Bardzo proszę o sprawdzenie loga pod wzgędem infekcji

[piksle]

Witam, może tu ktoś mi pomoże bo już nie wiem jak sobie poradzić. Używam przeglądarki firefox internet mam światłowód 300 mb/s na speedtest do 300 podbija ping 5 ms. A zamula mi otwieranie stron, jak i YT i podobne serwisy odpalają się po kilku kilkunastu sekundach i częste buforowanie, Bardzo proszę o sprawdzenie loga

Addition.txt FRST.txt

[Bromidum]

1. Wykonaj profilaktyczne skany:

 

• RogueKiller Anti Malware
  Zalecane pobranie wersji przenośnej (portable). Przed uruchomieniem pełnego skanowania należy włączyć w ustawieniach bezsygnaturowy „moduł MaIPE (BETA)”; opcjonalnie „skanuj z pełną wydajnością” (ustawienia → ustawienia skanowania).    
   
• AdwCleaner
  Po skończonym skanowaniu pomiń linie oznaczone jako preinstalowane.
Resztę odnalezionych elementów przenieś do kwarantanny. 

 

2. Odinstaluj:

- µTorrent (zamień na qBittorent)

- CCleaner (zamień na BleachBit) 

- NVIDIA GeForce Experience

- Spybot - Search & Destroy 

- WebAdvisor firmy McAfee

- Avast Free Antivirus

 

Pobieraj programy ze strony producenta, bez zbędnych asystentów pobiera. Ostrożnie z pobieraniem torrentów.  

 

3. Uruchom FRST/FRST64.exe, wciśnij kombinację klawiszy ctrl + y. Otworzy się notatnik, do którego wklej zawartość skryptu. Zamknij i zapisz. W FRST kliknij „napraw” →


