Wolno działąjący Internet, RAM 100%, Procesor 100%

[Comb0]

Witam, zauważyłem ze w moj komputer cały czas używa 100% swoich zasobów. Internet działa dziwnie wolniej.

 

Obowiązkowe logi w załączniku.

 

Pozdrawiam,

Szymek.

 

FRST.txt

Addition.txt

Shortcut.txt

[jessica]

Masz "chińczyków".

 

1) Użyj (o ile zechce w tej sytuacji działać!) >Adw-cleaner
najpierw kliknij na SKANUJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego "C".

 

2)

[Comb0]

@jessica Działanie komputera po skanie za pomocą ADW sie nie zmieniło.

Log w załączniku.

adwcleaner.txt

[jessica]

Otwórz Notatnik i wklej w nim:

 

FirewallRules: [{7D710421-C409-483E-B23E-5744BE87C8CF}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{E2C33170-E39C-4958-9B0A-428A638BF088}] => (Allow) C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe
FirewallRules: [{2F1CF8B5-4234-43AB-9BDF-AED57517601D}] => (Allow) C:\Program Files (x86)\GreatMaker\MaohaWiFi\MaohaWifiSvr.exe
RemoveDirectory: C:\Program Files (x86)\UCBrowser
RemoveDirectory: C:\Program Files (x86)\GreatMaker
RemoveDirectory: C:\Users\Szymek\AppData\Roaming\GowvePitpagf
RemoveDirectory: C:\Users\Szymek\AppData\Roaming\Geunfy
RemoveDirectory: C:\Users\Szymek\AppData\Roaming\Hemkajdoa
RemoveDirectory: C:\Program Files (x86)\Zerlucult
RemoveDirectory: C:\Program Files\żěŃą
RemoveDirectory: C:\Users\Szymek\AppData\LocalLow\Company
ShortcutWithArgument: C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> "hxxp://safesurfs.net/?ssid=1471867135&a=1078866&src=sh&uuid=3b72e03c-6e74-439a-bd5f-f9d297c18368"
Task: C:\Windows\Tasks\UCBrowserUpdater.job => C:\Program Files (x86)\UCBrowser\Application\update_task.exe <==== UWAGA
Task: {C046F846-F20B-49E2-9C87-92CAEFA0FE13} - System32\Tasks\UCBrowserUpdater => C:\Program Files (x86)\UCBrowser\Application\update_task.exe [2016-08-02] (UCWeb Inc) <==== UWAGA
Task: {CC81AB9E-A19D-4A28-863E-28789856C344} - System32\Tasks\Ghurcult Controls => C:\Program Files (x86)\Zerlucult\GhrCntqerpertainaterjeck.exe
Task: {F50549F2-6B64-4778-B0B9-2373DE001C2A} - System32\Tasks\{807F8D74-5FD5-40D6-9C09-296D5109C499} => pcalua.exe -a G:\DirectX\DXSetup.exe -d G:\DirectX
Task: {808CE240-E8AA-4A06-A8BD-62C98378AC20} - System32\Tasks\KuaiZip_Update => C:\Program Files\żěŃą\X86\Update.exe [2016-08-22] (Shanghai Guangle Network Technology Ltd
) <==== UWAGA
2016-04-26 14:24 - 2016-04-26 14:24 - 0000009 ____N () C:\Users\Szymek\AppData\Roaming\a.bat
2016-06-28 03:12 - 2016-06-28 03:12 - 0314434 ____N () C:\Users\Szymek\AppData\Roaming\EYapp.apk
2010-08-28 22:43 - 2010-08-28 22:43 - 0356009 ____N () C:\Users\Szymek\AppData\Roaming\fastboot.exe
2016-08-21 16:03 - 2016-07-25 22:03 - 0036379 ___SH () C:\Users\Szymek\AppData\Roaming\FMXCMZTdfGJETOQZhCa
2016-08-21 16:03 - 2016-07-01 10:34 - 0082432 ___SH () C:\Users\Szymek\AppData\Roaming\Keygen.exe
2016-08-21 16:04 - 2016-07-25 22:04 - 0828928 ___SH () C:\Users\Szymek\AppData\Roaming\KfiUCSFbYAeXdeLgTGIKG.cmd
2016-08-21 16:04 - 2016-04-06 05:22 - 0025486 ___SH () C:\Users\Szymek\AppData\Roaming\Loader.exe
