W logach nie widac wpisow z Opery, najlepiej zgraj zakladki i usun katalog profilu przegladarki.
Odinstaluj:
McAfee Security Scan Plus
McAfee WebAdvisor
YoutubeAdBlock
Wykonaj Fixlist.txt dla FRST:
WinThruster (HKLM\...\{773A8CA8-3876-4AA1-AB78-EECA231BFF3A}) (Version: 1.31.0 - Solvusoft Corporation) Hidden <==== UWAGA
Online Application (HKLM-x32\...\{5266F634-7B7D-4537-BDDC-98DD6CFCBAA1}) (Version: 2.7.0 - Microleaves) Hidden <==== UWAGA
Po wykonaniu odinstaluj:
Online Application
WinThruster
Wykonaj kolejny Fixlist.txt dla FRST:
CloseProcesses:
EmptyTemp:
Task: {0D91897D-252D-467F-9F59-F32D933C1532} - System32\Tasks\Updater_Online_Application => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== UWAGA
Task: {1904E56C-7234-4E49-8B3E-2ACDBCABAAF4} - System32\Tasks\{ED9FCE76-E2B7-4CC0-B9A9-A7035DF24194} => C:\Windows\system32\pcalua.exe -a C:\Users\Użytkownik\AppData\Local\Temp\Temp1_pbsetup.zip\pbsetup.exe <==== UWAGA
Task: {48FC849B-4A28-4925-8211-D963224677CD} - System32\Tasks\VnLjE => C:\Users\U┐ytkownik\AppData\Roaming\acyEA\VnLjE.vbs
Task: {5ADB5EC7-7D2C-4C7A-8DB1-ED1942B45FD1} - System32\Tasks\{A4A90C3D-D345-48B1-899D-4AE7099F8354} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Common Files\Zotlab\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\Zotlab\uninstall.dat" -a uninstallme 248B266D-2287-4A75-A8FD-5400AD6B85B4 DeviceId=22f03446-562c-3ff9-7113-12fdb06bd84f BarcodeId=51198003 ChannelId=003 DistributerName=APSFWakeNet
Task: {5DFAC4AC-6FDE-43B6-B697-1EC31677012E} - System32\Tasks\EGDwIDfrVjLvW2 => C:\Windows\system32\wscript.exe "C:\ProgramData\zTXZmVxyKBKDhdVB\QTjurZI.wsf"
Task: {66E233EC-A89F-469D-BACB-E835CE9B4AA5} - System32\Tasks\{7492AEE2-4012-478E-BF72-B6E3F65BBE37} => C:\Windows\system32\pcalua.exe -a "C:\Users\Użytkownik\Downloads\iZotope_Ozone_3-10\iZotope Ozone Setup v3-10 [KeyGen].exe" -d C:\Users\Użytkownik\Downloads\iZotope_Ozone_3-10
Task: {69277A9E-12DE-48D2-938D-85B8E6FAAE95} - System32\Tasks\{6C3E8675-2597-4B33-9337-4194A025189C} => C:\Windows\system32\pcalua.exe -a "C:\Users\Użytkownik\Desktop\DRUKARKA\epson323813eu (1).exe" -d C:\Users\Użytkownik\Desktop\DRUKARKA
Task: {8E53FF36-2673-4649-9AAB-9B209EFF357F} - System32\Tasks\{EB2AB760-D7AD-4948-9F5D-68AB07F8EC4C} => C:\Windows\system32\pcalua.exe -a "C:\Users\Użytkownik\Downloads\sylenth vtx licence.dat by bonio506 chomikuj pl\Lennar.Digital.Sylenth1.VSTi.v2.2.1.1.x86.PROPER-VTX\VTXSetup.exe" -d "C:\Users\Użytkownik\Downloads\sylenth vtx licence.dat by bonio506 chomikuj pl\Lennar.Digital.Sylenth1.VSTi.v2.2.1.1.x86.PROPER-VTX"
Task: {CE8E0845-1E56-4D39-A6A3-DC055F725652} - System32\Tasks\{15BE6613-D0B7-4173-836C-E37AAA8B10FC} => C:\Windows\system32\pcalua.exe -a C:\Users\Użytkownik\Downloads\vcredist_x64.exe -d C:\Users\Użytkownik\Downloads
Task: {D41342FD-C936-4B49-9594-A4CF51723DA8} - System32\Tasks\{CE617FB5-D517-43C1-B01A-09B99E6F542D} => C:\Windows\system32\pcalua.exe -a C:\Users\Użytkownik\AppData\Local\Temp\Temp1_ME(v9.5.14.1724_1.5M).zip\ME(v9.5.14.1724_1.5M)\setup.exe <==== UWAGA
Task: {DBC2A3C9-C080-4669-95F1-24E646A68546} - System32\Tasks\CastVPN => "cmd" /c sc stop CastVPN & sc start CastVPN"
Task: {E90525CE-F325-4893-9D3F-85281A70D1C1} - System32\Tasks\{171E3A11-9998-4179-9CDB-DC94455F2CF7} => C:\Windows\system32\pcalua.exe -a C:\Users\Użytkownik\Downloads\vcredist_x86.exe -d C:\Users\Użytkownik\Downloads
