VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

winnet32b - pro altrok

https://forum.viry.cz:443/viewtopic.php?t=144893

Stránka 1 z 1

winnet32b - pro altrok

Napsal: 18 čer 2015 16:31
od silvia15
Zdravím, prosím o kontrolu logu, všetko potrebné je v prílohe, ďakujem:)

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 16:36
od altrok
Krasny den Vam preju :bye:


:arrow: Odinstalujte :arrow: V ramci cisteni Vam budou vyprazdneny docasne adresare (vcetne Kose).

:arrow: Ulozte na plochu AdwCleaner https://toolslib.net/downloads/viewdown ... dwcleaner/ (nebo http://www.bleepingcomputer.com/download/adwcleaner/ )
  • ukoncete vsechny programy
  • kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
  • kliknete na Scan, pote na Cleaning
  • po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\AdwCleaner [Sx].txt), jehoz obsah mi zkopirujte do pristi odpovedi

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 16:53
od silvia15
# AdwCleaner v4.206 - Log vytvorený 18/06/2015 at 17:47:55
# Aktualizované 01/06/2015 by Xplode
# Databáza : 2015-06-17.1 [Server]
# Operačný systém : Windows 8.1 (x64)
# Uživateľské meno : Silvia Škulová - SILVIA
# Spustené z : C:\Users\Silvia Škulová\Desktop\AdwCleaner.exe
# Nastavenia : Čistenie

***** [ Služby ] *****


***** [ Súbory / Priečinky ] *****


***** [ Naplánované úlohy ] *****


***** [ Zástupcovia ] *****


***** [ Registre ] *****


***** [ Webové prehliadače ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Google Chrome v43.0.2357.124


*************************

AdwCleaner[R1].txt - [767 bajtov] - [18/06/2015 17:43:39]
AdwCleaner[S1].txt - [688 bajtov] - [18/06/2015 17:47:55]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [747 bajtov] ##########

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 17:01
od altrok
:arrow: Doporucuju zvysenou opatrnost pri pouzivani Wise Care 365.


  • Do Poznamkoveho bloku (Start -> spustit -> notepad) zkopirujte obsah bileho pole
  • ulozte na plochu jako fixlist (Typ souboru: Textovy dokument)
  • znovu spustte FRST a kliknete na Fix
  • po restartu bude na plose ulozen fixlog, jehoz obsah mi vlozte do pristi odpovedi

    Kód: Vybrat vše

    Start
CloseProcesses:
CreateRestorePoint:
Folder: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking
C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {9418c0dc-6891-11e3-be9b-dc85de83a992} - "F:\Autorun.exe" 
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {da7b1dee-d56b-11e3-bedf-dc85de83a992} - "E:\Start.exe" 
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {eb1973bb-7baf-11e4-bf17-dc85de83a992} - "G:\Start.exe" 
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {f6add5b0-d79d-11e3-bee0-dc85de83a992} - "E:\Start.exe" 
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {f6add659-d79d-11e3-bee0-001e101f21ed} - "E:\Start.exe" 
Startup: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost32.exe [2015-06-16] ()
Startup: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost64.exe [2015-06-16] ()

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]

2015-06-17 23:29 - 2015-06-18 17:03 - 00013675 _____ C:\Users\Silvia Škulová\Desktop\FRST.txt
2015-06-17 23:28 - 2015-06-17 23:28 - 00112640 _____ (forum.viry.cz) C:\Users\Silvia Škulová\Desktop\FRSTLauncher (1).exe
2015-06-17 23:28 - 2015-06-17 23:28 - 00029696 _____ C:\Users\Silvia Škulová\AppData\Local\MSGBOX.EXE
2015-06-17 23:28 - 2015-06-17 23:28 - 00015327 _____ C:\Users\Silvia Škulová\Desktop\LM.bat
2015-06-17 23:24 - 2015-06-17 23:24 - 00112640 _____ (forum.viry.cz) C:\Users\Silvia Škulová\Desktop\Nepotvrdené 195846.crdownload
2015-06-17 23:18 - 2015-06-17 23:18 - 02109952 _____ (Farbar) C:\Users\Silvia Škulová\Downloads\FRST64 (1).exe
2015-06-17 12:19 - 2015-06-17 12:19 - 00005602 _____ C:\Users\Silvia Škulová\Downloads\exe-fix (1).bat
2015-06-17 12:03 - 2015-06-17 12:06 - 00045351 _____ C:\Users\Silvia Škulová\Downloads\Addition.txt
2015-06-17 11:56 - 2015-06-17 23:23 - 00491391 _____ C:\Users\Silvia Škulová\Downloads\FRST.txt
2015-06-17 11:36 - 2015-06-17 11:36 - 02231296 _____ C:\Users\Silvia Škulová\Downloads\adwcleaner_4.206.exe

Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002Core.job => C:\Users\Silvia akulová\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002UA.job => C:\Users\Silvia akulová\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1d08f3b6cddd6cd.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf6c7d69039fac.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cff75f79eadfad.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d000df7d159e02.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d0411c44c86440.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d08f3b6d565b79.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
EmptyTemp:
End

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 17:17
od silvia15
Fix result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Silvia Škulová at 2015-06-18 18:12:09 Run:2
Running from C:\Users\Silvia Škulová\Desktop
Loaded Profiles: Silvia Škulová (Available Profiles: Silvia Škulová & Matej Nubold)
Boot Mode: Normal
==============================================

fixlist content:
*****************
tart
CloseProcesses:
CreateRestorePoint:
Folder: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking
C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {9418c0dc-6891-11e3-be9b-dc85de83a992} - "F:\Autorun.exe"
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {da7b1dee-d56b-11e3-bedf-dc85de83a992} - "E:\Start.exe"
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {eb1973bb-7baf-11e4-bf17-dc85de83a992} - "G:\Start.exe"
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {f6add5b0-d79d-11e3-bee0-dc85de83a992} - "E:\Start.exe"
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\...\MountPoints2: {f6add659-d79d-11e3-bee0-001e101f21ed} - "E:\Start.exe"
Startup: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost32.exe [2015-06-16] ()
Startup: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost64.exe [2015-06-16] ()

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]

2015-06-17 23:29 - 2015-06-18 17:03 - 00013675 _____ C:\Users\Silvia Škulová\Desktop\FRST.txt
2015-06-17 23:28 - 2015-06-17 23:28 - 00112640 _____ (forum.viry.cz) C:\Users\Silvia Škulová\Desktop\FRSTLauncher (1).exe
2015-06-17 23:28 - 2015-06-17 23:28 - 00029696 _____ C:\Users\Silvia Škulová\AppData\Local\MSGBOX.EXE
2015-06-17 23:28 - 2015-06-17 23:28 - 00015327 _____ C:\Users\Silvia Škulová\Desktop\LM.bat
2015-06-17 23:24 - 2015-06-17 23:24 - 00112640 _____ (forum.viry.cz) C:\Users\Silvia Škulová\Desktop\Nepotvrdené 195846.crdownload
2015-06-17 23:18 - 2015-06-17 23:18 - 02109952 _____ (Farbar) C:\Users\Silvia Škulová\Downloads\FRST64 (1).exe
2015-06-17 12:19 - 2015-06-17 12:19 - 00005602 _____ C:\Users\Silvia Škulová\Downloads\exe-fix (1).bat
2015-06-17 12:03 - 2015-06-17 12:06 - 00045351 _____ C:\Users\Silvia Škulová\Downloads\Addition.txt
2015-06-17 11:56 - 2015-06-17 23:23 - 00491391 _____ C:\Users\Silvia Škulová\Downloads\FRST.txt
2015-06-17 11:36 - 2015-06-17 11:36 - 02231296 _____ C:\Users\Silvia Škulová\Downloads\adwcleaner_4.206.exe

Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002Core.job => C:\Users\Silvia akulová\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002UA.job => C:\Users\Silvia akulová\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1d08f3b6cddd6cd.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf6c7d69039fac.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cff75f79eadfad.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d000df7d159e02.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d0411c44c86440.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d08f3b6d565b79.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
EmptyTemp:
End
*****************

tart => Error: No automatic fix found for this entry.
Processes closed successfully.
Restore point was successfully created.

