Wirusy - kilka programow chińskich?

[Gość: Szymon]

Witam, pojawiło się dzisiaj dużo programów krzaczkow (chińskich)

wyskakuja jakies okienka, zamykaja defendera i rozne dziwne akcje.
dzieciak prawdopodobnie nasciagal razem z grami


FRST
wklej.eu/index.php?id=76c43b6b1b

[Gość: szymon]

jeszcze jeden: wklej.eu/index.php?id=f677e7946f

[kolobos]

Odinstaluj: ????10.11 oraz Rising Antivirus.

Obok frst.exe utworz plik fixlist.txt z zawartoscia:
Task: {0C7AF833-DAFF-486B-B3E7-22064D23B464} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA
Task: {163C4135-E31D-48E0-9475-802332A8DEEE} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA
Task: {1A105F88-DD3D-40AB-9687-8316852DB6BD} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA
Task: {2B8C4CBE-4F09-4FD9-A43E-4B19F3A42C4C} - \PCDoctorBackgroundMonitorTask -> Brak pliku <==== UWAGA
Task: {360860DB-9C0F-42DE-AAE3-A566B3236EA2} - \SystemToolsDailyTest -> Brak pliku <==== UWAGA
Task: {40004C72-470C-4DBF-97E7-4F869D76C44A} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA
Task: {4383C0D0-455A-4A3E-87B9-2F99426A6F47} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA
Task: {75685EA8-97CB-420E-A051-EDA91AAA7350} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA
Task: {77FE2858-E7CE-4B38-8462-7E594A66B039} - \PCDEventLauncherTask -> Brak pliku <==== UWAGA
Task: {7E6323CE-9FAE-40EA-B70A-B148387EFDD0} - System32\Tasks\{8F85D031-B47C-440B-9ADC-778C070C213B} => pcalua.exe -a "C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16575.227\Uninst.exe"
Task: {A2743D2D-FB27-4319-A4F3-F81E2A9CDCDF} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA
Task: {ABF8D151-66FB-4FF6-8B90-906F7022D248} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA
Task: {B13AE8B2-BE34-4960-B4E0-CD5A05CC9241} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA
Task: {E6C445AC-1AAE-4DC5-AC59-4B5DFBC5C605} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA
Task: {F6E8C96A-7229-453A-86E3-C1382A9E6786} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA
Task: C:\WINDOWS\Tasks\AdobeoaUpdate Ver 201598.job => C:\Users\user\AppData\Roaming\wenguanjia\SoftBoard.exe/check_update C:\Users\user\AppData\Roaming\wenguanjia\
DELL\user'This task detect has update.Ver
(wgj) C:\Users\user\AppData\Roaming\wenguanjia\SoftBoard.exe
HKLM-x32\...\Run: [ QQPCTray] => "C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16575.227\QQPCTray.exe" /regrun
HKLM-x32\...\Run: [wenguanjia] => C:\Users\user\AppData\Roaming\wenguanjia\SoftBoard.exe [417168 2015-09-08] (wgj)
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16575.227\QMGCShellExt64.dll Brak pliku
FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [Brak pliku]
FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [Brak pliku]
FF Plugin: @mcafee.com/MSC,version=10 -> C:\Program Files\mcafee\msc\npMcSnFFPl64.dll [Brak pliku]
CHR Extension: (Please enter your password) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn [2015-08-28]
CHR Extension: (SiteAdvisor) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2015-08-28]
CHR Extension: (Voucherful.co.uk) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\kafpjghdfockenndmdalblagbonhemkf [2015-08-28]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx <nie znaleziono>
S1 TSDefenseBt; \??\C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16575.227\TSDefenseBT64.sys [X]
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]
2015-09-08 12:47 - 2015-09-08 12:47 - 00000000 ____D C:\ProgramData\TXQMPC
2015-09-08 12:42 - 2015-09-08 12:48 - 00000248 _____ C:\WINDOWS\Tasks\Relive.job
2015-09-08 12:42 - 2015-09-08 12:42 - 00002568 _____ C:\WINDOWS\System32\Tasks\Relive
2015-09-08 12:28 - 2015-09-08 12:40 - 00000000 ____D C:\AdwCleaner
2015-09-08 12:26 - 2015-09-08 12:26 - 00000000 ____D C:\Users\user\AppData\Local\F-Secure
2015-09-08 12:26 - 2015-09-08 12:26 - 00000000 ____D C:\ProgramData\F-Secure
2015-09-08 12:24 - 2015-09-08 12:26 - 00572456 _____ (F-Secure Corporation) C:\Users\user\Desktop\F-SecureOnlineScanner.exe
2015-09-08 12:23 - 2015-09-08 12:23 - 00003270 _____ C:\WINDOWS\System32\Tasks\{8F85D031-B47C-440B-9ADC-778C070C213B}
2015-09-08 12:18 - 2015-09-08 12:32 - 00000000 ___RD C:\RavBin
2015-09-08 12:18 - 2015-09-08 12:18 - 00000150 __RSH C:\rising.ini
2015-09-08 12:18 - 2015-09-08 12:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rising Antivirus
2015-09-08 12:18 - 2014-07-30 04:44 - 00091928 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\SysWOW64\vpatch.dll
2015-09-08 12:18 - 2014-01-02 09:37 - 00325400 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\system32\ravext64.dll
2015-09-08 12:18 - 2013-12-30 09:33 - 00256280 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\SysWOW64\ravext.dll
2015-09-08 12:18 - 2012-09-06 02:30 - 00240472 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\SysWOW64\bsmain.exe
2015-09-08 12:17 - 2014-09-10 08:11 - 00119344 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\sysmon.sys
2015-09-08 12:17 - 2014-08-15 03:22 - 00069336 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\rsutils.sys
2015-09-08 12:17 - 2012-02-29 09:49 - 00011888 ____N (Beijing Rising Information Technology Co., Ltd.) C:\WINDOWS\system32\Drivers\rsndisp.sys
2015-09-08 12:16 - 2015-09-08 12:40 - 00000462 _____ C:\WINDOWS\Tasks\AdobeoaUpdate Ver 201598.job
2015-09-08 12:16 - 2015-09-08 12:16 - 00087864 ____N (????) C:\WINDOWS\system32\Drivers\TFsFltX64.sys
2015-09-08 12:16 - 2015-09-08 12:16 - 00003582 _____ C:\WINDOWS\System32\Tasks\AdobeoaUpdate Ver 201598
2015-09-08 12:16 - 2015-09-08 12:16 - 00000000 ____D C:\Users\user\AppData\Roaming\wenguanjia
2015-09-08 12:16 - 2015-09-08 12:16 - 00000000 ____D C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\???(908)
2015-09-08 12:15 - 2015-09-08 12:47 - 00000000 ____D C:\Users\user\AppData\Roaming\Tencent
2015-09-08 12:15 - 2015-09-08 12:47 - 00000000 ____D C:\ProgramData\Tencent
2015-09-08 12:15 - 2015-09-08 12:15 - 00000000 ____D C:\Program Files (x86)\Tencent
2015-09-08 11:42 - 2015-09-08 11:43 - 00000000 ____D C:\qycache
2015-09-08 11:42 - 2015-09-08 11:42 - 00000000 ____D C:\Users\Public\QiYi
2015-09-08 11:42 - 2015-09-08 11:42 - 00000000 ____D C:\ppsfile
2015-09-08 11:40 - 2015-09-08 12:26 - 00000000 ____D C:\Program Files (x86)\baidu
2015-09-08 11:39 - 2015-09-08 12:26 - 00000000 ____D C:\ProgramData\cWdsManProc
2015-08-31 09:23 - 2015-08-31 09:23 - 00000000 ____D C:\WINDOWS\System32\Tasks\McAfee
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp:

