[Solved] FRST pro¶ba o sprawdzenie logów

CustomCLSID: HKU\S-1-5-21-376792767-328496917-335451232-1001_Classes\CLSID\{1c492e6a-2803-5ed7-83e1-1b1d4d41eb39}\InprocServer32 -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll => Brak pliku

ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Basia\AppData\Local\MEGAsync\ShellExtX32.dll -> Brak pliku

ContextMenuHandlers1: [###MegaContextMenuExt] -> {0229E5E7-09E9-45CF-9228-0228EC7D5F17} => C:\Users\Basia\AppData\Local\MEGAsync\ShellExtX32.dll -> Brak pliku

AlternateDataStreams: C:\Users\Basia\Dane aplikacji:6699d3ee8dd9cf775caae782c8f44f03 [394]

AlternateDataStreams: C:\Users\Basia\AppData\Roaming:6699d3ee8dd9cf775caae782c8f44f03 [394]

HKLM\software\microsoft\Windows\CurrentVersion\Telephony\Providers => ProviderFileName2 -> ndptsp.tsp (Brak pliku)



HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems, Incorporated -> Adobe Systems Incorporated)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [644552 2019-07-04] (Oracle America, Inc. -> Oracle Corporation)

HKU\S-1-5-21-376792767-328496917-335451232-1001\...\Run: [utweb] => "C:\Users\Basia\AppData\Roaming\uTorrent Web\utweb.exe" /MINIMIZED

HKU\S-1-5-21-376792767-328496917-335451232-1001\...\Run: [mfbot] => C:\Users\Basia\Desktop\MFBOT\MFBot.exe [46317056 2020-04-13] (mfbot.de) [Brak podpisu cyfrowego]

HKU\S-1-5-21-376792767-328496917-335451232-1001\...\MountPoints2: {0dfd0dfc-3677-11e3-afb9-bc5ff48e914e} - "F:\autorun.exe" 

Startup: C:\Users\Basia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Emotiplus.lnk [2016-07-04]

ShortcutTarget: Emotiplus.lnk -> C:\Users\Basia\AppData\Local\Emotiplus\Emotiplus.exe (EMOTIPLUS -> Emotiplus)

Task: {0B42A254-EEF8-4CFC-B62F-602A7B1BC6CF} - System32\Tasks\{88AC331D-E69F-40AF-919B-A263FB2B4673} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Basia\AppData\Local\Roblox\Versions\version-a10f4d0381364a83\RobloxPlayerLauncher.exe -c -uninstall

Task: {0CF86EF0-1066-4296-BB68-91E51AEF4C83} - System32\Tasks\{19E488FA-86CE-4269-BE33-5D9ECB312555} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Basia\AppData\Local\Roblox\Versions\version-9d38e4c6fb804c52\RobloxPlayerLauncher.exe -c -uninstall

Task: {25FC3671-5548-4D3C-A213-922B441C3A26} - System32\Tasks\Microsoft\Windows\MobilePC\HotStart => {06DA0625-9701-43da-BFD7-FBEEA2180A1E}

Task: {2FB03840-2323-4893-A90C-E7A352A1F1BB} - System32\Tasks\YoutubeDownloader => C:\Users\Basia\AppData\Roaming\YoutubeDownloader\python\pythonw.exe <==== UWAGA

Task: {3D8287E4-C8A3-40EE-B7D2-8051A0A3DD4E} - System32\Tasks\{FC8BE815-6969-4513-9623-15575A311785} => C:\WINDOWS\system32\pcalua.exe -a "C:\Users\Basia\Downloads\forge-1.7.10-10.13.4.1558-1.7.10-installer-win (5).exe" -d C:\Users\Basia\Downloads

Task: {3EC52D16-0245-446C-8882-421E1D7D44F7} - System32\Tasks\Microsoft\Windows\SideShow\SessionAgent => {45F26E9E-6199-477F-85DA-AF1EDfE067B1}

Task: {66C63674-3FCD-40AD-B9C3-172337B9487E} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files\ASUS\APRP\aprp.exe

Task: {7E4BFE5E-BCEC-4345-957F-0760B6AEB44D} - System32\Tasks\{245714A4-FB92-4299-BF68-191D8F365176} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Basia\AppData\Local\Roblox\Versions\version-30a7b5a120244826\RobloxPlayerLauncher.exe -c -uninstall

