Elektroda.pl
Elektroda.pl
X
Proszę, dodaj wyjątek www.elektroda.pl do Adblock.
Dzięki temu, że oglądasz reklamy, wspierasz portal i użytkowników.

W moim komputerze jest wirus Mail.ru

Adam_xD 06 Kwi 2018 19:49 318 5
  • #1 06 Kwi 2018 19:49
    Adam_xD
    Poziom 2  

    Na moim komputerze jest wirus. Cokolwiek chce zrobić zmienia przeglądarke na mail.ru . Z poprzednich postów dowiedziałem się, że pomaga program FRST. Jednak potrzeba do tego indywidualnego kodu fix. Jeśli ktoś potrafi coś takiego przygotować byłbym bardzo wdzięczny. W załączniku pliki FRST oraz Addition.

    0 5
  • #2 06 Kwi 2018 20:09
    Kolobos
    Spec od komputerów

    Odinstaluj:
    Amazon Assistant
    Browser-Security
    Intel Security True Key
    System Table

    Uzyj AdwCleaner, opcja Scan/Szukaj i Clean/Usun: http://www.bleepingcomputer.com/download/adwcleaner/

    Wykonaj Fixlist.txt dla FRST:
    Task: {0292CD24-48EC-4815-A685-D4921D10BCB1} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku <==== UWAGA
    Task: {2375429E-EE08-4AFF-98F7-1D0FFF4DB512} - System32\Tasks\DistromaticUpdater-periodic => C:\Program Files (x86)\Amazon Browser Settings\updater.exe <==== UWAGA
    Task: {3A20CBB8-D23D-4BE8-ABA4-6ACE996BF5F8} - System32\Tasks\DistromaticSearchProtect-logon => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe <==== UWAGA
    Task: {3C50F4B0-3F46-4539-B301-1246EF0BA129} - System32\Tasks\DistromaticSearchProtect-hourly => C:\Program Files (x86)\Amazon Browser Settings\AmznSearchProtect.exe <==== UWAGA
    Task: {53F56D20-D2C7-4864-9CFF-C01C42FAE39F} - System32\Tasks\Praosh Nodifier => C:\Program Files (x86)\Praosh\PraoshnodifierTask.exe <==== UWAGA
    Task: {56F05FE9-5273-451D-AFB0-D709C081C74E} - System32\Tasks\{ABA7CAB9-A1AB-4BE9-9B9A-3E22403E5D05} => "c:\program files (x86)\mozilla firefox\firefox.exe" hxxp://ui.skype.com/ui/0/7.18.0.112/pl/go/hel...ller?source=lightinstaller&LastError=1618
    Task: {8752F830-E487-41CA-9521-0221CA526FFC} - System32\Tasks\{89C6DD28-1B6A-4013-9D63-1790929F1797} => C:\WINDOWS\system32\pcalua.exe -a D:\steam\Drivers\UpdaterBootstrapper.exe -c 0 -uninstall "D:\steam\UninstallerScript.xml"
    Task: {94D28369-B17B-490A-8454-F31BFD3CB24D} - System32\Tasks\Opera scheduled Autoupdate 1490893783 => C:\Users\Adam\AppData\Local\Programs\Opera\launcher.exe
    Task: {DA7F8099-9838-4789-A7A6-19CBDE602BDA} - System32\Tasks\DistromaticUpdater-logon => C:\Program Files (x86)\Amazon Browser Settings\updater.exe <==== UWAGA
    Task: {E7926287-0280-40B4-86E1-A5B5DE1E1951} - System32\Tasks\Opera scheduled suite Autoupdate 1490893786 => C:\Users\Adam\AppData\Local\Programs\Opera\launcher.exe
    Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\WINDOWS\explorer.exe
    ShortcutWithArgument: C:\Users\Adam\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> %SNF%
    2016-06-19 13:24 - 2016-05-15 18:04 - 002089472 _____ () C:\ProgramData\Logic Handler\set.exe
    () C:\ProgramData\Logic Handler\set.exe
    (McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
    (McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
    AppInit_DLLs: C:\ProgramData\Ronzap\Holdcom.dll => Brak pliku
    Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
    HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61...X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
    HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811600
    SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
    SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61...X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
    SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BC0E08559-C40F-487B-9666-38023C2F803C%7D&gp=811610
    SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={searchTerms}&fr=ntg&product_id=%7BC0E08559-C40F-487B-9666-38023C2F803C%7D&gp=811610
    SearchScopes: HKU\S-1-5-21-1394522281-2860274102-1845149695-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61...X5wyPdDSfxwXLBsem28jp6u6Vj6PeZMniVCcvi&q={searchTerms}
    BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
    BHO-x32: Search(malpa)Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\Adam\AppData\Local\Mail.Ru\Sputnik\ie_addon_dll.dll [2018-04-06] (Mail.Ru)
    Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-07-15] (Intel Security)
    FF user.js: detected! => C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\qm4vkzv5.default-1513718035189\user.js [2017-06-30]
    CHR HKU\S-1-5-21-1394522281-2860274102-1845149695-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
    CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
    R2 backlh; C:\ProgramData\Logic Handler\set.exe [2089472 2016-05-15] () [Brak podpisu cyfrowego] <==== UWAGA
