Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
Task: {34E2F1B3-74D8-47E9-979A-0FD6C1039F6F} - System32\Tasks\Driver Booster SkipUAC (nemo) => C:\Program Files (x86)\IObit\Driver Booster\6.1.0\DriverBooster.exe [2018-11-18] (IObit)
Task: {429CF4DB-4D91-4307-B7C3-7253ECD416FC} - System32\Tasks\Opera scheduled Autoupdate 1527938697 => C:\Program Files\Opera\launcher.exe [2019-01-09] (Opera Software)
Task: {718042E0-B40A-48CC-8D7D-22E7BB8A7DC9} - System32\Tasks\ASC12_SkipUac_nemo => C:\Program Files (x86)\IObit\Advanced SystemCare\ASC.exe
Task: {B61EB7E4-78CF-4C96-8F61-E474717B55FF} - System32\Tasks\xIxJnPSrxDuXz2 => C:\Windows\system32\wscript.exe "C:\ProgramData\ZPRRvDdOzVPXJJVB\zPrgQdD.wsf"
Task: {B8DED182-CFC3-453A-A09D-D22A11FC7080} - System32\Tasks\ASC12_PerformanceMonitor => C:\Program Files (x86)\IObit\Advanced SystemCare\Monitor.exe
Hosts:
HKU\S-1-5-21-2902135042-4113931661-1799364185-1000\...\MountPoints2: {460806d2-a4a8-11e8-81e9-902b34a399e1} - J:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2902135042-4113931661-1799364185-1000\...\MountPoints2: {460806dc-a4a8-11e8-81e9-902b34a399e1} - J:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2902135042-4113931661-1799364185-1000\...\MountPoints2: {d4acc60b-e75c-11e8-8e2c-806e6f6e6963} - E:\SETUP.EXE
HKU\S-1-5-21-2902135042-4113931661-1799364185-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ-3wH9crAo2J7sAPtG2rKClMOkF4glvd9FRJqxdRTmQk6E9LSjJzNGQU8CwFWEUQceVNAN3o6AnaNEKGthmnhwvc5Oo-cV-gv6emRozvhDifEK8CZhJfW3VSGZGHBTeyZuZBrGXUgAnMVwdMqBfJ-UD1nNIH5_&q={searchTerms}
HKU\S-1-5-21-2902135042-4113931661-1799364185-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccZ-3wH9crAo2J7sAPtG2rKClMOkF4glvd9FRJqxdRTmQk6E9LSjJzNGQU8CwFWEUQcS0CVnWdGSpEsGH46pRkOiEUJKtx0LYWkSWzEKd1WkbW9IBwpCJ1tJSZGYFiCdXyLD3knjsOavm8InAmTr3X1Ll3vUvpIJ
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
Toolbar: HKU\S-1-5-21-2902135042-4113931661-1799364185-1000 -> Brak nazwy - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Brak pliku
C:\Users\nemo\AppData\Roaming\Opera Software\Opera Stable\Extensions\dmglmkdgnbnenakgmchjfkmlpmeaccio
OPR Extension: (Adblocker for Youtube™) - C:\Users\nemo\AppData\Roaming\Opera Software\Opera Stable\Extensions\dmglmkdgnbnenakgmchjfkmlpmeaccio [2018-08-02]
R2 winamgr; C:\ProgramData\Microsoft\Windows\Audio\winamgr.exe [10320384 2018-07-23] (Microsoft Corporation) [Brak podpisu cyfrowego] <==== UWAGA
S3 AscFileFilter; \??\C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\win7_amd64\AscFileFilter.sys [X]
S3 AscRegistryFilter; \??\C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\win7_amd64\AscRegistryFilter.sys [X]
S3 cpuz143; \??\C:\Windows\temp\cpuz143\cpuz143_x64.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 iobit_monitor_server; \??\C:\Program Files (x86)\IObit\Advanced SystemCare\drivers\Monitor_win7_x64.sys [X]
2019-01-31 14:11 - 2019-01-31 14:12 - 019341880 _____ (Piriform Software Ltd) C:\Users\nemo\Downloads\ccsetup552 (1).exe
2019-01-31 14:10 - 2019-01-31 14:11 - 019341880 _____ (Piriform Software Ltd) C:\Users\nemo\Downloads\ccsetup552.exe
2019-01-28 15:16 - 2019-02-01 12:13 - 000000000 ____D C:\Users\nemo\AppData\Local\NtvHost
2019-01-20 16:03 - 2019-02-01 12:16 - 000000000 ____D C:\Users\nemo\AppData\Local\GoogleChromeUserData
2019-01-20 16:03 - 2019-01-31 17:20 - 000000000 ____D C:\Users\nemo\AppData\Local\GoogleChromeApplication
2018-07-21 12:19 - 2018-07-21 12:19 - 007631872 _____ () C:\Users\nemo\AppData\Local\agent.dat
2018-07-21 12:19 - 2018-07-21 12:19 - 000070896 _____ () C:\Users\nemo\AppData\Local\Config.xml
2018-07-21 12:19 - 2018-07-21 12:19 - 000140800 _____ () C:\Users\nemo\AppData\Local\installer.dat
2018-07-21 12:19 - 2018-07-21 12:19 - 000005568 _____ () C:\Users\nemo\AppData\Local\md.xml
2018-07-21 12:19 - 2018-07-21 12:19 - 000126464 _____ () C:\Users\nemo\AppData\Local\noah.dat
2019-01-20 02:21 - 2019-01-20 02:21 - 000007605 _____ () C:\Users\nemo\AppData\Local\Resmon.ResmonCfg
2018-07-21 12:19 - 2018-07-21 12:33 - 000929792 _____ () C:\Users\nemo\AppData\Local\sham.db
2018-07-21 12:19 - 2018-07-21 12:19 - 001810944 _____ (TODO: <Company name>) C:\Users\nemo\AppData\Local\Sillax.exe
2018-07-21 12:19 - 2018-07-21 12:19 - 001989524 _____ () C:\Users\nemo\AppData\Local\Sillax.tst
2018-07-21 12:19 - 2018-07-21 12:19 - 000032038 _____ () C:\Users\nemo\AppData\Local\uninstall_temp.ico
2018-07-21 12:19 - 2018-07-21 12:19 - 001810944 _____ (TODO: <Company name>) C:\Users\nemo\AppData\Local\Y-flex.exe
2018-07-21 12:19 - 2018-07-21 12:19 - 000278509 _____ () C:\Users\nemo\AppData\Local\Y-flex.tst
2018-07-21 12:19 - 2018-07-21 12:19 - 001895382 _____ () C:\Users\nemo\AppData\Local\Zamtom.bin
