Malware przejmujący konta serwisów społecznościowych i usług online

[JacobAviator89]

Cześć, mam problem ze złośliwym oprogramowaniem, które musiałem pobrać razem z jakąś modyfikacją do gry z zewnętrznej strony www. Próbowałem czyścić samodzielnie przy pomocy Malwarebytes, ale efekt był doraźny, a malware działał ponownie po restarcie systemu. Oprócz ataku na konta w serwisach społecznościowych i usługach online zauważam też dziwne mignięcia ekranu i przyspieszanie wentylatorów komputera.

Załączam log z FRST

Addition.txt FRST.txt

[Illidan]

Siema. Uruchom FRST. Skopiuj zawartość podaną niżej i nigdzie nie wklejaj-FRST sam znajdzie "fixlist" w schowku systemowym.

 

Spoiler

Start::
CreateRestorePoint:
CustomCLSID: HKU\S-1-5-21-1015772933-3966090134-803934505-1001_Classes\CLSID\{000209F0-0000-4b30-A977-D214852036FF}\InprocServer32 ->  => Brak pliku
CustomCLSID: HKU\S-1-5-21-1015772933-3966090134-803934505-1001_Classes\CLSID\{45540086-5750-5300-4B49-4E47534F4655}\InprocServer32 ->  => Brak pliku
CustomCLSID: HKU\S-1-5-21-1015772933-3966090134-803934505-1001_Classes\CLSID\{74B989DB-3E7F-425C-AF5A-F6BFBF5B747A}\InprocServer32 ->  => Brak pliku
CustomCLSID: HKU\S-1-5-21-1015772933-3966090134-803934505-1001_Classes\CLSID\{91493443-94BF-4940-926D-4F38FECF2A48}\InprocServer32 ->  => Brak pliku
AlternateDataStreams: C:\ProgramData:62d28bc5 [1390]
AlternateDataStreams: C:\ProgramData:948df5f9 [1390]
AlternateDataStreams: C:\ProgramData:DNS [40]
AlternateDataStreams: C:\Users\All Users:62d28bc5 [1390]
AlternateDataStreams: C:\Users\All Users:948df5f9 [1390]
AlternateDataStreams: C:\Users\All Users:DNS [40]
AlternateDataStreams: C:\Users\a2622\Dane aplikacji:62d28bc5 [1390]
AlternateDataStreams: C:\Users\a2622\Dane aplikacji:948df5f9 [1390]
AlternateDataStreams: C:\Users\a2622\Dane aplikacji:DNS [40]
AlternateDataStreams: C:\Users\a2622\Ustawienia lokalne:bdgpd [32]
AlternateDataStreams: C:\Users\a2622\AppData\Local:bdgpd [32]
AlternateDataStreams: C:\Users\a2622\AppData\Roaming:62d28bc5 [1390]
AlternateDataStreams: C:\Users\a2622\AppData\Roaming:948df5f9 [1390]
AlternateDataStreams: C:\Users\a2622\AppData\Roaming:DNS [40]
AlternateDataStreams: C:\Users\a2622\AppData\Local\Dane aplikacji:bdgpd [32]
AlternateDataStreams: C:\Users\a2622\AppData\Local\Microsoft:ISBD [32]
AlternateDataStreams: C:\Users\a2622\Documents\GTA San Andreas User Files:62d28bc5 [1390]
AlternateDataStreams: C:\Users\a2622\Documents\GTA San Andreas User Files:948df5f9 [1390]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:62d28bc5 [1390]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:948df5f9 [1390]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:DNS [40]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:62d28bc5 [1390]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:948df5f9 [1390]
AlternateDataStreams: C:\ProgramData\MTA San Andreas All:DNS [40]
FirewallRules: [{F93FD19A-8C15-42AE-A094-E23F150B47E5}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => Brak pliku
FirewallRules: [{E92685E1-DB20-491C-B228-C5BDAB87CD2A}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => Brak pliku
FirewallRules: [{9EB91FB8-8CAF-4838-A757-86E6459256CB}] => (Allow) C:\Users\a2622\AppData\Roaming\uTorrent Web\utweb.exe => Brak pliku
FirewallRules: [{8D00AA4A-0024-4C91-B2A7-E0D859DB0CE9}] => (Allow) C:\Users\a2622\AppData\Roaming\uTorrent Web\utweb.exe => Brak pliku
