@TrueDie masz tylko jeden problem, nie potrafisz sciagac torrentow i sciagasz zainfekowane, dlatego teraz kopiesz dla kogos bitcoiny.
Fixlist.txt:
CloseProcesses:
(Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] C:\Users\Tomek\AppData\Roaming\.dllbackups\dllruntime.exe
(Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\Tomek\AppData\Local\Temp\1y6QaG1dVqmqkzRvawVNVxn3bhE\dllservices.exe <4>
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706288 2021-04-09] (Oracle America, Inc. -> Oracle Corporation)
HKLM-x32\...\Run: [] => [X]
HKU\S-1-5-21-4168713232-2136251825-2858130799-1001\...\Run: [Chromium] => "c:\users\tomek\appdata\local\chromium\application\chrome.exe" --auto-launch-at-startup --profile-directory="Default" --restore-last-session
HKU\S-1-5-21-4168713232-2136251825-2858130799-1001\...\Run: [Opera GX Browser Assistant] => C:\Users\Tomek\AppData\Local\Programs\Opera GX\assistant\browser_assistant.exe [3291288 2021-02-01] (Opera Software AS -> Opera Software)
HKU\S-1-5-21-4168713232-2136251825-2858130799-1001\...\Run: [electron.app.dllservices] => C:\Users\Tomek\AppData\Roaming\.dllbackups\dllruntime.exe [63924677 2021-09-14] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu]
HKU\S-1-5-21-4168713232-2136251825-2858130799-1001\...\MountPoints2: {30073433-1ff1-11ec-8193-d8cb8a19723c} - "F:\HiSuiteDownLoader.exe"
Task: {78580240-D382-42F0-87A7-AB3C9AB4E0D2} - System32\Tasks\Opera GX scheduled Autoupdate 1606934998 => C:\Users\Tomek\AppData\Local\Programs\Opera GX\launcher.exe [2192592 2021-12-22] (Opera Software AS -> Opera Software)
Task: {CD42B463-2C19-4B13-AEFE-DCA79B1E6024} - System32\Tasks\Opera GX scheduled assistant Autoupdate 1615549919 => C:\Users\Tomek\AppData\Local\Programs\Opera GX\launcher.exe [2192592 2021-12-22] (Opera Software AS -> Opera Software) -> --scheduledautoupdate --component-name=assistant --component-path="C:\Users\Tomek\AppData\Local\Programs\Opera GX\assistant" $(Arg0)
CHR HKLM-x32\...\Chrome\Extension: [aegnopegbbhjeeiganiajffnalhlkkjb]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj]
2021-12-14 12:23 - 2021-12-14 12:23 - 000005222 _____ () C:\Users\Tomek\AppData\Local\2636042875
2021-12-08 16:33 - 2021-12-08 16:33 - 000005190 _____ () C:\Users\Tomek\AppData\Local\4208131837
C:\Users\Tomek\AppData\Roaming\.dllbackups\
C:\Users\Tomek\AppData\Roaming\dll-propagation\
C:\Users\Tomek\AppData\Roaming\dllservices\
EmptyTemp:
Do tego nie pisz post pod postem, uzywaj ZMIEN.