Moze juz nie pobieraj pirackich zainfekowanych programow, marnie Ci to wychodzi, czego efekty widac.
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [NoInstrumentation] 1
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <==== UWAGA
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [33770112 2021-05-20] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Run: [Prun] => C:\WINDOWS\PublicGaming\prun.exe [715657728 2021-05-29] (DearMob, Inc.) [Brak podpisu cyfrowego] <==== UWAGA
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: []
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [NoWinkeys] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [DisallowRun] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-3008818557-499809861-3512677248-1003\...\MountPoints2: {f35956de-3c9f-11eb-b0a9-e4a471d88e79} - "E:\Setup.exe"
AppInit_DLLs: C:\ProgramData\Voyasollam\Jobhold.dll => Brak pliku
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Task: {19CD28F7-E9AF-4D8E-911B-3573542565B0} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2021-05-20] (Piriform Software Ltd -> Piriform)
Task: {23402908-C933-4500-BCC7-DD95D1C4D0B7} - \Update -> Brak pliku <==== UWAGA
Task: {4E0A7080-BDC6-4EBA-B6C5-3ACC703E258A} - System32\Tasks\NvNgxUpdateCheckDaily_{A6B397E0-97E0-97E0-97E0-A6B397E097E0} => C:\Users\taon-\AppData\Roaming\afreteb.exe <==== UWAGA
Task: {5E668B96-9D39-49A0-BA28-20729F62E260} - System32\Tasks\SpyHunter4Startup => E:\_\instale\SpyHunter 4.20.9.4533 Eng 32 Bit Portable\SpyHunter 4.20.9.4533 Eng 32 Bit Portable\SpyHunter4.exe
Task: {8BE548FC-E4EB-4A0B-AB76-785695533E66} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [28158080 2021-05-20] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {8D21EF80-4FCB-4CDE-BCB3-A648ED11CF9F} - System32\Tasks\Firefox Default Browser Agent 44CD3751BC72BF80 => C:\Users\taon-\AppData\Roaming\afreteb.exe <==== UWAGA
Task: {C67F9DA8-AB49-4D6D-B8CE-F702F3803615} - System32\Tasks\Firefox Default Browser Agent A7CF4B7BD8D4ED7F => C:\Users\taon-\AppData\Roaming\threteb.exe <==== UWAGA
Task: {F85912F9-FDC3-41BF-B4FE-A7B6FCBF53B8} - System32\Tasks\sne => C:\ProgramData\Voyasollam\Voyasollam.exe -> shuz -f "C:\ProgramData\Voyasollam\Donghome.dat" -a SNE "https://feed.sonic-search.com/?publisher=APSFWemonetize&co=PL&userid=42ae35b0-6c90-60e4-3d9e-64fb99dccd76&searchtype=ds&q={searchTerms}&installDate=05.05.2020&barcodeid=51557004&channelid=4&av=windows& --load-extension=\"C:\Users\taon-\AppData\Local\app\"" sne
Task: C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job => C:\Windows\explorer.exe
S3 wuauserv; C:\WINDOWS\system32\svchost.exe [57360 2020-10-22] (Microsoft Windows Publisher -> Microsoft Corporation) <==== UWAGA (Brak ServiceDLL)
S3 wuauserv; C:\WINDOWS\SysWOW64\svchost.exe [47016 2020-10-22] (Microsoft Windows Publisher -> Microsoft Corporation) <==== UWAGA (Brak ServiceDLL)
2021-05-30 13:00 - 2021-05-30 13:00 - 000000404 _____ C:\Users\taon-\Downloads\Blokowanie-apikacji-1 (1).zip
2021-05-29 22:40 - 2021-05-29 22:40 - 000000000 ____D C:\Users\taon-\Downloads\FRST-OlderVersion
2021-05-29 11:10 - 2021-05-29 11:12 - 000000000 ____D C:\AdwCleaner
2021-05-29 08:59 - 2021-05-29 08:59 - 000000000 ____D C:\ProgramData\I1ZYSWISJHUJDFV1EAQF90YDI
2021-05-29 08:58 - 2021-05-29 08:58 - 000003714 _____ C:\WINDOWS\system32\Tasks\Firefox Default Browser Agent A7CF4B7BD8D4ED7F
2021-05-29 08:58 - 2021-05-29 08:58 - 000000000 ____D C:\Users\taon-\AppData\LocalLow\gC9tT2iQ3s
2021-05-29 08:58 - 2021-05-29 08:58 - 000000000 ____D C:\Program Files\temp_files
2021-05-29 08:57 - 2021-05-29 11:32 - 000000000 ____D C:\Program Files (x86)\Company
2021-05-29 08:57 - 2021-05-29 11:03 - 000000000 ___HD C:\Users\taon-\AppData\Local\zztaon-
2021-05-29 08:57 - 2021-05-29 09:57 - 000000000 ___HD C:\ProgramData\Windows Host
2021-05-29 08:57 - 2021-05-29 08:58 - 000000000 ____D C:\Users\taon-\OneDrive\Dokumenty\VlcpVideoV1.0.1
2021-05-29 08:57 - 2021-05-29 08:57 - 000003714 _____ C:\WINDOWS\system32\Tasks\Firefox Default Browser Agent 44CD3751BC72BF80
2021-05-29 08:57 - 2021-05-29 08:57 - 000000000 ____D C:\Users\taon-\AppData\Local\AdvinstAnalytics
2021-05-29 08:57 - 2021-05-29 08:57 - 000000000 ____D C:\ProgramData\M3MT0TBLD096JAH5LSC21X69B
2021-05-29 08:57 - 2021-05-29 08:57 - 000000000 ____D C:\Program Files (x86)\AW Manager
2021-05-29 08:54 - 2021-05-29 09:56 - 000000000 ____D C:\WINDOWS\PublicGaming
2021-05-29 08:52 - 2021-05-29 08:52 - 001838522 _____ C:\Users\taon-\Downloads\autodesk-autoca(AAIFAI9GAgBQTBcAEgA).zip
2020-05-05 09:33 - 2020-05-05 12:42 - 000000004 _____ () C:\ProgramData\lock.dat
2020-05-05 09:34 - 2020-05-05 12:42 - 000000004 _____ () C:\ProgramData\rc.dat
2020-05-05 09:33 - 2020-05-05 09:33 - 000000008 _____ () C:\ProgramData\ts.dat
2020-11-14 13:48 - 2020-11-14 13:48 - 000321226 ___SH () C:\Users\taon-\AppData\Roaming\rhtwesh
Po wykonaniu sciagnij, rozpakuj i uruchom:
https://www.elektroda.pl/rtvforum/download.php?id=1052002 i sprawdz czy Windows Update dziala.
