Skocz do zawartości

Wirus od http://gmaegames.pro/redirect-from-banner.html

Wnk12

dodany przez Wnk12,
w Internet, sieci komputerowe, bezpieczeństwo

 Udostępnij Obserwujący 1

Recommended Posts

3ndurek

3ndurek 3585

Napisano
Napisano
START >>> Uruchom >>> wybierz (lub wpisz) REGEDIT >>> OK >>> rozwiń ten klucz, klikając na (+):
HKEY_USERS\1-5-21-1963541934-3095822493-844373909-1001\software\microsoft\windows\currentversion\run
w okienku po prawej zaznacz: domin
Z prawokliku >>>usuń
zrestartuj komputer

Zrób nowe logi już bez Addition.txt

  • Popieram 1
Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano

1.  Uruchom FRST, naciśnij jednocześnie CTRL+Y, otworzy się notatnik - wklej do niego: 

 

CloseProcesses:

Task: {4A20AC43-942B-4D5F-8793-473E4AFCC52F} - System32TasksMarian => cmd.exe /c REG ADD HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun /f /v Marian /t REG_SZ /d "explorer.exe hxxp://dipladoks.org" <==== UWAGA
HKUS-1-5-21-3792736137-1356401530-4023654279-1000...Run: [Marian] => explorer.exe hxxp://dipladoks.org <==== UWAGA
HKUS-1-5-21-3792736137-1356401530-4023654279-1000...MountPoints2: {f489b45d-2a7e-11e7-979e-d43d7e4c475c} - G:setup.exe
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> Brak pliku
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> Brak pliku
FirewallRules: [{2453641A-05CE-4375-AB7D-96111BDAC13E}] => (Allow) D:Just Cause 2bincefcef.win7steamwebhelper.exe Brak pliku
FirewallRules: [{D4A580C6-9F95-4FBC-A85E-D566A5DF543C}] => (Allow) D:Just Cause 2bincefcef.win7steamwebhelper.exe Brak pliku
FirewallRules: [TCP Query User{EADE4DDF-AC8F-4A5B-81B3-1338766480DD}D:outlast 2outlast.2-qoob-pl-dw-mtuoutlast 2binarieswin64outlast2.exe] => (Allow) D:outlast 2outlast.2-qoob-pl-dw-mtuoutlast 2binarieswin64outlast2.exe Brak pliku
FirewallRules: [uDP Query User{076A5605-01CB-4D7A-A415-41D81CEF46D0}D:outlast 2outlast.2-qoob-pl-dw-mtuoutlast 2binarieswin64outlast2.exe] => (Allow) D:outlast 2outlast.2-qoob-pl-dw-mtuoutlast 2binarieswin64outlast2.exe Brak pliku
FirewallRules: [TCP Query User{E71021A5-4060-4347-B872-E02BCE303496}D:preypreypreybinariesdaniellex64releaseprey.exe] => (Allow) D:preypreypreybinariesdaniellex64releaseprey.exe Brak pliku
FirewallRules: [uDP Query User{E5A03C7A-9933-46D6-9F9C-08386372E71B}D:preypreypreybinariesdaniellex64releaseprey.exe] => (Allow) D:preypreypreybinariesdaniellex64releaseprey.exe Brak pliku
FirewallRules: [TCP Query User{11276D68-77B2-4C1F-876C-05CCE3462ED1}E:call of duty 2cod2cod2mp_s.exe] => (Block) E:call of duty 2cod2cod2mp_s.exe Brak pliku
FirewallRules: [uDP Query User{A5B44E50-05BC-4250-8A23-D1757FC1E978}E:call of duty 2cod2cod2mp_s.exe] => (Block) E:call of duty 2cod2cod2mp_s.exe Brak pliku
FirewallRules: [TCP Query User{15455FC1-D57E-4FB7-A3EA-9ED64DD197C2}D:max payne 3gamemax payne 3max payne 3maxpayne3.exe] => (Allow) D:max payne 3gamemax payne 3max payne 3maxpayne3.exe Brak pliku
FirewallRules: [uDP Query User{C8E073D5-4D73-4EED-9152-31B4D1E6CD50}D:max payne 3gamemax payne 3max payne 3maxpayne3.exe] => (Allow) D:max payne 3gamemax payne 3max payne 3maxpayne3.exe Brak pliku

Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}

EmptyTemp:

 
Naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW)
 
 
2.  Załącz fixlog.txt i zrób nowe logi FRST
Link to post
Share on other sites
marian0099

marian0099 0

Napisano
Napisano

@@marian0099, infekcja nadal jest bo pewnie nie wkleiłeś / nie zapisałeś skryptu który podałem wyżej.