    C:\ProgramData\Logic Handler\
    R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
    R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
    S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
    2018-04-06 18:30 - 2018-04-06 18:30 - 000000000 ____D C:\Users\Adam\EasternGraphics
    2018-04-06 18:30 - 2018-04-06 18:30 - 000000000 ____D C:\Users\Adam\AppData\Local\III
    2018-04-06 18:29 - 2018-04-06 18:29 - 000000000 ____D C:\Users\Adam\AppData\Roaming\OneSystemCare
    2018-04-06 18:29 - 2018-04-06 18:29 - 000000000 ____D C:\Program Files (x86)\Mail.Ru
    2018-04-06 18:28 - 2018-04-06 18:31 - 000000000 ____D C:\Users\Adam\Downloads\crack-assassins-creed-origins
    2018-04-06 18:28 - 2018-04-06 18:29 - 000000000 ____D C:\Users\Adam\AppData\Local\Mail.Ru
    2018-04-06 18:28 - 2018-04-06 18:29 - 000000000 ____D C:\ProgramData\Mail.Ru
    2017-12-03 14:04 - 2017-12-03 14:04 - 000086016 _____ (PRO GAME) C:\Program Files (x86)\Common Files\atiecls.dll
    2017-12-03 14:17 - 2017-12-03 14:17 - 000036864 ___SH (Microsoft® DEVELOPER) C:\Program Files (x86)\Common Files\cnex-demo.exe
    2017-12-03 14:14 - 2017-12-03 14:14 - 000155648 ___SH (PRO_GAME) C:\Program Files (x86)\Common Files\cnex.exe
    2018-04-06 18:20 - 2018-04-06 18:21 - 000001716 _____ () C:\Program Files (x86)\Common Files\hopatemp.ini
    2017-12-03 15:35 - 2018-04-06 18:21 - 000057394 _____ () C:\Program Files (x86)\Common Files\unitemp.exe
    2016-06-19 13:24 - 2016-06-19 13:24 - 006867968 _____ () C:\Users\Adam\AppData\Roaming\agent.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 000054272 _____ () C:\Users\Adam\AppData\Roaming\ApplicationHosting.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 000069072 _____ () C:\Users\Adam\AppData\Roaming\Config.xml
    2016-06-19 13:23 - 2016-06-19 13:24 - 000019584 _____ () C:\Users\Adam\AppData\Roaming\InstallationConfiguration.xml
    2016-06-19 13:23 - 2016-06-19 13:23 - 000128512 _____ () C:\Users\Adam\AppData\Roaming\Installer.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 000072704 _____ () C:\Users\Adam\AppData\Roaming\Iszundex.tst
    2016-06-19 13:24 - 2016-06-19 13:24 - 000126464 _____ () C:\Users\Adam\AppData\Roaming\lobby.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 000018432 _____ () C:\Users\Adam\AppData\Roaming\Main.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 000005568 _____ () C:\Users\Adam\AppData\Roaming\md.xml
    2016-06-19 13:24 - 2016-06-19 13:24 - 000126464 _____ () C:\Users\Adam\AppData\Roaming\noah.dat
    2016-06-19 13:24 - 2016-06-19 13:24 - 002279413 _____ () C:\Users\Adam\AppData\Roaming\Quodax.bin
    2016-06-19 13:24 - 2016-06-19 13:24 - 001760384 _____ () C:\Users\Adam\AppData\Roaming\SaoFinfresh.tst
    2016-06-19 13:24 - 2016-06-19 13:24 - 000189618 _____ () C:\Users\Adam\AppData\Roaming\Trishold.bin
    2016-06-19 13:24 - 2016-06-19 13:24 - 000848437 _____ () C:\Users\Adam\AppData\Roaming\Zum-Tech.bin
    2017-08-23 17:06 - 2017-08-23 17:06 - 000174080 _____ (Igor Pavlov) C:\Users\Adam\AppData\Local\7zxa.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 002495696 _____ () C:\Users\Adam\AppData\Local\bigup2.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 000608768 _____ (Abysmal Software) C:\Users\Adam\AppData\Local\DevIL.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 000453120 _____ (The curl library, https://curl.haxx.se/) C:\Users\Adam\AppData\Local\libcurl.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 000249744 _____ () C:\Users\Adam\AppData\Local\lightupdate.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 005572304 _____ (MY.COM B.V.) C:\Users\Adam\AppData\Local\MyComGames.exe~
    2017-08-23 17:06 - 2017-08-23 17:06 - 000076176 _____ () C:\Users\Adam\AppData\Local\pxd.dll~
    2017-08-23 17:06 - 2017-08-23 17:06 - 000144896 _____ () C:\Users\Adam\AppData\Local\zlib1.dll~
    2018-04-06 18:29 - 2018-03-02 14:59 - 001314008 _____ (Mail.Ru) C:\Users\Adam\AppData\Local\Temp\57bf-0b6d-30ed-cddb.exe
    2018-04-06 18:29 - 2018-03-02 14:59 - 001314008 _____ (Mail.Ru) C:\Users\Adam\AppData\Local\Temp\b185-41c9-58ce-a7bd.exe


    Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
    http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

    0
  • #4 06 Kwi 2018 20:35
    Kolobos
    Spec od komputerów

    W ktorej przegladarce wystepuje ten problem? W Firefox? Jezeli tak to zgraj zakladki i usun katalog profilu przegladarki.

    0
  • #5 06 Kwi 2018 20:36
    Adam_xD
    Poziom 2  

    Dziękuje bardzo za pomoc. Wszystko działa :)

    0
  • #6 06 Kwi 2018 20:40
    Kolobos
    Spec od komputerów

    Usun katalog C:\FRST i to wszystko.

    0