Infekcja komputera

krzyszparku · 17 Styczeń 2015 20:11

Witam! Ostatnio chciałem zainstalować dawno usuniętego .Net Frameworka, wcześniej użyłem cleanup tool. Podczas instalacji wyskakuje mi błąd krytyczny instalacji. Dodatkowo podczas uruchamiania niektórych programów wyświetla się komunikat: “Aplikacja nie została właściwie uruchomiona (0xc0000135). Kliknij przycisk OK, aby zakończyć aplikację.” Wydaje mi się, że może mieć to coś wspólnego ze sobą. Od jednego z użytkowników dowiedziałm się, że może to być infekcja, kazał mi on zrobić skan komputera za pomoca programu Farbar Recovery Scan Tool. Oto i rezultat:

FRST:

http://wklej.org/hash/a8be4271171/

Addition:

http://wklej.org/id/1598695/

PS. Wszelkich metod reinstalacji Frameworka już próbowałem, żadna nie podziałała.

Atis · 17 Styczeń 2015 22:47

Odinstaluj Akamai NetSession Interface.

Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :

HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-3283615997-2505045684-1208877622-1001\...\Winlogon: [Shell] C:\Windows\Explorer.exe [2871808 2011-10-10] (Microsoft Corporation) <==== ATTENTION 
BootExecute: autocheck autochk * rogramDataAPPDATA=C:\Users\Dawid\AppData\RoamingCommonProgramFiles=C:\Program Files (x86)\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=DAWID-KOMPUTERComSpec=C:\Windows\system32\cmd.exeFP_NO_HOST_CHECK=NOHOMEDRIVE=C:HOMEPATH=\Users\DawidLOCALAPPDATA=C:\Users\Dawid\AppData\LocalLOGONSERVER=\\DAWID-KOMPUTERNUMBER_OF_PROCESSORS=4OS=Windows_NTPath=C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files (x86)\PC Connectivity Solution\;C:\Program Files\Common Files\Microsoft Shared\Windows Live;C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\OpenCL SDK\2.0\bin\x86;C:\Program Files (x86)\Intel\OpenCL SDK\2.0\bin\x64;C:\Program Files\Intel\WiFi\bin\;C:\Program Files\Common Files\Intel\WirelessCommon\;C:\Program Files\Lenovo\Bluetooth Software\;C:\Program Files\Lenovo\Bluetooth Software\syswow64;;C:\Program Files\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT;C:\Program Files (x86)\Windows Live\Shared;PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSCPROCESSOR_ARCHITECTURE=x86PROCESSOR_ARCHITEW6432=AMD64PROCESSOR_IDENTIFIER=Intel64 Family 6 Model 58 Stepping 9, GenuineIntelPROCESSOR_LEVEL=6PROCESSOR_REVISION=3a09ProgramData=C:\ProgramDataProgramFiles=C:\Program Files (x86)ProgramFiles(x86)=C:\Program Files (x86)ProgramW6432=C:\Program FilesPSModulePath=C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PUBLIC=C:\Users\PublicSHIM_MCCOMPAT=0x810000001SystemDrive=C:SystemRoot=C:\WindowsTEMP=C:\Users\Dawid\AppData\Local\TempTMP=C:\Users\Dawᰪ叜⾓ࠀCommonProgramW6432=C:\Program Files\Common Filesmmon Fiᰧ忝⶝ȢÄ&ᰴ䷜ⶐࠀCommonProgramFiles(x86)=C:\Program Files (x86)\Common Files
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
