Witam. Mam problem ze steam. Wszedłem przypadkowo w jakiś link, który służy do scamu na steam. Usunąłem steam, został mi jakiś programik, który ciągle automatycznie się uruchamia. Wygląda jak normalne okienko logowania steam, tylko jest po rosyjsku. Dodatkowo wirus wyłącza mi menadżera zadań. Programy do scanu nie pomagają. Proszę o pomoc.
Odinstaluj McAfee Security Scan Plus i Trojan Remover 6.9.2.
Wklej do systemowego notatnika i zapisz jako plik tekstowy o nazwie fixlist :
CloseProcesses:
HKLM-x32\...\Run: [TrojanScanner] => D:\Trojan Remover\Trjscan.exe [1911712 2015-05-14] (Simply Super Software)
AppInit_DLLs-x32: wbsys.dll => "wbsys.dll" File not found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2013-08-12]
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
ShellIconOverlayIdentifiers: [4sharedSyncOverlay1] -> {2012DE06-50C0-48BD-ACDE-88F95D4CAD1F} => No File
ShellIconOverlayIdentifiers: [4sharedSyncOverlay2] -> {C72C6188-BEF2-46E5-A89A-52F0ED75219E} => No File
ShellIconOverlayIdentifiers: [4sharedSyncOverlay3] -> {C92F6BC2-AF61-4C0E-80E0-939B8282DDB7} => No File
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File
GroupPolicyUsers\S-1-5-21-2862705919-630468593-1621977957-1002\User: Restriction detected <======= ATTENTION
HKU\S-1-5-21-2862705919-630468593-1621977957-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.interia.pl/#utm_source=instalki1&utm_medium=installer&utm_campaign=instalki1&iwa_source=installer_instalki
HKU\S-1-5-21-2862705919-630468593-1621977957-1000\Software\Microsoft\Internet Explorer\Main,Start Page Before = hxxp://search.audio4fun.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2862705919-630468593-1621977957-1000 -> ToolbarSearchProviderProgress {96bd48dd-741b-41ae-ac4a-aff96ba00f7e}
BHO: No Name -> {53d6b405-b933-48e2-94d9-9842e0ced22b} -> No File
BHO: No Name -> {58b99e36-a88c-4e8c-95d8-72977b03b3dd} -> No File
Toolbar: HKLM - No Name - {8664889D-ED18-4713-918F-E2BB69D8452B} - No File
Toolbar: HKLM-x32 - No Name - {8664889D-ED18-4713-918F-E2BB69D8452B} - No File
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF Homepage: hxxp://www.interia.pl/#utm_source=instalki1&utm_medium=installer&utm_campaign=instalki1&iwa_source=installer_instalki
S3 nosGetPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper_3004.dll [52288 2011-02-02] (NOS Microsystems Ltd.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.149\McCHSvc.exe [289256 2015-06-26] (McAfee, Inc.)
S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [X]
S2 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X]
S1 dizsgsnt; \??\C:\Windows\system32\drivers\dizsgsnt.sys [X]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 ewusbmbb; system32\DRIVERS\ewusbwwan.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 vserial; System32\DRIVERS\vserial.sys [X]
2015-08-23 14:12 - 2015-08-23 14:12 - 01248160 _____ C:\Users\Kompek\Downloads\Trojan-Remover-13140-dp (1).cpl
2015-07-28 11:40 - 2015-08-13 13:26 - 00001976 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2015-07-28 11:40 - 2015-07-28 11:40 - 00000000 ____ D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-07-28 11:40 - 2015-07-28 11:40 - 00000000 ____ D C:\Program Files\McAfee Security Scan
2015-08-23 13:15 - 2015-02-24 15:11 - 00000000 ____ D C:\AdwCleaner
2015-07-28 11:40 - 2013-08-12 11:40 - 00000000 ____ D C:\ProgramData\McAfee Security Scan
2013-10-13 10:47 - 2013-10-13 10:47 - 50053120 _____ () C:\Program Files (x86)\GUT5725.tmp
2014-10-31 22:47 - 2014-10-31 22:48 - 0000000 _____ () C:\Users\Kompek\AppData\Local\{A6F4EA84-1032-4985-829C-523473FC8A80}
2011-06-26 13:30 - 2011-06-26 13:30 - 0000004 _____ () C:\ProgramData\0051fe3d.tmp
Task: {0359E79E-1F8A-4B85-9299-E10104FD3013} - System32\Tasks\{8FDB407C-CB6D-458C-A3B8-65E24AA302EC} => Chrome.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {0ABFAC06-ECFC-420A-A754-EDC1AF0CA096} - System32\Tasks\{AB32C620-F49C-4AAF-AA1B-BC88F62CE6A7} => pcalua.exe -a "C:\Users\Kompek\AppData\Local\Temp\Temp1_fifa11_pc_demo_EU.zip\Support\FIFA 11_code.exe"
Task: {0C294B6F-CA3B-46C7-BB16-E51883E11FF6} - System32\Tasks\{A859E8F3-784C-4957-A0DB-63EA6F5BCB51} => pcalua.exe -a E:\autorun.exe -d E:\