Instrukcję masz wyżej, zrób to powoli i z głową.

 

Po tym załącz fixlog.txt, i zrób nowe logi FRST. Prawdopodobne, że może być jak u kolegi wcześniej, trzeba będzie usunąć z rejestru ręcznie

Wkleiłem, uruchomiłem ponownie komputer z tym, że teraz gdy strona się pojawia to antywirus ją blokuje, czego wcześniej nie robił.

 

FRST : http://www.wklejto.pl/704248

 

Addition : http://www.wklejto.pl/704249

 

Fixlog : http://www.wklejto.pl/704250

Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano
START >>> Uruchom >>> wybierz (lub wpisz) REGEDIT >>> OK >>> rozwiń ten klucz, klikając na (+):

HKEY_USERS\1-5-21-3792736137-1356401530-4023654279-1000\software\microsoft\windows\currentversion\run

w okienku po prawej zaznacz: Marian

Z prawokliku >>>usuń

zrestartuj komputer

 

Zrób nowe logi już bez Addition.txt

  • Popieram 1
Link to post
Share on other sites
marian0099

marian0099 0

Napisano
Napisano

 

START >>> Uruchom >>> wybierz (lub wpisz) REGEDIT >>> OK >>> rozwiń ten klucz, klikając na (+):
HKEY_USERS\1-5-21-3792736137-1356401530-4023654279-1000\software\microsoft\windows\currentversion\run
w okienku po prawej zaznacz: Marian
Z prawokliku >>>usuń
zrestartuj komputer
 
Zrób nowe logi już bez Addition.txt

 

Pomogło, dzięki wielkie. Czy wiadomo skąd można dostać taki syf? Wczoraj dziewczyna oglądała na jakiejś stronie serial i od tamtej chwili zaczęło się to pojawiać.

 

FRST : http://www.wklejto.pl/704254

Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano

1.  Uruchom FRST, naciśnij jednocześnie CTRL+Y, otworzy się notatnik - wklej do niego: 

 

CloseProcesses:

Task: {0F63D444-A0DD-4FB7-9FC6-CBF96400AF72} - System32TasksPatiGosiaKrzys => cmd.exe /c REG ADD HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun /f /v PatiGosiaKrzys /t REG_SZ /d "explorer.exe hxxp://dipladoks.org" <==== UWAGA
Task: {C657356F-4103-4565-91EB-FEA7D9A4FEBB} - System32Tasks{964B06F2-A0F5-4FD1-9EDF-E814614C104E} => C:Windowssystem32pcalua.exe -a F:TL-WN725N_WN723NSetup.exe -d F:TL-WN725N_WN723N
HKLMSOFTWAREPoliciesMicrosoftWindows Defender: Ograniczenia <==== UWAGA
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\Run: [PatiGosiaKrzys] => explorer.exe hxxp://dipladoks.org <==== UWAGA
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: G - G:Setup.exe
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: {29ccfbf7-bf09-11e7-8916-408d5c4c75d5} - G:HTC_Sync_Manager_PC.exe
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: {60751b78-667e-11e8-94a4-408d5c4c75d5} - H:Lenovo_Suite.exe
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: {732b8a12-2b3e-11e8-a407-408d5c4c75d5} - H:HTC_Sync_Manager_PC.exe
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: {f7b2ac95-1deb-11e8-9722-408d5c4c75d5} - H:Lenovo_Suite.exe
HKUS-1-5-21-4231217278-2160852450-543809477-1000\...\MountPoints2: {fd9aea2c-b7b1-11e7-b1d1-806e6f6e6963} - F:Run.exe
Toolbar: HKUS-1-5-21-4231217278-2160852450-543809477-1000 -> Brak nazwy - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Brak pliku
FF Plugin: @microsoft.com/GENUINE -> disabled [brak pliku]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [brak pliku]
S3 gdrv; ??C:Windowsgdrv.sys [X]
S3 MSICDSetup; ??F:CDriver64.sys [X]
S3 NTIOLib_1_0_C; ??F:NTIOLib_X64.sys [X]
S3 NTIOLib_DVDSetup; ??F:NTIOLib_X64.sys [X]
S3 Synth3dVsc; System32driverssynth3dvsc.sys [X]
S3 tsusbhub; system32driverstsusbhub.sys [X]
S3 VGPU; System32driversrdvgkmd.sys [X]
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> Brak pliku
FirewallRules: [{730A4252-FCBA-42CF-AB8B-785EB387B0E3}] => (Allow) C:Program FilesNVIDIA CorporationNvStreamSrvNvStreamUserAgent.exe Brak pliku
FirewallRules: [TCP Query User{5A22C54B-8531-4DB0-9DFF-21E0FC04E599}C:program files (x86)origin gamesfifa 18fifa18.exe] => (Allow) C:program files (x86)origin gamesfifa 18fifa18.exe Brak pliku
FirewallRules: [uDP Query User{7D08081D-B1B7-4DDF-AE23-69A70C087C6C}C:program files (x86)origin gamesfifa 18fifa18.exe] => (Allow) C:program files (x86)origin gamesfifa 18fifa18.exe Brak pliku
FirewallRules: [TCP Query User{1E59F56B-77E0-45DF-9A6E-8D60D5C5F7E8}C:userspatigosiakrzysappdatalocalscreamerapp-1.0.6167.30805screamer.exe] => (Allow) C:userspatigosiakrzysappdatalocalscreamerapp-1.0.6167.30805screamer.exe Brak pliku
FirewallRules: [uDP Query User{AB317BFB-5065-4E90-891F-917E720EDB7C}C:userspatigosiakrzysappdatalocalscreamerapp-1.0.6167.30805screamer.exe] => (Allow) C:userspatigosiakrzysappdatalocalscreamerapp-1.0.6167.30805screamer.exe Brak pliku
FirewallRules: [TCP Query User{248566AF-766D-4FF6-A958-A480461D9722}E:grytdu2uplauncher.exe] => (Block) E:grytdu2uplauncher.exe Brak pliku
FirewallRules: [uDP Query User{1876E8F6-4FC1-41D9-9A5D-C58A7FD0E4B6}E:grytdu2uplauncher.exe] => (Block) E:grytdu2uplauncher.exe Brak pliku
FirewallRules: [{E384F741-539E-4C5F-AADD-784E742E6161}] => (Block) E:GRYTDU2UpLauncher.exe Brak pliku
FirewallRules: [TCP Query User{A135EF46-9C4E-419C-BC6F-0B2EF671A379}E:grytdu2testdrive2.exe] => (Block) E:grytdu2testdrive2.exe Brak pliku
FirewallRules: [uDP Query User{F3749F92-5F81-455F-96A9-D7AB0322AA0F}E:grytdu2testdrive2.exe] => (Block) E:grytdu2testdrive2.exe Brak pliku
FirewallRules: [TCP Query User{6141FA3F-F0D9-4C7B-9B71-DF9B69BD505A}E:grykingdom come deliverancebinwin64kingdomcome.exe] => (Allow) E:grykingdom come deliverancebinwin64kingdomcome.exe Brak pliku
FirewallRules: [uDP Query User{963BC778-EED7-4303-83A9-285C8FFDA50F}E:grykingdom come deliverancebinwin64kingdomcome.exe] => (Allow) E:grykingdom come deliverancebinwin64kingdomcome.exe Brak pliku
FirewallRules: [TCP Query User{EF4A7614-9B67-4374-B67C-93348AE24478}C:userspatigosiakrzysappdatalocalscreamerapp-1.6644.27025screamer.exe] => (Allow) C:userspatigosiakrzysappdatalocalscreamerapp-1.6644.27025screamer.exe Brak pliku
FirewallRules: [uDP Query User{18A79EA6-D6E7-48EE-A41B-4F251F8462E4}C:userspatigosiakrzysappdatalocalscreamerapp-1.6644.27025screamer.exe] => (Allow) C:userspatigosiakrzysappdatalocalscreamerapp-1.6644.27025screamer.exe Brak pliku
FirewallRules: [TCP Query User{01038F44-84B2-4974-BC97-2719FDCC654A}C:program files (x86)allplayer remoteallplayerremotecontrol.exe] => (Allow) C:program files (x86)allplayer remoteallplayerremotecontrol.exe Brak pliku
FirewallRules: [uDP Query User{A755F562-E5B6-4EF1-A3C4-9B0B8AC28B6E}C:program files (x86)allplayer remoteallplayerremotecontrol.exe] => (Allow) C:program files (x86)allplayer remoteallplayerremotecontrol.exe Brak pliku
FirewallRules: [{D1D1A4DA-18BE-472E-98A5-19300619C300}] => (Allow) C:Program Files (x86)Steambincefcef.win7steamwebhelper.exe Brak pliku
FirewallRules: [{F077CC4C-31D4-4E66-89CF-2956A0018ED6}] => (Allow) C:Program Files (x86)Steambincefcef.win7steamwebhelper.exe Brak pliku
FirewallRules: [TCP Query User{C195621D-074E-4FD3-8635-96369A3055C3}E:grydying lightdyinglightgame.exe] => (Allow) E:grydying lightdyinglightgame.exe Brak pliku
FirewallRules: [uDP Query User{A6E7C4D8-36C7-413C-8CD7-5105942E75E7}E:grydying lightdyinglightgame.exe] => (Allow) E:grydying lightdyinglightgame.exe Brak pliku
FirewallRules: [TCP Query User{B96C6522-0FAF-4633-BD84-EC9C9E849D52}E:gryfootball manager 2019fm.exe] => (Allow) E:gryfootball manager 2019fm.exe Brak pliku
FirewallRules: [uDP Query User{88972752-89A5-432D-96D3-9FBE44892100}E:gryfootball manager 2019fm.exe] => (Allow) E:gryfootball manager 2019fm.exe Brak pliku
FirewallRules: [TCP Query User{E9BDC3FE-B484-4B34-BF90-E973E5605A57}E:grygta vgta5.exe] => (Allow) E:grygta vgta5.exe Brak pliku
FirewallRules: [uDP Query User{2F935FD0-E786-4F3F-A004-9FFF6FAB249C}E:grygta vgta5.exe] => (Allow) E:grygta vgta5.exe Brak pliku
FirewallRules: [{DF9482E7-1D65-4FC9-8E7F-77170F7A9AED}] => (Block) E:GRYGTA VGTA5.exe Brak pliku
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}

