Infekcja "skrótowa" to "pikuś" w porównaniu do drugiej infekcji, którą masz!
1) Wejdź w Tryb Awaryjny (F8 przed startem Systemu).
2) Otwórz Notatnik i wklej w nim:
C:\ProgramData\mspecft.exe
HKU\S-1-5-21-89879547-2904280558-3561642671-1001\...\CurrentVersion\Windows: [Load] C:\ProgramData\mspecft.exe <===== ATTENTION
G:\ \oob3g.4hqsuuk.ggo.ppi.smcbk.x6244.025uqcb.ga9ihjv
C:\Users\All Users\mspecft.exe
G:\Removable Drive (4GB).lnk
C:\Program Files\1CKR5JX6.exe
C:\Program Files\FUWY0EXS.exe
C:\Program Files\KG0K62SI.exe
R2 VSSS; C:\Users\Agnieszka\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe [101369984 2015-06-25] (Microsoft Corporation) [File not signed] <==== ATTENTION
C:\Users\Agnieszka\AppData\Roaming\Microsoft\SystemCertificates\VSSVC.exe
C:\Windows\Minidump\*.dmp
Reg: reg delete "HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes" /f
Reg: reg delete "HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes" /f
S3 X6va005; \??\C:\Users\AGNIES~1\AppData\Local\Temp\00541C2.tmp [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbfake; system32\DRIVERS\ewusbfake.sys [X]
R4 KProcessHacker2; \??\C:\Program Files\kprocesshacker.sys [X]
CMD: attrib /d /s -s -h G:\*
FF SearchEngineOrder.1: Ask Search
Toolbar: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=2&src=sp&cf=28a99aa0-412e-11e1-bcad-20cf305fb65e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=2&src=sp&cf=28a99aa0-412e-11e1-bcad-20cf305fb65e&q={searchTerms}
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> {5EAEF6B9-3133-44D6-B001-7482DBD3B7FC} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=&apn_dtid=OSJ000&apn_uid=A3C0E962-F485-4527-A5F7-936550EFAE66&apn_sauid=5E4CB263-D6BE-4066-A515-5FF07619DB78
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={6B6F7DD8-0EAA-4390-AEE4-CB0188D9432C}&mid=&lang=&ds=&pr=&d=&v=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1001 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
SearchScopes: HKU\S-1-5-21-89879547-2904280558-3561642671-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-89879547-2904280558-3561642671-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
Task: {20BF652E-F8DA-4654-9418-EDC4558FF1D7} - System32\Tasks\{720DE97C-A003-4205-B021-244F19639CC7} => pcalua.exe -a "D:\Deoero\Zakon Feniksa\Crack.exe" -d "D:\Deoero\Zakon Feniksa"
Task: {DEDFF8E4-F9C4-482E-A184-4AC877F9E5A3} - System32\Tasks\{B34CE6D9-271F-499C-A735-3358D1F9598A} => pcalua.exe -a C:\Users\Agnieszka\Downloads\SmartDeblur-1.27-win\SmartDeblur-1.27-win\SmartDeblur.exe -d C:\Users\Agnieszka\Downloads\SmartDeblur-1.27-win\SmartDeblur-1.27-win
FirewallRules: [{2EB51945-FD3F-435D-AD6F-7F4D74ED2851}] => (Allow) C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe
FirewallRules: [{C0419DBE-6699-48BA-8386-995EE803C604}] => (Allow) C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe
FirewallRules: [{C5BCA2CA-281E-4DF4-9FFB-76835E99B7A2}] => (Allow) C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe
FirewallRules: [{C170B9AF-7CBD-4660-9A70-DE1A38EF0031}] => (Allow) C:\Program Files (x86)\RelevantKnowledge\rlvknlg.exe
EmptyTemp:
Plik zapisz pod nazwą
fixlist.txt i umieść obok FRST.exe
Uruchom
FRST i kliknij przycisk
Fix.
Powstanie plik fixlog.txt.
Daj ten log.
3) Wejdź na "G" - powinien się tam pojawić folder bez nazwy, do którego nfekcja przesunęła wszystkie dane.
Przenieś z tego folderu pliki poziom wyżej, a folder "bez nazwy" przez SHIFT+DEL skasuj.
4) Zrób log z USBFix z opcji LISTING.
5) Zrób log z
Farbar Service Scanner >
http://download.bleepingcomputer.com/farbar/FSS.exe (do skanowania zaznacz wszystko).
6 )Zrób nowe logi z FRST.
.
Autor postu otrzymał pochwałę
