Cmd wyłącza się po sekundzie

[Dawidoz123]

Witam mam problem związany z wierszem poleceń cmd, a mianowicie kiedy odpalam wiersz poleceń wyłącza się on po sekundzie. W załączniku przesyłam skan FRST, addition. txt i shortcut.txt.

Shortcut.txt Addition.txt FRST.txt

[jessica]

Jest infekcja SOUNDMIXER!

 

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

Spoiler

HKU\S-1-5-21-3563840331-3337734302-301689356-1000\...\Winlogon: [Shell] %comspec% <==== UWAGA
HKU\S-1-5-21-3563840331-3337734302-301689356-1000\...\Command Processor: @mode 20,5 & tasklist /FI "IMAGENAME eq SoundMixer.exe" 2>NUL | find /I /N "SoundMixer.exe">NUL && exit & if exist "C:\Users\Pc\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" ( start /MIN "" "C:\Users\Pc\AppData\Roaming\Microsoft\SoundMixer\SoundMixer.exe" & tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) else ( tasklist /FI "IMAGENAME eq explorer.exe" 2>NUL | find /I /N "explorer.exe">NUL && exit & explorer.exe & exit ) <==== UWAGA
RemoveDirectory: C:\Users\Pc\AppData\Roaming\Microsoft\SoundMixer
HKLM\...\regfile\shell\open\command: "regedit.exe" "%1" <==== UWAGA
FirewallRules: [{0835E60F-B79B-4319-A9A6-08A87D911265}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe => Brak pliku
FirewallRules: [{5A0AE15B-CB0F-44C2-A839-6D42DAAF517A}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe => Brak pliku
FirewallRules: [{0A0D3EB5-3593-4790-953F-47424A5420CC}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe => Brak pliku
FirewallRules: [{FA98E9A9-52DD-474F-971C-82F147B31835}] => (Allow) C:\Program Files (x86)\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe => Brak pliku
FirewallRules: [{B6D35671-649B-4135-A956-1F016EFF8CD7}] => (Block) C:\users\pc\appdata\local\blitz\app-1.6.14\blitz.exe => Brak pliku
FirewallRules: [{8DDCBE98-E9EB-4B53-B5AF-15088F7F63FC}] => (Block) C:\users\pc\appdata\local\blitz\app-1.6.14\blitz.exe => Brak pliku
FirewallRules: [{BBA66E4C-968E-4DE5-8F8A-C7A9158B2980}] => (Block) C:\program files\java\jre1.8.0_241\bin\java.exe => Brak pliku
FirewallRules: [{098FD574-2A16-4026-B81D-1D39C33BF4E6}] => (Block) C:\program files\java\jre1.8.0_241\bin\java.exe => Brak pliku
S3 AsrAutoChkUpdDrv; \??\C:\Windows\SysWOW64\Drivers\AsrAutoChkUpdDrv.sys [X]
S3 BstkDrv; \??\C:\Program Files (x86)\BlueStacks\BstkDrv.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
S3 mracdrv; C:\Windows\System32\drivers\mracdrv.sys [9623160 2018-05-10] (Mail.Ru LLC -> LLC Mail.Ru)
S3 mracsvc; C:\Windows\System32\mracsvc.exe [10395248 2018-05-10] (Mail.Ru LLC -> LLC Mail.Ru)
C:\Windows\System32\mracsvc.exe
C:\Windows\System32\drivers\mracdrv.sys
S2 cFosSpeedS; "D:\Program Files (x86)\spd.exe" -service [X]
S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [X]
CHR HomePage: Profile 1 -> hxxps://mail.ru/cnt/10445?gp=811570
CHR StartupUrls: Profile 1 -> "hxxps://mail.ru/cnt/10445?gp=811570"
CHR HomePage: Default -> hxxp://www.nav-pl.com/
CHR StartupUrls: Default -> "hxxp://www.nav-pl.com/"
CHR NewTab: Default ->  Not-active:"chrome-extension://ncgedbgoggcobigaimlhdmmllhlbmlnj/newtabproduct.html", Not-active:"chrome-extension://fijccpiopmigdnmffiikljcnbmnflgec/product.html"
FF Homepage: Mozilla\Firefox\Profiles\7kpldkdr.default -> hxxp://www.nav-pl.com/
SearchScopes: HKU\S-1-5-21-3563840331-3337734302-301689356-1000 -> DefaultScope {50F45036-8D44-40C3-8EF4-F97AB6029A83} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3563840331-3337734302-301689356-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3563840331-3337734302-301689356-1000 -> {50F45036-8D44-40C3-8EF4-F97AB6029A83} URL = hxxp://www.nav-pl.com/search?q={searchTerms}
Task: {CB60B41E-6B8A-437C-9E50-2FB534DABFF3} - System32\Tasks\ByteFence => C:\Program Files\ByteFence\ByteFence.exe <==== UWAGA
C:\Program Files\ByteFence
Task: {5E504A07-F593-4F09-AA11-E9C85A0506F4} - System32\Tasks\{6B9AA344-7A2B-44EA-A22A-F7AE1B0C96C0} => C:\Windows\system32\pcalua.exe -a C:\Users\Pc\AppData\Local\Temp\jre-8u171-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== UWAGA
Task: {43CC78EA-18ED-4D17-BDDF-CA955BAC55E2} - System32\Tasks\{8A05072A-CDFC-4501-85EB-86C9BDA2D8D4} => C:\Windows\system32\pcalua.exe -a C:\Users\Pc\AppData\Local\Temp\jre-8u251-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1 <==== UWAGA
Task: {266B2DC4-B3CF-4175-9336-894DC84A22C5} - System32\Tasks\ByteFence Scan => C:\Program Files\ByteFence\ByteFence.exe <==== UWAGA
GroupPolicy: Ograniczenia ? <==== UWAGA
FF HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL+S.
W FRST kliknij na Fix (NAPRAW).

 

Napisz, czy problem znikł?

 

jessi

[Dawidoz123]

Tak działa dziękuje Ci, bo od kilku miesięcy starałem się poradzić z tym problemem. Bardzo dziękuję.