FF Extension: BeTtErPRiicceChecc - C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\es54z4d4.default\Extensions\wdh2-zxftj@u-mrcxgp.net [2014-12-07]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hp&ts=1417946838&from=vtt&uid=ST1000LM024XHN-M101MBB_S2U5J9CC754616
S4 aspnet_state; %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe [X]
S2 clr_optimization_v4.0.30319_32; C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [X]
S2 clr_optimization_v4.0.30319_64; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [X]
S2 Hamachi2Svc; "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe" -s [X]
S4 NetMsmqActivator; "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe" -NetMsmqActivator [X]
S4 NetPipeActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [X]
S4 NetTcpActivator; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [X]
S3 NetTcpPortSharing; C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe [X]
S2 SWUpdater; C:\Program Files (x86)\StormWatch\SWUpdaterSvc.exe [X]
S3 ATP; system32\DRIVERS\cmdatp.sys [X]
U3 BcmSqlStartupSvc; No ImagePath
S3 btwaudio; system32\drivers\btwaudio.sys [X]
S3 btwavdt; system32\DRIVERS\btwavdt.sys [X]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [X]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [X]
U2 CLKMSVC10_3A60B698; No ImagePath
U2 CLKMSVC10_C3B3B687; No ImagePath
U2 CscService; No ImagePath
U2 DriverService; No ImagePath
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
U2 IAStorDataMgrSvc; No ImagePath
U2 iATAgentService; No ImagePath
U2 idealife Update Service; No ImagePath
U3 IGRS; No ImagePath
U2 IviRegMgr; No ImagePath
S0 LHDmgr; System32\DRIVERS\LhdX64.sys [X]
U2 Oasis2Service; No ImagePath
U0 Partizan; system32\drivers\Partizan.sys [X]
U2 PCCarerService; No ImagePath
U2 ReadyComm.DirectRouter; No ImagePath
U2 RichVideo; No ImagePath
U2 RtLedService; No ImagePath
U2 SeaPort; No ImagePath
U2 SoftwareService; No ImagePath
S2 SPDRIVER_1.38.0.1431; \??\C:\Program Files (x86)\ShopperPro\JSDriver\1.38.0.1431\jsdrv.sys [X]
U3 SQLWriter; No ImagePath
S3 WinRing0_1_2_0; \??\C:\Programy\IObit\Game Booster 3\Driver\WinRing0x64.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
C:\Users\Dawid\AppData\Roaming\AVGNOJW
C:\Users\Dawid\AppData\Roaming\avgnojw.exe.5250.gzquar
C:\Users\Dawid\AppData\Roaming\DMHMP
C:\Users\Dawid\AppData\Roaming\dmhmp.exe.109808.gzquar
C:\Users\Public\AlexaNSISPlugin.3860.dll
Task: {032E1AD5-1B37-4EBE-897C-251ECB6B1316} - System32\Tasks\{ECE86809-BB79-4DCD-BA85-3F9DAE81B4EF} => pcalua.exe -a "C:\Users\Dawid\Desktop\Microsoft .NET Framework 3.5 Service Pack 1.exe" -d C:\Users\Dawid\Desktop
