Έλεγχος υπολογιστή Dr Joy

 

We have received an assistance request from Dr Joy.

Greacian Genious Geek, I would like your help! I would like a malware check up for my laptop.

FRST.txt

Addition.txt

-------------------------------------------------------------  

Grecian Geek replies:

Hi, Dr Joy.

Welcome to GGG.

My first comments/instructions:

No sign of active infection in your logs. We are going to remove some needless entries and then make a second scan with another tool, just to ensure that everything is clean. 

1. FRST Fix

NOTICE: This script was written specifically for this user. Running it on another machine may cause damage to your operating system

Please select the entire contents of the code box below, from the "Start::" line to "End::", including both lines. Right-click and select "Copy". No need to paste anything to anywhere.

Start:: closeprocesses: createrestorepoint: HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Restriction <==== ATTENTION Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found] Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found] Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found] Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found] Task: {0843E4DA-F75F-4E09-B224-0F45A78CE324} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule to run OMADMClient by server => C:\WINDOWS\system32\omadmclient.exe [438784 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {12D2A6FD-6A9B-4E8D-BF6C-1487A46C4CE1} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\OS Edition Upgrade event listener created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {15B3DC0C-E14A-4F0D-878C-3F283BDAB3E0} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule #2 created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {1736D310-BE3D-4057-AC00-287BC78AED07} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Provisioning initiated session => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {8E3D29A3-DEB8-4A00-9874-390F6125EB6A} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Wsc Startup event listener created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {9E35CF3D-D754-46DC-B95B-0D140E4AC6E1} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Passport for Work alert created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {AA9963E5-E64D-462A-B75D-63E51B969B80} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule #3 created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {CF320FD1-D011-43B9-BEBA-3F3D6DC11023} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\PushRenewal => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {D31FDE37-68FC-49D1-A970-AD2C9EAB3FB4} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule created by enrollment client for renewal of certificate warning => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {DEC8ABF1-FA0B-43C4-8899-439E14A7CA2D} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule #1 created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {E4044EFD-52CC-4C03-B185-4345539C3B83} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Win10 S Mode event listener created by enrollment client => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {E8C98BC7-EB6D-4A79-94BB-C3B472BFA86E} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\PushLaunch => C:\WINDOWS\system32\deviceenroller.exe [448512 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {F210837F-8FDE-490F-937A-E0B40CAF5863} - System32\Tasks\Microsoft\Windows\EnterpriseMgmt\1E64C5FA-EE88-444A-B07F-9C8D309FC9D2\Schedule to run OMADMClient by client => C:\WINDOWS\system32\omadmclient.exe [438784 2022-02-09] (Microsoft Windows -> Microsoft Corporation) Task: {ECBC2E21-C9D8-4FBE-BDA4-094AF1226250} - System32\Tasks\Microsoft\Windows\WindowsUpdate\RUXIM\PLUGScheduler => C:\Program Files\RUXIM\PLUGscheduler.exe [369512 2022-01-12] (Microsoft Windows -> Microsoft Corporation) emptytemp: end::

• Please right-click on FRST64 on your Desktop, to run it as administrator. When the tool opens, click "yes" to the disclaimer.
• Press the Fix button once and wait.
• FRST will process fixlist.txt
• When finished, it will produce a log fixlog.txt on your Desktop.

2. Eset Online Scanner

Download Eset Online Scanner and save it to your desktop.

• Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
• When the tool opens, click Get Started.
• Read and accept the license agreement.
• At the Welcome to ESET Online Scanner window, click Get Started.
• Select whether you would like to send anonymous data to ESET.
• Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
• Click on the Full Scan option.
• Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
• ESET will now begin scanning your computer. This may take some time. Actually, you can have a cup of coffee (or two maybe! ).
• When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
• ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
• On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
• Open the scan log on your desktop (eset.txt) and copy and paste its content into your next reply.

When you finish...

• In a comment below, I would like you to give me a link for the fixlog.txt, created in Step 1 above. 
• In a second comment please copy and paste the eset.txt, created in Step 2 above. 
• In a third comment please tell me why do you think you are infected? Any remaining issues/questions/concerns? 

Good luck!