Illidan
Ekspert
Liczba postów: 1.024
|
RE: Wirusy-infekcje, prosze o sprawdzenie logów
Uruchom "OTL" i wklej do niego:
Cytat::processes
killallprocesses
:File
C:\ProgramData\ExtTag\Yeartop.exe
C:\ProgramData\ExtTag\ExtTag.exe
L:\Program Files\igfx32\igfx32.exe
C:\ProgramData\ExtTags
C:\ProgramData\ExtTag
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-1-6.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-6.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-4.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-1-7.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-1-6.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-5_user.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-5.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-6.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-11.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-7.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-3.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-1-6.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-6.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-4.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-5_user.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-5.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-1-7.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-11.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-3.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-7.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-7.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-11.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-4.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-3.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-1-7.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-5_user.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-5.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-7.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-11.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-4.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-3.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-1-7.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-5_user.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-5.job
C:\Windows\tasks\APSnotifierPP3.job
C:\Windows\tasks\APSnotifierPP2.job
C:\Windows\tasks\b3d8e769-5a65-436f-b66f-f73034a7e103-10_user.job
C:\Windows\tasks\01b1ce1d-3273-4a5d-89f7-35b5d0877a35-10_user.job
[C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-10_user.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-10_user.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-1-6.job
C:\Windows\tasks\2d6eb033-4713-48b0-ae6b-943851c458ee-6.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-6.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-1-6.job
C:\Windows\tasks\0d6a911d-8318-4d4c-8705-6111c9b411b3-10_user.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-11.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-4.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-3.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-5_user.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-5.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-7.job
C:\Windows\tasks\efb369e1-db74-46bd-9211-c2ed892017d9-1-7.job
:OTL
SRV - File not found [On_Demand | Stopped] -- %PROGRAMFILES%\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - File not found [Auto | Stopped] -- L:\Program Files\Primary Color\bin\utilPrimaryColor.exe -- (Util Primary Color)
SRV - File not found [Auto | Stopped] -- L:\Program Files\Primary Color\updatePrimaryColor.exe -- (Update Primary Color)
SRV - File not found [Disabled | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /medsvc -- (gupdatem)
SRV - File not found [Disabled | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe /svc -- (gupdate)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\wsafd_1_10_0_19.sys -- (wsafd_1_10_0_19)
DRV - File not found [Kernel | System | Stopped] -- system32\drivers\tcfd_vt_1_10_0_21.sys -- (tcfd_vt_1_10_0_21)
DRV - File not found [Kernel | System | Stopped] -- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{12EA20EB-A385-4BBF-83D9-FA00D1942CBA}\MpKsl59e51834.sys -- (MpKsl59e51834)
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.mystartsearch.com/web/?type=d...archTerms}
IE - HKLM\..\SearchScopes\ielnksrch: "URL" = http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGj6djnKPJOQqePDeWaPY0iMI2U_Yz7PYSVPxkNuHiGYQ_yC4es67ILMIta5b3BI5mKOVYTGwWWUOYXIV&q={searchTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGj6djnKPJOQqePDeWaPY0iMI2U_Yz7PYSVPxkNuHiGYQ_yC4es67ILMIta5b3BI5mKOVYTGwWWUOYXIV&q={searchTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGj6djnKPJOQqePDeWaPY0iMI2U_Yz7PYSVPxkNuHiGYQ_yC4es67ILMIta5b3BI5mKOVYTGwWWUOYXIV&q={searchTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGjL5Xe3RR3UFog1CrTEVVnc4Hub6MULwfrBjdUTQOu4BBRWYg7d3_h6R_w7JqNphVaLhOtc2XQ1SvCle
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pl
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 76 2F F2 48 C9 21 D0 01 [binary data]
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGj6djnKPJOQqePDeWaPY0iMI2U_Yz7PYSVPxkNuHiGYQ_yC4es67ILMIta5b3BI5mKOVYTGwWWUOYXIV&q={searchTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes,DefaultScope = {ielnksrch}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerm...DF&pc=MSSE
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0}: "URL" = http://www.istartsurf.com/web/?utm_sourc...archTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://www.mystartsearch.com/web/?type=d...archTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{E733165D-CBCF-4FDA-883E-ADEF965B476C}: "URL" = http://www.istartsurf.com/web/?utm_sourc...archTerms}
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}: "URL" = http://www.bing.com/search?q={searchTerm...DF&pc=MSSE
IE - HKU\S-1-5-21-508398070-3938312038-3425218928-1000\..\SearchScopes\{ielnksrch}: "URL" = http://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBUTxkij9_B3vZOxc6r0vkIwYb3QkxS5B5RVb0tP7g0ikODxfDrMzu4oqMiORlPBcmjIaon_06znyid-iPs7CDKGj6djnKPJOQqePDeWaPY0iMI2U_Yz7PYSVPxkNuHiGYQ_yC4es67ILMIta5b3BI5mKOVYTGwWWUOYXIV&q={searchTerms}
FF - prefs.js..browser.search.defaultenginename: "findit"
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10: L:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll File not found
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4: L:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\quick_searchff@gmail.com: C:\Users\Patrycja\AppData\Roaming\Mozilla\Firefox\Profiles\gwh7z4ii.default\extensions\quick_searchff@gmail.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\sweetsearch@gmail.com: C:\Users\Patrycja\AppData\Roaming\Mozilla\Firefox\Profiles\gwh7z4ii.default\extensions\sweetsearch@gmail.com
[2015-08-24 19:24:57 | 000,002,377 | ---- | M] () -- C:\Users\Patrycja\AppData\Roaming\mozilla\firefox\profiles\e5a35wge.default-1440096157526\searchplugins\findit.xml
O4 - HKLM..\Run: [EaseUS EPM tray] C:\Program Files\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe File not found
O4 - HKU\S-1-5-19..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found
O4 - HKU\S-1-5-20..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun File not found
:Commands
[emptytemp]
Wykonaj skrypt i pokaż raport z usuwania po restarcie kompa.Dalej pobierz "Malwaresbytes Anty-Malware " i pokaż log ze skanowania.
|
Post: #2
