System Windows nie może odnaleźć pliku ,,G:\RECYCLED\e2a38afd.exe''

Dla specjalistów Bezpieczeństwo
#1

Witam mam następujący problemem, który pojawił się od kiedy kolega zwrócił  mój dysk zewnętrzny. Przedtem wszystko chodziło bez zarzutów ,lecz teraz  zamiast folderów pokazały mi się jedynie ich skróty. Natomiast przy próbie otwarcia jakiegokolwiek folderu pojawia się komunikat:

#2

Podepnij dysk.Użyj USBFix z funkcji Listing.Pokaż z niego log.

http://www.usbfix.net/

Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.

Uruchom FRST i kliknij Scan. Pokaż raport FRST i Addition.

Raporty umieść na http://wklej.org/ i podaj link.

#3

UsbFix  http://www.wklej.org/id/1587640/

FRST   http://www.wklej.org/id/1587604/

Addition  http://www.wklej.org/id/1587605/

#4

Odinstaluj Update for Funmoods.Otwórz notatnik systemowy i wklej:

Task: {66252788-A1D9-44BC-8DF0-FA4F55BE0D6F} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore = C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-02-02] (SaveSense) ==== ATTENTION
Task: {77F46C18-667E-41A0-B175-B63BCF9AA066} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2655767799-2549167989-2970426376-1000UA = C:\Users\Ja\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-21] (Facebook Inc.)
Task: {A91C7AE9-7C28-4D68-B4E7-E48D839E7A6E} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA = C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2014-02-02] (SaveSense) ==== ATTENTION
Task: {F478EB27-C80E-4670-807E-84C9A7677142} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2655767799-2549167989-2970426376-1000Core = C:\Users\Ja\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-21] (Facebook Inc.)
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2655767799-2549167989-2970426376-1000Core.job = C:\Users\Ja\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2655767799-2549167989-2970426376-1000UA.job = C:\Users\Ja\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job = C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe ==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job = C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe ==== ATTENTION
HKLM-x32\...\Run: [] = [X]
HKU\S-1-5-21-2655767799-2549167989-2970426376-1000\...\Run: [Facebook Update] = C:\Users\Ja\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-08-21] (Facebook Inc.)
HKU\S-1-5-21-2655767799-2549167989-2970426376-1000\...\RunOnce: [Adobe Speed Launcher] = 1420715413
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
CHR HKU\S-1-5-21-2655767799-2549167989-2970426376-1000\SOFTWARE\Policies\Google: Policy restriction ======= ATTENTION
HKU\S-1-5-21-2655767799-2549167989-2970426376-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.v9.com/?utm_source=butm_medium=v9tb
HKU\S-1-5-21-2655767799-2549167989-2970426376-1000\Software\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = http://search.babylon.com/?affID=113480tt=bandext_3312_4babsrc=HP_ssmntrId=2022a3f1000000000000001e101fa1f5
URLSearchHook: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - (No Name) - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
SearchScopes: HKLM - DefaultScope {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} URL = http://searchfunmoods.com/results.php?f=4q={searchTerms}a=as1212yir=as1212ycd=2XzuyEtN2Y1L1QzutC0CyC0FyCyDzytDtBtCyEyE0AtA0FtCtN0D0Tzu0CtAyDzztN1L2XzutBtFtBtFtCtFyEtDyBcr=999228313
SearchScopes: HKLM - {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} URL = http://searchfunmoods.com/results.php?f=4q={searchTerms}a=as1212yir=as1212ycd=2XzuyEtN2Y1L1QzutC0CyC0FyCyDzytDtBtCyEyE0AtA0FtCtN0D0Tzu0CtAyDzztN1L2XzutBtFtBtFtCtFyEtDyBcr=999228313
SearchScopes: HKLM-x32 - DefaultScope {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} URL = http://searchfunmoods.com/results.php?f=4q={searchTerms}a=as1212yir=as1212ycd=2XzuyEtN2Y1L1QzutC0CyC0FyCyDzytDtBtCyEyE0AtA0FtCtN0D0Tzu0CtAyDzztN1L2XzutBtFtBtFtCtFyEtDyBcr=999228313