W FRST wybierz Fix.

Po wykonaniu daj nowe logi z FRST, ze skanowania, wklej je na wklej.org

[Gość: Szymon]

logi: wklej.org/id/1793673/

Wszystko zniknęło, dzięki za pomoc ;)

[Gość: Kolobos]

Nowy Fixlist.txt dla FRST:
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=94493384_hao_pg
FF Plugin-x32: @mcafee.com/MSC,version=10 -> C:\Program Files (x86)\McAfee\msc\npMcSnFFPl.dll [Brak pliku]
FF Plugin-x32: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-1201939711-3691152681-4003334697-1001: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll Brak pliku
FF Plugin HKU\S-1-5-21-1201939711-3691152681-4003334697-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll Brak pliku
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
CHR Extension: (AVG Secure Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2015-09-08]
CHR Extension: (电脑管家上网防护) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ooebklgpfnbcnpokahmdidgbmlcdepkm [2015-09-08]
S0 bnsfw; System32\drivers\jeqhmo.sys [X]
S1 rsutils; system32\DRIVERS\rsutils.sys [X]
S0 sysmon; system32\DRIVERS\sysmon.sys [X]
2015-09-08 13:40 - 2015-09-08 13:40 - 00000000 ____D C:\ProgramData\Rising

Po wykonaniu usun katalog C:\FRST i to wszystko.