CloseProcesses:
CreateRestorePoint:
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiSpyware] Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Microsoft\Windows Defender: [DisableAntiVirus] Ograniczenia <==== UWAGA
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1802584 2022-08-04] (Overwolf Ltd -> Overwolf Ltd.)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [Opera GX Stable] => C:\Users\i7\AppData\Local\Programs\Opera GX\launcher.exe [2566600 2023-01-04] (Opera Norway AS -> Opera Software)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [MicrosoftEdgeAutoLaunch_B938E366F1C197C9E46D8EBEB4F065F0] => "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start /prefetch:5 [4188576 2023-02-02] (Microsoft Corporation -> Microsoft Corporation)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [Opera GX Browser Assistant] => C:\Users\i7\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe [3291288 2021-02-01] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [482128 2023-01-25] (AVB Disc Soft, SIA -> Disc Soft Ltd)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\Run: [ut] => C:\Users\i7\AppData\Roaming\uTorrent\uTorrent.exe [2719752 2023-01-31] (Rainberry Inc -> BitTorrent Inc.)
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\MountPoints2: {4c4da785-9c16-11ed-9443-18c04d59aa18} - "E:\SETUP.EXE" 
BootExecute: autocheck autochk * sdnclean64.exe
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
Task: {04500335-F6E1-487C-9EE6-74E34587D9D8} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {2009D6BA-A193-42F1-90D9-04BBC6227C56} - System32\Tasks\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\default-browser-agent.exe [710560 2023-02-01] (Mozilla Corporation -> Mozilla Foundation)
Task: {41C34A1A-1EFF-4A35-B38A-38EAF1F3CFBC} - System32\Tasks\Overwolf Updater Task => C:\Program Files (x86)\Common Files\Overwolf\OverwolfUpdater.exe [2577752 2022-08-04] (Overwolf Ltd -> Overwolf LTD)
Task: {4C07BA55-B1F3-4767-98E8-379ED9947DE0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [5363552 2021-11-16] (Safer-Networking Limited -> Safer-Networking Ltd.)
Task: {6657AA13-C580-496A-9756-DC7112BC1CE6} - System32\Tasks\Opera GX scheduled Autoupdate 1669491905 => C:\Users\i7\AppData\Local\Programs\Opera GX\launcher.exe [2566600 2023-01-04] (Opera Norway AS -> Opera Software)
Task: {6701AC24-8B81-4E26-82B9-33DC2C6D40E9} - System32\Tasks\EOSv3 Scheduler onLogOn => C:\Users\i7\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2022-07-22] (ESET, spol. s r.o. -> ESET)
Task: {719ABD0C-322C-49D2-9A55-5EFEFC3629B2} - System32\Tasks\EOSv3 Scheduler onTime => C:\Users\i7\AppData\Local\ESET\ESETOnlineScanner\ESETOnlineScanner.exe [21737944 2022-07-22] (ESET, spol. s r.o. -> ESET)
Task: {728CFE8E-2B16-442F-93CC-E59BEC4DD9A3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [5629064 2021-11-23] (Safer-Networking Limited -> Safer-Networking Ltd.)
Task: {7C86674A-B186-48D8-B9F1-7DE95EC92CF1} - System32\Tasks\Opera scheduled Autoupdate 1661100725 => C:\Users\i7\AppData\Local\Programs\Opera\launcher.exe --scheduledautoupdate $(Arg0) (Brak pliku)
Task: {8D696A35-828F-425D-A68C-F092E14FD825} - System32\Tasks\Opera GX scheduled assistant Autoupdate 1671216463 => C:\Users\i7\AppData\Local\Programs\Opera GX\launcher.exe [2566600 2023-01-04] (Opera Norway AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\i7\AppData\Local\Programs\Opera GX\assistant" $(Arg0)
Task: {A5B14CCB-2F64-4DE5-A1ED-F074AD163CFA} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [661408 2023-02-01] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
Task: {AE9B48D6-B9F3-4E44-AEC2-0F7C6212ADAE} - System32\Tasks\Avast Software\Overseer => C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe [2295192 2023-01-30] (Avast Software s.r.o. -> Avast Software)
Task: {B279B748-1575-47AD-AA5A-50C4CFA65F35} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\Office16\msoia.exe [416432 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Task: {CB357531-6DC4-45EB-A783-C29C02B002C5} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [6093928 2021-12-20] (Safer-Networking Limited -> Safer-Networking Ltd.)
Task: {D36CBB46-EBD9-4643-B19F-C6F09A924D68} - System32\Tasks\CCleanerCrashReporting => C:\Program Files\CCleaner\CCleanerBugReport.exe [4713808 2023-01-11] (PIRIFORM SOFTWARE LIMITED -> Piriform Software) -> --product 90 --send dumps|report --path "C:\Program Files\CCleaner\LOG" --programpath "C:\Program Files\CCleaner" --configpath "C:\Program Files\CCleaner\Setup" --guid "68dfa08b-8373-4f0e-874a-e2ae5eb55633" --version "6.08.10255" --silent
Task: {E886A82E-2318-4C72-8955-0F4C1DC5352E} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2023-01-11] (Piriform Software Ltd -> Piriform)
Task: {EF9D15C5-B29F-46EA-89BE-3A259C64FD9A} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office16\OLicenseHeartbeat.exe [316632 2015-07-31] (Microsoft Corporation -> Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{0abb1187-7a54-43d4-9dd7-c81d452042e6}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{d1050d2f-e84b-42f7-bca8-46b9d56dccbb}: [DhcpNameServer] 192.168.100.1
Edge HKLM\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
Edge HKLM-x32\...\Edge\Extension: [bojobppfploabceghnmlahpoonbcbacn]
FF Extension: (Adblock Plus - free ad blocker) - C:\Users\i7\AppData\Roaming\Mozilla\Firefox\Profiles\pvpgak2t.default-release\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2022-12-05]
C:\Users\i7\AppData\Local\Google\Chrome\User Data\Default\Extensions\aegnopegbbhjeeiganiajffnalhlkkjb
C:\Users\i7\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho]
CHR HKLM-x32\...\Chrome\Extension: [ihcjicgdanjaechkgeegckofjjedodee]
