Odinstaluj:
SafeFinder
SearchNewTab
YoutubeAdBlock
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
AlternateDataStreams: C:\Users\razti:.repos [616625]
C:\Users\razti\AppData\Local\TrustTone.exe
() [Brak podpisu cyfrowego] C:\Windows\kffee.exe
(Python Software Foundation -> Python Software Foundation) C:\Users\razti\AppData\Roaming\SearchNewTab\python\python.exe
C:\Users\razti\AppData\Roaming\SearchNewTab\
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [646160 2019-12-11] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [kffee] => C:\Windows\kffee.exe [880128 2020-04-09] () [Brak podpisu cyfrowego]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [2602377] => "C:\Users\razti\AppData\Local\Temp\is-J7NCE.tmp\ScreenShop.exe" /VERYSILENT <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [5332943] => "C:\Users\razti\AppData\Local\Temp\is-C6PIM.tmp\ScreenShop.exe" /VERYSILENT <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [SearchNewTab] => C:\Users\razti\AppData\Roaming\SearchNewTab\python\pythonw.exe [95760 2019-07-08] (Python Software Foundation -> Python Software Foundation) <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [BoldWave] => C:\WINDOWS\rss\csrss.exe [3926528 2020-04-09] () [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [QUY9954LDU61EBZ] => "C:\Program Files\UGV6EOPS92\UGV6EOPS9.exe"
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\...\Run: [hwicdpdg] => C:\Users\razti\rauzrqlh.exe [11765760 2020-04-09] () [Brak podpisu cyfrowego]
AppInit_DLLs: C:\ProgramData\Quoteex\Bluelight.dll => Brak pliku
AppInit_DLLs-x32: C:\ProgramData\Quoteex\KinIt.dll => Brak pliku
GroupPolicy: Ograniczenia - Windows Defender <==== UWAGA
Task: {0FB4CA64-3A45-4A06-A655-9CF2022270EA} - System32\Tasks\riztAYavQxciBK => rundll32 "C:\Program Files (x86)\WEknDKmznIzU2\tcoLvYEBItYTu.dll",#1
Task: {1372D1DB-FF20-4C7E-A33D-7703A5FA73E7} - System32\Tasks\Opera scheduled Autoupdate 711520318 => C:\Users\razti\AppData\Roaming\Microsoft\Windows\vvjwbrwi\eiihcsui.exe <==== UWAGA
Task: {2314D634-5E33-49D7-A329-72579838700D} - System32\Tasks\JflSNTUelPhxLFURAcL2 => rundll32 "C:\Program Files (x86)\BxniUNyGXmFKC\XcOxiFV.dll",#1
Task: {597A9694-5615-4B06-8A97-2BDA3DC20C1A} - System32\Tasks\KfCQDyHZpNaSNbL2 => rundll32 "C:\Program Files (x86)\GOFaztDyU\cLYBtT.dll",#1
Task: {9C0AC105-F4CD-42E0-9431-E1C99B3846ED} - System32\Tasks\koQPjcaomUlQfxiPT2 => rundll32 "C:\Program Files (x86)\unnAIAGDSplyFXDqYkR\cBMDmRr.dll",#1
Task: {9F246F44-D52C-489C-853D-2E0A53D298B3} - System32\Tasks\Opera GX scheduled Autoupdate 1585932632 => C:\Users\razti\AppData\Local\Programs\Opera GX\launcher.exe [1480216 2020-04-02] (Opera Software AS -> Opera Software)
Task: {BE75682E-7794-42CD-9ED2-E78A04D49040} - System32\Tasks\SearchNewTab => C:\Users\razti\AppData\Roaming\SearchNewTab\python\pythonw.exe [95760 2019-07-08] (Python Software Foundation -> Python Software Foundation) <==== UWAGA
Task: {CD2A16D3-A799-42BB-8C53-32CE88937299} - System32\Tasks\koIASyAUcnLTC2 => C:\WINDOWS\system32\wscript.exe "C:\ProgramData\lbXXFMhQgcaZEWVB\wEYAopA.wsf"
Task: {F7159795-42E2-4F76-A62F-27E2C19C07ED} - System32\Tasks\NvNgxUpdateCheckDaily_{A6B397E0-97E0-97E0-97E0-A6B397E097E0} => C:\Users\razti\AppData\Roaming\vueiihc.exe <==== UWAGA
Task: {FABA79D1-B369-4EEF-ABA6-C1757B3EB862} - System32\Tasks\SearchNewTab2 => C:\Users\razti\AppData\Roaming\SearchNewTab\python\pythonw.exe [95760 2019-07-08] (Python Software Foundation -> Python Software Foundation) <==== UWAGA
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ1p-ZBNiy_EVH9sOG8n3FFUUBIeNkmpX2DTbQ1Krh0H9A0QpJDrAN3xJhlDO6S-zj63vHH0nFOUftpvfZkYNgTXhIfwlLfHuTxoEg9V2Iti1RixwYApmJ0T3RDX8WN7cW95CZ8EHblKRGpYRBP4S2IkS_2ftWL&q={searchTerms}
HKU\S-1-5-21-432805831-2928031998-3456421409-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ1p-ZBNiy_EVH9sOG8n3FFUUBIeNkmpX2DTbQ1Krh0H9A0QpJDrAN3xJhlDO6S-zj2vvmyN5SfKHkmI7q108-CwGzHmIeSyzSCzhpFZXf1ASP0VTtQLNM_1Erv12F2bTFKsI5jZIW9zmVD9VbJVFjl4YUKa_Ym
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL =
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ1p-ZBNiy_EVH9sOG8n3FFUUBIeNkmpX2DTbQ1Krh0H9A0QpJDrAN3xJhlDO6S-zj63vHH0nFOUftpvfZkYNgTXhIfwlLfHuTxoEg9V2Iti1RixwYApmJ0T3RDX8WN7cW95CZ8EHblKRGpYRBP4S2IkS_2ftWL&q={searchTerms}
SearchScopes: HKU\S-1-5-21-432805831-2928031998-3456421409-1001 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ1p-ZBNiy_EVH9sOG8n3FFUUBIeNkmpX2DTbQ1Krh0H9A0QpJDrAN3xJhlDO6S-zj63vHH0nFOUftpvfZkYNgTXhIfwlLfHuTxoEg9V2Iti1RixwYApmJ0T3RDX8WN7cW95CZ8EHblKRGpYRBP4S2IkS_2ftWL&q={searchTerms}
SearchScopes: HKU\S-1-5-21-432805831-2928031998-3456421409-1001 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ1p-ZBNiy_EVH9sOG8n3FFUUBIeNkmpX2DTbQ1Krh0H9A0QpJDrAN3xJhlDO6S-zj63vHH0nFOUftpvfZkYNgTXhIfwlLfHuTxoEg9V2Iti1RixwYApmJ0T3RDX8WN7cW95CZ8EHblKRGpYRBP4S2IkS_2ftWL&q={searchTerms}
BHO: YoutubeAdBlock -> {99D3F4A6-43D7-43A6-A0A8-F14D6C5C98D8} -> C:\Program Files (x86)\QXnBrfetoIE\t0V24Gqw.dll [2020-04-09] () [Brak podpisu cyfrowego]
BHO-x32: YoutubeAdBlock -> {99D3F4A6-43D7-43A6-A0A8-F14D6C5C98D8} -> C:\Program Files (x86)\QXnBrfetoIE\kBsGbCQ.dll [2020-04-09] () [Brak podpisu cyfrowego]
S2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -a
S2 Quoteex; C:\ProgramData\\Quoteex\\Quoteex.exe shuz -f "C:\ProgramData\\Quoteex\\Quoteex.dat" -l -a <==== UWAGA
S1 tyrtfmsg; \??\C:\WINDOWS\system32\drivers\tyrtfmsg.sys [X]
