Infekcja zepsula Windows Update, do tego Defendera, najlepiej zresetowac system do ustawien fabrycznych z zachowaniem danych.
Odinstaluj:
CCleaner
Trojan Remover
Driver Booster
Fixlist.txt:
CloseProcesses:
ContextMenuHandlers2: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => -> No File
ContextMenuHandlers6: [Glary Utilities] -> {B3C418F8-922B-4faf-915E-59BC14448CF7} => -> No File
AlternateDataStreams: C:\Users\MATI\Dane aplikacji:00e481b5e22dbe1f649fcddd505d3eb7 [394]
AlternateDataStreams: C:\Users\MATI\AppData\Roaming:00e481b5e22dbe1f649fcddd505d3eb7 [394]
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate: Restriction <==== ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender Security Center: Restriction <==== ATTENTION
HKU\S-1-5-21-1947327320-3148436306-1845836710-1001\...\Run: [Opera GX Browser Assistant] => C:\Users\MATI\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe [3291288 2021-02-01] (Opera Software AS -> Opera Software)
C:\Users\MATI\AppData\Roaming\Windows Updates Files\
HKU\S-1-5-21-1947327320-3148436306-1845836710-1001\...\Run: [Windows Updates Service] => C:\Users\MATI\AppData\Roaming\Windows Updates Files\Windows Updates Service.vbe (No File) <==== ATTENTION
HKU\S-1-5-21-1947327320-3148436306-1845836710-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [40412984 2023-04-26] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-1947327320-3148436306-1845836710-1001\...\Policies\Explorer: [NoFolderOptions] 1
IFEO\EOSnotify.exe: [Debugger] /
IFEO\InstallAgent.exe: [Debugger] /
IFEO\MoNotificationUx.exe: [Debugger] /
IFEO\MusNotification.exe: [Debugger] /
IFEO\MusNotificationUx.exe: [Debugger] /
IFEO\remsh.exe: [Debugger] /
IFEO\SihClient.exe: [Debugger] /
IFEO\UpdateAssistant.exe: [Debugger] /
IFEO\UsoClient.exe: [Debugger] /
IFEO\WaaSMedic.exe: [Debugger] /
IFEO\WaasMedicAgent.exe: [Debugger] /
IFEO\Windows10Upgrade.exe: [Debugger] /
IFEO\Windows10UpgraderApp.exe: [Debugger] /
InternetURL: C:\Users\MATI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\telegram.eu.url ->
GroupPolicy: Restriction ? <==== ATTENTION
Policies: C:\ProgramData\NTUSER.pol: Restriction <==== ATTENTION
Task: {15806236-64A1-4E27-8746-AD83CBD24B65} - System32\Tasks\TR_FastScan_Daily_MATI => C:\Program Files (x86)\Trojan Remover\Trjscan.exe/silent
Task: {393432EE-FF01-4AD8-B93D-AD302DF767A8} - System32\Tasks\TR_AntiHijack => C:\Program Files (x86)\Trojan Remover\TRAntiHJ.exe (No File)
Task: {4DDD3148-52CB-4AA9-88F4-2FCE260ACF19} - System32\Tasks\Opera GX scheduled assistant Autoupdate 1614856355 => C:\Users\MATI\AppData\Local\Programs\Opera GX\launcher.exe [2623904 2023-04-12] (Opera Norway AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\MATI\AppData\Local\Programs\Opera GX\assistant" $(Arg0)
Task: {54E0ED61-BDD9-400E-82DA-E4C7BDF9EFC8} - System32\Tasks\Opera scheduled Autoupdate 1575900542 => C:\Users\MATI\AppData\Local\Programs\Opera\launcher.exe [2686872 2023-04-04] (Opera Norway AS -> Opera Software)
C:\Users\MATI\AppData\Local\Updates\
Task: {7A8BCE81-7BD0-4931-8D99-32D7271D9CF2} - System32\Tasks\Window Update => C:\Users\MATI\AppData\Local\Updates\Run.vbs [1015 2022-05-09] () [File not signed] <==== ATTENTION
Task: {7C071F1C-1AD9-4C27-A935-BB10C3DB3EA9} - System32\Tasks\TR_FastScan_AtLogon => C:\Program Files (x86)\Trojan Remover\Trjscan.exe/boot
Task: {81412CCB-2949-46A0-91F7-6B6A0D63EF05} - System32\Tasks\AutoPico Daily Restart => C:\Program Files\KMSpico\AutoPico.exe/silent
Task: {815B813C-41B4-45AC-B5EB-2A321FFD3C6D} - System32\Tasks\TR_Updater => C:\Program Files (x86)\Trojan Remover\Trupd.exe/silent
Task: {93105B75-2821-425D-A8CC-29CDD41EEDB9} - System32\Tasks\Driver Booster SkipUAC (MATI) => C:\Program Files (x86)\Driver Booster\DriverBooster.exe [7744000 2019-11-04] (IObit) [File not signed]
Task: {9777C839-6EB9-4C9C-97A9-3FB8A5E5226A} - System32\Tasks\Game_Booster_AutoUpdate => C:\Program Files (x86)\IObit\Game Booster 3\AutoUpdate.exe/AUTORUN
Task: {A6641A39-C126-4C9B-A1DF-34AB9188E337} - System32\Tasks\Opera scheduled assistant Autoupdate 1582297730 => C:\Users\MATI\AppData\Local\Programs\Opera\launcher.exe [2686872 2023-04-04] (Opera Norway AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\MATI\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {B2C5B523-3B60-44D5-B706-28106D6C27A7} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [714256 2023-04-26] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {B83BA316-CCBE-4D78-A2EA-7BB6C9253758} - System32\Tasks\Opera GX scheduled Autoupdate 1613949429 => C:\Users\MATI\AppData\Local\Programs\Opera GX\launcher.exe [2623904 2023-04-12] (Opera Norway AS -> Opera Software)
Task: {BF3B1634-5503-4393-B534-4BA431A702D4} - System32\Tasks\DB Bigupgrade Task (One Time) => C:\Program Files (x86)\IObit\Driver Booster\6.6.0\dbupgrade.exe/upgrade
Task: {DAB0E63D-FF29-48D1-864C-F2F78ACA206C} - System32\Tasks\CCleanerSkipUAC - MATI => C:\Program Files\CCleaner\CCleaner.exe [34159416 2023-04-26] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {ED9529A2-9557-43C3-8461-E57376450521} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [4703544 2023-04-26] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --configpath "C:\Program Files\CCleaner\Setup" --guid "ed85d052-b7a0-4900-babf-46a7a70d471e" --version "6.11.10455" --silent
Task: {F0D69410-37BB-4438-B8C1-D97EBACF2D68} - System32\Tasks\Windows Service Task => C:\Users\MATI\AppData\Local\Updates\WindowsService.exe [5581312 2022-05-11] () [File not signed] <==== ATTENTION
Task: C:\WINDOWS\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe
Hosts:
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
HKU\S-1-5-21-1947327320-3148436306-1845836710-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <==== ATTENTION
CHR Notifications: Default -> hxxps://1.madalse.com; hxxps://29.folderenius.com; hxxps://41.folderenius.com; hxxps://44.gubudakis.com; hxxps://46.folderenius.com; hxxps://61.folderenius.com; hxxps://7.kivilcitum.com; hxxps://70.kivilcitum.com; hxxps://71.folderenius.com; hxxps://80.folderenius.com; hxxps://86.kivilcitum.com; hxxps://97.gubudakis.com; hxxps://eee-news.com; hxxps://linkvertise.com; hxxps://multiup.org; hxxps://newswe.org; hxxps://oload.space; hxxps://rz8j.tontorcaltedron.info; hxxps://solarmovie.unblocker.cc; hxxps://tontorcaltedron.info; hxxps://uptobox.com; hxxps://vexfile.com; hxxps://www2a.debrahinton.pro; hxxps://www3.ecleneue.com; hxxps://www3a.bethanyharrell.pro; hxxps://www3p.lucienmann.pro
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
2019-03-02 05:37 - 2020-08-10 00:44 - 000000034 _____ () C:\Users\MATI\AppData\Roaming\Microsoft\data.ot
2020-06-30 06:25 - 2020-06-30 06:25 - 000003189 _____ () C:\Users\MATI\AppData\Local\Bron.tok.A8.em.bin
2020-06-30 05:12 - 2020-06-30 05:12 - 000000051 _____ () C:\Users\MATI\AppData\Local\Kosong.Bron.Tok.txt
2020-06-30 05:07 - 2020-06-30 05:07 - 000003189 _____ () C:\Users\MATI\AppData\Local\ListHost8.txt
Do tego skan przy pomocy mbam oraz adwcleaner.
gdzi to wkleic czy cos