Task: {04FCE17D-0898-4120-99D9-4BFDD674D902} - System32\Tasks\{6CE5A944-3D4C-4F17-B907-B4ABD20723CA} => Chrome.exe http://ui.skype.com/ui/0/5.10.0.116.259/pl/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {082D6363-5FAB-4C6E-9801-62891608E334} - System32\Tasks\{D737E346-29A5-4D7E-AF52-7A634EF4E0B4} => pcalua.exe -a C:\Users\Dawid\Desktop\HLC_setup.exe -d C:\Users\Dawid\Desktop
Task: {14701E2D-3498-4BAF-90A0-0C1D87181022} - System32\Tasks\SPBIW_UpdateTask_Time_3437393838383135352d344a414155342a2a236c6c5a => Wscript.exe //B "C:\ProgramData\ShopperPro\spbihe.js" spbiu.exe /invoke /f:check_services /l:0 <==== ATTENTION
Task: {1C074880-62A1-44E1-BEB9-7CD75B195241} - System32\Tasks\{F87F4302-0745-4C09-87A8-D28513ECF0C5} => pcalua.exe -a C:\Users\Dawid\Downloads\vcredist_x86.exe -d C:\Users\Dawid\Downloads
Task: {2256B671-7F56-4F90-9695-53E0B80F3898} - System32\Tasks\Go for FilesUpdate => C:\Program Files (x86)\GoforFiles\GFFUpdater.exe <==== ATTENTION
Task: {2BFCFB89-9939-4AC3-917A-592A5357DD09} - System32\Tasks\Microsoft\Windows\Maintenance\SMupdate2 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update2 <==== ATTENTION
Task: {3A59C641-4153-42DC-96E4-C530B45C95F4} - System32\Tasks\OFFICE2010ACT => C:\Windows\system32\OFFICEICON.vbs [2012-02-23] ()
Task: {45FA2754-7B85-40EA-B98F-150B6A6A5200} - System32\Tasks\{BC84595C-6BBA-42BB-B50C-C73BF1F12E5B} => pcalua.exe -a C:\Users\Dawid\Desktop\CEVPNSetup_XPVista_x32.exe -d C:\Users\Dawid\Desktop
Task: {46864331-9FED-4869-8E1C-0C390575A62B} - \DMHMP No Task File <==== ATTENTION
Task: {5E6D67A0-89D5-4AB1-98DE-AA27310A8CC0} - System32\Tasks\{5644865A-6E0B-49E4-BF16-296B9A5D6BD3} => Chrome.exe http://ui.skype.com/ui/0/6.10.0.104/pl/abandoninstall?page=tsProgressBar
Task: {7EAC78BD-5B97-462D-986E-445831112CEE} - System32\Tasks\{9F728189-9E13-4668-80D4-D62E938CC6E0} => pcalua.exe -a C:\Programy\ivo\Ivona_Rehab-1.0\spchapi.exe -d C:\Programy\ivo\Ivona_Rehab-1.0
Task: {831D924C-D043-4304-B6AC-EFC42667DCAD} - System32\Tasks\{B1736065-963C-4083-884C-E6D7480D67BE} => pcalua.exe -a "C:\Users\Dawid\Downloads\dotnetfx35setup (3).exe" -d C:\Users\Dawid\Downloads
Task: {8904A87E-8927-4293-8626-5679BD9366EA} - System32\Tasks\{9F93FBFB-7E36-4507-B2EB-D0A8B87BBFF1} => pcalua.exe -a C:\Users\Dawid\Desktop\013e3416d3c50bbd2bb03c25357bdeee.exe -d C:\Users\Dawid\Desktop
Task: {8A182E37-1AAD-4336-AABE-F02CFBECFBE8} - System32\Tasks\{82C2C488-95F1-4DE2-B650-A71CDA0E1BE6} => pcalua.exe -a "C:\Users\Dawid\Desktop\Microsoft .NET Framework 3.5.exe" -d C:\Users\Dawid\Desktop
Task: {8B1F0DBB-1E0E-4306-80F7-2A1183F634FF} - System32\Tasks\{D69D002B-DA48-4B4C-ADC3-9FAA26D8B8AA} => pcalua.exe -a "C:\Users\Dawid\Downloads\MeduZa GUI &amp; Driver V2.00.exe"
Task: {92A57050-49BF-4407-A119-0DDC9DBC33D6} - System32\Tasks\{178BED68-46ED-4F6F-B9B4-6E5FD4FABE61} => pcalua.exe -a "C:\Program Files (x86)\Nokia\Ovi\Application Installer\Application Installer\ApplicationInstaller.exe" -d C:\Users\Dawid\Desktop -c "C:\Users\Dawid\Desktop\mobireader.series60.3.sis"