S3 ALSysIO; C:\Users\i7\AppData\Local\Temp\ALSysIO64.sys [47240 2023-01-31] (ALCPU (Arthur Liberman) -> Arthur Liberman) <==== UWAGA
R3 cpuz143; C:\Users\i7\AppData\Local\Temp\cpuz143\cpuz143_x64.sys [48960 2023-02-02] (CPUID -> CPUID) <==== UWAGA
S3 rsDwf; \SystemRoot\system32\DRIVERS\rsDwf.sys [X]
2023-01-26 20:49 - 2023-01-26 20:49 - 000000893 _____ C:\Users\i7\Desktop\µTorrent.lnk
2023-01-26 20:49 - 2023-01-26 20:49 - 000000000 ____D C:\Users\i7\AppData\LocalLow\uTorrent.WebView2
2023-02-04 00:02 - 2022-08-21 17:52 - 000000000 ____D C:\Users\i7\AppData\Roaming\uTorrent
2023-02-03 19:38 - 2022-08-21 17:53 - 000000000 ____D C:\Users\i7\AppData\Local\BitTorrentHelper
2023-01-26 20:49 - 2023-01-26 20:49 - 000000873 _____ C:\Users\i7\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2023-01-26 20:48 - 2023-01-26 20:48 - 001762576 _____ ( ) C:\Users\i7\Downloads\utorrent_installer(3).exe
2023-01-26 20:40 - 2023-01-26 20:40 - 001762576 _____ ( ) C:\Users\i7\Downloads\utorrent_installer.exe
2023-01-26 20:40 - 2023-01-26 20:40 - 001762576 _____ ( ) C:\Users\i7\Downloads\utorrent_installer(1).exe
2023-01-26 20:37 - 2023-01-26 20:37 - 000000000 ____D C:\Program Files\McAfee
2023-01-26 20:36 - 2023-01-26 20:37 - 000000000 ____D C:\ProgramData\McAfee
C:\Program Files (x86)\Spybot - Search & Destroy 2
AV: Spybot - Search and Destroy (Disabled - Out of date) {F77C7796-45C4-531E-0DAE-B4A8229B11C8}
AV: Reason Cybersecurity (Enabled - Up to date) {ED4D1201-4876-7014-6F49-4BC9DA784B64}
AlternateDataStreams: C:\ProgramData:err [1090]
AlternateDataStreams: C:\Users\All Users:err [1090]
AlternateDataStreams: C:\ProgramData\Dane aplikacji:err [1090]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epic Games Launcher.lnk:BE32D07BC5 [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk:980850BA8A [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameDesire Gameroom.lnk:E736917BE1 [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk:F20EF51E1F [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk:FBFC89DD04 [2594]
AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk:F208FC6732 [2594]
AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [4058]
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "MicrosoftEdgeAutoLaunch_B938E366F1C197C9E46D8EBEB4F065F0"
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "ut"
FirewallRules: [{16BA2703-FC89-473D-B615-AADE45C5F9D5}] => (Allow) C:\Users\i7\Desktop\Tundra_1.16.1.0(32).ini => Brak pliku
FirewallRules: [{3C57621B-7799-4138-AA58-1D52A531D948}] => (Allow) C:\Users\i7\Desktop\Tundra_1.16.1.0(32).ini => Brak pliku
FirewallRules: [{0B80BF43-A9ED-464B-B4C1-C2431F308331}] => (Allow) C:\Users\i7\Desktop\Tundra_1.16.1.0(32).ini => Brak pliku
FirewallRules: [{0BED8BE4-6639-4631-AA3B-4A49F7C6DCB2}] => (Allow) C:\Users\i7\Desktop\Tundra_1.16.1.0(32).ini => Brak pliku
FirewallRules: [{30E7C3E8-C3BC-439E-8A08-BA19ECBFDED2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\War Thunder\eac_wt_mlauncher.exe => Brak pliku
FirewallRules: [{FB41DB75-9A78-4223-B750-6552373A7B38}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\War Thunder\eac_wt_mlauncher.exe => Brak pliku
FirewallRules: [{C36B4494-A865-427C-B505-4A4E458F3E05}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\War Thunder\launcher.exe => Brak pliku
FirewallRules: [{7818F198-8899-4AD9-9F66-F4437EBE43A4}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\War Thunder\launcher.exe => Brak pliku
FirewallRules: [TCP Query User{FD9E3A11-5647-441A-B7DE-FF6F7A53ED23}C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe => Brak pliku
FirewallRules: [UDP Query User{5903B629-2A9F-4F80-9DEC-6E89BB12B271}C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\war thunder\win64\aces.exe => Brak pliku
FirewallRules: [{48ED0448-A074-451C-A355-466A30251C9A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soundpad\Soundpad.exe => Brak pliku
FirewallRules: [{5C3FE84F-7DFC-4D75-861F-32B5B6740C47}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Soundpad\Soundpad.exe => Brak pliku
FirewallRules: [TCP Query User{ED474207-893C-4624-9355-440B416A3350}C:\users\i7\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\i7\appdata\local\discord\app-1.0.9008\discord.exe => Brak pliku
FirewallRules: [UDP Query User{A4F95899-B631-427F-857B-E91436D484EE}C:\users\i7\appdata\local\discord\app-1.0.9008\discord.exe] => (Allow) C:\users\i7\appdata\local\discord\app-1.0.9008\discord.exe => Brak pliku
FirewallRules: [{B1C5FE8D-8FF9-463A-B9C3-F4BC6F862D3C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sea of Thieves\Athena\Binaries\Win64\SoTGame.exe => Brak pliku
FirewallRules: [{23A07DA2-6310-4842-BD9C-6793985969CA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Sea of Thieves\Athena\Binaries\Win64\SoTGame.exe => Brak pliku
FirewallRules: [{C3F4E672-24D4-49A0-B8CB-B59BF68F1F9A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SCP Secret Laboratory\SCPSL.exe => Brak pliku
FirewallRules: [{F1673C9E-EE30-47B0-9E4F-95DCC3CC0322}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\SCP Secret Laboratory\SCPSL.exe => Brak pliku
FirewallRules: [{FFE8D1F5-6C68-4B98-A212-28D763735940}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe => Brak pliku
FirewallRules: [{A78F6815-8F53-472A-ABEB-FA628534B570}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x64\eurotrucks2.exe => Brak pliku
FirewallRules: [{45ED7C1B-AB79-4902-AE12-B8661097782A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe => Brak pliku
FirewallRules: [{417F2ECD-4D1A-49DE-80F5-FE408767AE58}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Euro Truck Simulator 2\bin\win_x86\eurotrucks2.exe => Brak pliku

