logo elektroda
logo elektroda
X
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

SurfVox - Wirus, blokuje przeglądarkę, menadżera zadań.

Arkenss 16 Cze 2015 12:21 1287 1
REKLAMA
  • #1 14775523
    Arkenss
    Poziom 2  
    Posty: 4
    Witam, mam problem z wirusem surfvox załaczam logi z FRST. Dodam jeszcze że blokuje adwclener i Malwarebytes Anti-Malware.
    Załączniki:
    • Addition.txt (72.81 KB) Musisz być zalogowany, aby pobrać ten załącznik.
    • FRST.txt (47.91 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • Pomocny post
    #2 14775578
    Acorus 20
    Poziom 43  
    Posty: 10541
    Pomógł: 3247
    Ocena: 1063
    Otwórz notatnik systemowy i wklej:
    Cytat:
    CloseProcesses:
    Task: {08F1B8B6-E6C4-4F8D-B133-390CF8B191C1} - \DealPlyUpdate No Task File <==== ATTENTION
    Task: {170328A2-AF20-4387-B9C6-495E767137D0} - \Norton Internet Security\Norton Error Analyzer No Task File <==== ATTENTION
    Task: {1A3DAA01-5A41-4211-859D-4997B07BC19B} - \Norton Internet Security\Norton Error Processor No Task File <==== ATTENTION
    Task: {81DF0F35-7133-466D-85D7-A6EBC981BDAF} - \GoforFilesUpdate No Task File <==== ATTENTION
    Task: {F731E468-71C8-4354-8D70-7D7825AD929D} - System32\Tasks\SYSTEM => C:\ProgramData\wmc.exe [2015-01-23] (Microsoft® Corporation) <==== ATTENTION
    HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [] => [X]
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\Run: [AdobeBridge] => [X]
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\Run: [nvxasync] => E:\Users\Piotrek\AppData\Roaming\nvxasync\nvxasync.exe [153822720 2015-06-15] ()
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\MountPoints2: G - G:\cda_menu.exe
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\MountPoints2: {517c7783-ca97-11e2-bfee-001e8c784fdd} - H:\setup.exe
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\MountPoints2: {c22e2399-f523-11e2-a588-001e8c784fdd} - K:\LGAutoRun.exe
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\MountPoints2: {df11b3c0-f052-11e2-87a4-806e6f6e6963} - H:\autorun.exe
    HKU\S-1-5-21-720544448-317035217-680682757-1009\...\Winlogon: [Shell] C:\ProgramData\nvxasync\cvxasync.exe [153822720 2015-06-15] () <==== ATTENTION
    Startup: E:\Users\Piotrek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk [2013-02-05]
    ShortcutTarget: Stardock ObjectDock.lnk -> C:\Programy\Stardock\ObjectDock\ObjectDock.exe (No File)
    HKU\S-1-5-21-720544448-317035217-680682757-1009\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.surfvox.com/
    HKU\S-1-5-21-720544448-317035217-680682757-1009\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www1.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=049500FF6D7A34C6
    URLSearchHook: HKU\S-1-5-21-720544448-317035217-680682757-1009 - (No Name) - {7473b6bd-4691-4744-a82b-7854eb3d70b6} - No File
    URLSearchHook: HKU\S-1-5-21-720544448-317035217-680682757-1009 - (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
    SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
    SearchScopes: HKLM-x32 -> DefaultScope value is missing
    SearchScopes: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
    SearchScopes: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&affID=119816&babsrc=SP_ss&mntrId=049500FF6D7A34C6
    SearchScopes: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> {45CF28BA-1EB3-4F92-8CB8-FBEF233037BC} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=1E903751-0E34-4640-A75A-77CC0A77CF3F&apn_sauid=99AFDD03-C8D8-4853-B5E8-EA81075CBEC2
    SearchScopes: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> {A60177C6-B991-41FD-895C-A5858417E71F} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=1E903751-0E34-4640-A75A-77CC0A77CF3F&apn_sauid=99AFDD03-C8D8-4853-B5E8-EA81075CBEC2
    SearchScopes: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468
    BHO: No Name -> {8664889D-ED18-4713-918F-E2BB69D8452B} -> No File
    BHO-x32: No Name -> {8664889D-ED18-4713-918F-E2BB69D8452B} -> No File
    Toolbar: HKLM - No Name - {8664889D-ED18-4713-918F-E2BB69D8452B} - No File
    Toolbar: HKLM-x32 - No Name - {8664889D-ED18-4713-918F-E2BB69D8452B} - No File
    Toolbar: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> No Name - {7473B6BD-4691-4744-A82B-7854EB3D70B6} - No File
    Toolbar: HKU\S-1-5-21-720544448-317035217-680682757-1009 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    FF DefaultSearchEngine: SurfVox
    FF SelectedSearchEngine: SurfVox
    FF Homepage: hxxp://www.surfvox.com
    CHR Extension: (No Name) - E:\Users\Piotrek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-12]
    CHR Extension: (No Name) - E:\Users\Piotrek\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2014-02-10]
    CHR Extension: (No Name) - E:\Users\Piotrek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-12]
    CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh
    U3 avhcx0qh; C:\Windows\System32\Drivers\avhcx0qh.sys [0 ] (Advanced Micro Devices) <==== ATTENTION (zero byte File/Folder)
    S3 ALSysIO; \??\E:\Users\Przemek\AppData\Local\Temp\ALSysIO64.sys [X]
    S3 ATICDSDr; \??\E:\Users\Piotrek\AppData\Local\Temp\ATICDSDr.sys [X]
    S1 cFosSpeed; system32\DRIVERS\cfosspeed6.sys [X]
    S3 cpuz135; \??\E:\Users\Przemek\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
    S3 dgderdrv; System32\drivers\dgderdrv.sys [X]
    S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
    S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
    S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    S3 WinRing0_1_2_0; \??\F:\Programy\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]
    S3 XFDriver64; \??\F:\Gry\Xfire2\XFDriver64.sys [X]
    2015-06-15 15:35 - 2015-06-15 15:36 - 00000000 _RSHD E:\Users\Piotrek\AppData\Roaming\nvxasync
    2015-06-15 15:35 - 2015-06-15 15:35 - 00000000 ____D E:\Users\Piotrek\AppData\Roaming\chportu
    2015-01-23 17:45 - 2015-01-23 17:45 - 0030747 ____S (Microsoft® Corporation) C:\ProgramData\wmc.exe
    EmptyTemp:


    Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
    Uruchom jako administrator FRST i kliknij w Fix.
REKLAMA