Witamy na forum PC Format Zapraszamy do REJESTRACJI


Użytkownicy przeglądający ten wątek: 1 gości

Samoczynne otwieranie sie stron z reklamami

#1
Samoczynne otwieranie sie stron z reklamami
Witam, od jakiegoś czasu samoczynnie otwierają mi się strony z reklamami. Korzystam z przeglądarki google chrome. Nie mogę uruchomić adwcleaner, ani wejść na żadną stronę z możliwością pobrania FRST. Wszystko to jest możliwe w trybie awaryjnym. Adwcleaner wykrył PUP.Optional.Legacy, usunąłem go lecz nie pomaga. Niżej podrzucam logi z tych programów. 

FRST: 
Spoiler
Kod:
Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 10.10.2018
Uruchomiony przez Komputer (administrator)  DESKTOP-2KC5OUJ (23-10-2018 21:16:21)
Uruchomiony z C:\Users\waria\Downloads
Załadowane profile: Komputer (Dostępne profile: Komputer)
Platform: Windows 10 Pro Wersja 1803 17134.345 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Safe Mode (with Networking)
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(SecureAge Technology) C:\Program Files\SecureAge\AntiVirus\sascansvc.exe
(SecureAge Technology) C:\Program Files\SecureAge\Whitelist\saappsvc.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.33.41.0_x64__kzf8qxf38zg5c\SkypeApp.exe
(Disc Soft Ltd) D:\Programy\DAEMON Tools Lite\DTShellHlp.exe
(Farbar) C:\Users\waria\Downloads\FRST64 (1).exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [638872 2018-04-12] (Microsoft Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [9229280 2017-06-01] (Realtek Semiconductor)
HKLM\...\Run: [Everything] => C:\Program Files\SecureAge\Everything\Everything.exe [2197608 2017-06-07] ()
HKLM\...\Run: [SAAppWhitelistingNotifier] => C:\Program Files\SecureAge\Whitelist\sanotifier.exe [4352040 2018-09-14] (SecureAge Technology)
HKLM\...\Run: [SecureAPlus] => C:\Program Files\SecureAge\Whitelist\SecureAPlus.exe [7275680 2018-09-14] (SecureAge Technology)
HKLM\...\Run: [ZAM] => D:\Programy\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-19\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-20\...\RunOnce: [WAB Migrate] => C:\Program Files\Windows Mail\wab.exe [518144 2018-04-12] (Microsoft Corporation)
HKU\S-1-5-21-53239187-4198146118-2327049702-1001\...\Run: [Steam] => D:\Programy\Steam\steam.exe [3208992 2018-10-13] (Valve Corporation)
HKU\S-1-5-21-53239187-4198146118-2327049702-1001\...\Run: [DAEMON Tools Lite Automount] => D:\Programy\DAEMON Tools Lite\DTAgent.exe [729704 2018-04-03] (Disc Soft Ltd)
HKU\S-1-5-21-53239187-4198146118-2327049702-1001\...\Run: [CCleaner Smart Cleaning] => C:\Program Files\CCleaner\CCleaner64.exe [18630056 2018-09-12] (Piriform Ltd)
GroupPolicy: Ograniczenia ? <==== UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{0cc8a901-9d9f-42bc-b4c8-2244b3b24a70}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{166289cd-babe-4774-b42d-121d23625f84}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{6741b349-5b88-48db-95c0-7f5ab624643a}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{ab111f75-71fc-44a0-9fd1-1b3f2d8a2eaf}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{abb94491-08e1-4288-8238-84fd408ac7e6}: [DhcpNameServer] 192.168.42.129

Internet Explorer:
==================
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\OCHelper.dll [2018-09-12] (Microsoft Corporation)
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-07] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-10-22] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-07] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-10-22] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-07] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-10-22] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2018-10-07] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\MSOSB.DLL [2018-10-22] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-09-12] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Microsoft Office\Office16\NPSPWRAP.DLL [2018-09-12] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-05-19] (Google Inc.)

