logo elektroda
logo elektroda
X
logo elektroda
REKLAMA
REKLAMA
Adblock/uBlockOrigin/AdGuard mogą powodować znikanie niektórych postów z powodu nowej reguły.

[Rozwiązano] Jak usunąć wirusa zmieniającego ustawienia proxy na 127...?

Lue14 06 Mar 2020 17:16 636 5
REKLAMA
  • #1 18514531
    Lue14
    Poziom 5  
    Posty: 5
    Ocena: 3
    Witam
    Proszę o pomoc w pozbyciu się wirusa zmieniającego proxy. W załączeniu pliki z FRST.
    Załączniki:
    • Addition[1].txt (37.32 KB) Musisz być zalogowany, aby pobrać ten załącznik.
    • FRST[1].txt (78.3 KB) Musisz być zalogowany, aby pobrać ten załącznik.
  • REKLAMA
  • Pomocny post
    #2 18514853
    Konto nie istnieje
    Poziom 1  
  • REKLAMA
  • Pomocny post
    #3 18515212
    RADU23
    VIP Zasłużony dla elektroda
    Posty: 20718
    Pomógł: 2427
    Ocena: 1729
    Wykonaj skanowanie MBAM oraz ADWcleaner i usuń wszystko co wykryją
    https://www.malwarebytes.com/dl-confirm/
    http://www.bleepingcomputer.com/download/adwcleaner/

    Otwórz notatnik i wklej zawartość z ramki:
    Cytat:
    CloseProcesses:
    CreateRestorePoint:
    RemoveProxy:
    Lsa: [Authentication Packages] msv1_0 SshdPinAuthLsa
    Task: {4AEC529B-0C47-4E35-997A-16D7CF793C64} - System32\Tasks\Opera scheduled Autoupdate 1567017413 => C:\Program Files (x86)\opera\launcher.exe [1528344 2019-11-25] (Opera Software AS -> Opera Software)
    HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings: [ProxySettingsPerUser] 0 <==== UWAGA (Ograniczenia - ProxySettings)
    Tcpip\..\Interfaces\{375620d9-2c5c-4027-8b18-b10aa816d9c7}: [DhcpNameServer] 37.8.214.2 31.11.202.254
    ManualProxies: 1http=127.0.0.1:8888;https=127.0.0.1:8888
    S3 mracsvc; C:\WINDOWS\System32\mracsvc.exe [18534552 2019-10-05] (Mail.Ru LLC -> LLC Mail.Ru)
    S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [17770920 2019-10-05] (Mail.Ru LLC -> LLC Mail.Ru)
    ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Brak pliku
    ShellIconOverlayIdentifiers: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive6] -> {9AA2F32D-362A-42D9-9328-24A483E2CCC3} => -> Brak pliku
    ShellIconOverlayIdentifiers-x32: [ OneDrive7] -> {C5FF006E-2AE9-408C-B85B-2DFDD5449D9C} => -> Brak pliku
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (17).jpg:3or4kl4x13tuuug3Byamue2s4b [83]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (17).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (18).jpg:3or4kl4x13tuuug3Byamue2s4b [83]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (18).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (19).jpg:3or4kl4x13tuuug3Byamue2s4b [83]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (19).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (20).jpg:3or4kl4x13tuuug3Byamue2s4b [83]
    AlternateDataStreams: C:\Users\Lue\Desktop\Obraz (20).jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
    AlternateDataStreams: C:\Users\Lue\Desktop\zmiany.jpg:3or4kl4x13tuuug3Byamue2s4b [83]
    AlternateDataStreams: C:\Users\Lue\Desktop\zmiany.jpg:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d} [0]
    AlternateDataStreams: C:\Users\Public\DRM:احتضان [48]
    FirewallRules: [OpenSSH-Server-In-TCP] => (Allow) %SystemRoot%\system32\OpenSSH\sshd.exe Brak pliku
    FirewallRules: [UDP Query User{D330018B-AAE9-4F4B-8581-12DB7ADB458D}E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe] => (Block) E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe Brak pliku
    FirewallRules: [TCP Query User{ED0C0443-EF7C-421F-B9DD-8CC990F90B56}E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe] => (Block) E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe Brak pliku
    FirewallRules: [TCP Query User{BB6435EC-3FD0-4874-AE68-7E2E78C0E8D5}E:\games\men of war - assault squad 2\mowas_2.exe] => (Block) E:\games\men of war - assault squad 2\mowas_2.exe Brak pliku
    FirewallRules: [UDP Query User{167286B3-4C6A-4DFA-AA0F-BCDD467FDB06}E:\games\men of war - assault squad 2\mowas_2.exe] => (Block) E:\games\men of war - assault squad 2\mowas_2.exe Brak pliku
    FirewallRules: [TCP Query User{592A2FA4-B2FE-4316-8FB1-C986115C83CC}E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe] => (Block) E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe Brak pliku
    FirewallRules: [UDP Query User{A836CEF1-D619-44F3-9D95-EE42E8137412}E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe] => (Block) E:\games\total war warhammer ii curse of the vampire coast\warhammer2.exe Brak pliku
    FirewallRules: [{6D877B1C-DD72-4BF4-860D-4630FA2C7941}] => (Allow) C:\Program Files (x86)\MediatekWiFi\Common\RaUI.exe Brak pliku
    FirewallRules: [TCP Query User{6D041485-9EBA-4FDC-9703-C99391CE6BEA}E:\games\fh 0.7 portable\battlefield 1942\bf1942.exe] => (Block) E:\games\fh 0.7 portable\battlefield 1942\bf1942.exe Brak pliku
    FirewallRules: [UDP Query User{20BC7F15-C7E0-478A-824E-4F7649ECD1CE}E:\games\fh 0.7 portable\battlefield 1942\bf1942.exe] => (Block) E:\games\fh 0.7 portable\battlefield 1942\bf1942.exe Brak pliku
    FirewallRules: [{12AF74A3-0599-4B68-9719-AE3508CF5F81}] => (Allow) C:\Users\Lue\AppData\Roaming\navHelper2.exe Brak pliku
    FirewallRules: [{6F0C820F-CC23-4404-BE53-B9FC7D8D7D1A}] => (Allow) C:\Users\Lue\AppData\Roaming\navHelper2.exe Brak pliku
    FirewallRules: [{7D62E09B-5465-4051-A571-6E9F62F5A0F0}] => (Allow) C:\Users\Lue\AppData\Roaming\navHelper2.exe Brak pliku
    FirewallRules: [{6C77FC82-3FEC-4D05-9DE3-1FE630E5DBA2}] => (Allow) C:\Users\Lue\AppData\Roaming\navHelper2.exe Brak pliku
    EmptyTemp:

    Plik zapisz pod nazwą fixlist.txt i umieść w folderze gdzie masz FRST.exe.
    Uruchom FRST i kliknij w Fix/Napraw.
  • REKLAMA
  • #4 18515643
    Lue14
    Poziom 5  
    Posty: 5
    Ocena: 3
    Podziękował :)
  • REKLAMA
  • Pomocny post
    #5 18515666
    Konto nie istnieje
    Poziom 1  
  • #6 18515986
    Lue14
    Poziom 5  
    Posty: 5
    Ocena: 3
    Wedle zaleceń
REKLAMA