SearchScopes: HKLM-x32 - {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} URL = http://searchfunmoods.com/results.php?f=4q={searchTerms}a=as1212yir=as1212ycd=2XzuyEtN2Y1L1QzutC0CyC0FyCyDzytDtBtCyEyE0AtA0FtCtN0D0Tzu0CtAyDzztN1L2XzutBtFtBtFtCtFyEtDyBcr=999228313
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6q={searchTerms}st=6barid={754E7B84-C175-453D-8152-7E9ADFF117D9}
SearchScopes: HKU\.DEFAULT - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - DefaultScope {F1C873B9-38CC-4253-A05E-F684678ACA96} URL = http://uk.search.yahoo.com/search?p={searchTerms}fr=chr-devicevmtype=IEBD
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - BrowserMngrDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}affID=119357babsrc=SP_ssmntrId=20221C6F65902144
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - {B7971660-A1CE-4FDD-B9E0-2C37D77AFB0B} URL =
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - {EEE6C360-6118-11DC-9C72-001320C79847} URL =
SearchScopes: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - {F1C873B9-38CC-4253-A05E-F684678ACA96} URL = http://uk.search.yahoo.com/search?p={searchTerms}fr=chr-devicevmtype=IEBD
BHO-x32: No Name - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - No File
BHO-x32: No Name - {2EECD738-5844-4a99-B4B6-146BF802613B} - No File
BHO-x32: No Name - {75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} - No File
BHO-x32: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} - No File
BHO-x32: No Name - {88be1aa9-6740-461c-9e3e-f35eb8fa741c} - No File
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll No File
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
BHO-x32: No Name - {EEE6C35C-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKLM - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File
Toolbar: HKLM-x32 - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File
Toolbar: HKLM-x32 - No Name - {A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} - No File
Toolbar: HKU\S-1-5-21-2655767799-2549167989-2970426376-1000 - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File
FF Homepage: hxxp://start.iminent.com/?appId=D3BDE28A-8739-4A88-AC42-F4D99961DCB1
FF SearchPlugin: C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\searchplugins\delta.xml
FF SearchPlugin: C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\searchplugins\Funmoods.xml
FF SearchPlugin: C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\searchplugins\sweetim.xml
FF Extension: Funmoods.com - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\Extensions\ffxtlbr@funmoods.com [2012-12-23]
FF Extension: SaveSense - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\Extensions\{2d7886a0-85bb-4bf2-b684-ba92b4b21d23} [2014-02-02]
FF Extension: SweetPacks Toolbar for Firefox - C:\Users\Ja\AppData\Roaming\Mozilla\Firefox\Profiles\5ct8litl.default\Extensions\{EEE6C361-6118-11DC-9C72-001320C79847}.xpi [2012-10-31]
CHR HKLM-x32\...\Chrome\Extension: [bpeeepmahhfjiediknjejcmcfmjcjdck] - C:\Users\Ja\AppData\Local\Google\Chrome\User Data\Default\Extensions\serach.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dkdkpmmkgdbglmfmmmmehbkmnkopingb] - C:\Users\Ja\AppData\Local\Google\Chrome\User Data\Default\Extensions\v9-toolbar.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Ja\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\Ja\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx [Not Found]
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-02-02] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-02-02] (SaveSense)
R2 Update RightSurf; C:\Program Files (x86)\RightSurf\updateRightSurf.exe [103200 2014-02-01] ()
U4 avast! Firewall; "C:\Program Files\AVAST Software\Avast\afwServ.exe" [X]
S3 gdrv; \\C:\Windows\gdrv.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S3 RTL8192cu; system32\DRIVERS\RTL8192cu.sys [X]
G:\*.lnk
G:\RECYCLED
G:\RECYCLER
G:\autorun.inf
CMD: attrib /d /s -s -h G:\*
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#5

Dzięki wielkie za pomoc. Wszystko jest już ok  :smiley:

#6

Skasuj folder C:\FRST