Uruchamianie przeglądarki przy starcie Win10 z reklamami

[www12]

Witam. Od jakiegoś czasu przy uruchomieniu komputera czy logowaniu na inne konto użytkownika uruchamia się przeglądarka z reklamami. Załączam logi z FRST.

Addition_03-04-2021 13.54.07.txt FRST_03-04-2021 13.54.07.txt

[jessica]

Jest infekcja

 

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.
Otworzy się Notatnik - wklej do niego:

Spoiler

HKU\S-1-5-21-1070265277-2710048808-566119981-1001\...\Run: [vichm] => explorer.exe hxxp://exinariuminix.info <==== UWAGA
Task: {1F6E0942-4B6F-4D04-AC0B-5E861257FCDC} - System32\Tasks\vichm => cmd.exe /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v vichm /t REG_SZ /d "explorer.exe http://exinariuminix.info" <==== UWAGA
RemoveDirectory: C:\Users\vichm\Downloads\FRST-OlderVersion
FirewallRules: [{EFA9992C-9462-4172-9F35-B5BD68BD5149}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe => Brak pliku
FirewallRules: [{9314785D-029A-4B0E-8485-F3F8F8B964B3}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\The Witcher 3\bin\x64\witcher3.exe => Brak pliku
FirewallRules: [{438EC783-A9D1-4C5D-A678-94B70FE64C12}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => Brak pliku
FirewallRules: [{B788CB88-4454-4D20-AAD6-0B77DC9A0F98}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => Brak pliku
FirewallRules: [{29863A0C-A22B-46E2-A5CF-D1F1C4B55F96}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe => Brak pliku
FirewallRules: [{A1CF34E2-C9ED-4CA2-9170-D16A11C1CDD0}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War WARHAMMER\launcher\launcher.exe => Brak pliku
FirewallRules: [{775DAAAC-4207-473C-A6EC-07122C5695B4}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => Brak pliku
FirewallRules: [{A7806398-4149-4FC4-98E6-D08579BFCA8C}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe => Brak pliku
FirewallRules: [{598A10F0-30DE-4729-A794-E6D1F70D4CF1}] => (Allow) C:\Program Files (x86)\World_of_Warships\WoWSLauncher.exe => Brak pliku
FirewallRules: [{1DC8085F-F479-4DBE-853A-30DB9FF67D81}] => (Allow) C:\Program Files (x86)\World_of_Warships\WoWSLauncher.exe => Brak pliku
FirewallRules: [{116237E2-D230-4535-AA7E-17B9CEC595ED}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => Brak pliku
FirewallRules: [{5588C6B4-FD4E-40A0-A2F7-4637A41D4C81}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe => Brak pliku
FirewallRules: [{883896B9-E412-4B9D-BFA5-01300DB9D1BD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe => Brak pliku
FirewallRules: [{C52F7117-BFBC-4D8B-822E-6AB8799BB64D}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Dragon Age Ultimate Edition\bin_ship\DAUpdaterSvc.Service.exe => Brak pliku
FirewallRules: [{79DE65A3-4AF7-4219-86DC-399B4B7E1FFF}] => (Allow) C:\Program Files (x86)\Microsoft Office\root\Office16\outlook.exe => Brak pliku
FirewallRules: [{5C0549EA-0128-4BEB-AFF0-84A27EFA170C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe => Brak pliku
FirewallRules: [{C8FA6C3B-CFCD-440B-8ED9-3C9EC4E134F1}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Total War Rome II\launcher\launcher.exe => Brak pliku
FirewallRules: [{1A54F247-19AD-4BB9-AC98-393A7F54CAFE}] => (Allow) D:\gtaV\steamapps\common\Grand Theft Auto V\PlayGTAV.exe => Brak pliku
FirewallRules: [{5585874D-0BD3-4630-BCF3-E8ACA784F38F}] => (Allow) D:\gtaV\steamapps\common\Grand Theft Auto V\PlayGTAV.exe => Brak pliku
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [Brak pliku]
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

Na klawiaturze naciśnij jednocześnie CTRL + S.
W FRST kliknij na Fix (NAPRAW).

 

Napisz, czy problem znikł?

 

jessi

[www12]

Pomogło :) Dzięki wielkie, Wesołych Świąt :)