Jednak komputer masz bardzo slaby, nawet jak na W8.1, korzystanie z tego zlomu musi byc koszmarne.
Płyta główna: Acer Aspire R3-131T
Procesor: Intel(R) Pentium(R) CPU N3700 @ 1.60GHz
Całkowita pamięć fizyczna: 3930.02 MB
Drive c: () (Fixed) (Total:256.78 GB) (Free:82.11 GB) (Model: WDC WD5000LPCX-00VHAT0) NTFS
Do tego jeszcze dysk talerzowy. Zamiesc screen calego okna z CrystalDiskInfo Portable.
System oczywiscie zainfekowany...
Do tego pytalem czy cos podmieniales, w logu widac, ze od paru dni wszystko psules sciagajac kolejne szkodliwe programy, wiec nic dziwnego, ze teraz nic nie dziala.
Zrob skan przy pomocy mbam oraz adwcleaner i usun to co wykryja.
Odinstaluj:
Intel(R) Security Assist
CCleaner
WinThruster v8.0.0.1 <- jeszcze jakies szkodliwe programy instalujesz...
Java 10.0.2 (64-bit) (HKLM\...\{EECB2736-D013-5AC5-9917-7656712F6931}) (Version: 10.0.2.0 - Oracle Corporation) <- ta utworzyla mase zbednych wpisow.
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.510 - Oracle)
Java 8 Update 251 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180251F0}) (Version: 8.0.2510.8 - Oracle Corporation)
Java 8 Update 251 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180251F0}) (Version: 8.0.2510.8 - Oracle Corporation)
Java 8 Update 311 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180311F0}) (Version: 8.0.3110.11 - Oracle Corporation)
Java 8 Update 321 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180321F0}) (Version: 8.0.3210.7 - Oracle Corporation)
Zainstaluj tylko najnowsza jave ->
https://www.java.com/download/ie_manual.jsp
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
MSCONFIG\Services: AdvancedSystemCareService16 => 2
MSCONFIG\Services: Apple Mobile Device Service => 2
MSCONFIG\Services: avg => 2
MSCONFIG\Services: AVG Tools => 2
MSCONFIG\Services: avgm => 3
MSCONFIG\Services: AVGSecureBrowserElevationService => 3
MSCONFIG\Services: CCleanerPerformanceOptimizerService => 3
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "Windows Updates Service"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "ALLUpdate"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "Napisy24Update"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "AVGBrowserAutoLaunch_9380FA77464E79C84195F5557C4524D0"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "Microsoft Edge Update"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\StartupApproved\Run: => "Advanced SystemCare"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1002\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
(svchost.exe ->) (Solvusoft Corporation -> Solvusoft) C:\Program Files (x86)\WinThruster\WTNotifications.exe
C:\Users\Lukasz\AppData\Roaming\Windows Updates Files\Windows Updates Service.vbe
HKLM-x32\...\Run: [isa] => C:\Program Files (x86)\Intel\Intel(R) Security Assist\isa.exe [330240 2015-02-18] () [Brak podpisu cyfrowego]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [707256 2021-12-15] (Oracle America, Inc. -> Oracle Corporation)
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [42614688 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\Run: [Windows Updates Service] => C:\Users\Lukasz\AppData\Roaming\Windows Updates Files\Windows Updates Service.vbe [1000 2022-12-20] () [Brak podpisu cyfrowego] <==== UWAGA
C:\Users\Lukasz\AppData\Roaming\Windows Updates Files\