2016-08-22 14:46 - 2016-07-01 11:19 - 8284704 _____ (深圳市伟创科技软件有限公司) C:\Users\Szymek\AppData\Roaming\MaoHaWiFiSetup_262.exe
2016-08-21 16:03 - 2016-07-25 22:03 - 0828928 ___SH () C:\Users\Szymek\AppData\Roaming\OQFPETVYIOcIgdeAFYWeG.cmd
2016-08-22 14:50 - 2016-08-22 14:51 - 7616340 _____ () C:\Users\Szymek\AppData\Roaming\setup.apk
2016-08-21 16:04 - 2016-07-25 22:04 - 0463376 ___SH () C:\Users\Szymek\AppData\Roaming\TCYUCPCgXcXS
2016-08-22 14:49 - 2016-07-05 07:58 - 9216000 _____ (eee) C:\Users\Szymek\AppData\Roaming\THREADAPP.exe
2016-08-21 16:03 - 2016-07-25 22:02 - 0463376 ___SH () C:\Users\Szymek\AppData\Roaming\UBAOUJJKYhEc
2016-08-21 16:04 - 2016-07-25 22:04 - 0036379 ___SH () C:\Users\Szymek\AppData\Roaming\WUGAKRLcYgXFdHSgJEX
2016-08-22 14:50 - 2016-08-22 14:51 - 0732869 _____ () C:\Users\Szymek\AppData\Roaming\xdo.zip
2016-08-22 14:41 - 2016-06-30 09:59 - 5267952 _____ () C:\Users\Szymek\AppData\Roaming\ziptool_wc-9025_setup.exe
2016-08-22 14:37 - 2016-08-22 14:40 - 00000000 ____D C:\Users\Szymek\AppData\Local\Tempfolder
2016-08-22 14:37 - 2016-08-22 14:37 - 00009082 _____ C:\Windows\System32\Tasks\Ghurcult Controls
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ___HD C:\Program Files (x86)\r2337DB
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ___HD C:\Program Files (x86)\54i4A0C
2016-06-29 15:03 - 2016-06-29 15:03 - 0000057 _____ () C:\ProgramData\Ament.ini
2016-08-22 14:49 - 2016-07-05 07:58 - 09216000 _____ (eee) C:\Users\Szymek\AppData\Roaming\THREADAPP.exe
2016-08-22 14:48 - 2016-08-22 14:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaohaWiFi
2016-08-22 14:46 - 2016-08-22 14:56 - 00000490 _____ C:\Windows\Tasks\UCBrowserUpdater.job
2016-08-22 14:46 - 2016-08-22 14:46 - 00003510 _____ C:\Windows\System32\Tasks\UCBrowserUpdater
2016-08-22 14:46 - 2016-07-01 11:19 - 08284704 _____ (深圳市伟创科技软件有限公司) C:\Users\Szymek\AppData\Roaming\MaoHaWiFiSetup_262.exe
2016-08-22 14:45 - 2016-08-22 14:46 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-08-22 14:45 - 2016-08-22 14:45 - 00001599 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-08-22 14:45 - 2016-08-22 14:45 - 00000000 ____D C:\Users\Szymek\AppData\Local\UCBrowser
2016-08-22 14:45 - 2016-08-22 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器
DeleteKey: HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes
DeleteKey: HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Softlink
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Kuaizip
2016-08-22 14:54 - 2016-08-22 14:54 - 00000000 ____D C:\Windows\system32\vyt
2016-08-22 14:50 - 2016-08-22 14:51 - 07616340 _____ C:\Users\Szymek\AppData\Roaming\setup.apk
2016-08-22 14:50 - 2016-08-22 14:51 - 00732869 _____ C:\Users\Szymek\AppData\Roaming\xdo.zip
2016-08-22 14:50 - 2016-08-22 14:50 - 00000000 ____D C:\Program Files\żěŃą
2016-08-22 14:49 - 2016-08-22 14:50 - 00003562 _____ C:\Windows\System32\Tasks\KuaiZip_Update
2016-08-22 14:49 - 2016-08-22 14:50 - 00000882 _____ C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\żěŃą.lnk
