Elektroda.pl
Elektroda.pl
X
Proszę, dodaj wyjątek www.elektroda.pl do Adblock.
Dzięki temu, że oglądasz reklamy, wspierasz portal i użytkowników.

CMD wyskakuje co jakiś czas i coś pobiera

ManuaL97 07 Sty 2018 04:50 261 3
  • #1 07 Sty 2018 04:50
    ManuaL97
    Poziom 2  

    Witam, mam problem z CMD wyskakuje co jakiś czas i zaczyna coś pobierać, wcześniej przy pobieraniu programu, pobrało Mail.ru, już usunąłem to kompletnie, ale teraz CMD wyskakuje i coś pobiera:

    Dodaje logi z Malwarebytes i FRST

    Prosze o szybką pomoc, pozdrawiam :)
    CMD wyskakuje co jakiś czas i coś pobiera

    0 3
  • Pomocny post
    #3 07 Sty 2018 09:07
    safbot1st
    Poziom 43  

    Odinstaluj IOBit.
    Otwórz notatnik i wklej:

    Code:

    HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000\...\MountPoints2: {4c2c425f-94d5-11e7-9a7e-f0761c347761} - G:\setup.exe
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01072018043332742\...\MountPoints2: {4c2c425f-94d5-11e7-9a7e-f0761c347761} - G:\setup.exe
    GroupPolicy: Restriction <==== ATTENTION
    GroupPolicy\User: Restriction <==== ATTENTION
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000\Software\Microsoft\Internet Explorer\Main,Start Page =
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01072018043332742\Software\Microsoft\Internet Explorer\Main,Start Page =
    HKU\S-1-5-21-1464078788-16451440-1299037667-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-01072018043332742\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
    FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
    CHR HomePage: Default -> hxxp://www.google.com/
    CHR StartupUrls: Default -> "hxxps://www.google.com/","hxxp://www.google.com/","hxxp://www.delta-homes.com/?type=hp&ts=1432127190&z=1b8ddfaba99a010686b1542gfz1c7o3g7obm8g3b1b&from=wpm05203&uid=TOSHIBAXMQ01ABF050_745MSMS1SXX745MSMS1S","hxxp://www.yoursearching.com/?type=hp&ts=1455129896&z=5fe97c72aedfea05fb9e5c1g2zdwdwbgeo2tebet2q&from=itr&uid=toshibaxmq01abf050_745msms1sxx745msms1s","hxxp://mail.ru/cnt/10445?gp=811138"
    CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
    S3 BTATH_HCRP; system32\DRIVERS\btath_hcrp.sys [X]
    S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    2018-01-04 18:51 - 2018-01-07 04:18 - 000003238 _____ C:\Windows\System32\Tasks\fPhifYjmuIcW
    2018-01-04 18:51 - 2018-01-07 00:58 - 000003616 _____ C:\Windows\System32\Tasks\FHElIhMsvGME
    2018-01-04 18:51 - 2018-01-07 00:58 - 000003484 _____ C:\Windows\System32\Tasks\MYayUEAMbEaqO
    2018-01-04 18:51 - 2016-11-09 16:55 - 000073216 _____ (Microsoft Corporation) C:\Users\Adam\AppData\Local\aEJowO.exe




    2018-01-04 18:51 - 2010-11-21 04:24 - 000186368 _____ (Microsoft Corporation) C:\Users\Adam\AppData\Local\RSOWeUYSuxdfa.exe
    2018-01-04 18:51 - 2009-07-14 02:14 - 000001102 _____ C:\Users\Adam\JgYZrygwURO
    2018-01-04 18:51 - 2009-07-14 02:14 - 000001061 _____ C:\Users\Adam\AppData\Roaming\CtOC
    2018-01-04 18:51 - 2009-07-14 02:14 - 000000055 _____ C:\Users\Adam\IyCeeAJO
    2018-01-01 18:37 - 2018-01-07 00:58 - 000003270 _____ C:\Windows\System32\Tasks\{E42BE8BC-3590-45DB-AB7A-3BE12A944C85}
    2018-01-01 18:32 - 2018-01-07 00:58 - 000003346 _____ C:\Windows\System32\Tasks\{91C1495E-79F7-4CE3-B43F-D7BF1B83EB7C}
    2018-01-01 14:25 - 2018-01-07 00:58 - 000003270 _____ C:\Windows\System32\Tasks\{5147194B-7E99-471E-AB80-E309B2A29EBA}
    2009-07-14 02:14 - 2009-07-14 02:14 - 000000055 _____ () C:\Users\Adam\IyCeeAJO.bat
    2009-07-14 02:14 - 2009-07-14 02:14 - 000001102 _____ () C:\Users\Adam\JgYZrygwURO.bat
    2018-01-04 18:51 - 2009-07-14 02:14 - 000000064 _____ () C:\Program Files (x86)\Common Files\CFyOeniy
    2009-07-14 02:14 - 2009-07-14 02:14 - 000000064 _____ () C:\Program Files (x86)\Common Files\CFyOeniy.bat
    2018-01-04 18:51 - 2009-07-14 02:14 - 000001061 _____ () C:\Users\Adam\AppData\Roaming\CtOC
    2009-07-14 02:14 - 2009-07-14 02:14 - 000001061 _____ () C:\Users\Adam\AppData\Roaming\CtOC.bat
    2018-01-04 18:51 - 2016-11-09 16:55 - 000073216 _____ (Microsoft Corporation) C:\Users\Adam\AppData\Local\aEJowO.exe
    2018-01-04 18:51 - 2010-11-21 04:24 - 000186368 _____ (Microsoft Corporation) C:\Users\Adam\AppData\Local\RSOWeUYSuxdfa.exe
    ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
    Task: {4564FC13-83D3-456E-A8C9-59B89DB5E755} - System32\Tasks\fPhifYjmuIcW => C:\Users\Adam\IyCeeAJO.bat [2009-07-14] () <==== ATTENTION
    Task: {D9513509-D34D-4A0D-B2FB-993FF5C4F69E} - System32\Tasks\MYayUEAMbEaqO => C:\Program Files (x86)\Common Files\CFyOeniy.bat [2009-07-14] () <==== ATTENTION
    AlternateDataStreams: C:\ProgramData:NT [40]
    AlternateDataStreams: C:\ProgramData:NT2 [432]
    AlternateDataStreams: C:\Users\All Users:NT [40]
    AlternateDataStreams: C:\Users\All Users:NT2 [432]
    AlternateDataStreams: C:\Users\Adam\Application Data:NT [40]
    AlternateDataStreams: C:\Users\Adam\Application Data:NT2 [432]
    AlternateDataStreams: C:\Users\Adam\AppData\Roaming:NT [40]
    AlternateDataStreams: C:\Users\Adam\AppData\Roaming:NT2 [432]
    AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
    AlternateDataStreams: C:\ProgramData\Application Data:NT2 [432]
    AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT [40]
    AlternateDataStreams: C:\ProgramData\MTA San Andreas All:NT2 [432]
    Hosts:
    EmptyTemp:

    ,zapisz jako fixlist.txt obok FRST.exe i w FRST wybierz "Napraw".
    Po naprawie usuń C:\FRST

    0
  • #4 07 Sty 2018 12:02
    ManuaL97
    Poziom 2  

    Jak na razie przy włączaniu komputera nic nie wyskoczyło, więc chyba już jest okej, wielkie dzięki.

    0