logo elektroda
logo elektroda
X
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

Jak usunąć win32:evo-gen [susp] z pliku ProtectWindowsManager.exe? Logi FRST

pagaga 01 Lut 2015 17:38 1089 3
REKLAMA
  • #1 14391635
    pagaga
    Poziom 2  
    Posty: 2
    Witam,

    Proszę o pomoc w usunięciu wirusa, który co chwilę pojawia się w AVAST. Nazwa pliku, w którym go znaleziono:
    SVC:WindowsMangerProtect > C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe

    Wykonałam skan w Farbar Recovery Scan Tool według poprzednich instrukcji.
    W załączniku raport FRST i Addition.

    Dziękuję za pomoc
    Załączniki:
    • FRST.txt (28.62 KB) Musisz być zalogowany, aby pobrać ten załącznik.
    • Addition.txt (37.64 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • Pomocny post
    #2 14391662
    Kolobos
    Spec od komputerów
    Posty: 85172
    Pomógł: 17169
    Ocena: 10450
    Odinstaluj:
    Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.370 - Oracle)
    Java(TM) 6 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416045FF}) (Version: 6.0.450 - Oracle)

    Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun: https://toolslib.net/downloads/viewdownload/1-adwcleaner/


    Obok frst.exe utworz plik fixlist.txt z zawartoscia:
    Spoiler:
    () C:\Program Files (x86)\SmarterPower\bin\utilSmarterPower.exe
    HKLM-x32\...\Run: [] => [X]
    HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
    HKU\S-1-5-21-2069368038-4120700897-3865020589-1001\...\Run: [Akamai NetSession Interface] => "C:\Users\Agg\AppData\Local\Akamai\netsession_win.exe"
    HKU\S-1-5-21-2069368038-4120700897-3865020589-1001\...\Policies\Explorer: []
    HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts...rom=cor&uid=SAMSUNGXHM641JI_S26XJ9HB715369&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts...rom=cor&uid=SAMSUNGXHM641JI_S26XJ9HB715369&q={searchTerms}
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
    HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts...rom=cor&uid=SAMSUNGXHM641JI_S26XJ9HB715369&q={searchTerms}
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts...rom=cor&uid=SAMSUNGXHM641JI_S26XJ9HB715369&q={searchTerms}
    HKU\S-1-5-21-2069368038-4120700897-3865020589-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    HKU\S-1-5-21-2069368038-4120700897-3865020589-1001\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://search.babylon.com/?AF=100482&babsrc=HP_ss&mntrId=9adf1f62000000000000b4749ffe0547
    SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
    SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=SMSTDF&pc=MASM&src=IE-SearchBox
    SearchScopes: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> {0388404D-6072-4CEB-B521-8F090FEAEE57} URL = http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=PL&install_date=20120109&user_guid=B736EBF76F9A43C7AA3799C09460BA1E&machine_id=66b1dd32fe66aada9d76c4029ae540ff&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source}
    SearchScopes: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=9ADFE0CA9449A91D&affID=119357&tt=250613_gr4&tsp=4926
    SearchScopes: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> {79546F23-25D2-4684-8A2C-052AC46B67AE} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=YYYYYYYYPL&apn_uid=170B3EC5-86EE-4B02-8B69-695DCD4A0ECB&apn_sauid=CF8B64A7-A8FF-4DFB-A2BB-63486837F9D7
    SearchScopes: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> {D6960F0C-6CA4-4B82-BF65-219A38103272} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}
    BHO-x32: SmarterPower -> {bd7c9b62-a7d9-4405-be51-7fd633f08791} -> C:\Program Files (x86)\SmarterPower\SmarterPowerbho.dll No File
    Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
    Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
    Toolbar: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
    Toolbar: HKU\S-1-5-21-2069368038-4120700897-3865020589-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=141...2&from=cor&uid=SAMSUNGXHM641JI_S26XJ9HB715369
    FF SearchPlugin: C:\Users\Agg\AppData\Roaming\Mozilla\Firefox\Profiles\mooptju8.default\searchplugins\babylon.xml
    FF SearchPlugin: C:\Users\Agg\AppData\Roaming\Mozilla\Firefox\Profiles\mooptju8.default\searchplugins\delta.xml
    FF SearchPlugin: C:\Users\Agg\AppData\Roaming\Mozilla\Firefox\Profiles\mooptju8.default\searchplugins\yahoo-zugo.xml
    FF Extension: Xpert-Web - C:\Users\Agg\AppData\Roaming\Mozilla\Firefox\Profiles\mooptju8.default\Extensions\{58e3c1c9-2dc1-4762-bd45-1df9da9d0820} [2014-11-11]
    S2 Update SmarterPower; C:\Program Files (x86)\SmarterPower\updateSmarterPower.exe [323320 2014-08-26] ()
    R2 Util SmarterPower; C:\Program Files (x86)\SmarterPower\bin\utilSmarterPower.exe [323320 2014-08-26] ()
    S4 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [485888 2014-12-18] (Fuyu LIMITED) [File not signed]
    R1 {5eeb83d0-96ea-4249-942c-beead6847053}Gw64; C:\Windows\System32\drivers\{5eeb83d0-96ea-4249-942c-beead6847053}Gw64.sys [61080 2014-08-20] (StdLib)
    C:\ProgramData\WindowsMangerProtect\
    C:\Program Files (x86)\SmarterPower\
    EmptyTemp:

    W FRST wybierz Fix.

    Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
    http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
  • REKLAMA
  • #3 14391950
    pagaga
    Poziom 2  
    Posty: 2
    Serdecznie dziękuję :) Pomogło..
    A czy teraz mogę spokojnie usunąć Mbam itp (będzie się gryzł z Avastem czy może zostać?)
  • #4 14392081
    Kolobos
    Spec od komputerów
    Posty: 85172
    Pomógł: 17169
    Ocena: 10450
    Moze zostac.

    Usun katalog C:\FRST i to wszystko.
    Jak usunąć win32:evo-gen [susp] z pliku ProtectWindowsManager.exe? Logi FRST
REKLAMA