VIRY.CZ

Pomáháme v boji s počítačovou havěti!
https://forum.viry.cz:443/

Ko logu po infekci policejním "virem"

https://forum.viry.cz:443/viewtopic.php?t=159229

Stránka 1 z 1

Ko logu po infekci policejním "virem"

Napsal: 31 črc 2023 18:26
od lola
CCa před měsícem stažen policejní "virus. Snad odstraněn, ale PC se zpomaluje, FF žádá každou chvíli o reset...

Re: Ko logu po infekci policejním "virem"

Napsal: 31 črc 2023 18:51
od Rudy
Zdravím!
Poprosím ještě o log FRST.txt. Je v souboru frst.txt na ploše. Děkuji.

Re: Ko logu po infekci policejním "virem"

Napsal: 31 črc 2023 19:06
od lola
Pokusím se, před tím mi tam nešel.. Nyní vypadá, že ano. Moc děkuji za rychlost.

Re: Ko logu po infekci policejním "virem"

Napsal: 31 črc 2023 20:04
od Rudy
Otevřte poznámkový blok a zkopírujte do něj:
Start

CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [738936 2023-03-17] (Oracle America, Inc. -> Oracle Corporation)
Task: {00FDF91E-C920-45A1-AF1E-57B30284CAE6} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\Jirka\Downloads\esetonlinescanner_csy.exe LOGON (No File)
Task: {ABE9B743-74D0-45CD-A7B1-949137E0C7DB} - System32\Tasks\GoogleUpdateTaskMachineCore{A1D33BB1-090E-4EE5-A75D-0B378C2B21D8} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-30] (Google LLC -> Google LLC)
Task: {D3A9079B-AB8A-4C8B-AA0C-8249E4296532} - System32\Tasks\GoogleUpdateTaskMachineUA{34EC7F6F-C023-4825-9796-5D4D34A7E1CD} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-30] (Google LLC -> Google LLC)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
C:\Users\Jirka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\S-1-5-21-3534509474-1781900124-1265873159-1001 -> DefaultScope {D3D44F78-EB33-4224-99AB-0F2CDE1FA5C7} URL =
SearchScopes: HKU\S-1-5-21-3534509474-1781900124-1265873159-1001 -> {D3D44F78-EB33-4224-99AB-0F2CDE1FA5C7} URL =
FirewallRules: [{EC7C0B55-093A-4BAF-AC22-BFEE3DE89573}] => (Allow) C:\Users\Jirka\AppData\Local\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe => No File
FirewallRules: [{512E1B13-2113-4323-A11A-16E3B4E58BB7}] => (Allow) C:\Users\Jirka\AppData\Local\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe => No File

EmptyTemp:
End
Uložte na plochu jako fixlist.txt. Spusťte znovu FRST a klikněte na >Fix<. Po skončení akce se objeví log, který sem zkopírujte.

Re: Ko logu po infekci policejním "virem"

Napsal: 01 srp 2023 08:47
od lola
Fix result of Farbar Recovery Scan Tool (x64) Version: 27-07-2023
Ran by Jirka (01-08-2023 09:19:07) Run:2
Running from C:\Users\Jirka\Desktop
Loaded Profiles: Jirka
Boot Mode: Normal
==============================================