Task: {9B60468F-0DED-4D8B-A87E-B235CCD6DCC8} - System32\Tasks\{37408416-CDC5-47DB-92DF-99DE83306041} => C:\WINDOWS\system32\pcalua.exe -a C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_32_0_0_363_pepper.exe -c -maintain pepperplugin

Task: {A0672CF3-B324-4B3F-A94B-586273B38F99} - System32\Tasks\{0B996F91-522D-4A67-B788-0D7916997E41} => C:\WINDOWS\system32\pcalua.exe -a C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_30_0_0_154_pepper.exe -c -maintain pepperplugin

Task: {A2D21339-48A8-4525-9688-E214FAB8869D} - System32\Tasks\Microsoft\Windows\SideShow\GadgetManager => {FF87090D-4A9A-4f47-879B-29A80C355D61}

Task: {A41B559B-9935-413A-B34A-3EB78F6AD9D1} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [2069952 2018-03-24] (NVIDIA Corporation -> NVIDIA Corporation)

Task: {B9301369-0A4F-4B24-86F4-3B44DAE5CA2B} - System32\Tasks\{D86FEC4A-2D37-4EC5-8E48-A58F813435A2} => C:\WINDOWS\system32\pcalua.exe -a "D:\soccer mania\Game.exe" -d "D:\soccer mania"

Task: {D1CFB084-2DC1-4E5B-8DCC-600FAA9AEC75} - System32\Tasks\Microsoft\Windows\SideShow\AutoWake => {E51DFD48-AA36-4B45-BB52-E831F02E8316}

Task: {E47C5B49-092A-406C-8D9C-2F06BDFB4EF0} - System32\Tasks\AdwCleaner_onReboot => C:\Users\Basia\Downloads\adwcleaner_8.0.2.exe

Task: {EDC33924-77F4-4FF4-9870-BBDD3D566B09} - System32\Tasks\{87A4862E-D9DB-4233-A1A7-162F25F40116} => C:\WINDOWS\system32\pcalua.exe -a C:\Users\Basia\Downloads\forge-1.7.10-10.13.4.1558-1.7.10-installer-win.exe -d C:\Users\Basia\Downloads

Task: {F234213E-CAFE-4B3B-BDCC-2E9410DC851E} - System32\Tasks\{A4484284-521E-4B43-B326-E8B009006593} => C:\WINDOWS\system32\pcalua.exe -a E:\Autorun.exe -d E:\

Task: {F7570B18-0FA0-43EF-ACEB-89846D9449A1} - System32\Tasks\AVG\Overseer => C:\Program Files\Common Files\AVG\Overseer\overseer.exe

Task: {FBD9863D-A156-42B3-9F7B-00B6AAF4739E} - System32\Tasks\Microsoft\Windows\SideShow\SystemDataProviders => {7CCA6768-8373-4D28-8876-83E8B4E3A969}

HKU\S-1-5-21-376792767-328496917-335451232-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp

FF Plugin HKU\S-1-5-21-376792767-328496917-335451232-1001: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [Brak pliku]

CHR StartupUrls: Profile 5 -> "hxxp://blackle.com/set-home-page/#"

R2 NvTelemetryContainer; "C:\Program Files\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvTelemetry\plugins" -r

S1 dqeqestv; \??\C:\WINDOWS\system32\drivers\dqeqestv.sys [X]

S1 fgsjoeio; \??\C:\WINDOWS\system32\drivers\fgsjoeio.sys [X]

S1 mxqixbka; \??\C:\WINDOWS\system32\drivers\mxqixbka.sys [X]

S1 qewyltgd; \??\C:\WINDOWS\system32\drivers\qewyltgd.sys [X]

S1 riymjptw; \??\C:\WINDOWS\system32\drivers\riymjptw.sys [X]

S1 tvwzjihu; \??\C:\WINDOWS\system32\drivers\tvwzjihu.sys [X]

S3 xhunter1; \??\C:\WINDOWS\xhunter1.sys [X]

S1 ydcimhzh; \??\C:\WINDOWS\system32\drivers\ydcimhzh.sys [X]

S1 YSDrv; \??\C:\Program Files\Bignox\BigNoxVM\RT\YSDrv.sys [X]

EmptyTemp: