Avast informuje o zagrożeniu URL:Mal

dj.breakdance · 2 Lipiec 2015 10:02

Od wczoraj po włączeniu komputera avast informuje mnie o zarażeniu wirusem URL:Mal w explorer.exe. Problem występuje tuż po uruchomieniu komputera (jeśli jestem podłączony do sieci), zauważyłem też, że komputer działa o wiele wolniej niż wcześniej. Komunikat wyskakuje cały czas (nawet po zamknięciu)

Logi OTL http://wklej.org/id/1750357/

Mam nadzieję, że jest ktoś mi wstanie pomóc.

Atis · 2 Lipiec 2015 11:17

Farbar Recovery Scan Tool - Raport obowiązkowy

dj.breakdance · 2 Lipiec 2015 13:00

Oto raport

Frst.txt -http://wklej.org/id/1750450/

Addition.txt -http://wklej.org/id/1750454/

Shortcut.txt -http://wklej.org/id/1750459/

Atis · 2 Lipiec 2015 13:24

Nie cytuj moich odpowiedzi.

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

CloseProcesses:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp220140828
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp220140828
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
FF DefaultSearchEngine: Yahoo! Search
FF SelectedSearchEngine: Yahoo! Search
FF SearchPlugin: C:\Users\Marcin\AppData\Roaming\Mozilla\Firefox\Profiles\nysvil98.default\searchplugins\keepmysearch.xml [2014-07-16]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_cdcecm; system32\DRIVERS\ew_jucdcecm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2015-07-02 10:41 - 2015-07-02 10:48 - 00000000 ____ D C:\AdwCleaner
2015-07-01 09:34 - 2015-07-01 14:36 - 00000000 ___HD C:\Users\Marcin\AppData\Roaming\9E2A446A
2015-07-01 09:34 - 2015-07-01 09:35 - 00000000 ___HD C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{C3BC25C0-FCD3-4F01-AFDD-41373F017C9A}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.26.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32 -> C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\ddraw.dll (rtrspocfMoa tonooiiCr) <==== ATTENTION
CustomCLSID: HKU\S-1-5-21-2413398751-1926525891-2327230122-1000_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Marcin\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File
Task: {2762E714-702E-4238-A0AD-923BF0D7A2DB} - System32\Tasks\{06DAF6F2-729A-4760-8670-F7042714B9A0} => Iexplore.exe http://ui.skype.com/ui/0/6.18.0.105/pl/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {11B20359-6BF6-497B-8DC9-C038FEE854BC} - System32\Tasks\{B6CC27EC-D40B-46C1-BDDA-50A4F56AB9DE} => C:\Users\Marcin\Desktop\gimp-2.6.12-i686-setup-2.exe
Task: {79CDFE1F-47DA-49A1-BA81-622CCBC2C2D1} - System32\Tasks\Driver Robot => C:\Program Files (x86)\Driver Robot\Driver Robot.lnk [2014-03-09] ()
Task: {87239351-9D12-498A-8209-B96C6325E660} - System32\Tasks\{EFEF5DF1-F083-4F3F-BC97-578A01870D34} => Iexplore.exe http://ui.skype.com/ui/0/6.18.0.105/pl/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {89E0ED43-B8AE-4800-ADD9-5AE0118BB7D9} - System32\Tasks\{05245DA3-1E44-4D01-A7E0-37C25EE64ADA} => pcalua.exe -a C:\Users\Marcin\Desktop\Minecraft-Setup.exe -d C:\Users\Marcin\Desktop
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.