2020-04-09 15:41 - 2020-04-09 15:41 - 011765760 _____ C:\Users\razti\rauzrqlh.exe
2020-04-09 15:38 - 2020-04-10 08:27 - 000003574 _____ C:\WINDOWS\system32\Tasks\Opera scheduled Autoupdate 711520318
2020-04-09 15:35 - 2020-04-09 15:44 - 000000000 ____D C:\Users\razti\AppData\Roaming\mtvrrweplo1
2020-04-09 15:15 - 2020-04-09 15:45 - 000000000 ____D C:\Users\razti\AppData\Roaming\SearchNewTab
2020-04-09 15:15 - 2020-04-09 15:15 - 000003504 _____ C:\WINDOWS\system32\Tasks\SearchNewTab
2020-04-09 15:15 - 2020-04-09 15:15 - 000003500 _____ C:\WINDOWS\system32\Tasks\SearchNewTab2
2020-04-09 15:15 - 2020-04-09 15:15 - 000000000 ____D C:\Users\razti\AppData\Roaming\Python
2020-04-09 15:14 - 2020-04-09 15:14 - 000004026 __RSH C:\ProgramData\ntuser.pol
2020-04-09 15:14 - 2020-04-09 15:14 - 000003356 _____ C:\WINDOWS\system32\Tasks\riztAYavQxciBK
2020-04-09 15:14 - 2020-04-09 15:14 - 000003044 _____ C:\WINDOWS\system32\Tasks\koIASyAUcnLTC2
2020-04-09 15:14 - 2020-04-09 15:14 - 000003034 _____ C:\WINDOWS\system32\Tasks\koQPjcaomUlQfxiPT2
2020-04-09 15:14 - 2020-04-09 15:14 - 000003026 _____ C:\WINDOWS\system32\Tasks\JflSNTUelPhxLFURAcL2
2020-04-09 15:14 - 2020-04-09 15:14 - 000003008 _____ C:\WINDOWS\system32\Tasks\KfCQDyHZpNaSNbL2
2020-04-09 15:14 - 2020-04-09 15:14 - 000000266 __RSH C:\Users\razti\ntuser.pol
2020-04-09 15:14 - 2020-04-09 15:14 - 000000000 ____D C:\Program Files (x86)\QXnBrfetoIE
2020-04-09 15:13 - 2020-04-09 15:13 - 008518656 _____ C:\Users\razti\AppData\Local\agent.dat
2020-04-09 15:13 - 2020-04-09 15:13 - 002161756 _____ C:\Users\razti\AppData\Local\TrustTone.tst
2020-04-09 15:13 - 2020-04-09 15:13 - 000126464 _____ C:\Users\razti\AppData\Local\noah.dat
2020-04-09 15:13 - 2020-04-09 15:13 - 000126464 _____ C:\Users\razti\AppData\Local\lobby.dat
2020-04-09 15:13 - 2020-04-09 15:13 - 000069888 _____ C:\Users\razti\AppData\Local\Config.xml
2020-04-09 15:13 - 2020-04-09 15:13 - 000068480 _____ C:\Users\razti\AppData\Local\Silverlux.tst
2020-04-09 15:13 - 2020-04-09 15:13 - 000045056 _____ C:\Users\razti\AppData\Local\ApplicationHosting.dat
2020-04-09 15:13 - 2020-04-09 15:13 - 000018432 _____ C:\Users\razti\AppData\Local\Main.dat
2020-04-09 15:13 - 2020-04-09 15:13 - 000015606 _____ C:\WINDOWS\SysWOW64\findit.xml
2020-04-09 15:13 - 2020-04-09 15:13 - 000005568 _____ C:\Users\razti\AppData\Local\md.xml
2020-04-09 15:11 - 2020-04-09 15:13 - 000016368 _____ C:\Users\razti\AppData\Local\InstallationConfiguration.xml
2020-04-09 15:11 - 2020-04-09 15:11 - 000142336 _____ C:\Users\razti\AppData\Local\installer.dat
2020-04-09 15:07 - 2020-04-09 15:07 - 000880128 _____ C:\WINDOWS\kffee.exe
EmptyTemp:
Oczywiscie zrob skan przy pomocy wspomnianego mbam oraz adwclaener (pobierz z bleeping) i usun to co wykryja.
