cmd

[zaremix]

cmd wyłącza się po sekundzie. oto logi z frst

FRST.txt Shortcut.txt Addition.txt

[jessica]

Jest infekcja SOUNDMODULE - (podobna do infekcji SOUNDMIXER)

 

1) Odinstaluj program

Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.8.2 - Reimage) <==== ATTENTION

 

2) Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

Spoiler

HKU\S-1-5-21-1694832792-2990361293-375382946-1000\...\Winlogon: [Shell] %comspec% <==== ATTENTION
HKU\S-1-5-21-1694832792-2990361293-375382946-1000\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundModule.exe" 2>NUL | find /I /N "SoundModule.exe">NUL && exit & if exist "C:\Users\Kruku\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe" ( start /MIN "" "C:\Users\Kruku\AppData\Roaming\Microsoft\SoundModule\SoundModule.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== ATTENTION
RemoveDirectory: C:\Users\Kruku\AppData\Roaming\Microsoft\SoundModule
KLM\...\Policies\Explorer: [HideSCAHealth] 1
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
Task: {7ABEA7F4-2230-45DC-BD78-351DDD6AB6BD} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe <==== ATTENTION
RemoveDirectory: C:\Program Files\Reimage
Task: {ED6564BF-B930-4D60-A6E5-2E485BF4ED9A} - System32\Tasks\Microsoft\Windows\Application Experience\StartupCheckLibrary => rundll32.exe StartupCheckLibrary.dll,DllMainRunLibrary <==== ATTENTION
Task: {F5C8A80E-100E-4D8D-BE05-F9C5A9701D61} - System32\Tasks\Microsoft\Windows\WDI\SrvHost => rundll32.exe winscomrssrv.dll,SrvMainHost <==== ATTENTION
S2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [X]
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
HKU\S-1-5-21-1694832792-2990361293-375382946-1000\...\Run: [GalaxyClient] => [X]
HKLM\Software\...\Authentication\Credential Providers: [{503739d0-4c5e-4cfd-b3ba-d881334f0df2}] ->
Task: {2693C559-4A55-4F6A-8856-6A2DFBC5345A} - System32\Tasks\{E3C2C144-E60D-4DC6-81EB-FA3167829373} => C:\Windows\system32\pcalua.exe -a D:\wake_of_gods358\wog358f.part01.exe -d D:\wake_of_gods358
Task: {471DE71C-5734-4C47-BE23-D5C31CC6A2D1} - System32\Tasks\{659DA1BB-291F-4646-861C-20C4B32A26F8} => C:\Windows\system32\pcalua.exe -a D:\Downloads\epson374932eu.exe -d D:\Downloads
FirewallRules: [{2AB663D8-4A6C-4FD9-991C-1545BA76E7EE}] => (Allow) D:\steam\steamapps\common\F1 2010\f1_2010.exe No File
FirewallRules: [{4BF4FB76-D6A0-4B31-B62F-D83A1EEF6CA4}] => (Allow) D:\steam\steamapps\common\F1 2010\f1_2010.exe No File
FirewallRules: [{23CF1A0B-ED5A-4BB7-A8BF-A80225996C3B}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{8CE1FD4F-7444-4CED-A510-1C34D3863049}] => (Allow) D:\steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{F20C8A1B-8F47-4D6A-8752-0E93A3994A44}] => (Allow) D:\steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{27337B18-8EEB-4F60-A2F5-0AC39933700B}] => (Allow) D:\steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{D6D7AFB9-B2CE-47F2-8C38-0E50FA48DD09}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's Ghost Recon Future Soldier\Future Soldier DX9.exe No File
FirewallRules: [{F506BC99-0FF1-4CCE-99F9-EBE20B3475EF}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's Ghost Recon Future Soldier\Future Soldier DX9.exe No File
FirewallRules: [{8EC5B132-50BD-4233-A7B8-4C50E9A52D2F}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's Ghost Recon Future Soldier\Future Soldier DX11.exe No File
FirewallRules: [{66CCE385-9E50-40D9-B610-4B718329A787}] => (Allow) C:\Program Files (x86)\Ubisoft\Tom Clancy's Ghost Recon Future Soldier\Future Soldier DX11.exe No File
FirewallRules: [{C72B9E6B-4777-4548-9426-347E222B38A8}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
FirewallRules: [{186F5CE4-1180-4B76-9EDF-DBBCBAB152F1}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe No File
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Help & Support.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Privacy Policy.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Reimage Repair.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Run in safe mode.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Terms of Use.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Uninstall Instructions.lnk
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair\Uninstall.lnk
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S.
W FRST kliknij na Fix (NAPRAW).

 

Po tym usuwaniu problem powinien zniknąć.

 

jessi

[zaremix]

podziałało, dziękuje