Chrome:
=======
CHR DefaultProfile: Profile 1
CHR HomePage: Profile 1 -> hxxps://www.google.com/
CHR DefaultSearchKeyword: Profile 1 -> google.pl_
CHR Profile: C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1 [2018-10-23]
CHR Extension: (Prezentacje) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-03-24]
CHR Extension: (Dokumenty) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2018-03-24]
CHR Extension: (Dysk Google) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-03-24]
CHR Extension: (YouTube) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-03-24]
CHR Extension: (Adblock Plus) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-09-12]
CHR Extension: (Arkusze) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-03-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-25]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03]
CHR Extension: (Google Quick Scroll) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\okanipcmceoeemlbjnmnbdibhgpbllgc [2018-05-16]
CHR Extension: (Gmail) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-03-24]
CHR Extension: (Chrome Media Router) - C:\Users\waria\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-09-23]
CHR Profile: C:\Users\waria\AppData\Local\Google\Chrome\User Data\System Profile [2018-10-11]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [9683736 2018-10-14] (Microsoft Corporation)
S3 Disc Soft Lite Bus Service; D:\Programy\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [3606120 2018-04-03] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [780928 2018-06-23] (EasyAntiCheat Ltd)
S2 Everything; C:\Program Files\SecureAge\Everything\Everything.exe [2197608 2017-06-07] ()
S2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2018-06-11] (Hi-Rez Studios) [Brak podpisu cyfrowego]
S3 mracsvc; C:\Windows\System32\mracsvc.exe [10654992 2018-06-23] (LLC Mail.Ru)
R2 saappsvc; C:\Program Files\SecureAge\Whitelist\saappsvc.exe [1055528 2018-09-15] (SecureAge Technology)
S2 SAEverythingServer; C:\Program Files\SecureAge\Everything\EverythingServer.exe [214000 2018-04-19] (SecureAge Technology)
R2 sascansvc; C:\Program Files\SecureAge\AntiVirus\sascansvc.exe [1136856 2018-09-14] (SecureAge Technology)
S2 SAUAVSvc; C:\Program Files\SecureAge\UniversalAV\UniversalAVService.exe [1287760 2018-09-14] (SecureAge Technology)
S2 SecureAPlusService; C:\Program Files\SecureAge\Whitelist\SecureAPlusService.exe [1114744 2018-09-14] (SecureAge Technology)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [4737448 2018-07-15] (Microsoft Corporation)
S4 ssh-agent; C:\WINDOWS\System32\OpenSSH\ssh-agent.exe [495616 2018-03-10] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [4451616 2018-04-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [107136 2018-09-21] (Microsoft Corporation)
S2 ZAMSvc; D:\Programy\Zemana AntiMalware\ZAM.exe [15775888 2017-08-09] (Copyright 2017.)
S2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 dot4; C:\WINDOWS\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\WINDOWS\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2018-02-11] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2018-02-11] (Disc Soft Ltd)
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [9871128 2018-06-23] (LLC Mail.Ru)
S3 nvlddmkm; C:\WINDOWS\System32\DriverStore\FileRepository\nv_ref_pubwu.inf_amd64_2e7fa54192fe16d0\nvlddmkm.sys [16936048 2017-11-09] (NVIDIA Corporation)
S3 nvvhci; C:\WINDOWS\System32\drivers\nvvhci.sys [58680 2018-01-10] (NVIDIA Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [963056 2017-05-17] (Realtek )
R0 SAAppCtl; C:\WINDOWS\System32\DRIVERS\saappctl.sys [283688 2018-09-11] (SecureAge Technology)
R0 sascan; C:\WINDOWS\System32\DRIVERS\sascan.sys [95768 2018-09-11] (SecureAge Technology)
S3 smbdirect; C:\WINDOWS\System32\DRIVERS\smbdirect.sys [152064 2018-04-12] (Microsoft Corporation)
S3 ssudcdf; C:\WINDOWS\System32\drivers\ssudcdf.sys [36608 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssuddmgr; C:\WINDOWS\System32\drivers\ssuddmgr.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
S3 ssudobex; C:\WINDOWS\System32\drivers\ssudobex.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ssudqcfilter; C:\WINDOWS\System32\drivers\ssudqcfilter.sys [64912 2017-05-18] (QUALCOMM Incorporated)
S3 ssudrmnet; C:\WINDOWS\System32\drivers\ssudrmnet.sys [70400 2014-01-22] (DEVGURU Co., LTD.)
S3 ssudserd; C:\WINDOWS\System32\drivers\ssudserd.sys [206080 2014-01-22] (DEVGURU Co., LTD.(www.devguru.co.kr))
S3 ss_conn_usb_driver; C:\WINDOWS\System32\Drivers\ss_conn_usb_driver.sys [26368 2014-01-22] (DEVGURU Co., LTD.)
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [22016 2018-04-12] (Microsoft Corporation)
S3 VBoxNetAdp; C:\WINDOWS\system32\DRIVERS\VBoxNetAdp6.sys [203328 2018-02-26] (Oracle Corporation)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44616 2018-04-12] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [331680 2018-04-12] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [44032 2018-04-12] (Microsoft Corporation)
S1 ZAM; C:\Windows\System32\drivers\zam64.sys [203680 2018-03-24] (Zemana Ltd.)
S1 ZAM_Guard; C:\Windows\System32\drivers\zamguard64.sys [203680 2018-03-24] (Zemana Ltd.)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-10-23 21:16 - 2018-10-23 21:17 - 000014038 _____ C:\Users\waria\Downloads\FRST.txt
2018-10-23 21:16 - 2018-10-23 21:16 - 000000000 ____D C:\FRST
2018-10-23 21:15 - 2018-10-23 21:16 - 000149506 _____ C:\WINDOWS\ntbtlog.txt
2018-10-23 21:15 - 2018-10-23 21:15 - 000000214 _____ C:\WINDOWS\Tasks\CreateExplorerShellUnelevatedTask.job
2018-10-23 21:10 - 2018-10-23 21:10 - 002414592 _____ (Farbar) C:\Users\waria\Downloads\FRST64 (1).exe
2018-10-23 20:55 - 2018-10-23 20:56 - 007592144 _____ (Malwarebytes) C:\Users\waria\Downloads\AdwCleaner.exe
2018-10-22 19:40 - 2018-10-22 19:40 - 000000000 ____D C:\Program Files\Common Files\DESIGNER
2018-10-21 14:04 - 2018-10-21 14:04 - 000000011 _____ C:\Users\waria\setup08.ini
2018-10-21 13:37 - 2018-10-21 13:37 - 000000000 ____D C:\AdwCleaner
2018-10-21 13:36 - 2018-10-21 13:36 - 007592144 _____ (Malwarebytes) C:\Users\waria\Downloads\adwcleaner_7.2.4.0.exe
2018-10-21 13:34 - 2018-10-21 13:34 - 000004483 _____ C:\Users\waria\Downloads\i.txt
2018-10-21 00:42 - 2018-10-21 00:42 - 000000011 _____ C:\Users\waria\setup07.ini
2018-10-21 00:01 - 2018-10-21 00:03 - 1976470252 _____ C:\Users\waria\Downloads\LykarionPL.zip
2018-10-20 22:56 - 2018-09-05 00:36 - 001476904 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcupdate_GenuineIntel.dll
2018-10-15 20:42 - 2018-10-17 20:42 - 000000000 ____D C:\Users\waria\AppData\Roaming\AppDataFiles
2018-10-13 20:42 - 2018-10-14 18:42 - 000000000 ____D C:\WINDOWS\Joomla Standart
2018-10-12 20:28 - 2018-10-12 20:28 - 000000649 _____ C:\Users\Public\Desktop\TruckersMP.lnk
2018-10-12 20:28 - 2018-10-12 20:28 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TruckersMP Launcher
2018-10-12 20:27 - 2018-10-12 20:28 - 000667351 _____ C:\Users\waria\Downloads\launcher_1004 (1).zip
2018-10-12 20:17 - 2018-10-12 20:17 - 000000000 ____D C:\Users\waria\AppData\Local\ElevatedDiagnostics
2018-10-10 20:39 - 2018-09-20 06:29 - 006569856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Protection.PlayReady.dll
2018-10-10 20:39 - 2018-09-20 06:09 - 007520096 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Protection.PlayReady.dll
2018-10-10 20:38 - 2018-09-21 11:21 - 001786168 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntVirtualization.dll
2018-10-10 20:38 - 2018-09-21 11:21 - 001626936 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVIntegration.dll
2018-10-10 20:38 - 2018-09-21 11:21 - 001422648 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystemController.dll
2018-10-10 20:38 - 2018-09-21 11:21 - 001038136 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPolicy.dll
2018-10-10 20:38 - 2018-09-21 11:21 - 000830264 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVOrchestration.dll
2018-10-10 20:38 - 2018-09-21 11:18 - 021386888 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2018-10-10 20:38 - 2018-09-21 10:22 - 020381784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2018-10-10 20:38 - 2018-09-21 06:14 - 000661056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\evr.dll
2018-10-10 20:38 - 2018-09-21 06:13 - 000480568 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll
2018-10-10 20:38 - 2018-09-21 06:12 - 001035256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ApplyTrustOffline.exe
2018-10-10 20:38 - 2018-09-21 06:11 - 000753056 _____ (Microsoft Corporation) C:\WINDOWS\system32\evr.dll
2018-10-10 20:38 - 2018-09-21 06:09 - 004790160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2018-10-10 20:38 - 2018-09-21 06:09 - 002253696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2018-10-10 20:38 - 2018-09-21 06:09 - 001427968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2018-10-10 20:38 - 2018-09-21 06:08 - 004404720 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2018-10-10 20:38 - 2018-09-21 06:08 - 002765344 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2018-10-10 20:38 - 2018-09-21 06:08 - 001566720 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2018-10-10 20:38 - 2018-09-21 06:08 - 001456720 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2018-10-10 20:38 - 2018-09-21 06:08 - 001257864 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2018-10-10 20:38 - 2018-09-21 06:08 - 001140672 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2018-10-10 20:38 - 2018-09-21 06:08 - 000982600 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2018-10-10 20:38 - 2018-09-21 05:58 - 005307392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll
2018-10-10 20:38 - 2018-09-21 05:57 - 002900992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmcore.dll
2018-10-10 20:38 - 2018-09-21 05:53 - 001006080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wpnapps.dll
2018-10-10 20:38 - 2018-09-21 05:43 - 001627136 _____ (Microsoft Corporation) C:\WINDOWS\system32\enterprisecsps.dll
2018-10-10 20:38 - 2018-09-21 05:41 - 003396096 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentServer.dll
2018-10-10 20:38 - 2018-09-21 05:40 - 002368000 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebRuntimeManager.dll
2018-10-10 20:38 - 2018-09-21 05:39 - 003320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmcore.dll
2018-10-10 20:38 - 2018-09-21 05:39 - 000625152 _____ (Microsoft Corporation) C:\WINDOWS\system32\PsmServiceExtHost.dll
2018-10-10 20:38 - 2018-09-21 05:38 - 002172928 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.onecore.dll
2018-10-10 20:38 - 2018-09-21 05:38 - 001551360 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXDeploymentExtensions.desktop.dll
2018-10-10 20:38 - 2018-09-21 05:37 - 002904064 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2018-10-10 20:38 - 2018-09-21 05:37 - 002236928 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys
2018-10-10 20:38 - 2018-09-21 05:37 - 001211904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpnapps.dll
2018-10-10 20:38 - 2018-09-21 05:37 - 000604160 _____ (Microsoft Corporation) C:\WINDOWS\system32\updatehandlers.dll
2018-10-10 20:38 - 2018-09-21 05:36 - 001159680 _____ (Microsoft Corporation) C:\WINDOWS\system32\rpcss.dll
2018-10-10 20:38 - 2018-09-21 05:36 - 001034240 _____ (Microsoft Corporation) C:\WINDOWS\system32\modernexecserver.dll
2018-10-10 20:38 - 2018-09-21 05:36 - 000505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgeIso.dll
2018-10-10 20:38 - 2018-09-20 11:37 - 001634944 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll
2018-10-10 20:38 - 2018-09-20 11:23 - 006602240 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2018-10-10 20:38 - 2018-09-20 11:22 - 013572096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll
2018-10-10 20:38 - 2018-09-20 11:18 - 003649024 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys
2018-10-10 20:38 - 2018-09-20 11:17 - 001856000 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml3.dll
2018-10-10 20:38 - 2018-09-20 11:17 - 001364992 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcastdvruserservice.dll
2018-10-10 20:38 - 2018-09-20 10:46 - 001454440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll
2018-10-10 20:38 - 2018-09-20 10:35 - 005669888 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2018-10-10 20:38 - 2018-09-20 10:34 - 012500992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll
2018-10-10 20:38 - 2018-09-20 10:29 - 002891776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys
2018-10-10 20:38 - 2018-09-20 06:29 - 006039368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\windows.storage.dll
2018-10-10 20:38 - 2018-09-20 06:29 - 001989232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml6.dll
2018-10-10 20:38 - 2018-09-20 06:29 - 001513032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WindowsCodecs.dll
2018-10-10 20:38 - 2018-09-20 06:28 - 001129544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvproc.dll
2018-10-10 20:38 - 2018-09-20 06:21 - 022013440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll
2018-10-10 20:38 - 2018-09-20 06:17 - 006661632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll
2018-10-10 20:38 - 2018-09-20 06:15 - 019404288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2018-10-10 20:38 - 2018-09-20 06:13 - 003711488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2018-10-10 20:38 - 2018-09-20 06:11 - 005777920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll
2018-10-10 20:38 - 2018-09-20 06:11 - 000608768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\EdgeManager.dll
2018-10-10 20:38 - 2018-09-20 06:10 - 002719032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2018-10-10 20:38 - 2018-09-20 06:10 - 001221128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe
2018-10-10 20:38 - 2018-09-20 06:10 - 001029432 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe
2018-10-10 20:38 - 2018-09-20 06:10 - 000566800 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcblaunch.exe
2018-10-10 20:38 - 2018-09-20 06:09 - 009089848 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2018-10-10 20:38 - 2018-09-20 06:09 - 007432136 _____ (Microsoft Corporation) C:\WINDOWS\system32\windows.storage.dll
2018-10-10 20:38 - 2018-09-20 06:09 - 002825232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2018-10-10 20:38 - 2018-09-20 06:09 - 002462888 _____ (Microsoft Corporation) C:\WINDOWS\system32\msxml6.dll
2018-10-10 20:38 - 2018-09-20 06:09 - 002421248 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2018-10-10 20:38 - 2018-09-20 06:09 - 001767096 _____ (Microsoft Corporation) C:\WINDOWS\system32\WindowsCodecs.dll
2018-10-10 20:38 - 2018-09-20 06:09 - 001097744 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvproc.dll
2018-10-10 20:38 - 2018-09-20 06:08 - 004191232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2018-10-10 20:38 - 2018-09-20 06:08 - 001627648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2018-10-10 20:38 - 2018-09-20 05:53 - 025851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll
2018-10-10 20:38 - 2018-09-20 05:46 - 022715392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2018-10-10 20:38 - 2018-09-20 05:44 - 008188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll
2018-10-10 20:38 - 2018-09-20 05:44 - 004383744 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeContent.dll
2018-10-10 20:38 - 2018-09-20 05:42 - 004866560 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2018-10-10 20:38 - 2018-09-20 05:42 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe
2018-10-10 20:38 - 2018-09-20 05:41 - 007577088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll
2018-10-10 20:38 - 2018-09-20 05:41 - 000898560 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll
2018-10-10 20:38 - 2018-09-20 05:41 - 000894464 _____ (Microsoft Corporation) C:\WINDOWS\system32\webplatstorageserver.dll
2018-10-10 20:38 - 2018-09-20 05:40 - 003090432 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll
2018-10-10 20:38 - 2018-09-20 05:40 - 000808448 _____ (Microsoft Corporation) C:\WINDOWS\system32\EdgeManager.dll
2018-10-10 20:38 - 2018-09-20 05:38 - 001724416 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpserverbase.dll
2018-10-10 20:38 - 2018-09-20 05:37 - 004615680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2018-10-10 20:38 - 2018-09-20 05:37 - 001804288 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2018-10-10 20:38 - 2018-09-20 05:36 - 001375232 _____ (Microsoft Corporation) C:\WINDOWS\system32\usocore.dll
2018-10-10 20:38 - 2018-09-08 10:12 - 000452112 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 002868536 _____ (Microsoft Corporation) C:\WINDOWS\system32\aitstatic.exe
2018-10-10 20:38 - 2018-09-08 10:07 - 001610552 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 000792376 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 000689464 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 000612360 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 000309560 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll
2018-10-10 20:38 - 2018-09-08 10:07 - 000144696 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe
2018-10-10 20:38 - 2018-09-08 10:03 - 002267136 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntSubsystems64.dll
2018-10-10 20:38 - 2018-09-08 10:02 - 000540984 _____ (Microsoft Corporation) C:\WINDOWS\system32\pcasvc.dll
2018-10-10 20:38 - 2018-09-08 09:58 - 001520744 _____ (Microsoft Corporation) C:\WINDOWS\system32\msctf.dll
2018-10-10 20:38 - 2018-09-08 09:42 - 000169984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.XamlHost.dll
2018-10-10 20:38 - 2018-09-08 09:40 - 001724928 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Immersive.dll
2018-10-10 20:38 - 2018-09-08 09:40 - 000677888 _____ (Microsoft Corporation) C:\WINDOWS\system32\winlogon.exe
2018-10-10 20:38 - 2018-09-08 09:40 - 000593408 _____ (Microsoft Corporation) C:\WINDOWS\system32\cryptui.dll
2018-10-10 20:38 - 2018-09-08 09:40 - 000522240 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2018-10-10 20:38 - 2018-09-08 09:39 - 002052096 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_fs.dll
2018-10-10 20:38 - 2018-09-08 09:39 - 001787904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsp_health.dll