Task: {F5DBC772-EF94-4B2A-8C73-AA513AF4FFFC} - System32\Tasks\qdxgajDnKqmDPrtzQ2 => rundll32 "C:\Program Files (x86)\BHXQvOBMsgKdEntstUR\qoPSKil.dll",#1
Task: {F7539BC2-9158-4B71-B406-337B2BDB5BCD} - System32\Tasks\Opera scheduled Autoupdate 1542145140 => C:\Users\Użytkownik\AppData\Local\Programs\Opera\launcher.exe [2018-12-19] (Opera Software)
Task: C:\Windows\Tasks\Updater_Online_Application.job => C:\Program Files (x86)\Microleaves\Online Application\Online Application Updater.exe <==== UWAGA
ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files (x86)\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
AlternateDataStreams: C:\Users\Użytkownik\AppData\Local\Temp:1vU3jF8Ub9fvxRg7Nobd [2278]
AlternateDataStreams: C:\Users\Użytkownik\AppData\Local\Temporary Internet Files:0LcoF3cg8lqLdGrZF24zO6mH [614]
AlternateDataStreams: C:\Users\Użytkownik\AppData\Local\Temporary Internet Files:7yHJtRdlsFeV01pLWXOJ [2678]
Hosts:
(McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\servicehost.exe
(McAfee, Inc.) C:\Program Files\McAfee\WebAdvisor\uihost.exe
() C:\ProgramData\Microsoft\Windows\Power\PowerSvc.exe
(CloudBees, Inc.) C:\Users\Użytkownik\AppData\Local\NtvHost\syssvc.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.895\SSScheduler.exe
(Solvusoft Corporation) C:\Program Files (x86)\Solvusoft\Tray\SolvusoftTray.exe
HKLM-x32\...\Run: [CommonToolkitTray_Solvusoft] => C:\Program Files (x86)\Solvusoft\Tray\SolvusoftTray.exe [1685192 2018-03-06] (Solvusoft Corporation)
HKU\S-1-5-21-2792713463-1681503104-1756881498-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2792713463-1681503104-1756881498-1000\...\MountPoints2: {3311039b-934a-11e8-8cb2-bc5ff4bd507d} - D:\setup.exe
HKU\S-1-5-21-2792713463-1681503104-1756881498-1000\...\MountPoints2: {3311039e-934a-11e8-8cb2-bc5ff4bd507d} - H:\setup.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2018-12-16]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.895\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Użytkownik\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\utefubhd.lnk [2018-11-13]
ShortcutTarget: utefubhd.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation)
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Tcpip\..\Interfaces\{E6A0AA10-EE9C-45D4-B091-B69323D77980}: [NameServer] 82.163.143.146,82.163.142.148
HKU\S-1-5-21-2792713463-1681503104-1756881498-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ_z0a6qMEXp4-AtFtozMmOjB3zEdTciEfmhXhaFUMtzYhOK10L3fgveAGBDbCtY6Hg2M375Fgi-inRyUgNphASKQ3wrEH3uxha08i0M-HS1YjvF-XIZxED8nf0wvSEpg8HoOYJYoOv6ZXqu7oBgWfi3gBdivoO&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ_z0a6qMEXp4-AtFtozMmOjB3zEdTciEfmhXhaFUMtzYhOK10L3fgveAGBDbCtY6Hg2M375Fgi-inRyUgNphASKQ3wrEH3uxha08i0M-HS1YjvF-XIZxED8nf0wvSEpg8HoOYJYoOv6ZXqu7oBgWfi3gBdivoO&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2792713463-1681503104-1756881498-1000 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ_z0a6qMEXp4-AtFtozMmOjB3zEdTciEfmhXhaFUMtzYhOK10L3fgveAGBDbCtY6Hg2M375Fgi-inRyUgNphASKQ3wrEH3uxha08i0M-HS1YjvF-XIZxED8nf0wvSEpg8HoOYJYoOv6ZXqu7oBgWfi3gBdivoO&q={searchTerms}
BHO: Brak nazwy -> {14D0AD49-F627-4E41-93CA-E9A444EE8B22} -> Brak pliku
BHO: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\x64\IEPlugin.dll [2018-12-24] (McAfee, Inc.)
