Nabourání přes discord

[Rudy]

Zdravím!
Pokud se vám naboural ořes PC, je vhodné provést kontrolu. Dejte logy FRST+Addition: http://forum.viry.cz/viewtopic.php?f=24&t=132509 . Pokud se ale naboural přímo zlomením hesla, v PC nic nenajdeme. Hesla si samozřejmě změňte.

[Rudy]

OK, teď spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

[Rudy]

Toto je OK. Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
AlternateDataStreams: C:\ProgramData:err [1968]
AlternateDataStreams: C:\Users\All Users:err [1968]
AlternateDataStreams: C:\ProgramData\Data aplikací:err [1968]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [10418]
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
FirewallRules: [TCP Query User{1959E81E-B3EF-4E18-8B60-76BD25DAD073}H:\zombie army 4 - dead war\bin\za4_vulkan.exe] => (Block) H:\zombie army 4 - dead war\bin\za4_vulkan.exe => No File
FirewallRules: [UDP Query User{2925DB99-47A2-4905-AC73-A56822798131}H:\zombie army 4 - dead war\bin\za4_vulkan.exe] => (Block) H:\zombie army 4 - dead war\bin\za4_vulkan.exe => No File
FirewallRules: [{4658E5A9-3F80-4224-A72D-F4E71488880F}] => (Allow) C:\Program Files (x86)\Deskshare\IP Camera Viewer 4\IP Camera Viewer.exe => No File
FirewallRules: [{8CA360C4-D9EA-462A-878C-CF45703BC0A0}] => (Allow) C:\Program Files (x86)\Deskshare\IP Camera Viewer 4\IP Camera Viewer.exe => No File
FirewallRules: [TCP Query User{8DA56E84-228F-450D-A8CC-2A9F42D093B1}H:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Block) H:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [UDP Query User{C39CAD00-CADC-4203-A537-4E4D0FB342C4}H:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Block) H:\games\cyberpunk 2077\bin\x64\cyberpunk2077.exe => No File
FirewallRules: [{66277BC1-4B41-4D33-A633-346EF7968CA0}] => (Allow) C:\Program Files\AMD\CNext\CNext\amddvr.exe => No File
FirewallRules: [{02761C45-39B1-4D9B-9CF3-DDC577325396}] => (Allow) C:\Program Files\AMD\CNext\CNext\AMDLink.exe => No File
FirewallRules: [TCP Query User{BFB02BE3-E4B3-4DE6-9757-FB5093BCC2F9}C:\users\miroslav\appdata\local\temp\rar$exa13040.37779\raft\raft.exe] => (Allow) C:\users\miroslav\appdata\local\temp\rar$exa13040.37779\raft\raft.exe => No File
FirewallRules: [UDP Query User{129EE6B3-E3E5-449E-A532-176FB62FE358}C:\users\miroslav\appdata\local\temp\rar$exa13040.37779\raft\raft.exe] => (Allow) C:\users\miroslav\appdata\local\temp\rar$exa13040.37779\raft\raft.exe => No File
FirewallRules: [TCP Query User{1C98CD33-DA13-42A6-B257-140DB90C6419}C:\windows\kmsemulator.exe] => (Block) C:\windows\kmsemulator.exe => No File
FirewallRules: [UDP Query User{4922CFAC-103F-4F37-A6C3-043E0BA4A8EE}C:\windows\kmsemulator.exe] => (Block) C:\windows\kmsemulator.exe => No File
FirewallRules: [TCP Query User{66A2B246-123A-407C-8E70-EA91B50E548E}C:\program files (x86)\call of duty\_beta_\cod.exe] => (Allow) C:\program files (x86)\call of duty\_beta_\cod.exe => No File
FirewallRules: [UDP Query User{55CC9815-6F41-409C-B3D5-1E1FC79A1C9F}C:\program files (x86)\call of duty\_beta_\cod.exe] => (Allow) C:\program files (x86)\call of duty\_beta_\cod.exe => No File
C:\Users\Miroslav\Downloads\Aktivator Windows 10-11

EmptyTemp:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

[Rudy]

Smazáno, PC by již mělo být čisté.

[Rudy]

Pravděpodobně vám e-mail nepadl útočník zvenčí zlomením hesla. V PC byly jen zbytečnosti.