Trojan Ruskill Cyber tarcza ORANGE

[ropyl]

Witam, dzisiaj podczas próby uruchomienia jakiejkolwiek przeglądarki wyskoczyła mi Cyber tarcza ORANGE trojan.russkil.

Z tego co czytałem na waszych forach to jest to niby fałszywy alarm ale dla świętego spokoju chciałbym posprawdzać po logach czy jest ok.

czynności jakie wykonałem do tej pory to przeskanowanie Avastem(wykazal dwa zagrożenia które przeniosłem do kwarantanny Win32:PUP-gen[PUP]

, Win32Adware-DAP[Adw]), zmiana hasła w routerze (poniewaz avast pokazał że jest za słabe). Reset routera (po resecie routera w cyber tarczy Orange nadal wykazuje

ze jest ten Trojan).Dodaje logi do sprawdzeni

 

 

 

Shortcut.txt

Addition.txt

FRST.txt

GMER.txt

[jessica]

Tytułowej infekcji oczywiście nie ma.

 

1) Odinstaluj ten program:

Host App Service (HKU\S-1-5-21-3033687615-447380842-2545036991-1002\...\SweetLabs_AP) (Version: 0.269.8.114 - Pokki)

 

2) Otwórz Notatnik i wklej w nim:

 

ShortcutWithArgument: C:\Users\Katarzyna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\Users\Katarzyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\Users\Katarzyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\Users\Katarzyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\Users\Katarzyna\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
ShortcutWithArgument: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) -> hxxp://www.delta-homes.com/?type=sc&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
HKU\S-1-5-21-3033687615-447380842-2545036991-1002\...\RunOnce: [Application Restart #3] => C:\Users\Katarzyna\AppData\Local\SweetLabs App Platform\Engine\ServiceHostApp.exe [7873512 2016-11-16] (Pokki)
AppInit_DLLs: C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC64Loader.dll => Brak pliku
AppInit_DLLs-x32: C:\PROGRA~2\LenovoBrowserGuard\LenovoBrowserGuard\bin\SPVC32Loader.dll => Brak pliku
RemoveDirectory: C:\Users\Katarzyna\AppData\Local\SweetLabs App Platform
HKU\S-1-5-21-3033687615-447380842-2545036991-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
HKU\S-1-5-21-3033687615-447380842-2545036991-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
URLSearchHook: [s-1-5-21-3033687615-447380842-2545036991-1001] UWAGA => Brak domyślnego URLSearchHook
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420192333&from=cor&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420192333&from=cor&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.delta-homes.com/?type=hp&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420192333&from=cor&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://isearch.omiga-plus.com/web/?type=ds&ts=1420192333&from=cor&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
HKU\S-1-5-21-3033687615-447380842-2545036991-1002\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.delta-homes.com/web/?type=ds&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3033687615-447380842-2545036991-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3033687615-447380842-2545036991-1002 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://isearch.omiga-plus.com/?type=sc&ts=1420192333&from=cor&uid=SanDiskXSDSSDHII240G_144461401830
CHR HomePage: Default -> hxxp://www.delta-homes.com/?type=hp&ts=1431684348&z=3bf5ae31244c3051064cf6ag6z1c5gaqbb7z2c6w9o&from=wpm05153&uid=SanDiskXSDSSDHII240G_144461401830
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST.exe
Uruchom FRST i kliknij przycisk Fix (NAPRAW).

 

jessi

[ropyl]

Wszystko zrobiłem zgodnie z wasza instrukcaja. Dziekuje za szybką pomoc