Sprawdzenie logów i stworzeie fixlist

[zarammoth]

Dzień dobry.

Nie wiem czy trafiłem temat w dobry dział . W programie FRST stworzyłem logi, jednak nie jestem sam stworzyć sobie fixlist. Może ktoś zobaczyć i napisać co wkleić do fixlist??

Linki :

FRST:

Dostępne tylko dla zarejestrowanych użytkowników

Addidtion:

Dostępne tylko dla zarejestrowanych użytkowników

ShortCut
Dostępne tylko dla zarejestrowanych użytkowników

[electrolux]

masz infekcję ...

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.Otworzy się Notatnik - wklej do niego:

C:\Windows\Minidump\*.dmp
2018-08-20 11:08 - 2018-08-20 11:08 - 007770624 _____ () C:\Users\user\AppData\Local\agent.dat
2018-08-20 11:08 - 2018-08-20 11:08 - 000070896 _____ () C:\Users\user\AppData\Local\Config.xml
2018-08-20 11:08 - 2018-08-20 11:08 - 000140800 _____ () C:\Users\user\AppData\Local\installer.dat
2018-08-20 11:08 - 2018-08-20 11:08 - 000005568 _____ () C:\Users\user\AppData\Local\md.xml
2018-08-20 11:08 - 2018-08-20 11:08 - 000126464 _____ () C:\Users\user\AppData\Local\noah.dat
2018-08-20 11:08 - 2018-08-20 11:41 - 001413120 _____ () C:\Users\user\AppData\Local\sham.db
2018-08-20 11:08 - 2018-08-20 11:08 - 002019916 _____ () C:\Users\user\AppData\Local\Solotameco.tst
2018-08-20 11:08 - 2018-08-20 11:08 - 000032038 _____ () C:\Users\user\AppData\Local\uninstall_temp.ico
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
CHR HomePage: Default -> hxxps://%66%65%65%64.%68%65%6C%70%65%72 ... Q9WoGdUykN
SearchScopes: HKU\S-1-5-21-1375362925-141197526-2114466732-1001 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%7 ... QQDGKd-&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1375362925-141197526-2114466732-1001 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%7 ... QQDGKd-&q={searchTerms}
HKU\S-1-5-21-1375362925-141197526-2114466732-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%7 ... QQDGKd-&q={searchTerms}
HKU\S-1-5-21-1375362925-141197526-2114466732-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72 ... eESAL0CxZy
HKU\S-1-5-21-1375362925-141197526-2114466732-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%7 ... QQDGKd-&q={searchTerms}
Task: {7B7E8DC2-E606-4595-B8E5-CB10071D4F24} - System32\Tasks\Opera scheduled Autoupdate 4086469641 => C:\Users\user\AppData\Roaming\Microsoft\Windows\vrucseew\hahivjug.exe <==== UWAGA
RemoveDirectory: C:\Users\user\AppData\Roaming\Microsoft\Windows\vrucseew
Task: {3F0F2DA8-3DD8-4325-B8A6-18E811C20BB8} - System32\Tasks\{F93CCDAE-D35B-4F43-B77A-531E30CB86CF} => C:\Windows\system32\pcalua.exe -a "C:\Program Files (x86)\Common Files\Kinruntam\uninstall.exe" -c shuz -f "C:\Program Files (x86)\Common Files\Kinruntam\uninstall.dat" -a uninstallme E8233F4F-0603-41F7-B219-AA7DB0FB00D3 DeviceId=07ddcc4e-51ff-c3ff-f378-cb09e4aa380a BarcodeId=51198003 ChannelId=003 DistributerName=APSFWakeNet
Task: {2C5CEE95-296E-4D69-9851-1B5F638295DF} - System32\Tasks\AdvancedWindowsManager => C:\Program Files (x86)\AdvancedWindowsManager\Windows Installer\AdvancedWindowsManager.exe [7915656 2020-02-21] (MICROLEAVES LTD -> ) <==== UWAGA
Task: {3C2E9255-9482-420B-90B6-640B57EB6B76} - System32\Tasks\AdvancedUpdater => C:\Program Files (x86)\AdvancedWindowsManager\Windows Installer\Windows Updater.exe [895112 2020-02-21] (MICROLEAVES LTD -> AdvancedWindowsManager) <==== UWAGA
RemoveDirectory: C:\Program Files (x86)\AdvancedWindowsManager
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vrucseew.lnk [2018-08-20]
ShortcutAndArgument: vrucseew.lnk -> C:\Windows\System32\cmd.exe => /c start "" "C:\Users\user\AppData\Roaming\Microsoft\Windows\vrucseew\hahivjug.exe"
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound Volume Control.lnk [2018-08-20]
ShortcutTarget: Sound Volume Control.lnk -> C:\Users\user\AppData\Roaming\Sound Volume Control\sndvol.exe (Brak pliku)
HKU\S-1-5-21-1375362925-141197526-2114466732-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [3229696 2016-08-29] (Microsoft Windows -> Microsoft Corporation) <==== UWAGA
HKLM\...\Run: [] => [X]
HKLM-x32\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-1375362925-141197526-2114466732-1000\...\Run: [] => [X]
RemoveDirectory: C:\Users\user\AppData\Roaming\Sound Volume Control
FirewallRules: [TCP Query User{535DA4DE-DC72-4335-9665-EEBD5ECB5BA8}F:\soundwawe\soundwire server\soundwireserver.exe] => (Allow) F:\soundwawe\soundwire server\soundwireserver.exe => Brak pliku
FirewallRules: [UDP Query User{0F87B427-807A-4348-B892-0BA8B961B4A0}F:\soundwawe\soundwire server\soundwireserver.exe] => (Allow) F:\soundwawe\soundwire server\soundwireserver.exe => Brak pliku
FirewallRules: [{5B2997BA-A9B8-40D7-B284-B8E60FFC0BC9}] => (Allow) C:\Users\user\AppData\Local\Programs\Opera\54.0.2952.60\opera.exe => Brak pliku
FirewallRules: [{A7FBD65D-11A6-462F-9C9C-792F534D423D}] => (Allow) C:\Users\user\AppData\Local\Programs\Opera\54.0.2952.64\opera.exe => Brak pliku
FirewallRules: [TCP Query User{39E40E30-F3CE-4396-962B-9BB16C30DC8C}F:\lol\rads\projects\league_client\releases\0.0.0.178\deploy\leagueclient.exe] => (Allow) F:\lol\rads\projects\league_client\releases\0.0.0.178\deploy\leagueclient.exe => Brak pliku
FirewallRules: [UDP Query User{5503155B-4E8C-4CDC-B392-7E8DFFB5620D}F:\lol\rads\projects\league_client\releases\0.0.0.178\deploy\leagueclient.exe] => (Allow) F:\lol\rads\projects\league_client\releases\0.0.0.178\deploy\leagueclient.exe => Brak pliku
ShortcutWithArgument: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
ShortcutWithArgument: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> %SNP%
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

==================================

Error: (08/22/2020 02:25:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Ściągnij MicrosoftFixit50688.msi stąd > Dostępne tylko dla zarejestrowanych użytkowników
i go uruchom jako Administator.
.