Hosts:
RemoveProxy:
EmptyEventLogs: 
EmptyTemp:

 

Plik naprawczy przeznaczony jest tylko dla autora wątku!


Po wykonaniu skryptu i ponownym uruchomieniu załącz utworzony fixlog.txt  

 

4. Zmień serwer DNS na Quad9 → https://www.youtube.com/embed/aujUl3yt6nM?autoplay=1 (podstawowy 9.9.9.9, zapasowy 149.112.112.112) 

W Firefoxie za obecnego Adblocka zainstaluj uBlock Origin → https://addons.mozilla.org/pl/firefox/addon/ublock-origin/
Dodatkowo podrzucam poradnik do Chrome → https://soo.bearblog.dev/chrome/ (zwróć uwagę na filtry)

 

5. Utwórz nowe logi FRST do kontroli, wybierając w programie opcję "skanuj".

Edytowane 6 lutego 2023 przez Bromidum

[piksle]

Zrobiłem wszystko zgodnie z opisem (mam nadzieję)  ale już widzę ulgę w systemie, przesyłam logi po wszystkim, i z miłą chęcią wesprę w jakikolwiek sposób za pomoc

Fixlog.txt FRST.txt Addition.txt

[Bromidum]

FRST.txt jest ucięty - popraw log.

Czy RogueKiller i AdwCleaner odnalazły jakieś zagrożenie? 

[piksle]

teraz są poprawnie wysłane

Addition.txt FRST.txt AdwCleaner[S05].txt skanRogueKiller.txt

[Bromidum]

Wysłałem Tobie wiadomość prywatną z kilkoma dodatkowymi sugestiami.  

 

• Malwarebytes Anti-Malware - masz już zainstalowany 
  Upewnij się, że przed skanowaniem zostało zaznaczone: skanuj w poszukiwaniu rootkitów, skanuj archiwa, użyj sztucznej inteligencji. Opcje te odnajdziesz w ustawieniach → bezpieczeństwo → opcje skanowania.  

