Nie sciagaj zainfekowanych aktywatorow, to nie bedziesz mial problemow.
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
Task: {44FA3E0C-531B-4597-922F-EB5668AC5CC4} - System32\Tasks\Opera scheduled Autoupdate 2796787680 => C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\tcisgctj\uarsfgtv.exe
( ) C:\Users\Bartek\AppData\Roaming\p4nkox4tkkm\ly4cqd2sbex.exe
() C:\Users\Bartek\AppData\Local\Temp\is-IMHU9.tmp\ly4cqd2sbex.tmp
(%R2ZPX4) C:\Program Files\E7AJ2KL19L\LBY52NHL3.exe
(DVC ) C:\Users\Bartek\AppData\Roaming\fv1uiq21g4n\ickezdnvtbc.exe
() C:\Users\Bartek\AppData\Local\Temp\is-JA47P.tmp\ickezdnvtbc.tmp
HKU\S-1-5-21-1307068467-321929082-2887256430-1001\...\Run: [8347173] => C:\Users\Bartek\AppData\Roaming\p4nkox4tkkm\ly4cqd2sbex.exe [609086 2018-11-01] ( )
HKU\S-1-5-21-1307068467-321929082-2887256430-1001\...\Run: [H4N3TPLQD4GUQHY] => C:\Program Files\E7AJ2KL19L\LBY52NHL3.exe [671232 2018-11-02] (%R2ZPX4)
HKU\S-1-5-21-1307068467-321929082-2887256430-1001\...\Run: [181701] => C:\Users\Bartek\AppData\Roaming\fv1uiq21g4n\ickezdnvtbc.exe [939501 2018-11-02] (DVC )
Startup: C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chibtfei.lnk [2018-11-01]
ShortcutTarget: chibtfei.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
Startup: C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcisgctj.lnk [2018-11-02]
ShortcutTarget: tcisgctj.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
2018-11-02 14:45 - 2018-11-02 14:45 - 000000008 __RSH C:\ProgramData\ntuser.pol
2018-11-02 14:18 - 2018-11-02 14:18 - 002414592 _____ (Farbar) C:\Users\Bartek\Downloads\Niepotwierdzony 705431.crdownload
2018-11-02 13:23 - 2018-11-02 13:24 - 000002334 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 2796787680
2018-11-02 12:29 - 2018-11-02 12:29 - 006860752 _____ (NeoSoft Tools ) C:\Users\Bartek\AppData\Roaming\cexplorer.exe
2018-11-02 12:29 - 2018-11-02 12:29 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\fv1uiq21g4n
2018-11-02 12:29 - 2018-11-02 12:29 - 000000000 ____D C:\Program Files\E7AJ2KL19L
2018-11-01 23:40 - 2018-11-01 23:40 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\Mozilla
2018-11-01 23:39 - 2018-11-02 14:48 - 000000000 ____D C:\Program Files\PTVCL5TWE9
2018-11-01 23:39 - 2018-11-01 23:39 - 007800320 _____ C:\Users\Bartek\AppData\Local\agent.dat
2018-11-01 23:39 - 2018-11-01 23:39 - 002020690 _____ C:\Users\Bartek\AppData\Local\Freezuncom.tst
2018-11-01 23:39 - 2018-11-01 23:39 - 001995264 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Freezuncom.exe
2018-11-01 23:39 - 2018-11-01 23:39 - 000126464 _____ C:\Users\Bartek\AppData\Local\noah.dat
2018-11-01 23:39 - 2018-11-01 23:39 - 000070896 _____ C:\Users\Bartek\AppData\Local\Config.xml
2018-11-01 23:39 - 2018-11-01 23:39 - 000005568 _____ C:\Users\Bartek\AppData\Local\md.xml
2018-11-01 23:39 - 2018-11-01 23:39 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\p4nkox4tkkm
2018-11-01 23:32 - 2018-11-02 12:35 - 000000066 _____ C:\WINDOWS\progress.ini
2018-11-01 23:03 - 2018-11-01 23:03 - 000000000 ____D C:\Users\Bartek\AppData\Local\mpress
2018-11-01 22:48 - 2018-11-02 10:55 - 000000000 ____D C:\Users\Bartek\AppData\Local\GoogleChromeUserData
2018-11-01 22:47 - 2018-11-02 10:46 - 000000000 ____D C:\Users\Bartek\AppData\Local\GoogleChromeApplication
2018-11-01 22:47 - 2018-11-01 22:55 - 000000000 ____D C:\Users\Bartek\AppData\Local\NtvHost
2018-11-01 22:46 - 2018-11-01 22:46 - 000000000 ____D C:\Users\Bartek\AppData\Local\William
2018-11-01 22:43 - 2018-11-02 10:58 - 000722944 _____ C:\Users\Bartek\AppData\Local\sham.db
2018-11-01 22:43 - 2018-11-01 22:43 - 005259067 _____ ( ) C:\ProgramData\zmrlcporvl.exe
2018-11-01 22:43 - 2018-11-01 22:43 - 000140800 _____ C:\Users\Bartek\AppData\Local\installer.dat
2018-11-01 22:43 - 2018-11-01 22:43 - 000000000 ____D C:\Users\Bartek\AppData\Local\Turbo.net
2018-11-01 22:43 - 2018-11-01 22:43 - 000000000 ____D C:\Users\Bartek\AppData\Local\AdvinstAnalytics
2018-11-01 22:42 - 2018-11-01 22:42 - 000000000 ____D C:\ProgramData\Blogger
2018-11-01 22:41 - 2018-11-01 22:41 - 000000000 ____D C:\Users\Bartek\AppData\Local\pidoraz
2018-11-01 22:41 - 2018-11-01 22:41 - 000000000 ____D C:\Program Files (x86)\Margin Trade
2018-11-01 22:43 - 2018-11-01 22:43 - 005259067 _____ ( ) C:\ProgramData\zmrlcporvl.exe
2018-11-02 12:29 - 2018-11-02 12:29 - 006860752 _____ (NeoSoft Tools ) C:\Users\Bartek\AppData\Roaming\cexplorer.exe
2018-11-01 23:39 - 2018-11-01 23:39 - 007800320 _____ () C:\Users\Bartek\AppData\Local\agent.dat
2018-11-01 23:39 - 2018-11-01 23:39 - 000070896 _____ () C:\Users\Bartek\AppData\Local\Config.xml
2018-11-01 23:39 - 2018-11-01 23:39 - 001995264 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Freezuncom.exe
2018-11-01 23:39 - 2018-11-01 23:39 - 002020690 _____ () C:\Users\Bartek\AppData\Local\Freezuncom.tst
2018-11-01 22:43 - 2018-11-01 22:43 - 000140800 _____ () C:\Users\Bartek\AppData\Local\installer.dat
2018-11-01 23:39 - 2018-11-01 23:39 - 000005568 _____ () C:\Users\Bartek\AppData\Local\md.xml
2018-11-01 23:39 - 2018-11-01 23:39 - 000126464 _____ () C:\Users\Bartek\AppData\Local\noah.dat
2018-11-01 22:43 - 2018-11-02 10:58 - 000722944 _____ () C:\Users\Bartek\AppData\Local\sham.db
2018-11-01 23:40 - 2018-11-01 23:40 - 000032038 _____ () C:\Users\Bartek\AppData\Local\uninstall_temp.ico
Usun katalog C:\FRST po wykonaniu.
Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
oraz
http://ftp.drweb.com/pub/drweb/cureit/launch.exe
Dla pewnosci zamiesc nowe logi z FRST, ze skanowania po wykonaniu wszystkiego.