EmptyTemp:

 
Naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW)
 
2.  Załącz fixlog.txt i zrób nowe logi FRST
Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano

@@kaki122,

 

1.  Uruchom FRST, naciśnij jednocześnie CTRL+Y, otworzy się notatnik - wklej do niego: 

 

CloseProcesses:

Task: {34DDFAFE-DDE2-4AA0-B48E-656979A19B8E} - Avast SoftwareOverseer -> Brak pliku <==== UWAGA

Task: {68460992-8A67-44B1-B724-47E0D4B5B3AE} - System32TasksMateusz => cmd.exe /c REG ADD HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun /f /v Mateusz /t REG_SZ /d "cmd.exe /c start www.dipladoks.org"

HKLMSOFTWAREPoliciesMicrosoftWindows Defender: Ograniczenia <==== UWAGA
HKUS-1-5-21-1496379750-4154463659-1740256873-1000\...\Policiessystem: [EnableLUA] 0
HKUS-1-5-21-1496379750-4154463659-1740256873-1000\...\MountPoints2: {6653e33c-a85d-11e7-9d7e-1c1b0de123ca} - I:setup.exe
HKUS-1-5-21-1496379750-4154463659-1740256873-1000\...\MountPoints2: {9e4078e5-8c16-11e7-8eca-806e6f6e6963} - D:Run.exe
HKUS-1-5-21-1496379750-4154463659-1740256873-1000\...\MountPoints2: {de4408e6-a2ad-11e7-9297-1c1b0de123ca} - G:Setup.exe
S3 gdrv; ??C:Windowsgdrv.sys [X]
S3 Synth3dVsc; System32driverssynth3dvsc.sys [X]
S3 tsusbhub; system32driverstsusbhub.sys [X]
S3 VGPU; System32driversrdvgkmd.sys [X]
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}

EmptyTemp:

 

Naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW)
 
2.  Załącz fixlog.txt i zrób nowe logi FRST

 

Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano

W poprzednich logach nie było:

 

HKUS-1-5-21-1496379750-4154463659-1740256873-1000...Run: [Mateusz] => cmd.exe /c start www.dipladoks.org

 

1.  Uruchom FRST, naciśnij jednocześnie CTRL+Y, otworzy się notatnik - wklej do niego: 

  

HKLMSOFTWAREPoliciesMicrosoftWindows Defender: Ograniczenia <==== UWAGA

HKUS-1-5-21-1496379750-4154463659-1740256873-1000...Run: [Mateusz] => cmd.exe /c start www.dipladoks.org