 

Uruchom FRST/FRST64.exe, wciśnij kombinację klawiszy ctrl + y. Otworzy się notatnik, do którego wklej zawartość skryptu. Zamknij i zapisz. W FRST kliknij „napraw” →


CloseProcesses:
CreateRestorePoint: 
VirusTotal: C:\Users\i7\Downloads\windows.exe
Task: {73AFB7B7-E8B2-4A21-B352-0E87A5A30249} - System32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB => C:\Program Files\Mozilla Firefox\firefox.exe [661408 2023-02-01] (Mozilla Corporation -> Mozilla Corporation) -> --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate
HKLM\Software\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files\Google\Chrome\Application\109.0.5414.120\Installer\chrmstp.exe [2023-01-27] (Google LLC -> Google LLC)
FF Extension: (Send invitation/Wysyłanie zaproszeń) - C:\Users\i7\AppData\Roaming\Mozilla\Firefox\Profiles\pvpgak2t.default-release\Extensions\{b75a35da-cd53-4313-afd1-fcb0b2bec23f}.xpi [2022-07-10] [UpdateUrl:hxxps://wot-recruitment.pl/extension/updates.json]
C:\Users\i7\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha
S4 NvModuleTracker; \SystemRoot\System32\DriverStore\FileRepository\nvmoduletracker.inf_amd64_0c1cc60a4b422185\NvModuleTracker.sys [X]
S4 nvvad_WaveExtensible; \SystemRoot\system32\drivers\nvvad64v.sys [X]
2023-02-06 20:05 - 2022-09-01 16:25 - 000000000 ____D C:\Users\i7\AppData\Local\Avast Software
2023-02-06 20:05 - 2022-08-21 17:52 - 000000000 ____D C:\ProgramData\Avast Software
2023-02-06 19:54 - 2022-09-01 16:16 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2023-01-31 21:07 - 2023-01-31 21:07 - 001306344 _____ () C:\Users\i7\Downloads\speedfan-6628363139270273-AsystentPobierania_v1.055.796.47.4.exe
2023-01-31 21:07 - 2023-01-31 21:07 - 001306344 _____ () C:\Users\i7\Downloads\speedfan-6628363139270273-AsystentPobierania_v1.05.57.96.47.4.exe
2023-01-29 16:51 - 2023-01-29 16:51 - 001306344 _____ () C:\Users\i7\Downloads\hwmonitor-6628685807028353-AsystentPobierania_v3.093.436.292.exe
2023-01-29 16:51 - 2023-01-29 16:51 - 001306344 _____ () C:\Users\i7\Downloads\hwmonitor-6628685807028353-AsystentPobierania_v3.09.34.362.92.exe
2023-01-26 20:36 - 2023-01-26 20:36 - 001306344 _____ () C:\Users\i7\Downloads\utorrent-6628624360319105-AsystentPobierania_v0.44.04.17.64.7.exe
2023-01-26 20:35 - 2023-01-26 20:36 - 001306344 _____ () C:\Users\i7\Downloads\utorrent-6628624360319105-AsystentPobierania_v0.440.41.76.47.exe
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
ContextMenuHandlers2: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
ContextMenuHandlers2: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> Brak pliku
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "CCleaner Smart Cleaning"
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "BakkesMod"
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "Opera GX Stable"
HKU\S-1-5-21-3198104584-1951858979-1071046496-1001\...\StartupApproved\Run: => "Opera GX Browser Assistant"
HKLM\...\StartupApproved\StartupFolder: => "$McRebootA5E6DEAA56$.lnk"
FirewallRules: [{25661090-A1C7-4051-B0EC-A9F7205FCD66}] => (Allow) C:\Users\i7\AppData\Local\Temp\utorrent\utorrent.exe => Brak pliku
FirewallRules: [{AC2CB9F7-70C6-4460-B31D-EF4D4EFC3EA8}] => (Allow) C:\Users\i7\AppData\Local\Temp\utorrent\utorrent.exe => Brak pliku
EmptyTemp:

 

Plik naprawczy przeznaczony jest tylko dla autora wątku!


Po wykonaniu skryptu i ponownym uruchomieniu załącz utworzony fixlog.txt

Edytowane 6 lutego 2023 przez Bromidum