Witam,
Dzisiaj podczas walki z 100% użyciem procesora przez plik svchost.exe natrafiłem na kilka trojanów. Pliki te zostały odnalezione przez MBAM i usunięte. Z racji, że ciężko mi powiedzieć czy system jest czysty prosiłbym o sprawdzenie logów.
Addition http://www.wklej.org/id/1556042/
FRST http://www.wklej.org/id/1556045/
Pozdrawiam
Wolfgar
Otwórz Notatnik i wklej:
Task: {1330C686-0361-470B-8926-C7D003CB55B7} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4270808645-2569383084-950112651-1002Core = C:\Users\Siwy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-12-08] (Facebook Inc.)
Task: {41EC3F9A-0513-4FEE-A647-0CAB0EE365D9} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-4270808645-2569383084-950112651-1002UA = C:\Users\Siwy\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-12-08]
Task: {B23C8257-B104-4B81-9B2D-ECEDB3B6A605} - System32\Tasks\Origin = C:\Users\Siwy\AppData\Roaming\Origin\update.vbe [2014-07-21] () ==== ATTENTION
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4270808645-2569383084-950112651-1002Core.job = C:\Users\Siwy\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4270808645-2569383084-950112651-1002UA.job = C:\Users\Siwy\AppData\Local\Facebook\Update\FacebookUpdate.exe
HKLM-x32\...\Run: [] = [X]
HKU\S-1-5-21-4270808645-2569383084-950112651-1002\...\Run: [Facebook Update] = C:\Users\Siwy\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-12-08] (Facebook Inc.)
HKU\S-1-5-21-4270808645-2569383084-950112651-1002\...\Run: [] = [X]
HKU\S-1-5-21-4270808645-2569383084-950112651-1002\...\RunOnce: [Adobe Speed Launcher] = 1418393834
BootExecute: auto_reactivate \\?\Volume{35184d62-a8aa-11df-830a-806e6f6e6963}\bootwiz\asrm.binautocheck autochk *
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction ======= ATTENTION
HKU\S-1-5-21-4270808645-2569383084-950112651-1002\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction ======= ATTENTION
SearchScopes: HKU\.DEFAULT - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4270808645-2569383084-950112651-1002 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-4270808645-2569383084-950112651-1002 - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
Toolbar: HKU\S-1-5-21-4270808645-2569383084-950112651-1002 - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
S3 catchme; \\C:\ComboFix\catchme.sys [X]
S3 cpuz130; \\C:\Users\Siwy\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 cpuz132; \\C:\Users\Siwy\AppData\Local\Temp\cpuz132\cpuz132_x64.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 GearAspiWDM; System32\drivers\GEARAspiWDM.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
U3 tmlwf; No ImagePath
U3 tmwfp; No ImagePath
U2 V2iMount; No ImagePath
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S3 WimFltr; system32\DRIVERS\wimfltr.sys [X]
S3 WinRing0_1_2_0; \\C:\Program Files (x86)\BatteryCare\WinRing0x64.sys [X]
C:\ProgramData\hash.dat
C:\Users\Siwy\AppData\Roaming\Origin\update.vbe
EmptyTemp:
Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
Skasuj folder C:\FRST