Nie wiem, po co wam te AVASTy, jak infekcja za infekcją.
Proszę, oto fixlist.txt:
CreateRestorePoint:
CloseProcesses:
EmptyTemp:
HKU\S-1-5-21-2967023489-4249352444-3931379873-1001\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-2967023489-4249352444-3931379873-1001\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq FirewallModule.exe" 2>NUL | find /I /N "FirewallModule.exe">NUL && exit & if exist ( start /MIN "" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{374867a6-d8c9-441d-8de0-d739ea422af3}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{b94a14c3-3043-4dee-b4aa-a6d9cc9ab491}: [DhcpNameServer] 217.172.224.160 89.231.1.206
SearchScopes: HKU\S-1-5-21-2967023489-4249352444-3931379873-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR HomePage: Default -> hxxp://search.babylon.com/?affID=112555&tt=3312_4&babsrc=HP_ss&mntrId=da85b924000000000000f46d040f53fd
CHR NewTab: Default -> Active:"chrome-extension://llaficoajjainaijghjlofdfmbjpebpa/newtab.html"
R2 Killer Network Service; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KillerNetworkService.exe [2483888 2018-07-13] (Rivet Networks LLC -> Rivet Networks)
S2 xTendSoftAPService; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\xTendSoftAPService.exe [72880 2018-07-13] (Rivet Networks LLC -> CloudBees, Inc.)
R2 xTendUtilityService; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\xTendUtilityService.exe [72880 2018-07-13] (Rivet Networks LLC -> CloudBees, Inc.)
R3 KfeCoSvc; C:\WINDOWS\System32\drivers\RivetNetworks\Killer\KfeCo10X64.sys [150184 2018-07-13] (Rivet Networks LLC -> Rivet Networks, LLC.)
C:\WINDOWS\System32\drivers\RivetNetworks\Killer\
2020-03-27 08:52 - 2018-04-04 12:30 - 000000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
Bubble Witch 3 Saga -> C:\Program Files\WindowsApps\king.com.BubbleWitch3Saga_6.5.9.0_x86__kgqvnymyfvs32 [2020-02-23] (king.com)
Candy Crush Soda Saga -> C:\Program Files\WindowsApps\king.com.CandyCrushSodaSaga_1.164.200.0_x86__kgqvnymyfvs32 [2020-03-21] (king.com)
Killer Control Center -> C:\Program Files\WindowsApps\RivetNetworks.KillerControlCenter_1.6.2143.0_x64__rh07ty8m5nkag [2018-12-06] (Rivet Networks LLC)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-01-21] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-01-21] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.1224.0_x64__8wekyb3d8bbwe [2020-03-25] (Microsoft Studios) [MS Ad]
MSN Pogoda -> C:\Program Files\WindowsApps\Microsoft.BingWeather_4.36.20714.0_x64__8wekyb3d8bbwe [2020-03-25] (Microsoft Corporation) [MS Ad]
AlternateDataStreams: C:\WINDOWS\system32\Drivers\IntcDAud.sys:$CmdTcID [64]
