Nie pojawil sie Fixlist.txt, tylko ktos go sciagnal z internetu, naiwnie myslac, ze to cos pomoze...
Odinstaluj: McAfee SiteAdvisor Enterprise
Zrob skan przy pomocy Mbam oraz AdwCleaner i usun to co wykryje.
Wykonaj Fixlist.txt dla FRST:
CloseProcesses:
(C:\Users\SAWEK~1\AppData\Local\Temp\24qrrXHyyao7PIDSMXbgocvqIlv\services.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] C:\Users\Sławek\AppData\Roaming\.dllbackups\data\modules\dll-propagation\dll-propagation_2.9.8.exe
C:\Users\Sławek\AppData\Roaming\.dllbackups\
(C:\Users\Sławek\AppData\Roaming\.dllbackups\data\modules\dll-propagation\dll-propagation_2.9.8.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\SAWEK~1\AppData\Local\Temp\1xq0MkKMTM0YtEl1JnXJ2x0ArfP\dll-propagation.exe <4>
(C:\Users\Sławek\AppData\Roaming\.dllbackups\dllservices.exe ->) (Microsoft Corporation) [Brak podpisu cyfrowego] C:\Users\SAWEK~1\AppData\Local\Temp\24qrrXHyyao7PIDSMXbgocvqIlv\services.exe <5>
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-12-16] (Oracle America, Inc. -> Oracle Corporation)
HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore: [DisableSR/DisableConfig] <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [35888256 2022-03-10] (Piriform Software Ltd -> Piriform Software Ltd)
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\Run: [InstMP_Service] => C:\Users\Sławek\AppData\Local\InstallShield\InstMP.exe [10240 2019-08-21] () [Brak podpisu cyfrowego]
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\Run: [electron.app.dllservices] => C:\Users\Sławek\AppData\Roaming\.dllbackups\dllservices.exe [63160117 2022-02-27] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] <==== UWAGA
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\Run: [electron.app.services] => C:\Users\Sławek\AppData\Roaming\.dllbackups\dllservices.exe [63160117 2022-02-27] (Microsoft Corporation) [Brak podpisu cyfrowego] [Plik w użyciu] <==== UWAGA
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\RunOnce: [FlashPlayerUpdate] => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_32_0_0_465_Plugin.exe [1504312 2020-12-09] (Adobe Inc. -> Adobe)
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\MountPoints2: {293ae45c-2095-11e9-aff2-b00594f3c5f7} - F:\Fairlight\Installer.exe
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\MountPoints2: {7f41c89d-ecd5-11e7-b731-b00594f3c5f7} - F:\SETUP.EXE
HKU\S-1-5-21-3589725667-2707424421-2716767340-1006\...\MountPoints2: {7f41c8a1-ecd5-11e7-b731-b00594f3c5f7} - G:\SETUP.EXE
HKU\S-1-5-18\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [35888256 2022-03-10] (Piriform Software Ltd -> Piriform Software Ltd)
ShortcutTarget: Chatter Desktop.lnk -> C:\Program Files (x86)\salesforce.com\Chatter Desktop\Chatter Desktop.exe (Brak pliku)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Dell System Manager.lnk [2013-11-13]
ShortcutTarget: Dell System Manager.lnk -> C:\Program Files\Dell\Dell System Manager\DCPSysMgr.exe (Dell Inc -> Dell Inc.)
