04.02.2019, 23:22
(Ten post był ostatnio modyfikowany: 04.02.2019, 23:45 przez morderca.)
RE: Przekierowania przeglądarki na niechciane strony.
1) Uruchom FRST. Na klawiaturze naciśnij jednocześnie
CTRL+
Y.Otworzy się Notatnik - wklej do niego:
Kod:
Task: {007698C6-2FE7-441D-8EE8-7E64AF0A275E} - System32\Tasks\ZFRWoJuqUrHKuF => rundll32 "C:\Program Files (x86)\EhWIjnqheYmU2\LddtnUpVyTvxQ.dll",#1
Task: {04D74ECD-EA6C-4439-BA7C-293A4E36AED5} - System32\Tasks\WAEBxyJePXzHCWqdB2 => rundll32 "C:\Program Files (x86)\sdTgmoxXoaahhwmevSR\hmipHqK.dll",#1
Task: {079177B4-7A0C-45D1-B75A-580E47347AE1} - System32\Tasks\gDmkMJnSTUxlqBnLhHL2 => rundll32 "C:\Program Files (x86)\engGZVhOjSquC\ZUreavY.dll",#1
Task: {89141594-871C-459B-B6B4-45333103D440} - System32\Tasks\jlMIvUDlqqWHW2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\FdCWEDqqlKJJtvVB\ClxRsNc.wsf"
Task: {D8B12EDB-A752-40F8-BA4F-D028298EF40D} - System32\Tasks\{e6b1bd71-40ef-4173-8106-93b5f9032a6e} => C:\Users\goalk\AppData\Local\Temp\{C0D4A64D-AA1C-40EF-963A-554FF88DCA03}.exe [2019-02-03] () <==== UWAGA
Task: {DF84066E-8F5A-4351-A452-685007D7B45C} - System32\Tasks\coQxHsTqvcmEwws2 => rundll32 "C:\Program Files (x86)\QVphpaDfU\dtUVTx.dll",#1
RemoveDirectory: C:\Program Files (x86)\EhWIjnqheYmU2
RemoveDirectory: C:\Program Files (x86)\sdTgmoxXoaahhwmevSR
RemoveDirectory: C:\Program Files (x86)\engGZVhOjSquC
RemoveDirectory: C:\ProgramData\FdCWEDqqlKJJtvVB
RemoveDirectory: C:\Program Files (x86)\QVphpaDfU
RemoveDirectory: C:\Users\goalk\AppData\Roaming\ymgmnmi3byq
RemoveDirectory: C:\Users\goalk\AppData\Roaming\wciwgb5bzu3
RemoveDirectory: C:\Users\goalk\AppData\Roaming\nkkpo11dag
RemoveDirectory: C:\Users\goalk\AppData\Roaming\lltqnvndf5h
RemoveDirectory: C:\Users\goalk\AppData\Roaming\i23ly1lihi3
RemoveDirectory: C:\Program Files (x86)\PUGpcyhepIE
RemoveDirectory: C:\Program Files\ZTUyY2RiNmFiMjU4NDV
RemoveDirectory: C:\Program Files (x86)\SmartData
RemoveDirectory: C:\ProgramData\boost_interprocess
Task: {E3BA62A8-C212-419B-A3BE-F79B21BC931D} - System32\Tasks\csrss => C:\WINDOWS\rss\csrss.exe <==== UWAGA
C:\WINDOWS\rss\csrss.exe
FirewallRules: [{6FB33465-36E7-4F2C-A8D3-1B16EB25C4D6}] => (Allow) C:\WINDOWS\rss\csrss.exe Brak pliku
FirewallRules: [{93F27AAE-8710-41D4-ACAE-2B5B29580109}] => (Allow) C:\Users\goalk\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe Brak pliku
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HOSTS:
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [7431220] => C:\Users\goalk\AppData\Roaming\ymgmnmi3byq\iltxc0cexyf.exe [1479099 2019-02-03] (dZAD )
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [l9ofdt] => rundll32.exe "C:\Users\goalk\AppData\Local\l9ofdt.dll",l9ofdt <==== UWAGA
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [5862915] => C:\Users\goalk\AppData\Roaming\wciwgb5bzu3\reef4mlpc5f.exe [1479099 2019-02-03] (dZAD )
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [1013739] => C:\Users\goalk\AppData\Roaming\nkkpo11dagl\1rnnd4bfzkk.exe [1479099 2019-02-03] (dZAD )
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [688904] => C:\Users\goalk\AppData\Roaming\lltqnvndf5h\hgqecvsxtge.exe [1479099 2019-02-03] (dZAD )
HKU\S-1-5-21-1931736991-350290309-859863673-1001\...\Run: [7203525] => C:\Users\goalk\AppData\Roaming\i23ly1lihi3\fshisdanx4h.exe [1479099 2019-02-03] (dZAD )
C:\Users\goalk\AppData\Local\l9ofdt.dll
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
HKU\S-1-5-21-1931736991-350290309-859863673-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOsmllcblIYPADGwmcKp64Vz0-1KnW6jkZIyypGJqPBiFEVqSPRWOC_VPoxeZexTeQ39M2so4p9fa1HiQBp445ZMN7Q0rtgp5gMqaHsGIIdV0RF-tDorCm-EAZx0wJsW2PYQtpxbvzffleOJTo7ibF3pZ53A-Cm4NZiq2BnuBwQ,,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