fixlist content:
*****************
Start

CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [738936 2023-03-17] (Oracle America, Inc. -> Oracle Corporation)
Task: {00FDF91E-C920-45A1-AF1E-57B30284CAE6} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\Jirka\Downloads\esetonlinescanner_csy.exe LOGON (No File)
Task: {ABE9B743-74D0-45CD-A7B1-949137E0C7DB} - System32\Tasks\GoogleUpdateTaskMachineCore{A1D33BB1-090E-4EE5-A75D-0B378C2B21D8} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-30] (Google LLC -> Google LLC)
Task: {D3A9079B-AB8A-4C8B-AA0C-8249E4296532} - System32\Tasks\GoogleUpdateTaskMachineUA{34EC7F6F-C023-4825-9796-5D4D34A7E1CD} => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [156232 2022-03-30] (Google LLC -> Google LLC)
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
C:\Users\Jirka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page =
SearchScopes: HKU\S-1-5-21-3534509474-1781900124-1265873159-1001 -> DefaultScope {D3D44F78-EB33-4224-99AB-0F2CDE1FA5C7} URL =
SearchScopes: HKU\S-1-5-21-3534509474-1781900124-1265873159-1001 -> {D3D44F78-EB33-4224-99AB-0F2CDE1FA5C7} URL =
FirewallRules: [{EC7C0B55-093A-4BAF-AC22-BFEE3DE89573}] => (Allow) C:\Users\Jirka\AppData\Local\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe => No File
FirewallRules: [{512E1B13-2113-4323-A11A-16E3B4E58BB7}] => (Allow) C:\Users\Jirka\AppData\Local\Apowersoft\Apowersoft Online Launcher\Apowersoft Online Launcher.exe => No File

EmptyTemp:
End
*****************

Processes closed successfully.
"HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{00FDF91E-C920-45A1-AF1E-57B30284CAE6}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{00FDF91E-C920-45A1-AF1E-57B30284CAE6}" => removed successfully
C:\WINDOWS\System32\Tasks\EOSv3 Scheduler onLogOn => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\EOSv3 Scheduler onLogOn" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ABE9B743-74D0-45CD-A7B1-949137E0C7DB}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ABE9B743-74D0-45CD-A7B1-949137E0C7DB}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore{A1D33BB1-090E-4EE5-A75D-0B378C2B21D8} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineCore{A1D33BB1-090E-4EE5-A75D-0B378C2B21D8}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{D3A9079B-AB8A-4C8B-AA0C-8249E4296532}" => removed successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D3A9079B-AB8A-4C8B-AA0C-8249E4296532}" => removed successfully
C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA{34EC7F6F-C023-4825-9796-5D4D34A7E1CD} => moved successfully
"HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\GoogleUpdateTaskMachineUA{34EC7F6F-C023-4825-9796-5D4D34A7E1CD}" => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\BookReader_B171F20233094AC88D05A8EF7B9763E8 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => removed successfully
HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\Config\PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => removed successfully
C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat => moved successfully
C:\Users\Jirka\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini => moved successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" => value restored successfully
HKLM\Software\\Microsoft\Internet Explorer\Main\\"Local Page"="C:\Windows\System32\blank.htm" => value restored successfully
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\"Local Page"="C:\Windows\SysWOW64\blank.htm" => value restored successfully
"HKU\S-1-5-21-3534509474-1781900124-1265873159-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope" => removed successfully
HKU\S-1-5-21-3534509474-1781900124-1265873159-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D3D44F78-EB33-4224-99AB-0F2CDE1FA5C7} => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{EC7C0B55-093A-4BAF-AC22-BFEE3DE89573}" => removed successfully
"HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{512E1B13-2113-4323-A11A-16E3B4E58BB7}" => removed successfully

=========== EmptyTemp: ==========

FlushDNS => completed
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 57735857 B
Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 0 B
Windows/system/drivers => 5093734 B
Edge => 0 B
Chrome => 365638103 B
Firefox => 1226088365 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Default => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 34980 B
Jirka => 81164658 B

RecycleBin => 22847 B
EmptyTemp: => 1.6 GB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 09:28:27 ====

Re: Ko logu po infekci policejním "virem"

Napsal: 01 srp 2023 12:09
od Rudy
Smazáno, log je již OK.

Re: Ko logu po infekci policejním "virem"

Napsal: 01 srp 2023 12:43
od lola
Děkuji mocx. Byl hodně zanesený? Můžu po testech uklidit?

Re: Ko logu po infekci policejním "virem"

Napsal: 01 srp 2023 12:51
od Rudy
Spíše tam byly zbytečnosti. Uklidit můžete klasickým smazáním utility FRST a všeho, co vytvořily
Všechny časy jsou v UTC+01:00
Stránka 1 z 1

Založeno na phpBB® Forum Software © phpBB Limited

Český překlad – phpBB.cz