Startup: C:\Users\slawomir.lipina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chatter Desktop.lnk [2018-06-18]
ShortcutTarget: Chatter Desktop.lnk -> C:\Program Files (x86)\salesforce.com\Chatter Desktop\Chatter Desktop.exe (Brak pliku)
Startup: C:\Users\slawomir.lipina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2018-09-02]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Brak pliku)
Startup: C:\Users\Sławek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chatter Desktop.lnk [2018-03-11]
ShortcutTarget: Chatter Desktop.lnk -> C:\Program Files (x86)\salesforce.com\Chatter Desktop\Chatter Desktop.exe (Brak pliku)
Startup: C:\Users\Sławek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk [2017-04-30]
ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Brak pliku)
Startup: C:\Users\usys-admn-marcin.wdo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chatter Desktop.lnk [2018-06-24]
ShortcutTarget: Chatter Desktop.lnk -> C:\Program Files (x86)\salesforce.com\Chatter Desktop\Chatter Desktop.exe (Brak pliku)
GroupPolicy: Ograniczenia ? <==== UWAGA
Policies: C:\ProgramData\NTUSER.pol: Ograniczenia <==== UWAGA
Policies: C:\Users\slawomir.lipina\NTUSER.pol: Ograniczenia <==== UWAGA
Policies: C:\Users\usys-admn-marcin.wdo\NTUSER.pol: Ograniczenia <==== UWAGA
HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
Task: {00009D2F-5A09-4110-8997-E20DF1957CEB} - System32\Tasks\{54392DDC-7290-4EFD-A9D8-99A57D2B8B24} => C:\Users\Sławek\Desktop\SH\Sensual_Haunting\!Start.exe (Brak pliku)
Task: {040B4C35-590A-4A7B-895A-4516FE3A4F3B} - System32\Tasks\{6F0A1312-AE3B-49B1-B68A-485BE6E21591} => G:\Sławek\Game\MOHW.exe (Brak pliku)
Task: {070F6C6A-1D00-487D-8032-C9C819BDDDB1} - System32\Tasks\{9546C56B-8245-4932-AE22-305E4FBB506D} => C:\Program Files (x86)\Activision\Call of Duty 2\CoD2SP_s.exe (Brak pliku)
Task: {093AC37B-5753-4AC1-8686-8CF16D746358} - System32\Tasks\Admin-Rights-Remover => \S2.MS.UNILEVER.COM\SysVol\S2.MS.UNILEVER.COM\Policies\{E910EC8E-AF66-4BB3-9DF4-EDA00A484107}\User\Scripts\Logon\Admin-Rights-Remover.vbs (Brak pliku)
Task: {0B81E4BC-F21F-47FD-928A-425E3037B2B2} - System32\Tasks\{25A4F415-A61B-469E-B89D-67E9AF26FA0E} => E:\setup.exe (Brak pliku)
Task: {11E1BDF1-0C65-40A1-A581-3F322E139018} - System32\Tasks\CorelUpdateHelperTaskCore => C:\Program Files (x86)\Corel\CUH\v2\CUH.exe /t (Brak pliku)
Task: {1FB015C7-CA35-4D53-9DA9-8353BCFF7E27} - System32\Tasks\{8116AC3E-F270-4846-8F2D-AF869F96B13A} => C:\Users\Sławek\Downloads\Mafia.II.Digital.Deluxe.Edition.RUS.ENG.MULTi.RePack.-VickNet\setup.exe (Brak pliku)
Task: {24F1DABB-DE8B-4AE3-93D6-17C668706568} - System32\Tasks\{B195B3B0-F176-4879-B30F-566554DC8659} => C:\WINDOWS\system32\pcalua.exe -a E:\setup.exe -d E:\
Task: {2BCC6E5C-6AC6-4542-8E69-BE05FDDE0FA5} - System32\Tasks\Disable-Wifi-On-Lan-Copy => \S2.MS.UNILEVER.COM\SysVol\S2.MS.UNILEVER.COM\Policies\{904D96B4-F5B5-4F83-9057-C981E455395D}\Machine\Scripts\Startup\CopyLocal.vbs (Brak pliku)
