Prośba o sprawdzenie logów

[tachion]

Przejdź do trybu awaryjnego.

Odinstaluj:

Malware Protection Live
Smart File Advisor 1.1.8
Windows Media Player 11 Packages
WinZip 20.0

Możesz pozbyć się też:

ClamWin Free Antivirus 0.98.7
Loaris Trojan Remover 1.3.9.1
Sophos Anti-Rootkit 1.5.20
Spybot - Search & Destroy
SUPERAntiSpyware

Do notatnika wklej i zapisz jako fixlist.txt

Kod:

CloseProcesses:
HKLM-x32\...\Run: [ClamWin] => C:\Program Files (x86)\ClamWin\bin\ClamTray.exe [86016 2015-05-05] (alch)
HKLM-x32\...\Run: [MalwareProtectionLive] => C:\Users\ppp\AppData\Local\MalwareProtectionLive\MalwareProtectionClient.exe [857632 2015-12-17] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk [2015-12-16]
ShortcutTarget: FAH.lnk -> C:\Program Files\WinZip\FAHConsole.exe (Nico Mak Computing)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Notifier.lnk.disabled [2015-12-16]
ShortcutTarget: Update Notifier.lnk.disabled -> C:\Program Files\WinZip\WZUpdateNotifier.exe (Nico Mak Computing)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk [2015-12-16]
ShortcutTarget: WinZip Preloader.lnk -> C:\Program Files\WinZip\WzPreloader.exe (WinZip Computing, S.L.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [NoViewOnDrive] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKLM\...\Policies\Explorer: [NoViewContextMenu] 0
HKLM\...\Policies\Explorer: [NoShellSearchButton] 0
HKLM\...\Policies\Explorer: [NoFind] 0
HKLM\...\Policies\Explorer: [NoFile] 0
HKLM\...\Policies\Explorer: [HideClock] 0
HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0
HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKLM\...\Policies\Explorer: [NoSetFolders] 0
HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKLM\...\Policies\Explorer: [NoSetTaskbar] 0
HKLM\...\Policies\Explorer: [NoDeletePrinter] 0
HKLM\...\Policies\Explorer: [NoDFSTab] 0
HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0
HKLM\...\Policies\Explorer: [NoLogoff] 0
HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0
HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0
HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKLM\...\Policies\Explorer: [NoResolveSearch] 0
HKLM\...\Policies\Explorer: [NoSaveSettings] 0
HKLM\...\Policies\Explorer: [NoHardwareTab] 0
HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKLM\...\Policies\Explorer: [NoDesktop] 0
HKU\S-1-5-19\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-19\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-19\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-19\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-19\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-19\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-20\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-20\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-20\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-20\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-20\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-20\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\...\Policies\Explorer: [NoStartMenuSubFolders] 0
HKU\S-1-5-18\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-18\...\Policies\system: [NoDispAppearancePage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispBackgroundPage] 0
HKU\S-1-5-18\...\Policies\system: [NoDispSettingsPage] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewOnDrive] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableLocalMachineRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableCurrentUserRun] 0
HKU\S-1-5-18\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoViewContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoShellSearchButton] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFind] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoFile] 0
HKU\S-1-5-18\...\Policies\Explorer: [HideClock] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayContextMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoTrayItemsDisplay] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetFolders] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDevMgrUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSetTaskbar] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDeletePrinter] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoDFSTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoChangeStartMenu] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoLogoff] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoWindowsUpdate] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoEncryptOnMove] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoRunasInstallPrompt] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoHardwareTab] 0
