VIRY.CZ

Prosím o kontrolu logu. Dostal jsem asi vir. Avira nic nenašla, online Eset scaner něco jo. Zmizelo mi všechno z HDD, systém ale ukazuje zaplněnost, takže to tam je. Jak postupovat dál tedy nevím. Děkuji

Zdravím!
Spusťte tuto utilitu:

Ulozte na plochu AdwCleaner https://malwarebytes.com/adwcleaner/ nebo http://www.bleepingcomputer.com/download/adwcleaner/

ukoncete vsechny programy
odsouhlaste licencni podmiky (EULA) klikem na Souhlasim
kliknete pravym na ikonu AdwCleaneru a vyberte Spustit jako spravce (v pripade Win XP spustte obycejne dvojklikem)
kliknete na Skenovat nyni (Scan now), pote na Cisteni a opravy (Clean and Repair)
po restartu na Vas vyskoci log (pripadne jej najdete v C:\AdwCleaner\Logs\AdwCleaner[Cxx].txt), jehoz obsah zkopirujte do pristi odpovedi

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Scan
# -------------------------------
# Start: 11-25-2018
# Duration: 00:00:06
# OS: Windows 10 Pro
# Scanned: 32104
# Detected: 39


***** [ Services ] *****

No malicious services found.

***** [ Folders ] *****

PUP.Optional.Ask C:\Program Files (x86)\Ask.com
PUP.Optional.Legacy C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

***** [ Files ] *****

PUP.Optional.Legacy C:\Users\josef\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Facebook.lnk

***** [ DLL ] *****

No malicious DLLs found.

***** [ WMI ] *****

No malicious WMI found.

***** [ Shortcuts ] *****

No malicious shortcuts found.

***** [ Tasks ] *****

PUP.Optional.Ask C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Registry ] *****

PUP.Adware.Heuristic HKCU\SOFTWARE\c4f75a7a2ccfeeb3256659b7363891a8
PUP.Adware.Heuristic HKCU\SOFTWARE\51c6838b2d9461bfc8e7228fb3036aa0
PUP.Optional.Ask HKCU\Software\Ask.com
PUP.Optional.Ask HKCU\Software\AppDataLow\Software\AskToolbar
PUP.Optional.Ask HKU\S-1-5-18\Software\AskToolbar
PUP.Optional.Ask HKU\.DEFAULT\Software\AskToolbar
PUP.Optional.Ask HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{046C8B51-CF48-4C33-9BBB-9B72C1C4C128}
PUP.Optional.Ask HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{046C8B51-CF48-4C33-9BBB-9B72C1C4C128}
PUP.Optional.Ask HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Scheduled Update for Ask Toolbar
PUP.Optional.FrostwireTB.A HKLM\Software\Wow6432Node\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
PUP.Optional.FrostwireTB.A HKLM\Software\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
PUP.Optional.Legacy HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run|System
PUP.Optional.Legacy HKCU\Software\DC3_FEXEC
PUP.Optional.Legacy HKCU\Software\AppDataLow\AskToolbarInfo
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966d4C29D35B1C9
PUP.Optional.Legacy HKLM\Software\Classes\Installer\UpgradeCodes\F928123A039649549966d4C29D35B1C9
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
PUP.Optional.Legacy HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\AppID\GenericAskToolbar.DLL
PUP.Optional.Legacy HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
PUP.Optional.Legacy HKLM\Software\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar|{D4027C7F-154A-4066-A1AD-4243D8127440}
PUP.Optional.Legacy HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
PUP.Optional.Legacy HKLM\Software\Classes\Prod.cap
PUP.Optional.Legacy HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries found.

***** [ Chromium URLs ] *****

No malicious Chromium URLs found.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries found.

***** [ Firefox URLs ] *****

No malicious Firefox URLs found.



########## EOF - C:\AdwCleaner\Logs\AdwCleaner[S00].txt ##########

nevím jestli jsem dal správný

# -------------------------------
# Malwarebytes AdwCleaner 7.2.4.0
# -------------------------------
# Build: 09-25-2018
# Database: 2018-11-19.1 (Cloud)
# Support: https://www.malwarebytes.com/support
#
# -------------------------------
# Mode: Clean
# -------------------------------
# Start: 11-25-2018
# Duration: 00:00:00
# OS: Windows 10 Pro
# Cleaned: 1
# Failed: 0


***** [ Services ] *****

No malicious services cleaned.

***** [ Folders ] *****

No malicious folders cleaned.

***** [ Files ] *****

No malicious files cleaned.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks cleaned.

***** [ Registry ] *****

Deleted HKCU\Software\csastats

***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries cleaned.

***** [ Chromium URLs ] *****

No malicious Chromium URLs cleaned.

***** [ Firefox (and derivatives) ] *****

No malicious Firefox entries cleaned.