========================= Folder: C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking ========================

2015-06-16 10:18 - 2015-06-16 10:18 - 0494606 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\inet32upd.exe
2015-06-16 10:18 - 2015-06-16 10:18 - 0626176 _____ (The cURL library, http://curl.haxx.se/) C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\libcurl.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 1704448 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\libeay32.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0112142 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\libgcc_s_dw2-1.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0279955 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\libidn-11.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0148760 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\libpdcurses.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0963232 _____ (Microsoft Corporation) C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\msvcr120.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0119704 _____ (Open Source Software community LGPL) C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\pthreadGC2.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 0021201 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\skein.cl
2015-06-16 10:18 - 2015-06-16 10:18 - 0971888 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\skeinDevastatorgv1w256l4.bin
2015-06-16 10:18 - 2015-06-16 10:18 - 0364544 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\ssleay32.dll
2015-06-16 10:18 - 2015-06-16 10:18 - 2418688 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\winnet32b.exe
2015-06-16 10:18 - 2015-06-16 10:18 - 0131598 _____ () C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking\zlib1.dll

====== End of Folder: ======

C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Networking => moved successfully.
HKU\S-1-5-21-2075188646-67270415-2939999708-1002\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\NoLowDiskSpaceChecks => value removed successfully
"HKU\S-1-5-21-2075188646-67270415-2939999708-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9418c0dc-6891-11e3-be9b-dc85de83a992}" => key removed successfully
HKCR\CLSID\{9418c0dc-6891-11e3-be9b-dc85de83a992} => key not found.
"HKU\S-1-5-21-2075188646-67270415-2939999708-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{da7b1dee-d56b-11e3-bedf-dc85de83a992}" => key removed successfully
HKCR\CLSID\{da7b1dee-d56b-11e3-bedf-dc85de83a992} => key not found.
"HKU\S-1-5-21-2075188646-67270415-2939999708-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{eb1973bb-7baf-11e4-bf17-dc85de83a992}" => key removed successfully
HKCR\CLSID\{eb1973bb-7baf-11e4-bf17-dc85de83a992} => key not found.
"HKU\S-1-5-21-2075188646-67270415-2939999708-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6add5b0-d79d-11e3-bee0-dc85de83a992}" => key removed successfully
HKCR\CLSID\{f6add5b0-d79d-11e3-bee0-dc85de83a992} => key not found.
"HKU\S-1-5-21-2075188646-67270415-2939999708-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f6add659-d79d-11e3-bee0-001e101f21ed}" => key removed successfully
HKCR\CLSID\{f6add659-d79d-11e3-bee0-001e101f21ed} => key not found.
C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost32.exe => moved successfully.
C:\Users\Silvia Škulová\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\conhost64.exe => moved successfully.
"HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
ewusbnet => Service removed successfully
C:\Users\Silvia Škulová\Desktop\FRST.txt => moved successfully.
C:\Users\Silvia Škulová\Desktop\FRSTLauncher (1).exe => moved successfully.
C:\Users\Silvia Škulová\AppData\Local\MSGBOX.EXE => moved successfully.
C:\Users\Silvia Škulová\Desktop\LM.bat => moved successfully.
C:\Users\Silvia Škulová\Desktop\Nepotvrdené 195846.crdownload => moved successfully.
C:\Users\Silvia Škulová\Downloads\FRST64 (1).exe => moved successfully.
C:\Users\Silvia Škulová\Downloads\exe-fix (1).bat => moved successfully.
C:\Users\Silvia Škulová\Downloads\Addition.txt => moved successfully.
C:\Users\Silvia Škulová\Downloads\FRST.txt => moved successfully.
C:\Users\Silvia Škulová\Downloads\adwcleaner_4.206.exe => moved successfully.
C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002Core.job => moved successfully.
C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-2075188646-67270415-2939999708-1002UA.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1d08f3b6cddd6cd.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cf6c7d69039fac.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1cff75f79eadfad.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d000df7d159e02.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d0411c44c86440.job => moved successfully.
C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA1d08f3b6d565b79.job => moved successfully.
C:\WINDOWS\Tasks\Wise Turbo Checker.job => moved successfully.
EmptyTemp: => 85.3 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 18:12:55 ====

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 17:19
od altrok
Takze jeste uklidime.
A pokud nejsou dotazy ci jine problemy, je to ode mne vse.

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 17:23
od silvia15
Veľká, veľká vďaka za Vašu pomoc! Chcela by som sa len spýtať ako predchádzať takýmto situáciám?

Re: winnet32b - pro altrok

Napsal: 18 čer 2015 17:29
od altrok
Nemate zac, rad jsem pomohl :worship:

Co je zdrojem tohoto BitCoin mineru presne nevim, ale posledni mesic konkretne tento kousek resime vice nez casto. BC minery obecne jsou casto soucasti cracku (mozna crack na Officy - nevim to jiste).
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz