Lapek strasznie muli 80% CPU

[flowerart]

WItam lapek mi strasznie muli Cpu skacze z80%-do 100%  zadnych podejrzanych procesow nie widac

mozliwe ze pobralem jakis syf ostatnio 

prosze o sprawdzenie logow 

 

 

 

Addition.txt

FRST.txt

Shortcut.txt

[jessica]

C:\Program Files\Toolrain\Application\chrome.exe

ta przeglądarka udaje, ze jest Google Chrome

 

zaraz...

 

jest dużo do usuwania, więc to trochę jeszcze potrwa

[flowerart]

okey dzieki wielkie i czekam za odp 

jeszcze czekam za logami z GMER

[jessica]

1) Otwórz Notatnik i wklej w nim:

 

FirewallRules: [{510102A5-8DB2-415B-AA88-363EE54F640F}] => (Allow) C:\Program Files\Toolrain\Update\ToolrainUpdate.exe
FirewallRules: [{361DB842-4F61-49D0-8CA4-8BF4C5213E00}] => (Allow) C:\Program Files\Toolrain\Application\chrome.exe
FirewallRules: [{A4E4AE8A-7C21-4752-8731-A22E6F5E8655}] => (Allow) C:\ProgramData\Toolrain\Toolrain.exe
2016-06-23 13:12 - 2016-06-23 06:03 - 00428416 _____ () C:\ProgramData\Birdsarah\Birdsarah.exe
2016-06-29 21:23 - 2016-06-28 15:23 - 00424832 _____ () C:\ProgramData\Toolrain\Toolrain.exe
RemoveDirectory: C:\Program Files\Toolrain
RemoveDirectory: C:\ProgramData\Birdsarah
RemoveDirectory: C:\ProgramData\Toolrain
RemoveDirectory: C:\Program Files\Sorawardanagck
RemoveDirectory: C:\Program Files\TXQQBrowser
RemoveDirectory: C:\Program Files\TData
RemoveDirectory: C:\Program Files\Birdsarah
RemoveDirectory: C:\Windows\system32\_TSpm
RemoveDirectory: C:\ProgramData\W
RemoveDirectory: C:\Users\flower\AppData\Local\Toolrain
RemoveDirectory: C:\Users\flower\AppData\Roaming\eCyber
RemoveDirectory: C:\Users\flower\AppData\Local\Birdsarah
RemoveDirectory: C:\Program Files\SFK
RemoveDirectory: C:\ProgramData\IwinpI
RemoveDirectory: C:\Windows\system32\_tWm
RemoveDirectory: C:\Program Files\WinZipper
RemoveDirectory: C:\Users\flower\AppData\Roaming\WinZiper
RemoveDirectory: C:\Users\flower\AppData\Roaming\TSv
RemoveDirectory: C:\Program Files\yesbnd
C:\ProgramData\Ament.ini
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks\Cossacks - EW.lnk
ShortcutWithArgument: C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files\Toolrain\Application\chrome.exe (Google Inc.) -> C:\Program Files\Google\Chrome\Application\chrome.exe
ShortcutWithArgument: C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\1bd7cef869b57013\Birdsarah.lnk -> C:\Program Files\Toolrain\Application\chrome.exe (Google Inc.) -> --profile-directory=ChromeDefaultData
C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\1bd7cef869b57013\Birdsarah.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\5d696d521de238c3\Google Chrome.lnk
C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk
C:\Users\flower\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk
C:\Users\flower\AppData\Local\Microsoft\Windows\GameExplorer\{0CA77E57-6F12-4073-9893-D7FB4763D252}\SupportTasks\0\Więcej gier od firmy Microsoft.lnk
C:\Users\flower\AppData\Local\Microsoft\Windows\GameExplorer\{0CA77E57-6F12-4073-9893-D7FB4763D252}\SupportTasks\1\Pomoc techniczna.lnk
C:\Users\flower\AppData\Local\Microsoft\Windows\GameExplorer\{82FCF0E1-87D5-479A-99D8-D57B74949DC1}\SupportTasks\0\Więcej gier od firmy Microsoft.lnk
C:\Users\flower\AppData\Local\Microsoft\Windows\GameExplorer\{82FCF0E1-87D5-479A-99D8-D57B74949DC1}\SupportTasks\1\Pomoc techniczna.lnk
Task: {E7D74D11-DFB8-443A-A4C5-6902B56B4FDA} - System32\Tasks\ToolrainUpdateTaskMachineUA => C:\Program Files\Toolrain\Update\ToolrainUpdate.exe [2016-06-28] () <==== UWAGA
Task: {B8DD29FD-DAC2-4DE1-898A-645BCEC8EE09} - System32\Tasks\{079291FA-C1DE-4BF9-8EE6-333EB93931CB} => pcalua.exe -a C:\Windows\system32\pcwrun.exe -c "C:\Program Files\Novatel Wireless\MobiLink3\MobiLink3.exe"
Task: {874150DE-87F6-4106-BA3D-30DC7640113C} - System32\Tasks\Sorawardanagck Manager => C:\Program Files\Sorawardanagck\SorawardanagckmanagerTsk.exe [2016-05-10] () <==== UWAGA
Task: {5A439439-4E95-428F-8FF4-24E363C025E7} - System32\Tasks\ToolrainUpdateTaskMachineCore => C:\Program Files\Toolrain\Update\ToolrainUpdate.exe [2016-06-28] () <==== UWAGA
Task: {28FBB98B-FDB5-4FB8-BC94-D4864E049806} - System32\Tasks\BirdsarahUpdateTaskMachineUA => C:\Program Files\Birdsarah\Update\BirdsarahUpdate.exe [2016-06-23] () <==== UWAGA
Task: {3D144361-6875-48DD-84D2-60DB2CF965DF} - System32\Tasks\Browser Updater Task(Core) => C:\Program Files\TXQQBrowser\Update\79667643458BB9779B58EFADD7956111\Update\BrowserUpdate.exe [2016-04-25] (Tencent) <==== UWAGA
Task: {3DF43766-1CBB-45F6-9A1C-5902C40ACE8A} - System32\Tasks\BirdsarahUpdateTaskMachineCore => C:\Program Files\Birdsarah\Update\BirdsarahUpdate.exe [2016-06-23] () <==== UWAGA
HKLM\...\Run: [] => [X]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-277916205-3838748793-3997461421-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-277916205-3838748793-3997461421-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
CHR HomePage: ChromeDefaultData -> hxxp://www.yessearches.com/?mode=loadm&ptid=imm&uid=616FBA9126A55FE79631767EB75F0B03&v=20160510&ts=AHEqAXYqBH0oBU..
CHR StartupUrls: ChromeDefaultData -> "hxxp://www.yessearches.com/?mode=loadm&ptid=imm&uid=616FBA9126A55FE79631767EB75F0B03&v=20160510&ts=AHEqAXYqBH0oBU.."
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.yessearches.com/chrome.php?q={searchTerms}&ts=AHEqAXYqBH0oBU..&v=20160510&uid=616FBA9126A55FE79631767EB75F0B03&ptid=imm&mode=loadm
CHR DefaultSearchKeyword: ChromeDefaultData -> yessearches
OPR StartupUrls: "hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T"
R2 BirdsarahP; C:\ProgramData\Birdsarah\Birdsarah.exe [428416 2016-06-23] ()
S2 BirdsarahU; C:\Program Files\Birdsarah\Update\BirdsarahUpdate.exe [591744 2016-06-23] ()
S2 SorawardanagckmanagerSrv; C:\Program Files\Sorawardanagck\SorawardanagckmanagerSrv.exe [988280 2016-05-10] ()
R2 TDataSvr; C:\Program Files\TData\TData.exe [135880 2016-06-12] (TData.com)
R2 ToolrainP; C:\ProgramData\Toolrain\Toolrain.exe [424832 2016-06-28] ()
S2 ToolrainU; C:\Program Files\Toolrain\Update\ToolrainUpdate.exe [590208 2016-06-28] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-25] ()
C:\Windows\System32\DRIVERS\EsgScanner.sys
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
C:\Program Files\SSFK.exe
2016-06-23 13:07 - 2016-07-05 19:23 - 00000172 _____ C:\Users\Public\Documents\report.dat
2016-06-21 14:15 - 2016-06-21 14:15 - 00000072 _____ C:\Windows\system32\EN_14799456.html
2016-06-21 14:14 - 2016-06-21 14:14 - 00000072 _____ C:\Windows\system32\EN_14711502.html
2016-06-21 14:14 - 2016-06-21 14:14 - 00000072 _____ C:\Windows\system32\EN_14711143.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14585797.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14585422.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14580773.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14580493.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14568262.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14567841.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14566936.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14566530.html
2016-06-21 14:11 - 2016-06-21 14:11 - 00000072 _____ C:\Windows\system32\pl_14520697.html
2016-06-21 14:11 - 2016-06-21 14:11 - 00000072 _____ C:\Windows\system32\EN_14522023.html
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FL Studio 11.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Image-Line\More....lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War\Çŕďóńňčňü Ęŕçŕęč - Ńíîâŕ Âîéíŕ.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War\Óäŕëčňü Cossacks - Back To War.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War\Ęŕçŕęč - ReadMe.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War\Ęŕçŕęč - Đĺäŕęňîđ Ńöĺíŕđčĺâ Đóęîâîäńňâî.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks - Back To War\Ęŕçŕęč - Đĺäŕęňîđ Ńöĺíŕđčĺâ.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks\ReadMe.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cossacks
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: Unicode
>>Zapisz
Plik umieść w folderze C:\Users\flower\AppData\Local\temp\scoped_dir4476_26870
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

2) Użyj >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C"

 

3) Zrób nowe logi FRST.

Przed skanem zaznacz "Addition.txt" oraz "Shortcut.txt"
 

jessi

[flowerart]

Prosze logi

komputer chodzi o niebo lepiej dzięki wielkie.

Fixlog naprawa.txt

AdwCleanerS1.txt

[jessica]

Adw-Cleaner:

najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.

 

jessi