Prośba o wyleczenie komputera

[vangandalf]

Witam, instalator udający inny program skutecznie zablokował mi komputer chinskimi programami, prosze o pomoc

 

Addition.txt

FRST.txt

Shortcut.txt

[picasso]

Konfiguracja skanu FRST: KLIK. Raport z FRST został zrobiony na innych ustawieniach niż zalecane. Odznaczyłeś pola w sekcji Filtrowanie, co spowodowało że pokazały się też poprawne wpisy umyślnie ukrywane, co tylko wydłuża analizę. Proszę trzymaj się ustawień podanych w przyklejonym temacie.

 

 

Ogromna ilość infekcji: chińskie programy, infekcja DNS (zmodyfikowany plik systemu dnsapi.dll), infekcja WMI, podstawiony fałszywy profil Firefox. Działania do przeprowadzenia:

 

1. Deinstalacje adware (należy ją wykonać poza trybem awaryjnym):

- Przez Panel sterowania odinstaluj: AdSkip, CleanBrowser, Compress, EasyHotspot version 1.0, groover, hohosearch - Uninstall.

- Wejdź do folderów C:\Program Files\MPC Cleaner + C:\Program Files\Tencent. Wyszukaj deinstalatory, z prawokliku "Uruchom jako administrator", zresetuj system. Przypuszczalnie Tencent stawi opór, ale próbuj.

 

2. Uruchom RepairDNS. Na Pulpicie powstanie log RepairDNS.txt.

 

3. Otwórz Notatnik i wklej w nim:

 

