiles\xkv3onia.default-release -> hxxps://www.yandex.ru/?win=515&clid=2379713-912
FF NewTabOverride: Mozilla\Firefox\Profiles\xkv3onia.default-release -> Enabled: vb@yandex.ru
HKU\S-1-5-21-2913843471-1356635206-1565958684-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [4968224 2022-02-11] (Microsoft Windows -> Microsoft Corporation) <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
RemoveDirectory: C:\Users\48512\AppData\Roaming\Music
RemoveDirectory: C:\Users\48512\AppData\Local\Host App Service
SearchScopes: HKU\S-1-5-21-2913843471-1356635206-1565958684-1001 -> ae327bf2-4483-11ec-adb6-98eecbde5fe0 URL = hxxps://yandex.ru/search/?win=515&clid=2379714-912&text={searchTerms}
HKLM\...\Run: [hola] => C:\Program Files\Hola\app\hola.exe --silent (Brak pliku) <==== UWAGA
FF Extension: (Визуальные закладки) - C:\Users\48512\AppData\Roaming\Mozilla\Firefox\Profiles\xkv3onia.default-release\Extensions\vb@yandex.ru.xpi [2021-12-19]
FF SearchPlugin: C:\Users\48512\AppData\Roaming\Mozilla\Firefox\Profiles\xkv3onia.default-release\searchplugins\yandex.ru-20211413.xml [2021-11-13]
S2 hola_svc; "C:\Program Files\Hola\app\hola_svc.exe" --service [X] <==== UWAGA
S2 hola_updater; "C:\Program Files\Hola\app\hola_updater.exe" --service --run-as hola_updater [X] <==== UWAGA
S2 SecurityService; C:\Program Files (x86)\TotalAV\SecurityService.exe [X] <==== UWAGA
S2 SecurityServiceMonitor; C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor [X] <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\TotalAV
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:
END::

W FRST kliknij na Fix (NAPRAW).

 

jessi