AVG wykrywa Win32:Malware-gen

[Roinoss]

Cześć,

AVG zaczął mi co chwilę (co kilkanaście minut) wykrywać Win32:Malware-gen (zrzut ekranu komunikatu w załączniku) łączącym się z linkiem url wyglądającym na należący do Microsoftu. Wirus czy fałszywy alarm?

Skanowanie systemu AVG nic nie wykrywa.

Z innych dziwnych rzeczy przestało mi działać wyszukiwanie w Windowsie 11 (nie uruchamiałem urządzenia ponownie od zauważenia problemu).

 

FRST.txt Addition.txt Shortcut.txt

[jessica]

W logach nie ma niczego podejrzanego.

 

Kosmetyka:

Uruchom FRST.
Skopiuj to poniższe: (ale nigdzie nie wklejaj tego!)

Spoiler

START::
HKLM\Software\...\Authentication\Credential Providers: [{C885AA15-1764-4293-B82A-0586ADD46B35}] ->
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWA
Task: {185ED804-4A21-4308-AC3E-E76E363DA46E} - System32\Tasks\S-1-5-21-185452805-796166148-205060070-1001\DataSenseLiveTileTask => C:\WINDOWS\System32\DataUsageLiveTileTask.exe (Brak pliku)
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\WINDOWS\System32\MbaeParserTask.exe (Brak pliku)
Task: {E4488EC8-41E1-49BE-B4E0-6CFA9F6DDCC8} - System32\Tasks\{5E9C47D5-C2A3-4B5B-9646-23F9F5362F1A} => C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\MTGAInstaller_1.0.95.809059.exe -> /i "C:\Users\User1Renamed\AppData\Local\Temp\MTGAinstall\MTGAInstaller.msi" AI_SETUPEXEPATH="C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\MTGAInstaller_1.0.95.809059.exe" SETUPEXEDIR="C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\" ADDLOCAL=MainFeature,MicrosoftVisualC ALLUSERS="1" PRIMARYFOLDER="APPDIR" ROOTDRIVE="D:\" AI_PREREQFILES="C:\Users\User1Renamed\AppData\Roaming\Wizards of the Coast\MTGA Launcher\prerequisites\Visual C++ Redistributable for Visual Studio 2015-2019\VC_redist.x64_14_29_30135.exe" AI_PREREQDIRS="C:\Users\User1Renamed\AppData\Roaming" AI_MISSING_PREREQS="Visual C++ Redistributable for Visual Studio 2017 x64" AI_SETUPEXEPATH="C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\MTGAInstaller_1.0.95.809059.exe" SETUPEXEDIR="C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\" AI_INSTALL="1" BIPROCESSTIME="2021-11-11T18:09:14.6034237Z" TARGETLOCKED="TRUE" TARGETDIR="D:\" APPDIR="C:\Program Files\Wizards of the Coast\MTGA\" AI_SETUPEXEPATH_ORIGINAL="C:\Program Files\Wizards of the Coast\MTGA\MTGALauncher\Updates\MTGAInstaller_1.0.95.809059.exe"
Task: {F1409D35-53C3-463E-A4F9-91062595CDEB} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe do-task "308046B0AF4A39CB"
S4 WacHidRouterPro; \SystemRoot\System32\drivers\wachidrouter.sys [X]
S4 wacomrouterfilter; \SystemRoot\System32\drivers\wacomrouterfilter.sys [X]
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
FirewallRules: [{B6E73FA0-93EA-4E64-8EF8-ABFF4C700A2A}] => (Allow) C:\Program Files\Common Files\McAfee\MMSSHost\MMSSHost.exe => Brak pliku
FirewallRules: [{489722DA-5E67-4CDE-A964-D8E43F92D7CF}] => (Allow) C:\Program Files (x86)\Common Files\Mcafee\MMSSHost\MMSSHost.exe => Brak pliku
FirewallRules: [{2EF9512D-EE6D-4819-8547-6D8F9CCCBD43}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Brak pliku
FirewallRules: [{AF47F931-BF40-4266-9038-1D07934E7AA7}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe => Brak pliku
FirewallRules: [{728A8F2B-3F43-443F-B737-F0FD7D049960}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Brak pliku
FirewallRules: [{FCBA8B8F-FF36-403D-AADC-F509A1EC9397}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe => Brak pliku
FirewallRules: [UDP Query User{3A91D687-00C9-4CF9-9526-99950DAD4A2E}C:\program files (x86)\neverwinter_en\neverwinter\live\crashreporterx64.exe] => (Allow) C:\program files (x86)\neverwinter_en\neverwinter\live\crashreporterx64.exe => Brak pliku
FirewallRules: [TCP Query User{D0E1D03B-570D-4851-8204-291553D8BBF9}C:\program files (x86)\neverwinter_en\neverwinter\live\crashreporterx64.exe] => (Allow) C:\program files (x86)\neverwinter_en\neverwinter\live\crashreporterx64.exe => Brak pliku
FirewallRules: [UDP Query User{F8C0F9B9-9E13-4EA0-B945-11238C9473A8}C:\program files (x86)\neverwinter_en\neverwinter\live\x64\gameclient.exe] => (Allow) C:\program files (x86)\neverwinter_en\neverwinter\live\x64\gameclient.exe => Brak pliku
FirewallRules: [TCP Query User{D3165214-C8FC-407D-8DE7-3F73F65D56FB}C:\program files (x86)\neverwinter_en\neverwinter\live\x64\gameclient.exe] => (Allow) C:\program files (x86)\neverwinter_en\neverwinter\live\x64\gameclient.exe => Brak pliku
FirewallRules: [{D7FE6C4F-2B70-4AC2-AA2D-BCA47E9EAD72}] => (Allow) C:\Users\User1Renamed\AppData\Roaming\Zoom\bin\Zoom.exe => Brak pliku
FirewallRules: [{FCA27A2C-1A7E-4887-A225-513FA31DDE29}] => (Allow) C:\Users\User1Renamed\AppData\Roaming\Zoom\bin\airhost.exe => Brak pliku
FirewallRules: [{FDD7F93B-2123-4417-9DC3-33583FD3DCE1}] => (Allow) C:\Users\User1Renamed\AppData\Roaming\Zoom\bin\airhost.exe => Brak pliku
 Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:
END::

W FRST kliknij na Fix (NAPRAW).

 

jessi