W ustawieniach Chrome wylacz przywracanie zestawu stron po starcie.
Nie uzywaj Combofix!
Wykonaj Fixlist.txt dla FRST:
Task: {1787CD6C-B11D-43F6-94BD-6BF0ED9E164D} - System32\Tasks\{73FD49C6-6BB4-4FE8-83A6-44C1AB588C0A} => C:\Windows\system32\pcalua.exe -a D:\Programy\clonyxxl\ClonyXXL_2.0.1.5_PL.exe -d D:\Programy\clonyxxl
Task: {8035764B-DC33-4C64-A043-0584524B7CF9} - System32\Tasks\{365C35F0-5A16-4C92-A746-410136866AA7} => C:\Windows\system32\pcalua.exe -a "H:\Programy i sterowniki\Office 2007 PL\setup.exe" -d "H:\Programy i sterowniki\Office 2007 PL"
Task: {AB134FCE-9C8D-46EF-BBE9-32CB02D50787} - System32\Tasks\{1179AB09-6825-4B56-ADFC-5F4BC72910EB} => C:\Windows\system32\pcalua.exe -a "H:\Auto\autodata 3.17 pl\warsztat\VMWare Workstation 5.5.2-29772\VMware-workstation-5.5.2-29772.exe" -d "H:\Auto\autodata 3.17 pl\warsztat\VMWare Workstation 5.5.2-29772"
Task: {B5D5E5F8-1D58-44C8-B901-325539913AA4} - System32\Tasks\{B816D766-58C9-4F78-A53B-A1AEAB89066B} => C:\Windows\system32\pcalua.exe -a I:\nfs\setup.exe -d I:\nfs
AlternateDataStreams: C:\ProgramData:3f80b7866a646e [8582]
AlternateDataStreams: C:\ProgramData:fe93a19e34e9a [930]
AlternateDataStreams: C:\Users\All Users:3f80b7866a646e [8582]
AlternateDataStreams: C:\Users\All Users:fe93a19e34e9a [930]
AlternateDataStreams: C:\Users\M:aed4492b0 [1736]
AlternateDataStreams: C:\ProgramData\Application Data:3f80b7866a646e [8582]
AlternateDataStreams: C:\ProgramData\Application Data:fe93a19e34e9a [930]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:3f80b7866a646e [8582]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:fe93a19e34e9a [930]
AlternateDataStreams: C:\Users\M\Dane aplikacji:c05a146d48ae4 [8680]
AlternateDataStreams: C:\Users\M\Ustawienia lokalne:df91111699 [766]
AlternateDataStreams: C:\Users\M\AppData\Local:df91111699 [766]
AlternateDataStreams: C:\Users\M\AppData\Roaming:c05a146d48ae4 [8680]
AlternateDataStreams: C:\Users\M\AppData\Local\Dane aplikacji:df91111699 [766]
AlternateDataStreams: C:\Users\M\AppData\Local\Historia:6ded282dcbb [6580]
AlternateDataStreams: C:\Users\M\AppData\Local\Temp:30a428cf1 [495]
HKLM-x32\...\RunOnce: [] => [X]
HKU\S-1-5-21-1598909851-3688221429-4285144285-1000\...\Run: [smycWTeXSeDFCWU] => wscript.exe //B "C:\Users\M\AppData\Local\Temp\smycWTeXSeDFCWU.wSf" <==== UWAGA
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1598909851-3688221429-4285144285-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1598909851-3688221429-4285144285-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://pl.search.yahoo.com/yhs/web?hspart=lvs&hsimp=yhs-awc&type=lvs__webcompa__1_0__ya__hp_WCYID10438__171105__yaie
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1598909851-3688221429-4285144285-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-1598909851-3688221429-4285144285-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = hxxps://pl.search.yahoo.com/yhs/search?hspart=lvs&hsimp=yhs-awc&type=lvs__webcompa__1_0__ya__ch_WCYID10438__171105__yaie&p={searchTerms}
CHR StartupUrls: Default -> "hxxp://www.google.com/","hxxp://www.sweet-page.com/?type=hppp&ts=1409425125&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1409478072&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1409511218&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1409559633&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1409776773&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1410029589&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1410163578&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1410255397&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hppp&ts=1410556688&from=smt&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.sweet-page.com/?type=hp&ts=1413288820&from=cor&uid=SAMSUNGXHM321HI_S25WJ9DB156297","hxxp://www.istartsurf.com/?type=hp&ts=1430173342&from=squadm&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726","hxxp://www.mystartsearch.com/?type=hp&ts=1438075931&z=88b99cad7f8e00596372791g2z7cab0e5m6w7beb7w&from=wpc&uid=ST1000LM024XHN-M101MBB_S2SMJ9ADB01726"
CHR DefaultSearchURL: Default -> hxxps://www.elektroda.pl/rtvforum/topic3403416.html#16857728
U3 a3n424s1; C:\Windows\System32\Drivers\a3n424s1.sys [0 ] (Advanced Micro Devices) <==== UWAGA (zerobajtowy plik/folder)
U3 a6sgar11; C:\Windows\System32\Drivers\a6sgar11.sys [0 ] (Advanced Micro Devices) <==== UWAGA (zerobajtowy plik/folder)
S3 ALSysIO; \??\C:\Users\M\AppData\Local\Temp\ALSysIO64.sys [X] <==== UWAGA
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S2 vstor2; \??\C:\Program Files (x86)\Common Files\VMware\VMware Virtual Image Editing\vstor2.sys [X]
2017-11-29 20:21 - 2017-11-29 20:25 - 000000000 ____D C:\AdwCleaner
2017-11-28 13:27 - 2017-11-28 13:27 - 000012496 _____ C:\ComboFix.txt
2017-11-28 13:22 - 2011-06-26 07:45 - 000256000 _____ C:\Windows\PEV.exe
2017-11-28 13:22 - 2010-11-07 18:20 - 000208896 _____ C:\Windows\MBR.exe
2017-11-28 13:22 - 2009-04-20 05:56 - 000060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-11-28 13:22 - 2000-08-31 01:00 - 000518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-11-28 13:22 - 2000-08-31 01:00 - 000406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-11-28 13:22 - 2000-08-31 01:00 - 000098816 _____ C:\Windows\sed.exe
2017-11-28 13:22 - 2000-08-31 01:00 - 000080412 _____ C:\Windows\grep.exe
2017-11-28 13:22 - 2000-08-31 01:00 - 000068096 _____ C:\Windows\zip.exe
2017-11-28 13:21 - 2017-11-29 20:09 - 000000000 ____D C:\Qoobox
2017-11-28 13:21 - 2017-11-28 13:21 - 005659763 ____R (Swearware) C:\Users\M\Desktop\ComboFix.exe
Po wykonaniu usun katalog C:\FRST.
