Nadal zly dzial, ale teraz chociaz udalo Ci sie zamiescic logi.
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
AlternateDataStreams: C:\Users\kris8\Dane aplikacji:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\kris8\ntuser.ini:NTV [12908]
AlternateDataStreams: C:\Users\kris8\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [234]
(ResolveDevOps Limited -> ResolveDevOps Limited) C:\Users\kris8\AppData\Roaming\ProductAuthenticationService\pas.exe
(SoundMixer) [Brak podpisu cyfrowego] C:\Users\kris8\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-3822372958-2827751283-590578582-1001\...\Run: [ProductAuthenticationService] => C:\Users\kris8\AppData\Roaming\ProductAuthenticationService\pas.exe [1004072 2019-05-07] (ResolveDevOps Limited -> ResolveDevOps Limited)
HKU\S-1-5-21-3822372958-2827751283-590578582-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-3822372958-2827751283-590578582-1001\...\Command Processor:
@mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\kris8\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\kris8\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
HKU\S-1-5-18\...\Policies\system: [DisableTaskMgr] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
Task: {A3158DC9-12D1-4B49-9339-55F1E4D5A84B} - System32\Tasks\WindowsTaskCoreUpdate => C:\Windows\system32\config\systemprofile\AppData\Roaming\8510933377FD49CB8021AC983EE68DBC\6E6D2C982BDC47F5BE997F6C977962D7.vbe [23372 2020-01-02] () [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-3822372958-2827751283-590578582-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://securedsearch.lavasoft.com/?pr=vmn&id=webcompa&ent=hp_WCYID10454__190818
SearchScopes: HKU\S-1-5-21-3822372958-2827751283-590578582-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=1414181440&from=smt&uid=395049983_1052499_3481026D
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hp&ts=1414181440&from=smt&uid=395049983_1052499_3481026D","hxxp://www.sweet-page.com/?type=hp&ts=1415127097&from=cor&uid=395049983_1052499_3481026D","hxxp://www.istartsurf.com/?type=hp&ts=1434986405&z=c1792981878442ca4e7eef7gez9c0zct9b2qdzbecz&from=icp&uid=395049983_1052499_7414072F","hxxp://www.istartsurf.com/?type=hp&ts=1440271940&z=ef782087aeb82f9d307548bgaz7zceco3m2g4b3c2c&from=obw&uid=SAMSUNGXHD103SJ_S246J90B526632","hxxp://www.mystartsearch.com/?type=hp&ts=1440272555&z=ac27ba39b5b03908468f37dg1zdz0edo7m5oczfz7b&from=cmi&uid=SAMSUNGXHD103SJ_S246J90B526632","hxxp://www.google.com/"
S3 fiddrv64; Brak ImagePath
S3 GPCIDrv; \??\C:\Users\kris8\AppData\Local\Temp\7zS11D5.tmp\N2080_FW_Upgrade_Tool_V003\GPCIDrv64.sys [X] <==== UWAGA
S3 MSICDSetup; \??\E:\CDriver.sys [X]
2020-01-01 23:00 - 2020-01-01 23:00 - 000000000 ____D C:\Users\kris8\Downloads\FRST-OlderVersion
C:\Users\kris8\AppData\Roaming\Microsoft\SoundMixer\
Uzyj:
https://www.bleepingcomputer.com/download/adwcleaner/
https://www.bleepingcomputer.com/download/malwarebytes-anti-malware/
http://update.askad.net/Dr.Web/CureIt/launch.exe
i usun to co wykryja.