***** [ Firefox URLs ] *****

No malicious Firefox URLs cleaned.


*************************

[+] Delete Tracing Keys
[+] Reset Winsock

*************************

AdwCleaner[S00].txt - [5584 octets] - [25/11/2018 09:17:59]
AdwCleaner[C00].txt - [5060 octets] - [25/11/2018 09:19:04]
AdwCleaner[S01].txt - [1389 octets] - [25/11/2018 11:52:59]
AdwCleaner[S02].txt - [1450 octets] - [25/11/2018 11:53:19]

########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C02].txt ##########

Dejte nové logy FRST+Addition.

V příloze

Otevřte poznámkový blok a zkopírujte do něj:

Start

CloseProcesses:
HKLM\...\Run: [CL-23-DF6DCCDD-730C-4BDA-A6B7-A176D2591BF8] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-DF6DCCDD-730C-4BDA-A6B7-A176D2591BF8\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-DF6DCCD (the data entry has 44 more characters).
HKLM\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [] => [X]
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [51c6838b2d9461bfc8e7228fb3036aa0] => .. [0 2018-11-24] ()
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [c4f75a7a2ccfeeb3256659b7363891a8] => .. [0 2018-11-24] ()
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
C:\WINDOWS\SvcFiles\msde.exe
Task: {1645F588-C002-4527-B89D-E9502839AC8C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-11-02] (Google Inc.)
Task: {F4C85ABC-C177-4577-ACA8-A6B8B2BABACA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-11-02] (Google Inc.)
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [354]

EmptyTemp:
Hosts:
End

Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Fix result of Farbar Recovery Scan Tool (x64) Version: 21.11.2018
Ran by josef (25-11-2018 12:13:23) Run:1
Running from C:\Users\josef\Desktop
Loaded Profiles: josef (Available Profiles: defaultuser0 & josef)
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM\...\Run: [CL-23-DF6DCCDD-730C-4BDA-A6B7-A176D2591BF8] => "C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-DF6DCCDD-730C-4BDA-A6B7-A176D2591BF8\setuplauncher.exe" /run:"C:\Program Files\Common Files\Bitdefender\SetupInformation\CL-23-DF6DCCD (the data entry has 44 more characters).
HKLM\...\Run: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [] => [X]
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [51c6838b2d9461bfc8e7228fb3036aa0] => .. [0 2018-11-24] ()
HKU\S-1-5-21-2950931986-994548441-678899500-1001\...\Run: [c4f75a7a2ccfeeb3256659b7363891a8] => .. [0 2018-11-24] ()
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
C:\WINDOWS\SvcFiles\msde.exe
Task: {1645F588-C002-4527-B89D-E9502839AC8C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-11-02] (Google Inc.)
Task: {F4C85ABC-C177-4577-ACA8-A6B8B2BABACA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2018-11-02] (Google Inc.)
AlternateDataStreams: C:\ProgramData\TEMP:1CE11B51 [354]

EmptyTemp:
Hosts:
End
*****************

Processes closed successfully.
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\CL-23-DF6DCCDD-730C-4BDA-A6B7-A176D2591BF8" => removed successfully
"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender => removed successfully
"HKU\S-1-5-21-2950931986-994548441-678899500-1001\Software\Microsoft\Windows\CurrentVersion\Run\\" => removed successfully
"HKU\S-1-5-21-2950931986-994548441-678899500-1001\Software\Microsoft\Windows\CurrentVersion\Run\\51c6838b2d9461bfc8e7228fb3036aa0" => removed successfully
"HKU\S-1-5-21-2950931986-994548441-678899500-1001\Software\Microsoft\Windows\CurrentVersion\Run\\c4f75a7a2ccfeeb3256659b7363891a8" => removed successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => value restored successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA => moved successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore => moved successfully
C:\WINDOWS\SvcFiles\msde.exe => moved successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1645F588-C002-4527-B89D-E9502839AC8C}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1645F588-C002-4527-B89D-E9502839AC8C}" => removed successfully
"C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F4C85ABC-C177-4577-ACA8-A6B8B2BABACA}" => removed successfully
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F4C85ABC-C177-4577-ACA8-A6B8B2BABACA}" => removed successfully
"C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA" => not found
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA" => removed successfully
C:\ProgramData\TEMP => ":1CE11B51" ADS removed successfully
Could not move "C:\Windows\System32\Drivers\etc\hosts" => Scheduled to move on reboot.

=========== EmptyTemp: ==========

BITS transfer queue => 7888896 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 196603034 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 2410033 B
Edge => 551848 B
Chrome => 778122088 B
Firefox => 0 B
Opera => 379843716 B

Temp, IE cache, history, cookies, recent:
Default => 6656 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 60838 B
LocalService => 0 B
NetworkService => 0 B
NetworkService => 0 B
defaultuser0 => 6656 B
josef => 58408873 B

RecycleBin => 6787252631 B
EmptyTemp: => 7.6 GB temporary data Removed.

