Prośba o analizę logów FRST.

[Suchy86CK]

Czy mogę prosić o przeanalizowanie logów, prawdopodobnie na jednym z dwóch urządzeń znalazł się trojan, przy pomocy, którego pozyskano hasła do Facebooka i Instagrama.

 

1 urządzenie

FRST.txt

Addition.txt

 

2 urządzenie

FRST.txt

Addition.txt

 

 

[Illidan]

Zamieść jeszcze logi "Shorcut.txt". Będzie komplet ,to przejrzę.

[Suchy86CK]

Wrzucam od nowa wszystkie z 1 komputera. Z góry serdecznie dziękuję.

 

Shortcut.txtFRST.txtAddition.txt

[Illidan]

Uruchom FRST. 
Skopiuj zawartość podaną niżej i nigdzie nie wklejaj-FRST sam znajdzie "fixlist" w schowku systemowym.

 

Spoiler

START::
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{041F9391-C79D-44EE-AA4E-AF4E029C4B47}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.112\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{1F9E0710-2073-435F-9C1B-F29946205947}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.152\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{2919A592-BF5E-4AF5-A658-84454D70841E}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.202\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{3BC2EF70-3830-43FC-9009-029942FD2DCE}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.372\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{46406D82-6EC0-47CC-8A75-1F33C6DEDBBE}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.35.442\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{540C17A8-04F2-4B66-95D7-B2FEF9A19B54}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.35.422\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{5D44759C-CF3F-433D-9EA0-267E45577C77}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.212\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{69545769-8D02-4B07-A481-AD374CD8D5D1}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.132\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{6D264B70-DA18-401D-910C-B202D89670C6}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.32\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{75399D28-E622-4973-8752-BC0F7DC47AF3}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.122\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{84EB3779-151B-4C71-AEF0-A0FEE9481401}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.35.342\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{85D8EE2F-794F-41F0-BB03-49D56A23BEF4}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.372\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{8B480070-D37D-4090-A063-7A429F849652}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.92\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{8D422533-936A-4A82-B15C-BD5319AB0026}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.332\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{AE9899FA-E21F-4D91-BD1F-59BC10E56CA1}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.293\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{B9C751AA-D9CF-4E09-A270-E5BBD2194F83}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.352\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{BE5C2E39-090F-46A2-AFAA-47540743B4FE}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.102\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{CA07EE63-A212-4373-AE82-FBF92FCA8DCC}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.242\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{CA8FA699-91CD-412F-9D13-9B1222F4370E}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.82\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{CA919489-0396-4164-A6E7-94CDED45A707}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.52\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{DA06AAE8-5748-4509-850F-17AA522F8372}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.272\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{DEDF773D-E27B-485E-8E7D-85C5B0EB5A67}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.72\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{E4949BE6-C9FF-4AFA-8672-6127D857418B}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.312\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.372\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{E9E7529D-7F09-410B-AF2A-CC154473B19C}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.35.452\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{ED0BC9DB-3CE6-49E5-9B2F-590DCEF8C016}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.36.343\psuser_64.dll => Brak pliku
CustomCLSID: HKU\S-1-5-21-2460985897-3955756783-2422704168-1001_Classes\CLSID\{EF076C91-DC9E-43E3-84ED-3D219E065A4F}\InprocServer32 -> C:\Users\Lenovo\AppData\Local\Google\Update\1.3.35.302\psuser_64.dll => Brak pliku
HKU\S-1-5-21-2460985897-3955756783-2422704168-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus17win10.msn.com/?pc=ASTE
HKU\S-1-5-21-2460985897-3955756783-2422704168-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus17win10.msn.com/?pc=ASTE
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
Task: {CCDFC0B8-01A3-4E74-A820-4F13F51D269E} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => %SystemRoot%\System32\MbaeParserTask.exe  (Brak pliku)
Task: {C97D80F0-1A42-49F0-8879-24D7AD316D5C} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\MusUx_LogonUpdateResults => %systemroot%\system32\MusNotification.exe  LogonUpdateResults (Brak pliku)
Task: {6ECC17BA-2F21-4D1D-A937-AF5B7E29ED7A} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot => %systemroot%\system32\MusNotification.exe  ForcedReboot (Brak pliku)
Task: {35F57237-4EFC-460D-BA36-C7268C4DCFD7} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_AC => %systemroot%\system32\MusNotification.exe  /RunOnAC ReadyToReboot (Brak pliku)
Task: {3E84D387-2BD7-4405-9FF2-8B9B8AC8CCB3} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Reboot_Battery => %systemroot%\system32\MusNotification.exe  /RunOnBattery ReadyToReboot (Brak pliku)
Task: {7D993353-1A89-4BAE-93EC-DCDB7F64FB9F} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_Broker_Display => %systemroot%\system32\MusNotification.exe  Display (Brak pliku)
Task: {E0F10DCF-44AD-40E8-9370-FB5DA59F93FB} - System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker => %systemroot%\system32\MusNotification.exe  (Brak pliku)
HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3: <==== UWAGA (Ograniczenia - Zones)
S1 WinSetupMon; system32\DRIVERS\WinSetupMon.sys [X]
C:\Users\Lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office\WPS Office Tools\Uninstall WPS Office.lnk
C:\Users\Lenovo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WPS Office\WPS Office Tools\WPS Office Configuration Tools.lnk
C:\Users\Lenovo\AppData\Roaming\kingsoft\office6\mui\11.2.0.10351\pl_PL.lnk
C:\Users\Lenovo\AppData\Roaming\kingsoft\office6\mui\11.2.0.10323\pl_PL.lnk
C:\Users\Lenovo\AppData\Roaming\kingsoft\office6\mui\11.2.0.10294\pl_PL.lnk
CreateRestorePoint:
EmptyTemp:
END::

 

Fixlist przeznaczona tylko dla autora tematu!

W FRST kliknij opcję "Napraw" (Fix). Pokaż raport  "fixlog.txt", który otrzymasz po restarcie komputera. Pobierz też darmowy programik "AdwCleaner". Przeskanuj nim system, usuń jeśli coś znajdzie i pokaż raport z usuwania. Dodatkowo pobierz program "Malwaresbytes" i także zrób skanowanie i usuwanie nim, jeśli będą wykrycia i pokaż log z usuwania.