HKU\S-1-5-18\...\Policies\Explorer: [NoStartMenuSubFolders] 0
InternetURL: C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regsvcs.url -> file://C:\Users\ppp\AppData\Roaming\MICROS~1\Windows\regsvcs.exe
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
CHR HKLM-x32\...\Chrome\Extension: [kjeghcllfecehndceplomkocgfbklffd] - hxxps://clients2.google.com/service/update2/crx
S2 Abel; C:\Users\ppp\AppData\Local\Temp\wz4519\PortableApps\Cain\Abel.exe [X]
S2 DigitalWave.Update.Service; "C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe" [X]
S2 moohelp; C:\Program Files (x86)\The Cleaner\mhelper.exe [X]
S3 esgiguard; C:\Program Files (x86)\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] ()
S3 MEMSWEEP2; C:\WINDOWS\system32\547.tmp [6144 2011-05-12] (Sophos Plc) [Brak podpisu cyfrowego]
S1 CSN5PDTS82; System32\Drivers\CSN5PDTS82.sys [X]
S1 epp64; \??\D:\EMSISOFT\bin\epp64.sys [X]
R0 FE86ACD7; C:\Windows\System32\drivers\FE86ACD7.sys [478392 2015-12-31] (Kaspersky Lab ZAO)
R0 FE86ACD76; C:\Windows\System32\drivers\FE86ACD76.sys [478392 2015-12-31] (Kaspersky Lab ZAO)
R0 SSFS0BBC; C:\Windows\System32\Drivers\SSFS0BBC.SYS [37488 2009-11-06] (Webroot Software, Inc. (www.webroot.com))
R0 SSIDRV; C:\Windows\System32\Drivers\SSIDRV.SYS [135280 2009-11-06] (Webroot Software, Inc. (www.webroot.com))
C:\Windows\System32\drivers\FE86ACD7.sys
C:\Windows\System32\drivers\FE86ACD76.sys
C:\Windows\System32\Drivers\SSFS0BBC.SYS
C:\Windows\System32\Drivers\SSIDRV.SYS
U0 SR; Brak ImagePath
U2 srservice; Brak ImagePath
C:\Users\ppp\AppData\Roaming\thecleaner
C:\Program Files (x86)\The Cleaner
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-090142.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-090119.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-090059.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-090004.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-085951.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-085412.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-085352.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-085339.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160104-085301.backup
C:\WINDOWS\system32\Drivers\etc\hosts.20160103-192803.backup
C:\Users\ppp\AppData\Roaming\Soft4Boost
C:\WINDOWS\system32\547.tmp
C:\WINDOWS\system32\Drivers\etc\hp.bak
C:\spyhunter.fix
C:\shldr.mbr
C:\ProgramData\Ultra Adware Killer
RemoveDirectory: C:\AdwCleaner
C:\ProgramData\HitmanPro
C:\Users\ppp\Doctor Web
Task: {26274128-717B-41C1-BA50-582FB0369D58} - System32\Tasks\{8D9BFCEC-AD7D-4317-B973-83C3A738CECE} => pcalua.exe -a "C:\Users\ppp\Downloads\DeviceDoctor.7ZipOpener_mkdtfchztkfbm!App\SeconfigXP\Seconfig XP.exe" -d C:\Users\ppp\Downloads\DeviceDoctor.7ZipOpener_mkdtfchztkfbm!App\SeconfigXP
Task: C:\WINDOWS\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: C:\WINDOWS\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}.job => C:\Users\ppp\AppData\Local\Temp\cis29C8.exe <==== UWAGA
Task: C:\WINDOWS\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: C:\WINDOWS\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: C:\WINDOWS\Tasks\Trojan Remover.job => C:\Program Files\Loaris\Trojan Remover\ltr.exe
AlternateDataStreams: C:\ProgramData\TEMP:430C6D84
AlternateDataStreams: C:\ProgramData\TEMP:C31F31E6
AlternateDataStreams: C:\ProgramData\TEMP:CB0AACC9
AlternateDataStreams: C:\ProgramData\TEMP:DFC5A2B2
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FE86ACD7.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FE86ACD76.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FE86ACD7.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\FE86ACD76.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRkrn => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WRSVC => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"
HKU\.DEFAULT\Software\Classes\.exe: exefile => "%1" %* <===== UWAGA
HKU\.DEFAULT\Software\Classes\exefile: "%1" %* <===== UWAGA
HKU\S-1-5-19\Software\Classes\exefile:  <===== UWAGA
HKU\S-1-5-20\Software\Classes\exefile:  <===== UWAGA
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\Software\Classes\.exe: exefile => "%1" %* <===== UWAGA
HKU\S-1-5-21-2743865930-3103381627-1221076486-1001\Software\Classes\exefile: "%1" %* <===== UWAGA
CMD: netsh advfirewall reset
Hosts:
EmptyTemp:

Zapisany skrypt umieść obok ściągniętego programu FRST 
Następnie w programie kliknij Napraw. Po wykonaniu pokaż raport z tego działania.

Uruchom system normalnie.

Zrób nowe logi i przedstaw z FRST.txt > Addition.txt > Shortcut.txt