Task: {2EA3AB55-E74D-474C-97B6-7055DC418996} - System32\Tasks\{1DE16936-8AA4-4A37-8898-4BF6CD0AFE3E} => F:\DVDCheck.exe (Brak pliku)
Task: {2F20A466-0728-47EE-AA85-8EF1FC43B828} - \Spooler SubSystem App -> Brak pliku <==== UWAGA
Task: {30190741-6E40-4925-B6F4-DC32B56F86FC} - System32\Tasks\wininit => C:\ProgramData\unsecapp\spoolsv.exe (Brak pliku)
Task: {40F2104C-137D-45CA-A202-27700050636B} - System32\Tasks\FreedomeReset => C:\Program Files (x86)\F-Secure\Freedome\Freset.exe (Brak pliku)
Task: {42329015-216C-462D-9872-C99CE83144D0} - System32\Tasks\{C2B521EC-6C3A-4112-B2A7-339F9C30B862} => G:\Sławek\Game\MOHW.exe (Brak pliku)
Task: {464B4106-A925-4347-8B87-924027AE26C7} - System32\Tasks\{F718109D-C601-4EE6-A859-50DE34303606} => E:\setup.exe (Brak pliku)
Task: {48716F4A-AC12-4FE7-98D9-0395CC3356A0} - System32\Tasks\{1785D882-039D-40AB-8391-1F74B3653CAF} => F:\Slav\AM\Sensual Haunting\Sensual_Haunting\!Start.exe (Brak pliku)
Task: {4B5D6F54-073F-4C33-B00D-FECBA8617D6C} - System32\Tasks\UACEnable => C:\Windows\System32\cscript.exe C:\ProgramData\RemoveMachineFromAD.vbs
Task: {5558821A-4DE1-4D9A-A07B-0434430E891B} - System32\Tasks\{539EDF12-1C4C-424E-ACE6-6CF0E0D064AC} => F:\Slav\AM\Sensual Haunting\Sensual_Haunting\!Start.exe (Brak pliku)
Task: {56DC5905-3F2E-4EC8-BA0E-6D6E82F29D1F} - System32\Tasks\CCleaner Update => C:\Program Files\CCleaner\CCUpdate.exe [684976 2022-03-10] (Piriform Software Ltd -> Piriform)
Task: {6ADCB6AA-1341-48BA-A15D-8F963075EC42} - System32\Tasks\CCleanerSkipUAC - Sławek => C:\Program Files\CCleaner\CCleaner.exe [30053504 2022-03-10] (Piriform Software Ltd -> Piriform Software Ltd)
Task: {6B905CE9-DDE5-4644-8370-6776C3986C5E} - System32\Tasks\{E65839FB-E883-451C-80F4-BE580B7E6565} => C:\WINDOWS\system32\pcalua.exe -a C:\Windows\NetSurveillance\uninstall.exe -c "/U:C:\WINDOWS\NetSurveillance\Uninstall\uninstall.xml"
Task: {7AF53218-C1CD-49F4-8363-2121B9204DB4} - System32\Tasks\FreedomeTrialReset => C:\ProgramData\F-Secure\Freedome\FreedomeTrialReset.exe (Brak pliku)
Task: {84CEAA17-1788-4AE8-A1B8-90FFD38AA65E} - System32\Tasks\{222CA262-4464-4E17-A882-682240615846} => C:\Users\Sławek\Desktop\SH\Sensual_Haunting\!Start.exe (Brak pliku)
Task: {8DAB1938-0EE6-44F3-B578-2DE5FCC0EFF0} - System32\Tasks\{B1096A8A-4A2C-4DE6-B745-EC48B3DBC3FF} => C:\Users\slawomir.lipina\Downloads\iTunes64Setup.exe (Brak pliku)
Task: {9E4B774E-4AE9-4220-A8CE-8418149DF968} - System32\Tasks\{2AEC9BD4-4369-47FB-AF61-7DB28B478F4B} => G:\Sławek\Game\MOHW.exe (Brak pliku)
Task: {9E724C75-88B5-4396-A317-E7429988FF44} - System32\Tasks\{D6E7F4C1-B20A-4EE2-B769-6136EB853155} => C:\WINDOWS\system32\pcalua.exe -a F:\DirectX9\dxsetup.exe -d F:\DirectX9
Task: {A745BDA6-C913-41B5-A433-725B9BAF5959} - System32\Tasks\{892902D1-B78D-4BDF-9A1D-BE03A335F0ED} => D:\MTKV26B1 Aktywator POLECAM !!!\Microsoft Toolkit.exe (Brak pliku)
Task: {AEBB44AC-2333-4FE6-A19D-80688758F069} - System32\Tasks\HealthCheckTool => C:\WINDOWS\System32\cscript.exe "C:\Program Files\SMS\HealthCheckTool\Scripts\HealthCheckTool.wsf"
