sprawdzanie logow

[pisi123]

Od paru dni komputer dziwnie sie zachowuje, zacina sie i muli przeskanowalem spyhunterem i usunal pare virosow, ale zacina sie dalej .

 

FRST

Addition

skroty

OTLT

extrast

 

Tez pojawily mi sie jakies ukryte dwa pliki desktop.ini

 

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21799
 

i drugi

 

[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21769
IconResource=%SystemRoot%\system32\imageres.dll,-183

 

I jeden w narzedzia administracyjne

 

[LocalizedFileNames]
Memory Diagnostics Tool.lnk=@%SystemRoot%\system32\MdSched.exe,-4001
System Configuration.lnk=@%systemroot%\system32\msconfig.exe,-126
Performance Monitor.lnk=@%SystemRoot%\system32\wdc.dll,-10021
Data Sources (ODBC).lnk=@%SystemRoot%\system32\odbcint.dll,-1310
Windows Firewall with Advanced Security.lnk=@%SystemRoot%\System32\AuthFWGP.dll,-20
services.lnk=@%systemroot%\system32\filemgmt.dll,-2204
Computer Management.lnk=@%SystemRoot%\system32\mycomput.dll,-300
iSCSI Initiator.lnk=@%SystemRoot%\system32\iscsicpl.dll,-5001
Event Viewer.lnk=@%SystemRoot%\system32\miguiresource.dll,-101
Task Scheduler.lnk=@%SystemRoot%\system32\miguiresource.dll,-201
Component Services.lnk=@%systemroot%\system32\comres.dll,-3410
Print Management.lnk=@%systemroot%\system32\pmcsnap.dll,-700
Security Configuration Management.lnk=@%SystemRoot%\system32\wsecedit.dll,-718
[.ShellClassInfo]
LocalizedResourceName=@%SystemRoot%\system32\shell32.dll,-21762


 

Edytowane 13 Maja 2015 przez pisi123

[ULLISSES]

Ukryte pliki desktop.ini są tam od zawsze.

 

Przeskanuj kompa przy pomocy AdwCleaner a potem np przy pomocy Aviry.

[pisi123]

ADWCLEANER http://wklej.org/hash/6c08a98e969/

[Kolobos]

Odinstaluj:
BestSaVeeForYaou (HKLM-x32\...\{F6A71DC7-28F4-C6C7-8FA9-8A56C80FC96A}) (Version: - "") <==== ATTENTION
CiHeapMe (HKLM-x32\...\{F6C44C71-2CFE-8176-3A4D-CBD0DCE5AEFA}) (Version: - "") <==== ATTENTION
EnJuooyCoupon (HKLM-x32\...\{2DF3E224-05CD-4113-AA7A-86F2F6607B46}) (Version: - "") <==== ATTENTION
Hauppy2Suavee (HKLM-x32\...\{E957849A-94AC-6F46-4623-C31474E3C170}) (Version: - "") <==== ATTENTION
Isaveeer (HKLM-x32\...\{F1422DAA-0829-09A1-7536-73936CAB8FFA}) (Version: - "") <==== ATTENTION
NetoCoupuon (HKLM-x32\...\{317D8BB4-16C3-CFBD-3777-AED69667DA46}) (Version: - "") <==== ATTENTION
Online music radio (HKLM-x32\...\{CA1838EF-A497-194E-3850-37A62CEE398B}) (Version: - "") <==== ATTENTION
SpyHunter (HKLM-x32\...\{0028CB34-D5D3-460F-B308-A39A095A5E01}) (Version: 4.16.5.4290 - Enigma Software Group USA, LLC)
Website and SEO Analysis (HKLM-x32\...\{7223EDAC-E091-B3C1-BD91-B66CE557800F}) (Version: - "") <==== ATTENTION

Obok frst.exe utowrz plik fixlist.txt z zawartoscia:
Task: {6079164C-52AF-467F-84B2-6E09AF9C693F} - System32\Tasks\SpyHunter4Startup => C:\Program Files (x86)\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-05-13] (Enigma Software Group USA, LLC.)
AlternateDataStreams: C:\Users\x\AppData\Local\4EAmOZwWIJ:fpsfdEwjpctoUZO7syL0X92D
AlternateDataStreams: C:\Users\x\AppData\Local\Temporary Internet Files:jWQvS3WtuNH1Bhs7BsiSwjV
AlternateDataStreams: C:\Users\x\AppData\Local\Temporary Internet Files:U3NGWwjLDEOgfS13vr0
HKU\S-1-5-21-895852538-1234023079-4263962446-1000\...\Run: [AdobeBridge] => [X]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
R3 WinHttpAutoProxySvc; winhttp.dll [X]
2015-05-12 03:34 - 2015-05-12 03:34 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\x\Downloads\SpyHunter-Installer(1).exe
2015-05-07 14:32 - 2015-05-13 17:13 - 00000000 ____D () C:\Program Files (x86)\Website and SEO Analysis
2015-05-07 14:32 - 2015-05-13 17:13 - 00000000 ____D () C:\Program Files (x86)\BestSaVeeForYaou
2015-05-07 14:32 - 2015-05-07 14:32 - 00000000 ____D () C:\Program Files (x86)\Isaveeer
2015-05-07 14:32 - 2015-05-07 14:32 - 00000000 ____D () C:\Program Files (x86)\CiHeapMe
2015-05-05 00:59 - 2015-05-05 00:59 - 00732332 _____ () C:\ComboFix.txt
2015-05-05 00:48 - 2015-05-05 00:59 - 00000000 ____D () C:\Qoobox
2015-04-09 15:27 - 2015-05-13 19:31 - 00000000 ____D () C:\Program Files (x86)\TurboSys
2015-04-09 15:27 - 2015-05-06 17:46 - 00000000 ____D () C:\Program Files (x86)\SSalePluS
2015-04-09 15:26 - 2015-05-13 19:31 - 00000000 ____D () C:\ProgramData\{c0cfe345-d41b-79d3-c0cf-fe345d418d17}
2015-04-09 15:26 - 2015-04-09 15:26 - 00465920 _____ () C:\Users\x\Downloads\shameless-theres-the-rub-pol-5536136(1).exe
2015-04-09 15:18 - 2015-05-13 17:13 - 00000000 ____D () C:\Program Files (x86)\SalePPlus
2015-04-09 15:18 - 2015-05-13 17:13 - 00000000 ____D () C:\Program Files (x86)\Outlook365 Notifier
2015-04-09 15:18 - 2015-05-07 14:32 - 00000000 ____D () C:\ProgramData\15681867075780971378
2015-04-09 15:18 - 2015-04-09 15:27 - 00000000 ____D () C:\Program Files (x86)\TerminusTurbo
2015-04-09 15:17 - 2015-05-13 19:31 - 00000000 ____D () C:\ProgramData\{9d0201bd-191e-8f69-9d02-201bd19106f4}
2015-04-09 15:17 - 2015-04-09 15:17 - 00465920 _____ () C:\Users\x\Downloads\shameless-theres-the-rub-pol-5536136.exe
EmptyTemp:

 

W FRST wybierz Fix.

 

Zrob pelny skan przy pomocy Mbam i usun to co wykryje:
http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/