Prośba o sprawdzenie logów

[chrubson 2]

Witam, wrzucam logi z lapka siostry, stwierdziła że strasznie zwolnił. Również wspomniała coś o skanowanie dysku przy starcie systemu.

 

 

FRST

 

Addition

 

 

Shortcut

 

 

 

Z góry dziękuje za pomoc

[filutka78 11]

Otwórz Notatnik i wklej w nim:

Task: C:\Windows\Tasks\temp_4163a01d-f8ce-493c-a92a-0b69ebc73c32-6.job => C:\Program Files (x86)\TheTorntv V10\4163a01d-f8ce-493c-a92a-0b69ebc73c32-6.exeɽ/QxUPN='TheTorntv V10' /ZaNABdKVC=61855 /rfMHehz='001823' /idYZrCu='0' /hoNJdU='0' /NofnrLXhn=5D3BE3DE92BA49919EA8A69F9985B35CIE /xdMfwPsFJ=5984c996a4faf75e1c1181bb113c0ade /xdaqi=1_34_07_29 /zkCGI=1.34.7.29 /pArpzloO=1406648453 /BNMRUh=hxxp:/stats.infogenservice.com /oySfG=hxxp:/errors.infogenservice.com /snlsgiL=hxxp:/cr.install-daddy.com /YcllzA=ch /gWLZGUR /fPAENI=TheTorntv V10 /lTOQwIIBNde9203c9-4356-4cef-bc2e-06d90d3ed4ef.dll /OWVdaA91acd452-6fef-41e5-b54b-4db79f23eb1d.dll /BTKVFbq4163a01d-f8ce-493c-a92a-0b69ebc73c32-64.exe /bKRScUKKT='nova' /FwoWB=hxxp:/cr.install-daddy.com <==== UWAGA

Task: {D5A8CBA4-8ECF-4017-ACDB-6E7935C7E84D} - System32\Tasks\{84F9F8C0-ACB0-4E8A-A829-8166333E72A1} => pcalua.exe -a C:\Users\aadmin\Desktop\SecureW2_EAP_Suite_113_CE\SecureW2_EAP_Suite_113_CE.exe -d C:\Users\aadmin\Desktop\SecureW2_EAP_Suite_113_CE

Task: {D6B5BDFF-D9B2-4D9A-810E-3CA1FBEEA801} - System32\Tasks\{0DACF361-9E66-4B66-AA9D-A35FB8D74FFF} => pcalua.exe -a C:\Users\aadmin\Desktop\SecureW2_EAP_Suite_113_CE\SecureW2_EAP_Suite_113_CE.exe -d C:\Users\aadmin\Desktop\SecureW2_EAP_Suite_113_CE

Task: {9F41349E-1368-4CDD-AF3B-6D33791A9611} - System32\Tasks\{2FF2534F-D04C-4004-97BD-779F6FD32BBA} => pcalua.exe -a "D:\Pliki programów\LT Beam\setup.exe" -d "D:\Pliki programów\LT Beam"

Task: {B318F7EE-9017-4665-94A2-CFB2A74C7CAB} - System32\Tasks\temp_4163a01d-f8ce-493c-a92a-0b69ebc73c32-6 => C:\Program Files (x86)\TheTorntv V10\4163a01d-f8ce-493c-a92a-0b69ebc73c32-6.exe <==== UWAGA

C:\Program Files (x86)\TheTorntv V10

DeleteKey: HKLM\SOFTWARE\Wow6432Node\yoursites123Software

DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes

DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes

DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes

FirewallRules: [TCP Query User{9E63D297-6532-4D13-AE61-49E72C2535F0}C:\users\aadmin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\aadmin\appdata\local\akamai\netsession_win.exe

FirewallRules: [uDP Query User{DC183ABE-3325-4DF9-B14D-06422ACF8937}C:\users\aadmin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\aadmin\appdata\local\akamai\netsession_win.exe