Task: {B006EE64-67F9-4837-B9AF-8B3D7AC5C1A0} - System32\Tasks\Boot Time Logger => \S2.MS.UNILEVER.COM\SYSVOL\S2.MS.UNILEVER.COM\Policies\{06C0B6B1-36EB-4029-9127-00F122100C30}\Machine\Scripts\StartUp\EventLogBoottimeWMI.VBS (Brak pliku)
Task: {B9B2ED91-250D-4A8C-B98F-4EB08642EE0F} - System32\Tasks\csrss => C:\Users\Sławek\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\WmiPrvSE\svchost.exe (Brak pliku) <==== UWAGA
Task: {BD05BB98-AAC1-4033-BA47-AB888F1A2E49} - System32\Tasks\{4284D231-ADD0-4DCB-A418-8CE6E54207C9} => E:\setup.exe (Brak pliku)
Task: {C0AB57B5-24D7-4B69-A566-7C0CF5EFA9E1} - System32\Tasks\{39DB776B-2116-451B-A676-AC9D156AF3A4} => C:\Users\Sławek\Desktop\CoD2SP_s.exe (Brak pliku)
Task: {C5C61329-1EA2-458C-9D0D-CAA099D69A34} - System32\Tasks\{81199E38-26E7-43A3-B9A4-75AA24C1AF8B} => C:\WINDOWS\system32\pcalua.exe -a G:\setup.exe -d G:\
Task: {CB9A7ED8-1D7A-4328-AB0A-C4FBFA161686} - System32\Tasks\{849F7C56-92E3-450E-AB41-A76B2C800DAB} => F:\DVDCheck.exe (Brak pliku)
Task: {CFDD59F3-F538-4B9E-8A96-948428B26CDE} - System32\Tasks\Disable-Wifi-On-Lan-Run => C:\Windows\System32\cscript.exe c:\windows\Temp\Disable-Wifi-On-Lan.vbs <==== UWAGA
Task: {DC14BAFA-D838-4DEB-9538-F2D4279FD1F8} - System32\Tasks\Microsoft Office 15 Sync Maintenance for {faf5b70c-1d66-4f58-ae3d-8cd538cc27aa} KCBLW78J2CRY1.S2.MS.UNILEVER.com => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe (Brak pliku)
Task: {E02B2D8C-E765-451A-8918-6CCE7BC71968} - \Windows\Services\Management Service -> Brak pliku <==== UWAGA
Task: {EFA7953A-2FE8-40AE-B5DE-12E18EDA0F79} - System32\Tasks\{CE450C95-72C3-4EBF-8502-5D57DCEAAA38} => E:\setup.exe (Brak pliku)
Task: {FDFEFAEF-79D1-4840-A808-F004154842FC} - \Windows\Services\Windows Extension library for rastls -> Brak pliku <==== UWAGA
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
CHR Extension: (Kaspersky Protection) - C:\Users\Sławek\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ahkjpbeeocnddjkakilopmfdlnjdpcdm [2022-01-07]
CHR Extension: (McAfee SiteAdvisor Enterprise) - C:\Users\Sławek\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\cmendinpapjjojakimjlmkkkcmnojefg [2022-01-07]
CHR Extension: (McAfee SiteAdvisor Enterprise) - C:\Users\Sławek\AppData\Local\Google\Chrome\User Data\Profile 3\Extensions\cmendinpapjjojakimjlmkkkcmnojefg [2022-02-02]
CHR HKLM\...\Chrome\Extension: [feobgjncdknhelkhjpiejdbpliekmfaj] - C:\Program Files (x86)\McAfee\SiteAdvisor Enterprise\McChPlg.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [cmendinpapjjojakimjlmkkkcmnojefg]
CHR HKLM-x32\...\Chrome\Extension: [ofoeigeaodhbjogdigckajfhjbonaofg]
S3 dcdbas; system32\DRIVERS\dcdbas64.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 NgFilter; system32\DRIVERS\ngfilter.sys [X]
S3 NgLog; system32\DRIVERS\nglog.sys [X]
S3 NgVpn; system32\DRIVERS\ngvpn.sys [X]
S3 NgWfp; system32\DRIVERS\ngwfp.sys [X]
U4 SecurityHealthService; Brak ImagePath
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
2022-04-11 22:22 - 2021-09-05 13:10 - 000000000 ____D C:\Users\Sławek\AppData\Roaming\dll-propagation
EmptyTemp:
