windows script host

[JaRon]

Ahoj,
system sa snazi spustit script, ktory bol medzitym zmazany
Bud skus cez regedit najst a zmazat kluc, ktory obsahuje h.vbs
Alebo vloz oba logy frst a pozriem na to

[JaRon]

Kludne to zmaz

[JaRon]

Pouzi fixlist:

Start

StartupDir: C:\Users\Public\Data <==== ATTENTION
Startup: C:\Users\Public\Data\h.vbs.lnk [2024-08-26]
ShortcutTarget: h.vbs.lnk -> C:\ProgramData\h.vbs () [File not signed]

EmpyTemp:

End

[Rudy]

Omloiuvám se za vstup. Pan kolega se překlepl. Místo EmpyTemp:, má být EmptyTemp.

[JaRon]

Je to nejake prepletene - dalsi fixlist:

Start

2024-08-26 17:05 - 2022-10-25 09:33 - 000078634 _____ C:\ProgramData\info.bat
2024-08-26 17:04 - 2022-10-25 09:32 - 000078634 _____ C:\ProgramData\certlm.exe.manifest

End

[JaRon]

Doporucujem vycistit s Ccleanerom vcetne registrov
Restart
A vycistit s Avptool - Kvrt

[JaRon]

Vloz oba aktualne logy FRST

[JaRon]

ak nezafunguje v normal, pouzi v nudzovom rezime - citat:
Tvorba fixlistu pro FRST
•Spustte poznamkovy blok (Start-spustit-notepad)
•Zkopirujte skript >>

Kód: Vybrat vše

Start
CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Restriction <==== ATTENTION
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Restriction <==== ATTENTION
Startup: C:\Users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\certlm.exe [2022-10-25] (Adersoft -> Adersoft)
Startup: C:\Users\Petr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\h.vbs.lnk [2022-10-25]
ShortcutTarget: h.vbs.lnk -> C:\ProgramData\h.vbs (No File)
S3 cpuz148; \??\C:\WINDOWS\temp\cpuz148\cpuz148_x64.sys [X] <==== ATTENTION
2024-08-26 17:05 - 2024-08-26 17:05 - 000078634 _____ C:\Users\Public\Microsoft Edge.exe
2024-08-26 17:05 - 2024-08-26 17:05 - 000003578 _____ C:\WINDOWS\system32\Tasks\Microsoft Edge
2024-08-26 17:05 - 2021-08-20 14:37 - 011705368 _____ C:\ProgramData\nbminer.exe
2024-08-26 17:04 - 2024-08-26 17:04 - 000078634 _____ C:\ProgramData\certlm.exe
2024-08-26 17:04 - 2024-08-26 17:04 - 000000000 ____D C:\Users\Petr\AppData\Roaming\Key
FCheck: C:\Users\Petr\AppData\Roaming\Google\Libs\WR64.sys [2023-02-06] <==== ATTENTION


EmptyTemp:
Reboot:
End

•Ulozte vytvoreny TXT jako fixlist.txt
•Presunte vytvoreny fixlist vedle FRST

Spustte znovu FRST.exe
•Kliknete na Fix
•Probehne oprava a vytvori log Fixlog.txt

Restart PC a dejte mi sem fixlog.txt

[JaRon]

1. nastala nejaka zmena

[JaRon]

Za malo
Odstran link z podpisu