BHO-x32: McAfee WebAdvisor -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> C:\Program Files\McAfee\WebAdvisor\win32\IEPlugin.dll [2018-12-24] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll Brak pliku
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
FF Extension: (McAfee® WebAdvisor) - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi [2018-12-28]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files\McAfee\WebAdvisor\e10ssaffplg.xpi
CHR StartupUrls: Default -> "hxxp://www.istartsurf.com/?type=hp&ts=1447794248&z=ee8cefb21a185a90eb0c834g6zfzbmcm7t9cct7z1g&from=face&uid=ST3500418AS_6VMPZYZAXXXX6VMPZYZA","hxxp://www.istartpageing.com/?type=hp&ts=1447859720&z=9a744f76a9c748f45245ddfg7zaz0meb8wat4mdg6w&from=cmi&uid=ST3500418AS_6VMPZYZAXXXX6VMPZYZA","hxxp://www.istartpageing.com/?type=hp&ts=1447942243&z=cf8c6cb2272554fbd2642c1gaz8zcm0tezfo3o7c6q&from=cmi&uid=ST3500418AS_6VMPZYZAXXXX6VMPZYZA","hxxp://www.istartpageing.com/?type=hp&ts=1448055244&z=a4e616e784b4d33aa3a40a4g3z2z6b5e1w5w5o3c2z&from=cmi&uid=ST3500418AS_6VMPZYZAXXXX6VMPZYZA","hxxp://www.trotux.com/?z=6f042d837d3a1f81191680agfzcmdq3b5g6tbofc9z&from=ftp&uid=ST3500418AS_6VMPZYZAXXXX6VMPZYZA&type=hp"
C:\Users\Użytkownik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmepafhiigbfimndaicdpoeebdgmkfdb
C:\Users\Użytkownik\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicah
CHR Extension: (McAfee® WebAdvisor) - C:\Users\Użytkownik\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2018-10-16]
CHR Extension: (Adblocker for Youtube™) - C:\Users\Użytkownik\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmepafhiigbfimndaicdpoeebdgmkfdb [2018-11-13] [UpdateUrl: hxxps://clients88.google.com/service/update2/crx] <==== UWAGA
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2792713463-1681503104-1756881498-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gcnfpjoimnmmdiokmpaebcacnnpdifbn] - hxxps://clients2.google.com/service/update2/crx
S2 EventSvc; C:\ProgramData\Microsoft\Windows\EventSvc\eventsvc.exe [360448 2018-07-24] (CloudBees, Inc.) [Brak podpisu cyfrowego] <==== UWAGA
R2 McAfee WebAdvisor; C:\Program Files\McAfee\WebAdvisor\ServiceHost.exe [905336 2018-12-24] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.895\McCHSvc.exe [405392 2018-12-11] (McAfee, Inc.)