HKUS-1-5-21-1496379750-4154463659-1740256873-1000...Policiessystem: [EnableLUA] 0
HKUS-1-5-21-1496379750-4154463659-1740256873-1000...MountPoints2: {6653e33c-a85d-11e7-9d7e-1c1b0de123ca} - I:setup.exe
HKUS-1-5-21-1496379750-4154463659-1740256873-1000...MountPoints2: {9e4078e5-8c16-11e7-8eca-806e6f6e6963} - D:Run.exe
HKUS-1-5-21-1496379750-4154463659-1740256873-1000...MountPoints2: {de4408e6-a2ad-11e7-9297-1c1b0de123ca} - G:Setup.exe

Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}

EmptyTemp:

Naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW)
 
2.  Załącz fixlog.txt i zrób nowe logi FRST
 
3. Jak znowu to będzie w logach zrobimy to inaczej
Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano
START >>> Uruchom >>> wybierz (lub wpisz) REGEDIT >>> OK >>> rozwiń ten klucz, klikając na (+):

HKEY_USERS\1-5-21-1496379750-4154463659-1740256873-1000\software\microsoft\windows\currentversion\run

w okienku po prawej zaznacz: Mateusz

Z prawokliku >>>usuń

zrestartuj komputer

 

Zrób nowe logi już bez Addition.txt

Link to post
Share on other sites
3ndurek

3ndurek 3585

Napisano
Napisano (edytowane)
@Bartek2115
 
1.  Uruchom FRST, naciśnij jednocześnie CTRL+Y, otworzy się notatnik - wklej do niego: 

CloseProcesses:
Task: {4359E6EA-640F-43E3-B946-9183EFA23039} - \Avast Software\Overseer -> Brak pliku <==== UWAGA
Task: {7F980041-9D34-433D-A53A-C7E9EC966866} - System32\Tasks\Dom4 => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Dom4 /t REG_SZ /d "explorer.exe hxxp://dipladoks.org" <==== UWAGA
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\Run: [Dom4] => explorer.exe hxxp://dipladoks.org <==== UWAGA
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\MountPoints2: {051660f1-d072-11e8-9b95-d8cb8aed1ca5} - D:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\MountPoints2: {051660fe-d072-11e8-9b95-d8cb8aed1ca5} - D:\HiSuiteDownLoader.exe
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\MountPoints2: {330a0f67-42d6-11e8-8a97-806e6f6e6963} - D:\autorun.exe
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\MountPoints2: {681e0809-fb9e-11e8-9293-d8cb8aed1ca5} - G:\setup.exe
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\...\MountPoints2: {d290a3aa-0844-11e9-8f9a-d8cb8aed1ca5} - G:\HiSuiteDownLoader.exe
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.gmx.com/start?src=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.gmx.com/start?src=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29
HKU\S-1-5-21-3768484684-991739710-3201713222-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.gmx.com/start?src=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3768484684-991739710-3201713222-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3768484684-991739710-3201713222-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxps://search.gmx.com/web/result?origin=p_jkld_pl&p=jkld&p_brw=ie&p_mkt=pl&p_tsrc=301ssg01&p_w=y1w29&q={searchTerms}
Toolbar: HKU\S-1-5-21-3768484684-991739710-3201713222-1000 -> Brak nazwy - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  Brak pliku
Toolbar: HKU\S-1-5-21-3768484684-991739710-3201713222-1000 -> Brak nazwy - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Brak pliku
FF Session Restore: Mozilla\Firefox\Profiles\afknalag.default-1537606999406 -> [funkcja włączona]
FF Extension: (ESET Smart Security Extension) - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2018-06-01] [Przestarzałe] [brak podpisu cyfrowego]
FF Plugin: @microsoft.com/GENUINE -> disabled [brak pliku]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [brak pliku]
U3 aswbdisk; Brak ImagePath
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
ContextMenuHandlers4: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> Brak pliku
ContextMenuHandlers6: [Offline Files] -> {474C98EE-CF3D-41f5-80E3-4AAB0AB04301} =>  -> Brak pliku
FirewallRules: [{49A08A54-517C-461F-9AB5-A5F0A4FBDC77}] => (Allow) D:\fscommand\CKSocketServer.exe Brak pliku
FirewallRules: [{BBBC5D9C-F2D2-46B1-AC90-ED201F5C5B88}] => (Allow) D:\fscommand\CKSocketServer.exe Brak pliku
FirewallRules: [{297A08F9-75F9-4FF3-9A8B-37A82CD6EB26}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku
FirewallRules: [{B3DBA354-52FC-449C-B62E-7BCC168B21A2}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe Brak pliku
FirewallRules: [TCP Query User{F9DC5C1D-3804-4E0D-8A7F-B8EA6EFC0A42}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe Brak pliku
FirewallRules: [uDP Query User{085205DE-7F36-477B-A188-1B175A858262}C:\program files (x86)\origin games\fifa 16\fifa16.exe] => (Allow) C:\program files (x86)\origin games\fifa 16\fifa16.exe Brak pliku
FirewallRules: [{B5DC69CF-30CD-4A00-870C-E1E211349055}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe Brak pliku
FirewallRules: [{4C3A99ED-CADB-4C3A-BBE7-936D8EDD63EE}] => (Allow) C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe Brak pliku
FirewallRules: [TCP Query User{C180AC0F-F1B7-41FD-BA12-4D41E14AB666}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.160\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.160\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{83F8F238-87EC-4F33-9DCF-7E5F0EC76D6D}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.160\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.160\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{9C6DC457-6D51-481F-91C7-AAF143553EA9}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.161\deploy\leagueclient.exe] => (Block) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.161\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{A34AA3FF-F2BA-40DE-B5B2-1A14119C5A88}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.161\deploy\leagueclient.exe] => (Block) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.161\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{00096E94-169A-4E32-B45F-5470A713B792}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.162\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.162\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{E4A97848-9E10-4994-84F9-95D9033AB975}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.162\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.162\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{762817C4-4CFB-47A0-84E6-60008114A126}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.163\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.163\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{A42F299A-1684-4D13-896E-5311AE0C8E9E}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.163\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.163\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{78EC3771-33E3-43CF-A30E-7D5D64E3AE3F}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.170\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.170\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{A6128EB3-6BDD-47A9-B49B-B036BBBC107E}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.170\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.170\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{8ED8573A-242F-4C47-A3DE-7495C8E684FC}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.171\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.171\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{256C7259-F370-40FA-A511-064DC346D173}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.171\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.171\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{95416C53-9FF2-4EEB-9E89-5827A920A5E8}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.172\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.172\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{6C8A752E-EDDC-48D0-B043-3527BB8CF982}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.172\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.172\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{50E07607-AAF7-4BC8-A105-ACF618F9EEEB}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.174\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.174\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{5FB89CF0-1B8C-452B-90FE-A6C4224DD46E}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.174\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.174\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{36EC3BA5-F35C-4CD2-9EEB-36E5FDC1343A}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.175\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.175\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{22AD950A-541C-4075-B4FC-CD390B215631}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.175\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.175\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{17A089A6-30D3-4DC6-8F91-B9185A4A0BF0}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.176\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.176\deploy\leagueclient.exe Brak pliku
FirewallRules: [uDP Query User{E389E71F-DECC-416D-AC69-23B3FFCB00D0}C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.176\deploy\leagueclient.exe] => (Allow) C:\riot games\league of legends\rads\projects\league_client\releases\0.0.0.176\deploy\leagueclient.exe Brak pliku
FirewallRules: [TCP Query User{D8095D40-C243-46F0-B6A1-E439EE417DD5}C:\gog games\vikings - wolves of midgard\vikings.exe] => (Allow) C:\gog games\vikings - wolves of midgard\vikings.exe Brak pliku
FirewallRules: [uDP Query User{0B39FFD6-51D8-4111-8732-3118BC257C90}C:\gog games\vikings - wolves of midgard\vikings.exe] => (Allow) C:\gog games\vikings - wolves of midgard\vikings.exe Brak pliku
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:
 
Naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW)
 
2.  Załącz fixlog.txt
Edytowane przez 3ndurek
Link to post
Share on other sites

Dołącz do dyskusji

Możesz dodać zawartość już teraz a zarejestrować się później. Jeśli posiadasz już konto, zaloguj się aby dodać zawartość za jego pomocą.

Gość
Odpowiedz w tym wątku...

×   Wklejono zawartość z formatowaniem.   Usuń formatowanie

  Dozwolonych jest tylko 75 emoji.

×   Odnośnik został automatycznie osadzony.   Przywróć wyświetlanie jako odnośnik

×   Przywrócono poprzednią zawartość.   Wyczyść edytor

×   Nie możesz bezpośrednio wkleić grafiki. Dodaj lub załącz grafiki z adresu URL.

×
 Udostępnij
Obserwujący 1
Wróć do listy tematów

  • Ostatnio przeglądający   0 użytkowników

    Brak zarejestrowanych użytkowników przeglądających tę stronę.

×
×
  • Dodaj nową pozycję...