================================

Result of scheduled files to move (Boot Mode: Normal) (Date&Time: 25-11-2018 12:14:49)

C:\Windows\System32\Drivers\etc\hosts => Could not move
Could not restore Hosts.

==== End of Fixlog 12:14:49 ====

Smazáno. Nastala nějaká změna?

PC normálně funguje, jen nejsou dále vidět složky a soubory na discích, kromě C:
Diskový manager hlásí, že je to zaplněné ale Průzkumník nic nevidí. Zkoušel jsem přes live CD Ubuntu, jeden z disků by i šel překopírovat ale ostatní ani za boha.

Vytvořila se podivná složka, do které se všechno přesunulo a zřejmě zašifrovalo nebo co

OK. Udělejte kompletní sken MBAM: http://www.malwarebytes.org/mbam.php a dejte log. Předem nic nemažte.

Malwarebytes
www.malwarebytes.com

-Podrobnosti logovacího souboru-
Datum skenování: 25.11.18
Čas skenování: 15:07
Logovací soubor: 7e0bcc7c-f0bb-11e8-b4a9-7c05070ea31c.json

-Informace o softwaru-
Verze: 3.6.1.2711
Verze komponentů: 1.0.482
Aktualizovat verzi balíku komponent: 1.0.8015
Licence: Zkušební

-Systémová informace-
OS: Windows 10 (Build 17134.407)
CPU: x64
Systém souborů: NTFS
Uživatel: DESKTOP-A9OPUV2\josef

-Shrnutí skenování-
Typ skenování: Skenování hrozeb (Threat Scan)
Spuštění skenování: Ruční
Výsledek: Dokončeno
Skenované objekty: 291610
Zjištěné hrozby: 10
Hrozby umístěné do karantény: 0
Uplynulý čas: 0 min, 47 sek

-Možnosti skenování-
Paměť: Povoleno
Start: Povoleno
Systém souborů: Povoleno
Archivy: Povoleno
Rootkity: Zakázáno
Heuristika: Povoleno
Potenciálně nežádoucí program: Detekovat
Potenciálně nežádoucí modifikace: Detekovat

-Podrobnosti skenování-
Proces: 0
(Nebyly zjištěny žádné škodlivé položky)

Modul: 0
(Nebyly zjištěny žádné škodlivé položky)

Klíč registru: 0
(Nebyly zjištěny žádné škodlivé položky)

Hodnota v registru: 1
Worm.SpamBot, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|SERVICES, Žádná uživatelská akce, [7123], [245474],1.0.8015

Data registrů: 0
(Nebyly zjištěny žádné škodlivé položky)

Datové proudy: 0
(Nebyly zjištěny žádné škodlivé položky)

Adresář: 3
Trojan.StolenData, C:\USERS\JOSEF\APPDATA\ROAMING\DCLOGS, Žádná uživatelská akce, [3586], [250094],1.0.8015
PUP.Optional.Babylon, C:\Users\josef\AppData\Local\Babylon\Setup, Žádná uživatelská akce, [331], [339640],1.0.8015
PUP.Optional.Babylon, C:\USERS\JOSEF\APPDATA\LOCAL\BABYLON, Žádná uživatelská akce, [331], [339640],1.0.8015

Soubor: 6
Trojan.StolenData, C:\USERS\JOSEF\APPDATA\ROAMING\DCLOGS\2018-11-24-7.dc, Žádná uživatelská akce, [3586], [250094],1.0.8015
PUP.Optional.Babylon, C:\USERS\JOSEF\APPDATA\LOCAL\BABYLON\SETUP\SETUP2.ZPB, Žádná uživatelská akce, [331], [339640],1.0.8015
PUP.Optional.Babylon, C:\Users\josef\AppData\Local\Babylon\Setup\Setup3.zpb, Žádná uživatelská akce, [331], [339640],1.0.8015
Spyware.KeyLogger, C:\PROGRAMDATA\JHM\JHM.02, Žádná uživatelská akce, [3795], [355174],1.0.8015
PUP.Optional.InstallCore, C:\USERS\JOSEF\DOWNLOADS\ACLVIEW 1.4_0921166890.EXE, Žádná uživatelská akce, [408], [300908],1.0.8015
PUP.Optional.ASK, C:\WINDOWS\INSTALLER\1BD43D.MSI, Žádná uživatelská akce, [2], [113867],1.0.8015

Fyzický sektor: 0
(Nebyly zjištěny žádné škodlivé položky)

WMI: 0
(Nebyly zjištěny žádné škodlivé položky)


(end)

Všechny položky smažte.

Děkuji za rady, proveden ještě jeden scan - v pořádku. Nicméně můj problém není vyřešen, složky a soubory stále nejsou vidět. Asi mám smůlu. Ponaučení pro příště. 2TB dat v háji.