2016-08-22 14:49 - 2016-08-22 14:49 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
S1 UCGuard; system32\DRIVERS\ucguard.sys [X] <==== UWAGA
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92872 2016-08-22] (WinMount International Inc)
S2 Citdhwa; "C:\Users\Szymek\AppData\Roaming\AzigcWig\Geeswu.exe" -cms [X]
S2 GhrCntvakokvaqapy.exe; "C:\Program Files (x86)\Zerlucult\GhrCntvakokvaqapy.exe" {C25DA384-2010-45A4-A1ED-BFA540D4789B} {9DC74CD5-24EA-4ADE-9C42-608A8CE17116} [X]
R2 Viokdojvaf; C:\Users\Szymek\AppData\Roaming\Hemkajdoa\Hemkajdoa.exe [170496 2016-08-11] () [brak podpisu cyfrowego]
S2 KuaizipUpdateChecker; C:\Program Files\żěŃą\X86\kuaizipUpdateChecker.dll [219072 2016-08-22] ()
R2 Noije; C:\Users\Szymek\AppData\Roaming\Geunfy\Geunfy.exe [170496 2016-08-11] () [brak podpisu cyfrowego]
R2 Bokvunnu; C:\Users\Szymek\AppData\Roaming\GowvePitpagf\Lurzem.exe [121344 2016-08-11] () [brak podpisu cyfrowego]
FF user.js: detected! => C:\Users\Szymek\AppData\Roaming\Mozilla\Firefox\Profiles\igmkaogv.default\user.js [2016-08-22]
ManualProxies: 0hxxp://stoppblock.org/wpad.dat?c4a183707b1c1561ca2ad33dde5562a714879554
Tcpip\..\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{6bb4f047-2706-11e5-9bbe-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{b46bd732-d562-4bf7-8d9c-4f8a375af839}: [NameServer] 104.197.191.4
AutoConfigURL: [s-1-5-21-2393552708-3704467510-2414285713-1001] => hxxp://stoppblock.org/wpad.dat?c4a183707b1c1561ca2ad33dde5562a714879554
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Brak pliku
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} =>  Brak pliku
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Brak pliku
Startup: C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TCYUCPCgXcXSeOHU.cmd.lnk [2016-08-21]
ShortcutTarget: TCYUCPCgXcXSeOHU.cmd.lnk -> C:\Users\Szymek\AppData\Roaming\KfiUCSFbYAeXdeLgTGIKG.cmd ()
Startup: C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UBAOUJJKYhEceYCi.cmd.lnk [2016-08-21]
ShortcutTarget: UBAOUJJKYhEceYCi.cmd.lnk -> C:\Users\Szymek\AppData\Roaming\OQFPETVYIOcIgdeAFYWeG.cmd ()
GroupPolicyScripts: Ograniczenia <======= UWAGA
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaohaWiFi
C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\żěŃą.lnk
C:\Users\Szymek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\UC浏览器.lnk
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器\卸载UC浏览器.lnk -> C:\Program Files (x86)\UCBrowser\Application\Uninstall.exe (UCWeb Inc.) -> --uninstall --system-level
Reg: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /v PendingFileRenameOperations /t REG_MULTI_SZ /d "" /f
CMD: for %i in ("C:\Program Files\żěŃą\X86\*.dll") do regsvr32.exe /s /u %i
HOSTS:
EmptyTemp:

>>Menu Notatnika >> Plik >>
>>Zapisz jako >>
Nazwa pliku: fixlist
Zapisz jako typ: Dokumenty tekstowe
Kodowanie: UTF -8
>>Zapisz
Plik umieść w folderze C:\Users\Szymek\Desktop
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

Zrób nowe logi FRST.

przed skanem zaznacz: Additional.txt Shortcut.txt,

 

jessi