CloseProcesses:
(Microsoft Corporation) C:\Windows\explorer.exe
S2 4CF14471-2DB5-4622-9A5D-81788C0951D3; C:\Program Files\Nuvkiiwmomdirh\Tydusat.exe [271360 2016-06-15] () [brak podpisu cyfrowego]
S2 ADSkipSvc; C:\Program Files\ADSKIP\ADSkipSvc.exe [129144 2016-05-11] ()
S2 Huhcadj; C:\Users\Serwis\AppData\Roaming\Xyqoufob\Xyqoufob.exe [170496 2016-06-15] () [brak podpisu cyfrowego]
S2 Nuvkiiwmomdirh Updater; C:\Program Files\Nuvkiiwmomdirh\Lopgostu.exe [267776 2016-06-15] () [brak podpisu cyfrowego]
S2 ProntSpooler; C:\Users\Serwis\AppData\Local\Apps\2.0\abril.exe [134656 2016-05-19] () [brak podpisu cyfrowego]
R2 QQPCRTP; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe [313936 2016-06-15] (Tencent)
S2 QQRepair24ab; C:\Program Files\Tencent\QQPCMGR\QQRepair24ab [147176 2016-06-15] ()
S2 QQRepairFixSVC; C:\Program Files\Tencent\QQPCMGR\QQRepairFixSVC [147176 2016-06-15] ()
S2 ziphost; C:\Program Files\ZipTool\ziphost.dll [114080 2015-11-30] ()
S2 ArerackServerService; "C:\Program Files\Arerack\ArerackServerService.html5" {79740E79-A383-47A7-B513-3DF6563D007F} {8C4CE252-7DB2-4F8E-8E76-BAD0E5826A83} [X]
S3 blNetFilter; C:\Windows\system32\drivers\blNetFilter.sys [43912 2016-05-11] ()
R1 bsdp32; C:\Windows\system32\Drivers\bsdp32.sys [32576 2016-06-15] ()
S1 QMUdisk; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMUdisk.sys [104440 2016-05-18] (Tencent)
S1 QQPCHelper; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCHelper.sys [34936 2016-06-15] (Tencent)
S2 QQSysMon; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQSysMon.sys [120952 2016-06-15] (电脑管家)
S1 softaal; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\softaal.sys [45816 2016-06-15] (Tencent)
S3 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator.sys [126008 2016-06-15] (Tencent)
S1 TAOKernelDriver; C:\Windows\system32\Drivers\TAOKernel.sys [109688 2016-06-15] (Tencent Technology(Shenzhen) Company Limited)
S3 TFsFlt; C:\Windows\System32\Drivers\TFsFlt.sys [159608 2016-06-15] (电脑管家)
S1 TSDefenseBt; C:\Windows\System32\DRIVERS\TSDefenseBt.sys [14008 2016-06-15] (Tencent)
R0 TsFltMgr; C:\Windows\System32\drivers\TsFltMgr.sys [137816 2016-06-15] (电脑管家)
S1 TSKSP; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\TSKsp.sys [220984 2016-06-15] (电脑管家)
S2 tsnethlp; C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\TsNetHlp.sys [53368 2016-06-15] ()
S3 TSSK; C:\Windows\System32\tssk.sys [83576 2016-06-15] (电脑管家)
R0 YJSPVTFSCR; C:\Windows\System32\Drivers\askProtect.sys [200072 2016-05-11] ()
S1 ZipProtect; c:\program files\ziptool\ZipProtect.sys [515824 2015-12-14] ()
S2 Ca1628av; System32\Drivers\Ca1628av.sys [X]
S3 MarkFun_NT; \??\C:\Program Files\Gigabyte\ET5\markfun.w32 [X]
S1 SRepairDrv; \??\C:\Program Files\Tencent\QQPCMGR\SRepairDrv [X]
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\bsdp32.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\QQPCRTP => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bsdp32.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\QQPCRTP => ""="service"
HKLM\...\Run: [apphide] => C:\Program Files\badu\qq.exe [499802 2016-06-11] ()
HKLM\...\Run: [EasyHotspot] => C:\Program Files\EasyHotspot\EasyHotspot.exe [2622976 2016-04-18] (CSDI)
HKLM\...\Run: [ QQPCTray] => C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe [362304 2016-06-15] (Tencent)
HKLM\...\RunOnce: [iDSCPRODUCT] => C:\Program Files\EasyHotspot\idscservice.exe [60416 2016-06-15] ( 
HKLM\...\RunOnce: [OTUTPRODUCT_P1QD2] => C:\Program Files\mpck\otutnetwork.exe [314880 2016-06-15] ()
HKLM\...\Winlogon: [userinit] wscript C:\Windows\run.vbs,
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1431477904-2404962558-605509844-1000\...\Run: [QGuan10in12] => C:\Users\Serwis\AppData\Roaming\UPUpdata\service90132.exe [1945600 2016-06-15] ()
HKU\S-1-5-21-1431477904-2404962558-605509844-1000\...\Run: [msiql] => C:\Users\Serwis\AppData\Roaming\UPUpdata\msiql.exe [1902080 2016-06-15] ()
HKU\S-1-5-21-1431477904-2404962558-605509844-1000\...\Run: [QGuan10in1] => C:\Users\Serwis\AppData\Roaming\UPUpdata\service72564.exe [1945600 2016-06-15] ()
ShellExecuteHooks: - {98C066AB-D735-4339-9E52-A34875141B56} - C:\Users\Serwis\AppData\Roaming\Microsoft\Windows\Cookies\grumak.dll [316088 2016-06-14] ()
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMGCShellExt.dll [2016-06-15] (Tencent)
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} => C:\Program Files\ZipTool\JZipExt.dll [2015-11-30] ()
BHO: Nuvkiiwmomdirh -> {9A714587-DD25-4BD8-8938-EAE3940B98B1} -> C:\Program Files\Nuvkiiwmomdirh\Vidci.dll [2016-06-15] ()
FF Plugin: @qq.com/QQPCMgr -> C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\npQMExtensionsMozilla.dll [2016-06-15] (Tencent Technology (Shenzhen) Company Limited)
Task: {096E5706-630A-4C23-8B03-0C34C51376CB} - System32\Tasks\{7F556B9D-27BB-4A07-AC67-C8C781A3D2BC} => pcalua.exe -a C:\WINDOWS\ISUNINST.EXE -c -f"C:\Program Files\Gigabyte\ET5\Uninst.isu" -c"C:\Program Files\Gigabyte\ET5\uninstdrv.dll"
Task: {360D6C92-FB18-4EE1-AA28-1766F0B0E2B7} - System32\Tasks\{4CB3C0B7-F0C4-4F53-8728-A2CC9DBBD64D} => pcalua.exe -a H:\SETUP.EXE -d H:\
Task: {4A682105-BE16-4F9D-95E9-82F6A8675599} - System32\Tasks\Arerack Server => C:\Program Files\Arerack\ArerackServerTask.exe [2016-06-14] () 
Task: {56C540C6-1C9A-4C5E-AE97-3255400EEB2C} - System32\Tasks\tasklist => C:\Users\Serwis\AppData\Roaming\UPUpdata\service72564.exe [2016-06-15] ()
Task: {5ACDFC22-1CAF-424B-91B8-1817E4F08D13} - System32\Tasks\{00D8F59D-6355-4320-B656-047D4C30E9B3} => pcalua.exe -a "G:\Radio Code\SAMOCHODY\IMMOBILIZER\immo_soft\Loader.exe"
Task: {B433477F-0A53-4761-97C9-E89B7A0FF50B} - System32\Tasks\{11403C9E-61E0-4B9C-9504-953691A52CDB} => pcalua.exe -a G:\Programatory\setup97ja.exe -d G:\Programatory
Task: {D766EBAE-00E2-48BD-AB1C-EB468F980EEB} - System32\Tasks\{4240F6B0-999B-41A0-8684-C12891E7CDDF} => pcalua.exe -a "G:\Radio Code\SAMOCHODY\IMMOBILIZER\immo_soft\IMMOdecoder.exe"
Task: {DCD321CF-F4D8-4AB5-B4AA-08F868508DAC} - System32\Tasks\{84127E72-29F0-441F-8636-3FEA3CBFD515} => pcalua.exe -a I:\vcredist_x64.exe -d I:\ -c /q
Tcpip\..\Interfaces\{0D2388DF-3057-4C45-A1AD-F255975D7760}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{6D5499AB-547E-439A-99DF-01AA3724394E}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{7B6720DA-83C2-42F0-8C02-023D8CFDE8A0}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{9DA41E12-3CEE-4C4D-A802-D3B75618EDDD}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{e29ac6c2-7037-11de-816d-806e6f6e6963}: [NameServer] 104.197.191.4
WMI_ActiveScriptEventConsumer_ASEC: 
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.hao123.com/?tn=90098758_hao_pg
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://www.hao123.com/?tn=90098758_hao_pg
HKU\S-1-5-21-1431477904-2404962558-605509844-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.hao123.com/?tn=90098758_hao_pg
HKU\S-1-5-21-1431477904-2404962558-605509844-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://www.hao123.com/?tn=90098758_hao_pg
FirewallRules: [{BA7B264F-91FE-4BA5-B5FC-C5910471F06D}] => (Allow) C:\Program Files\ADSKIP\ADSkip.exe
FirewallRules: [{88963AA8-35CC-4C4E-8A69-5E15DF794BB5}] => (Allow) C:\Program Files\ADSKIP\ADSkipSvc.exe
FirewallRules: [{583D1364-F5E0-4A6B-BA31-0481645F7FD3}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCmgrInstallGuide.exe
FirewallRules: [{51A67260-7EF5-45B6-A7A5-D3EAA8CA4F66}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCTray.exe
FirewallRules: [{0FA725BB-9BD2-40A6-87D3-EA17FD369463}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCMgr.exe
FirewallRules: [{E4737BD1-3948-4431-8A66-FD1858B644B9}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCRTP.exe
FirewallRules: [{B37795DE-3551-4B7A-998C-1C07A7DBD534}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMDL.exe
FirewallRules: [{0C12E439-6898-4FCE-BCC0-3B0EA833D2F3}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\bugreport.exe
FirewallRules: [{1A7EFB1D-0B61-404E-901F-2D2E67CAA5AB}] => (Allow) C:\program files\common files\tencent\qqdownload\130\bugreport_xf.exe
FirewallRules: [{E09C8D87-FA76-4FF8-B9F0-D2FDA2AB9A65}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCFileOpen.exe
FirewallRules: [{BACABF39-2C61-4CDB-9B95-51C19F088E2A}] => (Allow) C:\program files\common files\tencent\qqdownload\130\tencentdl.exe
FirewallRules: [{1E2079EF-5B98-4055-9782-D601737D90CD}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCLeakScan.exe
FirewallRules: [{0C42BD49-5C02-4FC9-BB5D-E7C749378F67}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPConfig.exe
FirewallRules: [{70249663-419B-4DAC-A31D-2F40BA4C5BFD}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCSoftMgr.exe
FirewallRules: [{7EBBC529-2F2A-4F27-BCB7-848F81A46F3D}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\plugins\QMNetMon\QQPCNetFlow.exe
FirewallRules: [{3C3B0FCB-E14A-43AF-BF09-C3E78C6CB635}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCBTU.exe
FirewallRules: [{4485A483-E11F-4393-B454-9FE8BC7D5C8A}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCClinic.exe
FirewallRules: [{A9A42589-062C-40C3-8EA0-C597C509301D}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCLaunch.exe
FirewallRules: [{51DA95C7-3B17-4658-8131-C798344CBF8B}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMUpdate\QQPCMgrUpdate.exe
FirewallRules: [{5F6B87B1-275B-412B-A287-4E6045558C08}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCSoftGame.exe
FirewallRules: [{BEBDBAD9-9A71-4F47-B737-F847FD560BAC}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCSysOptimize.exe
FirewallRules: [{03AFCFDA-671F-46F3-922A-C70473CB4019}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCUpdateAVLib.exe
FirewallRules: [{EB01873C-6B5B-41FE-89A1-4726638C04C6}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQRepair.exe
FirewallRules: [{C5E5B65D-26AF-4540-8457-F4576D961560}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\Uninst.exe
FirewallRules: [{61370178-1ED8-49A8-8AC6-C49D30479F04}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QQPCPatch.exe
FirewallRules: [{8995C442-A354-45AB-B3E4-0EE58CF6E509}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\TpkUpdate.exe
FirewallRules: [{51F88AFE-EE60-490B-B927-5775B864D9B2}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMRouterMgr.exe
FirewallRules: [{6231A899-0506-4F82-A4D4-6D988B3D2296}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMAccountProtection.exe
FirewallRules: [{E7B4421F-8EB3-452E-9E7A-844205EA464D}] => (Allow) C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\QMAdBlock.exe
AV: 电脑管家系统防护 (Enabled - Up to date) {6F9C3F92-B625-0E47-F0B1-447602EC65F5}
AS: 电脑管家系统防护 (Enabled - Up to date) {D4FDDE76-901F-01C9-CA01-7F04796B2F48}
DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\mountpoints2
DeleteKey: HKCU\Software\Tencent
DeleteKey: HKLM\SOFTWARE\Tencent
Reg: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "" /f
CMD: for %i in ("C:\Program Files\ZipTool\*.dll") do regsvr32 /s /u %i
CMD: for %i in ("C:\Program Files\Tencent\QQPCMgr\11.5.17490.219\*.dll") do regsvr32 /s /u %i
C:\Program Files\mshexc.bmp
C:\Program Files\ADSKIP
C:\Program Files\Arerack
C:\Program Files\badu
C:\Program Files\CleanBrowser
C:\Program Files\EasyHotspot
C:\Program Files\Mozilla Firefox\plugins
C:\Program Files\MPC Cleaner
C:\Program Files\mpck
C:\Program Files\Nuvkiiwmomdirh
C:\Program Files\NuvkiiwmomdirhUn
C:\Program Files\Shoruyjjsp
C:\Program Files\Tencent
C:\Program Files\Wutaingjlaph
C:\Program Files\ZipTool
C:\Program Files\Common Files\Tencent
C:\ProgramData\Tencent
C:\ProgramData\TXQMPC
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Compress
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
C:\uninst
C:\Users\Serwis\AppData\Local\app
C:\Users\Serwis\AppData\Local\csdi_monetize_120160614
C:\Users\Serwis\AppData\Local\Tempfolder
C:\Users\Serwis\AppData\Local\tuto_monetize_120160614
C:\Users\Serwis\AppData\Local\Apps\2.0\abril.exe
C:\Users\Serwis\AppData\LocalLow\{D2020D47-707D-4E26-B4D9-739C4F4C2E9A}
C:\Users\Serwis\AppData\LocalLow\Company
C:\Users\Serwis\AppData\LocalLow00237270
C:\Users\Serwis\AppData\LocalLow0036CAA8
C:\Users\Serwis\AppData\Roaming\*.*
C:\Users\Serwis\AppData\Roaming\ADSKIP
C:\Users\Serwis\AppData\Roaming\MCorp
C:\Users\Serwis\AppData\Roaming\Tencent
C:\Users\Serwis\AppData\Roaming\UPUpdata
C:\Users\Serwis\AppData\Roaming\Xyqoufob
C:\Users\Serwis\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\AdSkip.lnk
C:\Users\Serwis\AppData\Roaming\Microsoft\Windows\Cookies\grumak.dll
C:\Users\Serwis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AdSkip
C:\Users\Serwis\Desktop\AdSkip.lnk
C:\Users\Serwis\Desktop\AutoTime.lnk
C:\Users\Serwis\Desktop\EasyHotspot.lnk
C:\Users\Public\Desktop\MPC Cleaner.lnk
C:\Windows\system32\TSSK.sys
C:\Windows\system32\mhl
C:\Windows\system32\Drivers\askProtect.sys
C:\Windows\system32\Drivers\blNetFilter.sys
C:\Windows\system32\Drivers\bsdp32.sys
C:\Windows\system32\Drivers\TAOAccelerator.sys
C:\Windows\system32\Drivers\TAOKernel.sys
C:\Windows\system32\Drivers\TFsFlt.sys
C:\Windows\system32\Drivers\TSDefenseBt.sys
C:\Windows\system32\Drivers\TsFltMgr.sys
C:\Windows\system32\Drivers\etc\hp.bak
CMD: ipconfig /flushdns
Hosts:
EmptyTemp:

 

Adnotacja dla innych czytających: skrypt unikatowy - dopasowany tylko i wyłącznie pod ten system, proszę nie stosować na swoich systemach.

 

Z menu Notatnika > Plik > Zapisz jako > wprowadź nazwę fixlist.txt > Kodowanie zmień na UTF-8

 

Plik fixlist.txt umieść w folderze z którego uruchamiasz FRST. Przejdź w Tryb awaryjny Windows. Uruchom FRST i kliknij w Napraw (Fix). Czekaj cierpliwie, nie przerywaj działania. Gdy Fix ukończy pracę, nastąpi restart systemu, opuść Tryb awaryjny. W tym samym katalogu skąd uruchamiano FRST powstanie plik fixlog.txt.

 

4. Operacje związane z usuwaniem profilu adware w Firefox:

- Wyeksportuj z obecnego profilu zakładki, o ile w ogóle cokolwiek jest. Zamknij Firefox.

- Klawisz z flagą Windows + R i wklej poniższe polecenie, co otworzy Menedżer profilów. Załóż świeży profil a dwa pozostałe widoczne w oknie całkowicie skasuj.

 

"C:\Program Files\Mozilla Firefox\firefox.exe" -p

 

5. Zrób nowy log FRST z opcji Skanuj (Scan), ponownie z Addition ale bez Shortcut. Dołącz też pliki fixlog.txt + RepairDNS.txt.

Edytowane 19 Lipca 2016 przez picasso
Temat zostaje zamknięty z powodu braku odpowiedzi. //picasso