Spowolniona praca komputera, podejrzenie wirusa


(Witch_24) #1

Witam,

 

od jakiegoś czasu komputer zaczął dość mocno się przegrzewać i chodzi zdecydowanie wolniej. Avira wykrywa jakieś ukryte obiekty, ale nie może nic z tym zrobić.

 

Log FRST

http://www.wklej.org/id/1487663/

 

Log Addition

http://www.wklej.org/id/1487664/

 


(Acorus) #2

Otwórz Notatnik i wklej:

Task: {2348AA8C-74C4-436F-B5EA-41B51EF92CCC} - System32\Tasks\{B0BD138C-CCEF-4B12-A3BA-4F1903999645} = Firefox.exe http://ui.skype.com/ui/0/6.18.0.106/pl/abandoninstall?page=tsBing
Task: {D8FF2C0A-E0EF-4677-BEA4-973E464318A5} - System32\Tasks\DTReg = C:\Users\Geralt\AppData\Roaming\defaulttab\defaulttab\DTReg.exe ==== ATTENTION
AlternateDataStreams: C:\Temp:pid1
AlternateDataStreams: C:\Temp:pid2
AlternateDataStreams: C:\Temp:pid3
AlternateDataStreams: C:\Temp:rnd.dat
AlternateDataStreams: C:\Temp:srv
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\Run: [AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA] = 1
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {1c57afdf-fb0a-11e3-9821-240a6490bc76} - H:\AutoRun.exe
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {1c57afed-fb0a-11e3-9821-240a6490bc76} - H:\AutoRun.exe
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {399f8429-fbc9-11e3-b401-240a6490bc76} - H:\AutoRun.exe
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {70f50460-18da-11e4-a28b-240a6490bc76} - H:\AutoRun.exe
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {fa910567-fad6-11e3-8fab-240a6490bc76} - H:\AutoRun.exe
HKU\S-1-5-21-3601936837-3678968528-610748813-1001\...\MountPoints2: {fa910576-fad6-11e3-8fab-240a6490bc76} - H:\AutoRun.exe
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
S3 EagleX64; \\C:\Windows\system32\drivers\EagleX64.sys [X]
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.


(Witch_24) #3

Log z usuwania

http://www.wklej.org/id/1488660/


(Acorus) #4

Skasuj folder C:\FRST.

Przeskanuj programem Malwarebytes Anti-Malware http://data-cdn.mbamupdates.com/v2/mbam/consumer/data/mbam-setup-2.0.2.1012.exe