R2 PowerSvc; C:\ProgramData\Microsoft\Windows\Power\PowerSvc.exe [6406448 2018-06-25] () [Brak podpisu cyfrowego] <==== UWAGA
R2 SysSvc; C:\Users\Użytkownik\AppData\Local\NtvHost\syssvc.exe [360448 2018-07-24] (CloudBees, Inc.) [Brak podpisu cyfrowego] <==== UWAGA
S2 CRMSvc; "C:\Users\Użytkownik\AppData\Roaming\CRMSvc\CRMSvc.exe" [X]
S2 Key Symbols Notifier; "C:\Users\Użytkownik\AppData\Local\WServices\svb98s12e.exe" /srv [X]
S4 ljoiyzxd; C:\Windows\SysWOW64\ljoiyzxd\bsloviut.exe [X]
2019-01-10 14:53 - 2019-01-10 14:53 - 000000000 ____D C:\Users\Użytkownik\Desktop\FRST-OlderVersion
2018-12-16 13:02 - 2018-12-16 13:02 - 000001924 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2018-12-16 13:02 - 2018-12-16 13:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2018-12-16 13:01 - 2018-12-16 13:07 - 000000000 ____D C:\ProgramData\McAfee Security Scan
2019-01-07 22:15 - 2018-11-13 22:39 - 000004112 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1542145140
2019-01-07 22:15 - 2018-11-13 13:07 - 000002890 _____ C:\Windows\System32\Tasks\EGDwIDfrVjLvW2
2019-01-07 22:15 - 2018-11-13 13:07 - 000002872 _____ C:\Windows\System32\Tasks\qdxgajDnKqmDPrtzQ2
2019-01-07 22:15 - 2018-11-13 13:06 - 000003442 _____ C:\Windows\System32\Tasks\CastVPN
2019-01-07 22:15 - 2018-11-13 12:26 - 000003570 _____ C:\Windows\System32\Tasks\{A4A90C3D-D345-48B1-899D-4AE7099F8354}
2019-01-07 22:15 - 2018-11-13 11:46 - 000003240 _____ C:\Windows\System32\Tasks\VnLjE
2019-01-07 22:15 - 2018-11-13 11:41 - 000003318 _____ C:\Windows\System32\Tasks\Updater_Online_Application
2019-01-07 22:15 - 2018-10-23 18:07 - 000003278 _____ C:\Windows\System32\Tasks\{7492AEE2-4012-478E-BF72-B6E3F65BBE37}
2019-01-07 22:15 - 2018-09-06 12:11 - 000003196 _____ C:\Windows\System32\Tasks\{6C3E8675-2597-4B33-9337-4194A025189C}
2019-01-07 22:15 - 2018-06-04 22:50 - 000003566 _____ C:\Windows\System32\Tasks\{EB2AB760-D7AD-4948-9F5D-68AB07F8EC4C}
2019-01-07 22:15 - 2018-04-20 15:10 - 000003154 _____ C:\Windows\System32\Tasks\{171E3A11-9998-4179-9CDB-DC94455F2CF7}
2019-01-07 22:15 - 2018-04-20 15:10 - 000003154 _____ C:\Windows\System32\Tasks\{15BE6613-D0B7-4173-836C-E37AAA8B10FC}
2019-01-07 22:15 - 2017-12-24 00:27 - 000003200 _____ C:\Windows\System32\Tasks\{CE617FB5-D517-43C1-B01A-09B99E6F542D}
2019-01-07 22:15 - 2017-12-24 00:11 - 000003132 _____ C:\Windows\System32\Tasks\{ED9FCE76-E2B7-4CC0-B9A9-A7035DF24194}
2018-12-29 18:56 - 2018-11-13 11:43 - 000000000 ____D C:\Users\Użytkownik\AppData\Local\NtvHost
2018-12-16 13:02 - 2017-12-09 17:33 - 000000000 ____D C:\Program Files\McAfee Security Scan
2018-11-13 11:39 - 2018-11-13 11:39 - 007809024 _____ () C:\Users\Użytkownik\AppData\Local\agent.dat
2018-11-13 11:39 - 2018-11-13 11:39 - 000070896 _____ () C:\Users\Użytkownik\AppData\Local\Config.xml
2018-11-13 11:38 - 2018-11-13 11:39 - 000016416 _____ () C:\Users\Użytkownik\AppData\Local\InstallationConfiguration.xml
2018-11-13 11:38 - 2018-11-13 11:38 - 000140800 _____ () C:\Users\Użytkownik\AppData\Local\installer.dat
2018-11-13 11:39 - 2018-11-13 11:39 - 000018432 _____ () C:\Users\Użytkownik\AppData\Local\Main.dat
2018-11-13 11:39 - 2018-11-13 11:39 - 000005568 _____ () C:\Users\Użytkownik\AppData\Local\md.xml
2018-11-13 11:39 - 2018-11-13 11:39 - 000126464 _____ () C:\Users\Użytkownik\AppData\Local\noah.dat
2018-11-13 11:38 - 2018-11-13 12:26 - 000722944 _____ () C:\Users\Użytkownik\AppData\Local\sham.db
2018-11-13 11:39 - 2018-11-13 11:39 - 002025489 _____ () C:\Users\Użytkownik\AppData\Local\Unifind.tst
2018-11-13 11:40 - 2018-11-13 11:40 - 000032038 _____ () C:\Users\Użytkownik\AppData\Local\uninstall_temp.ico
Uzyj AdwCleaner, opcja Scan/Szukaj i Clean/Usun:
http://www.bleepingcomputer.com/download/adwcleaner/ Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/ oraz
http://ftp.drweb.com/pub/drweb/cureit/launch.exe
Po wykonaniu zamiesc nowe logi z FRST, ze skanowania.