FirewallRules: [{1189B320-FC42-4087-A65A-A4F65C18F360}] => (Allow) D:\SteamLibrary\steamapps\common\Days Gone\BendGame\Binaries\Win64\DaysGone.exe => Brak pliku
FirewallRules: [{1C2A1A1E-665A-4A3F-8150-7E887E13AFD8}] => (Allow) D:\SteamLibrary\steamapps\common\Days Gone\BendGame\Binaries\Win64\DaysGone.exe => Brak pliku
FirewallRules: [{9F78D0A0-41A5-40BF-89A7-6EAD36AF28C2}] => (Allow) E:\SteamLibrary\steamapps\common\Road to Vostok Demo\Road_to_Vostok_Demo.exe => Brak pliku
FirewallRules: [{D92B16A5-EBE3-4DC3-BEEB-D4E76889B614}] => (Allow) E:\SteamLibrary\steamapps\common\Road to Vostok Demo\Road_to_Vostok_Demo.exe => Brak pliku
FirewallRules: [{0976E374-AF0E-44D7-9540-EB2A421C2F13}] => (Allow) D:\SteamLibrary\steamapps\common\DEATH STRANDING 2 - ON THE BEACH\DS2.exe => Brak pliku
FirewallRules: [{C50A49CA-EDDD-43BC-832E-0C401B871C7C}] => (Allow) D:\SteamLibrary\steamapps\common\DEATH STRANDING 2 - ON THE BEACH\DS2.exe => Brak pliku
FirewallRules: [{7A850A97-CDE3-4B46-8FB9-72CF58DD32B6}] => (Allow) D:\SteamLibrary\steamapps\common\ELDEN RING\Game\start_protected_game.exe => Brak pliku
FirewallRules: [{C54C98B3-9CCE-4CD6-AC8C-AAE116F91B28}] => (Allow) D:\SteamLibrary\steamapps\common\ELDEN RING\Game\start_protected_game.exe => Brak pliku
FirewallRules: [{E637412D-21E7-44F0-B8C0-D126DA958854}] => (Allow) C:\Users\a2622\AppData\Roaming\uTorrent\uTorrent.exe => Brak pliku
FirewallRules: [{01370181-89D5-4FB8-AA83-E95AE9CE290C}] => (Allow) C:\Users\a2622\AppData\Roaming\uTorrent\uTorrent.exe => Brak pliku
FirewallRules: [{E8C31758-941B-444B-B307-FC74E15F9FAE}] => (Allow) E:\SteamLibrary\steamapps\common\Dark Souls II Scholar of the First Sin\Game\DarkSoulsII.exe => Brak pliku
FirewallRules: [{EC406D1E-AB99-4D44-AB9E-1A8912678E77}] => (Allow) E:\SteamLibrary\steamapps\common\Dark Souls II Scholar of the First Sin\Game\DarkSoulsII.exe => Brak pliku
FirewallRules: [{EF1AFCD5-8C50-4EA1-8FD3-B227F1CC9071}] => (Allow) E:\SteamLibrary\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => Brak pliku
FirewallRules: [{A4166840-DE93-4128-8C0E-A9A25BACE2C0}] => (Allow) E:\SteamLibrary\steamapps\common\Ready Or Not\Engine\Binaries\Win64\CrashReporter.exe => Brak pliku
FirewallRules: [{C7FAAFD0-C896-43FF-BDCB-D7E7B09BA705}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260617020912\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{5D5F686F-2CF2-4F30-917F-E7D1080E34AE}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260617020912\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{778E1B12-3A94-4082-BC3F-027C16457657}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260617035745\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{2E3DB0A2-9DE7-4349-854D-8E7CDB7664CC}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260617035745\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{96B192A3-5094-4A2C-B002-428FF185F53E}] => (Allow) E:\Tarkov\BsgLauncher\BsgLauncher.exe => Brak pliku
FirewallRules: [{69E3345C-39AE-487B-89D0-F88D551EB03A}] => (Allow) E:\Tarkov\BsgLauncher\BsgLauncher.exe => Brak pliku
FirewallRules: [{70FF7424-3409-4412-ACA6-DB59D24EAF06}] => (Allow) E:\Tarkov\Escape From Tarkov\escapefromtarkov_data\plugins\x86_64\vuplexwebviewchromium\vuplex webview.vuplex => Brak pliku
