Odinstaluj:
amuleC
WinSnare
Uzyj
https://www.bleepingcomputer.com/download/adwcleaner/ i usun wszystko co znajdzie.
Obok frst.exe utworz plik Fixlist.txt z zawartoscia:
CloseProcesses:
Task: {9CF5A1D9-D636-40FC-B14C-4B3813E81FDB} - System32\Tasks\Phezash Engine => C:\Program Files (x86)\Kugshcoijich\faherent.exe [2017-02-07] (Glarysoft Ltd)
Task: {E91D34B5-3151-416A-A99D-DCEC366C7C7B} - System32\Tasks\Coemsh => msiexec /i hxxp://d2buh1bf1g584w.cloudfront.net/msi/rel.php?u=SAMSUNGXSSDX830XSeries_S0Z3NEACA03456&v=201727 /q
Task: {F1A9909B-EF5A-435D-85D0-6E339E040EAF} - System32\Tasks\Milimili => C:\Program Files (x86)\MIO\MIO.exe [2017-02-13] ()
() C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
HKU\S-1-5-21-3811933890-3646825986-1744517-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3811933890-3646825986-1744517-1000\...\MountPoints2: F - F:\setup.exe
HKU\S-1-5-21-3811933890-3646825986-1744517-1000\...\MountPoints2: G - G:\setup.exe
HKU\S-1-5-21-3811933890-3646825986-1744517-1000\...\MountPoints2: {4e1ec327-7b7a-11e6-a579-6cf049eefd27} - H:\startme.exe
HKU\S-1-5-21-3811933890-3646825986-1744517-1000\...\MountPoints2: {c3e0f22e-c508-11e6-b01d-6cf049eefd27} - H:\HTC_Sync_Manager_PC.exe
HKLM\...\Providers\lwtfw39y: C:\Program Files (x86)\Phezash Engine\local64spl.dll
ShellExecuteHooks: Brak nazwy - {F12D15C2-EABB-11E6-97A8-64006A5CFC23} - -> Brak pliku
AutoConfigURL: [S-1-5-21-3811933890-3646825986-1744517-1000] => hxxp://nonereblock.net/wpad.dat?4b8c3ec6ea69c364a24831a66fdf388a25066335
ManualProxies: 0hxxp://nonereblock.net/wpad.dat?4b8c3ec6ea69c364a24831a66fdf388a25066335
RemoveProxy:
FF Homepage: Firefox\Firefox\Profiles\o409zwl4.default-1486534345438 -> hxxp://www.searchinme.com/?type=hp&ts=1486985551641&z=&from=official&uid=SAMSUNGXSSDX830XSeries_S0Z3NEACA03456
FF Extension: (FF Adr) - C:\Users\WAR\AppData\Roaming\Firefox\Firefox\Profiles\o409zwl4.default-1486534345438\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-02-13] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\WAR\AppData\Roaming\Firefox\Firefox\Profiles\o409zwl4.default-1486534345438\searchplugins\searchinme.xml [2017-02-13]
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\16701560.js [2017-02-07] <==== UWAGA (Linkuje do pliku *.cfg)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\16701560.cfg [2017-02-07] <==== UWAGA
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [162992 2017-02-13] ()
S2 Themes; C:\Windows\system32\themeservice.dll [44544 2009-07-14] (Microsoft Corporation) [DependOnService: iThemes5]<==== UWAGA
R2 WinSAPSvc; C:\Users\WAR\AppData\Roaming\WinSAPSvc\WinSAP.dll [185344 2017-02-13] (TODO: <Company name>) [Brak podpisu cyfrowego]
S2 WinSnare; C:\Users\WAR\AppData\Roaming\WinSnare\WinSnare.dll [779776 2017-02-08] (InterSect Alliance Pty Ltd) [Brak podpisu cyfrowego]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
2017-02-13 12:31 - 2017-02-13 12:31 - 00000000 ____D C:\Program Files (x86)\Goldass
2017-02-13 12:29 - 2017-02-14 22:42 - 00000000 ____D C:\Program Files (x86)\amuleCe
2017-02-13 12:29 - 2017-02-13 12:29 - 00000000 ____D C:\Users\WAR\AppData\Roaming\WinSAPSvc
2017-02-13 12:29 - 2017-02-13 12:29 - 00000000 ____D C:\Users\WAR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\amuleC
2017-02-13 12:29 - 2017-02-13 12:29 - 00000000 ____D C:\Users\WAR\AppData\Roaming\aMule
2017-02-13 12:29 - 2017-02-13 12:29 - 00000000 ____D C:\Program Files\lwtfw39y
2017-02-13 11:51 - 2017-02-15 12:01 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-02-13 11:51 - 2017-02-13 12:44 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2017-02-13 11:51 - 2017-02-13 11:51 - 00000000 ____D C:\Program Files (x86)\58A18FB1_jumpeasy
2017-02-09 19:49 - 2017-02-09 19:49 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.1.0)
2017-02-08 11:26 - 2017-02-14 22:42 - 00000000 ____D C:\Program Files (x86)\Gub
2017-02-08 11:26 - 2017-02-13 12:42 - 00000000 ____D C:\ProgramData\WinSAPSvc
2017-02-08 11:26 - 2017-02-13 12:29 - 00003566 _____ C:\Windows\System32\Tasks\Milimili
2017-02-08 11:26 - 2017-02-13 11:51 - 00000000 ____D C:\Users\WAR\AppData\Roaming\WinSnare
2017-02-08 11:26 - 2017-02-09 21:00 - 00000000 ____D C:\Program Files (x86)\WinArcher
2017-02-08 11:26 - 2017-02-09 19:49 - 00000000 ____D C:\Program Files (x86)\WinSnare(4.0.9)
2017-02-08 11:26 - 2017-02-09 19:49 - 00000000 ____D C:\Program Files (x86)\MIO
2017-02-08 11:22 - 2017-02-08 11:22 - 00000000 ____D C:\Program Files (x86)\lwtfw39y
2017-02-07 00:13 - 2017-02-14 22:42 - 00000000 ____D C:\Program Files (x86)\Phezash Engine
2017-02-07 00:13 - 2017-02-13 12:42 - 00000000 ____D C:\Program Files (x86)\Kugshcoijich
2017-02-07 00:13 - 2017-02-08 11:12 - 00000000 ____D C:\Users\WAR\AppData\Roaming\Climuwarddredoty
2017-02-07 00:13 - 2017-02-07 00:13 - 00005978 _____ C:\Windows\System32\Tasks\Phezash Engine
2017-02-07 00:13 - 2017-02-07 00:13 - 00003676 _____ C:\Windows\System32\Tasks\Coemsh
2017-02-07 00:13 - 2017-02-07 00:13 - 00000000 ____D C:\ProgramData\Avira
2017-02-07 00:13 - 2017-02-07 00:13 - 00000000 ____D C:\ProgramData\Avg
EmptyTemp:
W FRST wybierz Napraw.
Zrob pelny skan przy pomocy
https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ i usun to co wykryje.
Po wszystkim zamiesc nowe logi z FRST, ze skanowania.
.