Task: {946177C3-5D09-4002-9B91-7C2513C17074} - System32\Tasks\Microsoft\Windows\Multimedia\SMupdate3 => Rundll32.exe C:\PROGRA~1\COMMON~1\System\SysMenu.dll ,Command701 update3 <==== ATTENTION
Task: {99936BAD-18C9-4A9D-A34F-34CA6FA6E9F9} - System32\Tasks\{C9C39794-9FFD-4B4D-8E69-86E9D6368ECD} => pcalua.exe -a "C:\Users\Dawid\Downloads\dotnetfx35setup (2).exe" -d C:\Users\Dawid\Downloads
Task: {9A4EC136-BC7C-4BF1-A078-F1EABA53B363} - \AVGNOJW No Task File <==== ATTENTION
Task: {9FB07CFC-7083-47FB-8606-D81284880FA7} - System32\Tasks\{A6AFF16C-029C-42D0-8997-921B3AEE0208} => pcalua.exe -a "C:\Users\Dawid\Desktop\music makers\fl studio plugins\Native Instruments Absynth 5\Absynth 5 Setup PC.exe" -d "C:\Users\Dawid\Desktop\music makers\fl studio plugins\Native Instruments Absynth 5"
Task: {A4542445-6B3E-4D03-8483-12F6DDD9296A} - System32\Tasks\{426227F8-1DF3-4DB6-8A70-9D9FB1DE602B} => pcalua.exe -a H:\Setup.exe -d H:\
Task: {B0C997DD-5B9C-44C1-A6C8-52E5DD962147} - System32\Tasks\{868DA39B-12B3-455A-99BA-1AC62939A4D5} => pcalua.exe -a C:\Users\Dawid\Desktop\vcredist_x86.exe -d C:\Users\Dawid\Desktop
Task: {BFAE54F9-26DD-41BB-BE4A-32B7E63EEF2D} - System32\Tasks\{DFCFDEAA-4B37-4975-8EDF-E48735098629} => C:\OG\MK3\MK3W.EXE
Task: {C4924D10-383C-4DAB-951D-9452C34DBC7E} - System32\Tasks\{ADC45C40-8930-4934-B7A8-137B1C6B2F72} => C:\Gry\THQ\MX vs ATV Unleashed\MXvsATV.exe
Task: {D08A715C-D9C4-487C-B0E1-A1D9A9F4ABE7} - System32\Tasks\{8FD18643-ADC4-43ED-8449-A36AF849F525} => pcalua.exe -a "C:\Users\Dawid\Downloads\dotNetFx35setup (1).exe" -d C:\Users\Dawid\Downloads
Task: {D41CA578-82BF-4C31-B655-3872E38D85DB} - System32\Tasks\{AE99F9F9-11D3-4F30-91D2-9DECE4B05DB6} => C:\OG\MK3\MK3W.EXE
Task: {D78B0953-1242-4725-864F-87528B3F47E6} - System32\Tasks\{57FF4F7E-0618-428F-9CE5-5AD4C7F237D1} => pcalua.exe -a "C:\Users\Dawid\Desktop\Adobe Photoshop 7.0 CE\Setup.exe" -d "C:\Users\Dawid\Desktop\Adobe Photoshop 7.0 CE"
Task: {DA12E2D3-80F1-4B40-A732-F0673D8252BE} - System32\Tasks\{863A99DF-C19A-4ABA-BFAD-8B8C54F224A0} => pcalua.exe -a C:\Users\Dawid\Desktop\dotnetfx35.exe -d C:\Users\Dawid\Desktop
Task: {E25C5520-8280-4807-8E0E-3B39DBBB847B} - System32\Tasks\{675EB8D6-404F-4C35-8A7F-FD3378E1DC61} => pcalua.exe -a "C:\Users\Dawid\Desktop\Install Minecraft.exe" -d C:\Users\Dawid\Desktop
Task: {F21AB8EC-F442-4DED-921D-E8D7878A702F} - System32\Tasks\YTDownloaderUpd => C:\Program Files (x86)\YTDownloader\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\AVGNOJW.job => C:\Users\Dawid\AppData\Roaming\AVGNOJW.exe <==== ATTENTION
Task: C:\Windows\Tasks\DMHMP.job => C:\Users\Dawid\AppData\Roaming\DMHMP.exe <==== ATTENTION
C:\Users\Dawid\AppData\Roaming\*.exe
EmptyTemp:

Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.

Kliknij Scan i pokaż nowy raport z FRST bez Addition.