Analiza logów z FRST - czy ktoś może rzucić okiem?

Question

Jak w tytule.

Konto nie istnieje · Answer

Wejdź w Windows Update i kliknij Sprawdź aktualizacje, niech sobie zainstaluje wszystkie. Odinstaluj: Avast cleanup premium Avast secureline SpyBot (oba) Pobierz i zrób skan - usuń wszystko co znajdą: Skopiuj i wklej do notatnika: UWAGA: Zapisz swoją pracę (Word, Excel itp.) przed wykonaniem polecenia Napraw. Spoiler: Pokaż CloseProcesses: CreateRestorePoint: EmptyTemp: HKLM Group Policy restriction on software: %systemroot%\system32\mrt.exe C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.) Tcpip\..\Interfaces\{06524428-3735-4cd4-b71f-2458cc2a1b8f}: [NameServer] 100.120.94.1 Tcpip\..\Interfaces\{c79a72fa-a814-4fa8-a9a9-09deda3059f0}: [DhcpNameServer] 62.179.1.61 62.179.1.63 Tcpip\..\Interfaces\{dbb3edf6-0727-425d-a4b5-0a5b9c0de76a}: [DhcpNameServer] 192.168.0.1 HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2017-08-13] (Ivaylo Beltchev -> IvoSoft) S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X] S4 nvvad_WaveExtensible; \SystemRoot\system32\driversvvad64v.sys [X] S4 nvvhci; \SystemRoot\System32\driversvvhci.sys [X] AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} ContextMenuHandlers1_S-1-5-21-1665468735-3431212190-3593455711-1001: [GGDriveMenu] -> {E68D0A55-3C40-4712-B90D-DCFA93FF2534} => -> Brak pliku ContextMenuHandlers4_S-1-5-21-1665468735-3431212190-3593455711-1001: [GGDriveMenu] -> {E68D0A55-3C40-4712-B90D-DCFA93FF2534} => -> Brak pliku ContextMenuHandlers5_S-1-5-21-1665468735-3431212190-3593455711-1001: [GGDriveMenu] -> {E68D0A55-3C40-4712-B90D-DCFA93FF2534} => -> Brak pliku Task: {09F4EC5F-6F16-40AB-8F91-B8D6D06DA4E4} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe (Safer Networking Ltd. -> Safer-Networking Ltd.) Task: {0B0B07E4-1043-4117-B501-B0B296F08C7B} - \Microsoft\Windows\UNP\RunCampaignManager -> Brak pliku C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe (Safer Networking Ltd. -> Safer-Networking Ltd.) Task: {10AE9574-8F3B-44AA-89C6-14CD2824A6F4} - System32\Tasks\{1F34B5BC-DE57-41AE-8804-856990D27AA0} => C:\Windows\system32\pcalua.exe -a E:\AUTOMENU.EXE -d E:\ Task: {23038482-32FA-4261-8ACD-B6CCBDC90B96} - System32\Tasks\Safer-Networking\Spybot Anti-Beacon\Refresh Anti-Beacon immunization => C:\Program Files (x86)\Spybot Anti-Beacon\SDAntiBeacon.exe (Safer-Networking Ltd. -> Safer-Networking Ltd.) Task: {4F29CD1B-8595-4A4B-B637-A998CC732103} - System32\Tasks\{AAED5C94-79E7-4C16-8924-641408244FC2} => C:\Windows\system32\pcalua.exe -a C:\Program Files\MicroProse\Majesty\Majesty.exe -d C:\Program Files\MicroProse\Majesty Task: {63ABB9EE-DB56-46BA-B3E5-3685884E1FBF} - System32\Tasks\{853161CC-D3A6-42D0-8C17-F5F36ED15531} => C:\Windows\system32\pcalua.exe -a E:\AUTOMENU.EXE -d E:\ Task: {851D3C5A-4252-4BFC-9A60-249F8FC93099} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe (Safer Networking Ltd. -> Safer-Networking Ltd.) Task: {9EDD4FC2-2899-4A5D-AD50-0D871B6BBE30} - System32\Tasks\Avast TUNEUP Update => C:\Program Files (x86)\AVAST Software\Avast Cleanup\TUNEUpdate.exe (AVAST Software s.r.o. -> AVAST Software) Task: {CA87B366-38EE-4A6C-B638-302AD0A9DEAC} - System32\Tasks\Driver Booster SkipUAC (DOM) => C:\Program Files (x86)\IObit\Driver Booster\5.1.0\DriverBooster.exe AlternateDataStreams: C:\Users\DOM\Dane aplikacji:6699d3ee8dd9cf775caae782c8f44f03 [394] AlternateDataStreams: C:\Users\DOM\AppData\Roaming:6699d3ee8dd9cf775caae782c8f44f03 [394] AlternateDataStreams: C:\Users\DOM\AppData\Local\Temp:$DATA​ [16] IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\007guard.com -> install.007guard.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\008k.com -> www.008k.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\00hq.com -> www.00hq.