FirewallRules: [{1795CE74-DFA3-4E61-A82B-FC2D119063C3}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260907133211\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{D4F0E2E7-5B1E-49B9-9D34-B20E933C3096}] => (Allow) C:\ProgramData\ASUS\ARMOURY CRATE One Package\ACFL20260907133211\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{5454C181-0394-42C7-BFA8-188A06E9E331}] => (Allow) C:\Program Files\ASUS\ARMOURY CRATE One Package\ACFL20260918132714\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{E9BD4CF1-C9AE-487D-AF7D-CCFF57D96137}] => (Allow) C:\Program Files\ASUS\ARMOURY CRATE One Package\ACFL20260918132714\ACSetup\ACSetup.exe => Brak pliku
FirewallRules: [{733EA891-12C3-4324-977C-21A8C401D3C1}] => (Allow) C:\Program Files\Razer\RazerAppEngine\app-4.0.895\RazerAppEngine.exe => Brak pliku
FirewallRules: [{D8C7A213-2C44-43F7-B6C9-9FFFADA1672E}] => (Allow) C:\Program Files (x86)\Overwolf\0.311.0.6\OverwolfBrowser.exe => Brak pliku
FirewallRules: [{AE1316E4-5393-4217-8CE1-8A917306D3D2}] => (Allow) C:\Program Files (x86)\Overwolf\0.311.0.6\OverwolfBrowser.exe => Brak pliku
FirewallRules: [{CAAD2CCA-2D5F-4305-920A-B747B21BA5CD}] => (Block) C:\Program Files (x86)\Overwolf\0.311.0.6\OverwolfBrowser.exe => Brak pliku
FirewallRules: [{AF0B56BB-A5D6-41C4-884E-05BD951E09B4}] => (Block) C:\Program Files (x86)\Overwolf\0.311.0.6\OverwolfBrowser.exe => Brak pliku
HKU\S-1-5-21-1015772933-3966090134-803934505-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-1015772933-3966090134-803934505-1001\...\Run: [MicrosoftCopilotAutoLaunch_12E4422660CF728D3935EA4959EC4820] => "C:\Program Files (x86)\Microsoft\Copilot\Application\mscopilot.exe" --no-startup-window --win-session-start (Brak pliku)
Task: {ECAA7265-FCB1-4C07-ACBA-E5E510A6A71A} - System32\Tasks\ASUS\P508PowerAgent_sdk => C:\Program Files (x86)\ASUS\ArmouryDevice\dll\ShareFromArmouryIII\Mouse\ROG STRIX CARRY\P508PowerAgent.exe (Brak pliku)  (Brak pliku)
Task: {077BA067-7C15-40F0-B22E-C9DC2A54B4A2} - System32\Tasks\Microsoft\Windows\Location\Notifications => %windir%\System32\LocationNotificationWindows.exe (Brak pliku)  (Brak pliku)
Task: {0BB36A32-0D9E-4297-AFD7-6BD7B5DB4C9B} - System32\Tasks\Microsoft\Windows\UNP\RunUpdateNotificationMgr => %windir%\System32\UNP\UpdateNotificationMgr.exe (Brak pliku)  (Brak pliku)
Task: {F3E6E7ED-A196-4E44-8803-55FAB3AD4E29} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe (Brak pliku)  (Brak pliku)
Task: {F6FC81BC-B88F-4F24-AF00-736D3949A8A9} - System32\Tasks\MicrosoftEdge\Update\EdgeUpdateCompatCheck => C:\Users\a2622\AppData\Roaming\Mozilla\Updates\Services\1ae2af770.exe [10150004 2026-11-08] (Synaptics Incorporated) [Brak podpisu cyfrowego] <==== UWAGA
FF Plugin HKU\S-1-5-21-1015772933-3966090134-803934505-1001: @wpspdf.com/nppdf -> C:\Users\a2622\AppData\Local\Kingsoft\WPS Office\12.1.0.29162\office6\npwpsframe.dll [Brak pliku]
R3 cpuz159; \??\C:\WINDOWS\temp\cpuz159\cpuz159_x64.sys [44680 2026-11-08] (Microsoft Windows Hardware Compatibility Publisher -> ) <==== UWAGA
S3 EAAntiCheat; system32\drivers\eaanticheat.sys (Brak pliku)
EmptyTemp:
End::

 

Fixlist przeznaczona tylko dla autora tematu!

W FRST kliknij opcję "Napraw" (Fix). Pokaż raport  "fixlog.txt", który otrzymasz po restarcie komputera. Pobierz  darmowy "ADWCleaner", skanowanie, pokaż log ze skanowania.

Do tego system raportuje problemy ze sterownikami i niektórymi aplikacjami jak ARCTIC_RGB_Control_Master.exe. Uaktualnij sterowniki, pobierz, co trzeba ze strony producenta płyty głównej pod system, najlepiej wszystkie. Ewentualnie możesz sprawdzić do ego celu darmowy program "DriverCloud".