BHO: YoutubeAdBlock -> {0AA83778-BEDD-4855-A8FE-CE2EA58563FD} -> C:\Program Files (x86)\PUGpcyhepIE\tUOZG5rCn.dll => Brak pliku
BHO-x32: YoutubeAdBlock -> {0AA83778-BEDD-4855-A8FE-CE2EA58563FD} -> C:\Program Files (x86)\PUGpcyhepIE\kjIWYuJx7.dll => Brak pliku
FF user.js: detected! => C:\Users\goalk\AppData\Roaming\Mozilla\Firefox\Profiles\vdrycnge.default-1549220949781\user.js [2019-02-04]
FF Extension: (Brak nazwy) - C:\Program Files\Mozilla Firefox\browser\features\{51143AA8-3F13-47BA-AE9A-A9600A32A53E}.xpi [2019-02-03] [Brak podpisu cyfrowego]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\secure_cert.js [2019-02-04] <==== UWAGA
CHR DefaultSearchURL: Default -> hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBLoO-BhLymRVyoiO2t6mfQOsmllcblIYPADGwmcKp64Vz0-1KnW6jkZIyypGJqPBiFEVqSPRWOC_VPoxeZexTeQ39M2so4p9fa1HiQEddpwWzn2g0qH8I-eeCyymAkJUDCYbkRBsSbaKn4tjEDSUfDR-I2lrv-WyO_BkYVCCzcI4woN12bNXYj0FrHYDt8Dg,,&q={searchTerms}
CHR DefaultSearchKeyword: Default -> feed.sonic-search.com
S2 ZTUyY2RiNmFiMjU4NDV; C:\Program Files\ZTUyY2RiNmFiMjU4NDV\OWY4NTkxNmYxM2.exe [1014984 2019-02-03] (chavanactechnology.com -> )
S2 Smart Monitoring; "C:\Program Files (x86)\SmartData\j0192udlkhas.exe" /srv [X]
S1 2D226E28DAA0; C:\WINDOWS\2D226E28DAA0.sys [621928 2019-02-03] (韵羽健康管理咨询（上海）有限公司 -> VxDriver)
C:\WINDOWS\2D226E28DAA0.sys
R1 MTI3MD; \??\C:\WINDOWS\system32\drivers\MTI3MD [X]
C:\WINDOWS\skscbybgztpnuhhjdpf.sks
019-02-03 16:24 - 2019-02-03 16:25 - 000607196 _____ C:\Users\goalk\AppData\Roaming\lakric.exe
2019-02-03 16:24 - 2019-02-03 16:24 - 006860752 _____ C:\Users\goalk\AppData\Roaming\cbargat.exe.E
2019-02-03 16:24 - 2019-02-03 16:24 - 006860752 _____ (NeoSoft Tools ) C:\Users\goalk\AppData\Roaming\cbargat.exe
2019-02-03 16:24 - 2019-02-03 16:24 - 000607196 _____ C:\Users\goalk\AppData\Roaming\lakric.exe.E
2019-02-03 16:24 - 2019-02-03 16:24 - 000016384 _____ C:\Users\goalk\AppData\Local\l9ofdt.dll
2019-02-03 16:24 - 2019-02-03 16:24 - 000000000 ____D C:\Users\goalk\AppData\Roaming\ymgmnmi3byq
2019-02-03 16:24 - 2019-02-03 16:24 - 000000000 ____D C:\Users\goalk\AppData\Roaming\wciwgb5bzu3
2019-02-03 16:23 - 2019-02-03 16:23 - 007878144 _____ C:\Users\goalk\AppData\Local\agent.dat
2019-02-03 16:23 - 2019-02-03 16:23 - 002036701 _____ C:\Users\goalk\AppData\Local\Rankzap.tst
2019-02-03 16:23 - 2019-02-03 16:23 - 001895383 _____ C:\Users\goalk\AppData\Local\ScotRuntouch.bin
2019-02-03 16:23 - 2019-02-03 16:23 - 000126464 _____ C:\Users\goalk\AppData\Local\noah.dat
2019-02-03 16:23 - 2019-02-03 16:23 - 000070896 _____ C:\Users\goalk\AppData\Local\Config.xml
2019-02-03 16:23 - 2019-02-03 16:23 - 000005568 _____ C:\Users\goalk\AppData\Local\md.xml
2019-02-03 16:23 - 2019-02-03 16:22 - 001632256 _____ (TODO: <Company name>) C:\Users\goalk\AppData\Local\Rankzap.exe
2019-02-03 16:22 - 2019-02-03 20:49 - 000722944 _____ C:\Users\goalk\AppData\Local\sham.db
2019-02-03 16:22 - 2019-02-03 16:22 - 000140800 _____ C:\Users\goalk\AppData\Local\installer.dat
2019-02-02 12:56 - 2019-02-02 12:56 - 001203712 _____ C:\WINDOWS\MzRhNDU1.exe
2019-02-02 12:56 - 2019-02-02 12:56 - 000188424 _____ C:\WINDOWS\system32\Drivers\MTI3MD
C:\Users\goalk\Desktop\Telegram.lnk
EmptyTemp:
Na klawiaturze naciśnij jednocześnie
CTRL+
S. W FRST kliknij na Fix (NAPRAW).
2) Spy Hunter to nie jest zaufany program.
Spróbuj odinstalować w ten sposób:
kliknij na tę ikonkę C:\Users\nazwa Użytkownika\Start Menu\Programs\SpyHunter\Uninstall.lnk (czyli >>START >>Programy>>SpyHunter>>Uninstall)
wyskoczy okienko, ale zamiast klikać wielki zielony guzik "continue" kliknij "no, thanks". To drugie odinstalowuje.
3) Spybot też odinstaluj - nie pasuje do nowocześniejszych infekcji, nie jest w stanie wykrywać takich infekcji.
4) Zrób nowe logi FRST.
przed skanem zaznacz: Additional.txt Shortcut.txt,
.