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\Run: [Microsoft Edge Update] => C:\Users\Lukasz\AppData\Local\Microsoft\EdgeUpdate\1.3.177.11\MicrosoftEdgeUpdateCore.exe [263648 2023-07-13] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\MountPoints2: {47ef9866-22f2-11ec-825b-e09467e55cf8} - "F:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1001\...\MountPoints2: {e3c31c51-a37c-11eb-8252-e09467e55cf8} - "E:\HiSuiteDownLoader.exe"
HKU\S-1-5-21-2559551443-3895959728-3540466190-1002\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [42614688 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
Policies: C:\Users\Lukasz\NTUSER.pol: Ograniczenia <==== UWAGA
Policies: C:\Users\lukaszek\NTUSER.pol: Ograniczenia <==== UWAGA
Task: {D060C9F4-E479-4D0E-A7A4-0F896B737C16} - System32\Tasks\{FCB801E8-1A14-493D-9664-B1033FCD0C2A} => C:\Windows\system32\pcalua.exe [13312 2018-01-02] (Microsoft Windows -> Microsoft Corporation) -> -a C:\Users\Lukasz\Desktop\skoki\Install.exe -d C:\Users\Lukasz\Desktop\skoki
Task: {4B439C87-21E7-4D7F-9575-E72231DC2027} - System32\Tasks\ACC => C:\Program Files\Acer\FUB\FUB_Send.bat [916 2015-01-06] () [Brak podpisu cyfrowego]
Task: {44F6F764-62DF-4357-A70A-DD58A477083F} - System32\Tasks\AVGSteam-type2.9.6.6\AVGSteam-type2.9.6.6 => C:\ProgramData\AVGSteam-type2.9.6.6\AVGSteam-type2.9.6.6.exe [0 0000-00-00] () [Odmowa dostępu] <==== UWAGA
Task: {7CBF41F4-8111-49CA-8F63-D66D760BDBAE} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [714256 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {4BC9B8CD-585E-4268-9BEA-2E1889EB1EA7} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [4703648 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --configpath "C:\Program Files\CCleaner\Setup" --guid "033a71c9-d417-4a68-9aa7-7e040443b64b" --version "6.16.10662" --silent
Task: {D0A67E00-D5C2-497C-A06B-2EE0DE6458A8} - System32\Tasks\CCleanerSkipUAC - Lukasz => C:\Program Files\CCleaner\CCleaner.exe [35675552 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {E69D789F-9238-4428-A345-B60E99D60C4D} - System32\Tasks\CCleanerSkipUAC - lukaszek => C:\Program Files\CCleaner\CCleaner.exe [35675552 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
Task: {C54A04BB-E7FF-4317-9F29-174053B0DDF6} - System32\Tasks\iTop BLACK FRIDAY Task (One-Time) => "C:\Program Files (x86)\iTop VPN\Pub\itopbf.exe" /vpn (Brak pliku)
Task: {1737B2E2-45D4-40EC-88B7-25D79D6FA7FD} - System32\Tasks\Opera scheduled Autoupdate 1650482677 => C:\Users\Lukasz\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Brak pliku)
C:\Users\lukaszek\AppData\Local\Updates\Run.vbs
C:\Users\lukaszek\AppData\Local\Updates\
Task: {7C266EB8-56E8-4B9B-8DC7-6BA80FEBCFC4} - System32\Tasks\Window Update => C:\Users\lukaszek\AppData\Local\Updates\Run.vbs [1015 2022-05-09] () [Brak podpisu cyfrowego] <==== UWAGA
Task: {90BFD727-E1FB-4191-B994-F640B6BD9F5C} - System32\Tasks\Windows Service Task => C:\Users\lukaszek\AppData\Local\Updates\WindowsService.exe [5581312 2022-05-11] () [Brak podpisu cyfrowego] <==== UWAGA
Task: {E8DC1776-A523-44BD-913C-E21C2BA93E49} - System32\Tasks\WinThruster automatic scan and notifications => C:\Program Files (x86)\WinThruster\WTNotifications.exe [5179136 2023-03-13] (Solvusoft Corporation -> Solvusoft) <==== UWAGA
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\CCleanerCrashReporting.job => C:\Program Files\CCleaner\CCleanerBugReport.exe
S4 CCleanerPerformanceOptimizerService; C:\Program Files\CCleaner\CCleanerPerformanceOptimizerService.exe [1074080 2023-09-08] (PIRIFORM SOFTWARE LIMITED -> Piriform Software Ltd)