FirewallRules: [TCP Query User{E7CA4932-041F-47D2-A129-2AF5221DDC67}C:\users\aadmin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\aadmin\appdata\local\akamai\netsession_win.exe

FirewallRules: [uDP Query User{510398B4-2BA2-424B-BFD3-9BBEF287293B}C:\users\aadmin\appdata\local\akamai\netsession_win.exe] => (Allow) C:\users\aadmin\appdata\local\akamai\netsession_win.exe

S1 {0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw64; system32\drivers\{0c0bb4a8-45a4-4685-9c1d-08d98af4b926}Gw64.sys [X]

S2 LiveUpdateWPP Manager; C:\Program Files (x86)\LiveUpdateWPP\LiveUpdateWPP.exe [X]

StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1418666587&from=cor&uid=HGSTXHTS545050A7E380_TM85F34TGXEW3MGXEW3MX

URLSearchHook: HKLM-x32 -> Domyślne = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}

SearchScopes: HKU\S-1-5-21-2098861562-828284276-4157317399-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.only-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=80DCD0DF9A98C254&affID=129300&tsp=5323

SearchScopes: HKU\S-1-5-21-2098861562-828284276-4157317399-1000 -> {3E4E7F21-0E41-4914-8A1B-574AED0CF708} URL = hxxp://www.only-search.com/?babsrc=SP_kms&affID=129300&tt=&mntrid=80DCD0DF9A98C254&tsp=5323&q={searchTerms}&r=265

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1418666587&from=cor&uid=HGSTXHTS545050A7E380_TM85F34TGXEW3MGXEW3MX&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1418666587&from=cor&uid=HGSTXHTS545050A7E380_TM85F34TGXEW3MGXEW3MX&q={searchTerms}

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1418666587&from=cor&uid=HGSTXHTS545050A7E380_TM85F34TGXEW3MGXEW3MX&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1418666587&from=cor&uid=HGSTXHTS545050A7E380_TM85F34TGXEW3MGXEW3MX&q={searchTerms}

IFEO\bitguard.exe: [Debugger] tasklist.exe

IFEO\bprotect.exe: [Debugger] tasklist.exe

IFEO\bpsvc.exe: [Debugger] tasklist.exe

IFEO\browserdefender.exe: [Debugger] tasklist.exe

IFEO\browserprotect.exe: [Debugger] tasklist.exe

IFEO\browsersafeguard.exe: [Debugger] tasklist.exe

IFEO\dprotectsvc.exe: [Debugger] tasklist.exe

IFEO\jumpflip: [Debugger] tasklist.exe

IFEO\protectedsearch.exe: [Debugger] tasklist.exe

IFEO\searchinstaller.exe: [Debugger] tasklist.exe

IFEO\searchprotection.exe: [Debugger] tasklist.exe

IFEO\searchprotector.exe: [Debugger] tasklist.exe

IFEO\searchsettings.exe: [Debugger] tasklist.exe

IFEO\searchsettings64.exe: [Debugger] tasklist.exe

IFEO\snapdo.exe: [Debugger] tasklist.exe

IFEO\stinst32.exe: [Debugger] tasklist.exe

IFEO\stinst64.exe: [Debugger] tasklist.exe

IFEO\umbrella.exe: [Debugger] tasklist.exe

IFEO\utiljumpflip.exe: [Debugger] tasklist.exe

IFEO\volaro: [Debugger] tasklist.exe

IFEO\vonteera: [Debugger] tasklist.exe

IFEO\websteroids.exe: [Debugger] tasklist.exe

IFEO\websteroidsservice.exe: [Debugger] tasklist.exe

HKU\S-1-5-21-2098861562-828284276-4157317399-1000\...\Policies\Explorer: []

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [fst_pl_162] => [X]

C:\Users\aadmin\AppData\Local\Akamai\netsession_win.exe

EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe

Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

F.