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\010402.com -> 010402.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\0scan.com -> www.0scan.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\10sek.com -> www.10sek.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\12-26.net -> user1.12-26.net IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\12-27.net -> user1.12-27.net IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1000\...\123simsen.com -> www.123simsen.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\007guard.com -> install.007guard.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\008k.com -> www.008k.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\00hq.com -> www.00hq.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\010402.com -> 010402.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\0scan.com -> www.0scan.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\10sek.com -> www.10sek.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\12-26.net -> user1.12-26.net IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\12-27.net -> user1.12-27.net IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\S-1-5-21-1665468735-3431212190-3593455711-1001\...\123simsen.com -> www.123simsen.com FirewallRules: [TCP Query User{AAC3764C-669B-4DD1-AE40-A43ADE16AB1B}E:\ieembed.exe] => (Allow) E:\ieembed.exe Brak pliku FirewallRules: => (Allow) E:\ieembed.exe Brak pliku FirewallRules: [TCP Query User{AA910F98-5C9C-4E9B-8EBF-B0A5CDD099C9}F:\gog galaxy\games\world in conflict - complete edition\wic.exe] => (Allow) F:\gog galaxy\games\world in conflict - complete edition\wic.exe Brak pliku FirewallRules: => (Allow) F:\gog galaxy\games\world in conflict - complete edition\wic.exe Brak pliku FirewallRules: [TCP Query User{AE0E2C9A-206B-4E18-8ED5-4D8ADF3C7D54}F:\gog galaxy\games\stronghold hd\stronghold.exe] => (Allow) F:\gog galaxy\games\stronghold hd\stronghold.exe Brak pliku FirewallRules: => (Allow) F:\gog galaxy\games\stronghold hd\stronghold.exe Brak pliku FirewallRules: [{9520BFC7-3177-4A8D-89D4-7249F249FB86}] => (Allow) F:\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku FirewallRules: [{C1554C3C-6E45-429A-89F6-7FB1F2497D3B}] => (Allow) F:\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku FirewallRules: [TCP Query User{CC125442-6131-4D4E-82A2-8A75E7E09882}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.184\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.184\deploy\leagueclient.exe Brak pliku FirewallRules: => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.184\deploy\leagueclient.exe Brak pliku FirewallRules: [TCP Query User{B53ED00E-0472-41ED-8005-7D8029155A6B}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.185\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.185\deploy\leagueclient.exe Brak pliku FirewallRules: => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.185\deploy\leagueclient.exe Brak pliku FirewallRules: [TCP Query User{B056436F-9C41-490C-B95E-B12544B9A65D}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.187\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.187\deploy\leagueclient.exe Brak pliku FirewallRules: => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.187\deploy\leagueclient.exe Brak pliku FirewallRules: [TCP Query User{BA217D6C-64C1-48CB-9FB7-09382E0A1702}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.188\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.188\deploy\leagueclient.exe Brak pliku FirewallRules: => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.188\deploy\leagueclient.exe Brak pliku Hosts: Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze. Uruchom FRST i kliknij w Fix/Napraw.

Analiza logów z FRST - czy ktoś może rzucić okiem?

Post #1

Post #2