S4 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [813032 2021-12-07] (EasyAntiCheat Oy -> Epic Games, Inc)
S3 Rockstar Service; "C:\Program Files\Rockstar Games\Launcher\RockstarService.exe" [X]
U1 avgbdisk; Brak ImagePath
S3 cpuz154; \??\C:\Windows\temp\cpuz154\cpuz154_x64.sys [X]
S3 MpKsl24299a2f; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D8DCF4AB-2963-4342-8C7A-623072FE419E}\MpKslDrv.sys [X]
U4 MsSecFlt; Brak ImagePath
U4 Sense; Brak ImagePath
U4 SgrmAgent; Brak ImagePath
U4 SgrmBroker; Brak ImagePath
U4 WdBoot; Brak ImagePath
U4 WdFilter; Brak ImagePath
U4 WdNisDrv; Brak ImagePath
U4 WdNisSvc; Brak ImagePath
U4 WinDefend; Brak ImagePath
2023-10-09 22:44 - 2023-10-09 22:44 - 000000000 ____D C:\Users\Lukasz\Downloads\FRST-OlderVersion
2023-10-09 19:43 - 2023-10-09 17:41 - 000707584 _____ (Valve Corporation) C:\Windows\SysWOW64\(0xc000007b).dll
2023-10-09 19:43 - 2023-10-09 17:41 - 000707584 _____ (Valve Corporation) C:\Windows\system32\(0xc000007b).dll
2023-10-09 19:42 - 2023-10-09 17:41 - 000707584 _____ (Valve Corporation) C:\Users\Lukasz\Desktop\(0xc000007b).dll
2023-10-09 19:41 - 2023-10-09 19:42 - 000692144 _____ C:\Users\Lukasz\Downloads\(0xc000007b).zip
2023-10-08 22:45 - 2023-10-08 22:45 - 001421536 _____ () C:\Users\Lukasz\Downloads\adobe-shockwave-player-6628704611604609-AsystentPobierania_v2.08.817.13.08.exe
2023-10-08 22:45 - 2023-10-08 22:45 - 001421536 _____ () C:\Users\Lukasz\Downloads\adobe-shockwave-player-6628704611604609-AsystentPobierania_v2.08.81.713.08.exe
2023-10-08 13:34 - 2023-10-08 13:34 - 000000000 ____D C:\Users\lukaszek\AppData\Roaming\dll-files.com
2023-10-08 12:12 - 2023-10-08 12:12 - 025401728 _____ (Outbyte) C:\Users\Lukasz\Downloads\winmm_dll-outbyte-pc-repair (1).exe
2023-10-08 11:35 - 2023-10-08 11:35 - 000146937 _____ C:\Users\Lukasz\Downloads\winmm.zip
2023-10-08 02:35 - 2023-10-08 02:35 - 005022920 _____ (Dll-Files.com ) C:\Users\Lukasz\Downloads\1- dffsetup.exe
2023-10-08 02:35 - 2023-10-08 02:35 - 000049664 _____ C:\Users\Lukasz\Downloads\3- DLL Files Fixes (Crack).exe
2023-10-08 02:35 - 2023-10-08 02:35 - 000001068 _____ C:\Users\Lukasz\Downloads\MANUAL DE INSTRUÇÕES.txt
2023-10-08 02:35 - 2023-10-08 02:35 - 000000997 _____ C:\Users\Lukasz\Downloads\4- Desabilitar a ativação.cmd
2023-10-08 02:35 - 2023-10-08 02:35 - 000000161 _____ C:\Users\Lukasz\Downloads\2- Serial 64bit DLL-Files Fixer.reg
2023-10-08 02:35 - 2023-10-08 02:35 - 000000149 _____ C:\Users\Lukasz\Downloads\2- Serial 32bit -DLL-Files Fixer.reg
2023-10-08 02:34 - 2023-10-08 02:33 - 000327680 _____ C:\ProgramData\91425067676259794430473402
2023-10-08 02:34 - 2023-08-29 14:49 - 000294912 _____ C:\ProgramData\45036769294167040866521514
2023-10-08 02:34 - 2022-07-12 13:47 - 000020480 _____ C:\ProgramData\18745860114652661197013569
2023-10-08 02:34 - 2022-07-09 01:05 - 000028672 _____ C:\ProgramData\39102063730521492030790914
2023-10-08 02:34 - 2022-07-09 01:05 - 000028672 _____ C:\ProgramData\38901449680051353496181762
2023-10-08 02:30 - 2023-10-08 02:30 - 000327680 _____ C:\ProgramData\05760571389148209781079563
2023-10-08 02:30 - 2023-08-29 14:49 - 000294912 _____ C:\ProgramData\03334922717573805284200680
2023-10-08 02:30 - 2022-07-12 13:47 - 000020480 _____ C:\ProgramData\05223397566845342735335311
2023-10-08 02:30 - 2022-07-09 01:05 - 000028672 _____ C:\ProgramData\17651202843861092045992899
2023-10-08 02:30 - 2022-07-09 01:05 - 000028672 _____ C:\ProgramData\16491624743229342008903505
2023-10-08 02:29 - 2023-10-08 02:29 - 000000000 ____D C:\Users\Lukasz\AppData\Roaming\ZARNYSZKMNNDKSH
2023-10-08 02:28 - 2023-10-08 02:29 - 025623150 _____ C:\Users\Lukasz\Downloads\App-Setup_Update_Launcher.rar
2023-10-08 02:26 - 2023-10-08 02:26 - 012121134 _____ C:\Users\Lukasz\Downloads\Passwrd-2023-Setup.rar
2023-10-08 02:24 - 2023-10-08 02:24 - 005022920 _____ (Dll-Files.com ) C:\Users\Lukasz\Downloads\dffsetup.exe
2023-10-08 02:20 - 2023-10-08 02:20 - 002057424 _____ ( ) C:\Users\Lukasz\Downloads\data-recovery.exe
2023-10-08 02:15 - 2023-10-08 02:15 - 000193933 _____ C:\Users\Lukasz\Downloads\ws2_32.zip
2023-10-08 02:11 - 2023-10-08 02:11 - 016578402 _____ ( ) C:\Users\Lukasz\Downloads\DLLSuite_Setup_2013.exe
2023-10-08 02:11 - 2023-10-08 02:11 - 000000000 ____D C:\Program Files (x86)\DLLSuite
2023-10-08 02:04 - 2023-10-08 02:04 - 000000000 _____ C:\Users\Lukasz\Downloads\DLLSuite_Setup.exe
2023-10-08 02:01 - 2023-10-08 02:01 - 001421536 _____ () C:\Users\Lukasz\Downloads\dll-suite-6628564026017921-AsystentPobierania_v0.312.115.97.6.exe
2023-10-08 02:01 - 2023-10-08 02:01 - 001421536 _____ () C:\Users\Lukasz\Downloads\dll-suite-6628564026017921-AsystentPobierania_v0.31.21.15.97.6.exe
2023-10-08 01:55 - 2023-10-08 01:55 - 000001812 _____ C:\Users\Lukasz\Downloads\api-ms-win-core-apiquery-l1-1-0.zip
2023-10-08 01:49 - 2023-10-09 08:47 - 000003244 _____ C:\Windows\system32\Tasks\WinThruster automatic scan and notifications
2023-10-08 01:49 - 2023-10-08 02:51 - 000000000 ____D C:\ProgramData\WinThruster
2023-10-08 01:49 - 2023-10-08 02:51 - 000000000 ____D C:\Program Files (x86)\WinThruster
2023-10-08 01:49 - 2023-10-08 01:49 - 000001063 _____ C:\Users\Lukasz\Desktop\WinThruster.lnk
2023-10-08 01:49 - 2023-10-08 01:49 - 000000000 ____D C:\Users\Lukasz\AppData\Roaming\WinThruster
2023-10-08 01:49 - 2023-10-08 01:49 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinThruster
2023-10-08 01:48 - 2023-10-08 01:48 - 007634112 _____ (Solvusoft ) C:\Users\Lukasz\Downloads\Setup_WinThruster_2024.exe
2023-10-08 01:39 - 2023-10-08 01:40 - 026190888 _____ (Outbyte) C:\Users\Lukasz\Downloads\binkw32_dll-outbyte-pc-repair.exe
2023-10-08 01:39 - 2023-10-08 01:39 - 026190888 _____ (Outbyte) C:\Users\Lukasz\Downloads\vcruntime140_dll-outbyte-pc-repair.exe
2023-10-08 01:38 - 2023-10-08 21:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outbyte
2023-10-08 01:37 - 2023-10-08 01:38 - 021754408 _____ (Outbyte) C:\Users\Lukasz\Downloads\api-ms-win-crt-runtime-l1-1-0_dll-outbyte-driver-updater.exe
2023-10-08 01:34 - 2023-10-08 01:35 - 026190888 _____ (Outbyte) C:\Users\Lukasz\Downloads\msvcp140_dll-outbyte-pc-repair.exe
2023-10-08 01:26 - 2023-10-08 01:26 - 025401728 _____ (Outbyte) C:\Users\Lukasz\Downloads\winmm_dll-outbyte-pc-repair.exe
2023-10-01 08:22 - 2023-10-09 01:30 - 000000760 _____ C:\Windows\Tasks\CCleanerCrashReporting.job
2023-10-01 08:22 - 2023-10-08 22:51 - 000004128 _____ C:\Windows\system32\Tasks\CCleaner Update
2023-10-01 08:22 - 2023-10-01 08:22 - 000003332 _____ C:\Windows\system32\Tasks\CCleanerCrashReporting
2023-04-10 17:29 C:\ProgramData\AVGSteam-type2.9.6.6
EmptyTemp:
Jak nic sie nie zmieni po wykonaniu wszystkiego to reinstaluj system, nie ma sensu uzywac systemu w ktorym sporo uslug uszkodzila infekcja + twoje zabawy z losowymi programami.