Task: {0E191441-694C-4B4C-A82A-132BCE8F3211} - System32\Tasks\{B87A20D6-C952-486C-B7CA-4821B02E0994} => Chrome.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {1F209037-80D6-4AF5-B6CF-61E1A8E71451} - System32\Tasks\{006448DA-E5D6-42ED-95BA-5648D4D33AFB} => pcalua.exe -a "C:\Program Files (x86)\RocketDock\unins000.exe"
Task: {35F64540-DB0F-4D1A-81D1-068242FB860E} - System32\Tasks\{EE56E7FD-43D9-4971-9F8E-D42955DC8BA2} => pcalua.exe -a "F:\Na metka\Metin2Mod_ml.exe" -d "F:\Na metka"
Task: {3BBDBA26-3C2A-4FCB-83EB-68C604544DEE} - System32\Tasks\{9EE5102A-58BC-474B-AAA7-29E4B597D4AF} => pcalua.exe -a "C:\Users\Kuba\Desktop\4. JAF Box x64 Driver\1. PKEY_Driver_setup_English.exe" -d "C:\Users\Kuba\Desktop\4. JAF Box x64 Driver"
Task: {401E8305-D11E-407E-867F-347602C2504D} - System32\Tasks\{6B25BF13-402D-440F-AAF1-20816672F2B3} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.158/pl/abandoninstall?page=tsMain
Task: {45B10A5D-6914-4029-BF37-E32980F9DB79} - System32\Tasks\{BBD1CB9B-FFC4-4A07-A89C-524FE4CDD3F7} => Chrome.exe
Task: {5165885B-644A-4601-A3BC-5A16AEA5C8C6} - System32\Tasks\{0A9F3BF1-3723-4028-8EB1-21137A4FB064} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.158.259/pl/abandoninstall?page=tsProgressBar
Task: {5296B78B-BC67-4E05-8F91-B7C342199EA3} - System32\Tasks\{991BBD1A-A736-44B3-AB31-0FC4697D08E7} => Chrome.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {647E2C7F-D676-421A-909E-F9AAB552E5AA} - System32\Tasks\{25E1C06A-AC50-4FED-8F4E-7F70196CED14} => pcalua.exe -a C:\Users\Kompek\AppData\Local\Temp\Temp1_fifa11_pc_demo_EU.zip\DotNet2Redistributable\dotnetfx.exe
Task: {6536A200-5922-4705-BD79-5AB230851110} - System32\Tasks\{6A05D256-ECEE-4F1C-8B37-663D26B9AC62} => Firefox.exe http://ui.skype.com/ui/0/5.10.0.116/pl/abandoninstall?page=tsProgressBar
Task: {7BFC98FE-50D7-4D17-854D-14C1A8A7F257} - System32\Tasks\{0A1E35EB-BB81-437A-853A-EFD68D7AD587} => Chrome.exe
Task: {8BB8C8CB-AE48-4D68-881A-45276E9ADB92} - System32\Tasks\{B0BD29E4-D861-492C-BDC9-E2692F0D0C02} => Chrome.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {93FFB500-6F85-47AC-8A47-A14D8A90ED79} - System32\Tasks\{AFBF631E-0B8B-40ED-A93D-58E41008BCCF} => pcalua.exe -a "D:\Program Files (x86)\Deluxe Ski Jump 3\Setup.exe" -d "D:\Program Files (x86)\Deluxe Ski Jump 3"
Task: {AFDD21D4-F9CD-4329-BB19-19A3A4616958} - System32\Tasks\{60E16E8C-CCE5-42BC-A7F2-7FF597217927} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.158.259/pl/abandoninstall?page=tsProgressBar
Task: {B508FFCE-F610-4BDF-AAB3-8598848992F2} - System32\Tasks\Norton Security Scan for Kuba => C:\Program Files (x86)\Norton Security Scan\Engine\3.0.0.103\Nss.exe [2010-11-17] (Symantec Corporation)
Task: {CB877111-8832-411B-B237-DA99878127CE} - System32\Tasks\{82C6B58B-BF33-4701-BD40-7359D015FDC2} => Chrome.exe
Task: {D41D6105-64E7-4BE9-AB3B-DF8DCDC1AAFC} - System32\Tasks\{BA33E131-799E-4C58-80F3-9A359566F1AD} => Chrome.exe http://ui.skype.com/ui/0/6.3.0.105/pl/abandoninstall?page=tsProgressBar
Task: {E3513727-B589-4979-A24B-20C8425CCB13} - System32\Tasks\{527675A9-2133-4ABF-83EC-DD7104C8810B} => Chrome.exe http://ui.skype.com/ui/0/6.1.0.129.272/pl/abandoninstall?page=tsProgressBar
Task: {E78EF9F9-08E5-4B40-B98B-A022E77FB1D2} - System32\Tasks\{37F9B4FE-59B3-40DA-80F0-C648E3C6DD62} => pcalua.exe -a C:\Users\Kuba\AppData\Local\Temp\Temp1_dw-65050-themes_creator_4.16.zip\ThemesCreator-v4.16.2.6.exe
Task: {E8EF3603-D099-41EA-9300-80547E4A9A26} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {ECA1D252-AAEF-45FF-9885-A6AC94CA9F84} - System32\Tasks\Update\svhost => C:\Users\Kompek\AppData\Local\Temp\svhost.exe [2015-08-23] () <==== ATTENTION
Task: {F3016E3A-2F74-49B6-93D7-061305F95B56} - System32\Tasks\{17A7E3EE-D562-4E81-ABF0-4F046E004367} => Chrome.exe
Task: {F5E95E39-878D-4398-AB22-D57D3CECA291} - System32\Tasks\{A8826B7C-F240-476F-8025-D2BA650C938B} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.158.259/pl/abandoninstall?page=tsProgressBar
C:\Program Files (x86)\Norton Security Scan
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
EmptyTemp:
Uruchom FRST i kliknij Fix. Pokaż raport z usuwania Fixlog.
Kliknij Scan i pokaż nowy raport z FRST bez Addition i Shortcut.
Skasuj folder C:\FRST
Usuń stare punkty przywracania: Aby usunąć wszystkie punkty przywracania
Dysk przeskanuj ESET Online Scanner
Zainstaluj Java 8 Update 60