2018-10-10 20:38 - 2018-09-08 09:39 - 000615936 _____ (Microsoft Corporation) C:\WINDOWS\system32\resutils.dll
2018-10-10 20:38 - 2018-09-08 09:38 - 001288192 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettings.Handlers.dll
2018-10-10 20:38 - 2018-09-08 09:38 - 001004544 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2018-10-10 20:38 - 2018-09-08 09:38 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\SmartcardCredentialProvider.dll
2018-10-10 20:38 - 2018-09-08 09:38 - 000836608 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2018-10-10 20:38 - 2018-09-08 09:17 - 001540104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppVEntSubsystems32.dll
2018-10-10 20:38 - 2018-09-08 09:14 - 001328056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msctf.dll
2018-10-10 20:38 - 2018-09-08 09:00 - 000548864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\cryptui.dll
2018-10-10 20:38 - 2018-09-08 08:59 - 001530368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Immersive.dll
2018-10-10 20:38 - 2018-09-08 08:59 - 001452544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_fs.dll
2018-10-10 20:38 - 2018-09-08 08:59 - 000485376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\resutils.dll
2018-10-10 20:38 - 2018-09-08 08:59 - 000133632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.XamlHost.dll
2018-10-10 20:38 - 2018-09-08 08:58 - 001308672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsp_health.dll
2018-10-10 20:38 - 2018-09-08 08:58 - 000775680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2018-10-10 20:38 - 2018-09-08 08:57 - 000625664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SmartcardCredentialProvider.dll
2018-10-10 20:38 - 2018-09-08 08:57 - 000423936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2018-10-10 20:38 - 2018-09-08 06:08 - 000462880 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2018-10-10 20:38 - 2018-09-08 05:59 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2018-10-10 20:38 - 2018-09-08 05:59 - 000361544 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Storage.ApplicationData.dll
2018-10-10 20:38 - 2018-09-08 05:58 - 000744976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys
2018-10-10 20:38 - 2018-09-08 05:58 - 000376120 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fastfat.sys
2018-10-10 20:38 - 2018-09-08 05:57 - 002571128 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll
2018-10-10 20:38 - 2018-09-08 05:57 - 001016984 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll
2018-10-10 20:38 - 2018-09-08 05:57 - 000930616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe
2018-10-10 20:38 - 2018-09-08 05:57 - 000482384 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase_enclave.dll
2018-10-10 20:38 - 2018-09-08 05:57 - 000267576 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserbroker.dll
2018-10-10 20:38 - 2018-09-08 05:51 - 000380728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll
2018-10-10 20:38 - 2018-09-08 05:45 - 000286824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Storage.ApplicationData.dll
2018-10-10 20:38 - 2018-09-08 05:44 - 001980984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll
2018-10-10 20:38 - 2018-09-08 05:44 - 000829752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe
2018-10-10 20:38 - 2018-09-08 05:43 - 001174448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll
2018-10-10 20:38 - 2018-09-08 05:30 - 003601920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Service.dll
2018-10-10 20:38 - 2018-09-08 05:29 - 004771840 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputService.dll
2018-10-10 20:38 - 2018-09-08 05:29 - 000358912 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\exfat.sys
2018-10-10 20:38 - 2018-09-08 05:29 - 000241152 _____ (Microsoft Corporation) C:\WINDOWS\system32\HttpsDataSource.dll
2018-10-10 20:38 - 2018-09-08 05:28 - 000481280 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngccredprov.dll
2018-10-10 20:38 - 2018-09-08 05:28 - 000473088 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2018-10-10 20:38 - 2018-09-08 05:28 - 000273408 _____ (Microsoft Corporation) C:\WINDOWS\system32\ubpm.dll
2018-10-10 20:38 - 2018-09-08 05:28 - 000265728 _____ (Microsoft Corporation) C:\WINDOWS\system32\psmsrv.dll
2018-10-10 20:38 - 2018-09-08 05:27 - 003348992 _____ (Microsoft Corporation) C:\WINDOWS\system32\msftedit.dll
2018-10-10 20:38 - 2018-09-08 05:27 - 000983040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wbiosrvc.dll
2018-10-10 20:38 - 2018-09-08 05:27 - 000596992 _____ (Microsoft Corporation) C:\WINDOWS\system32\TileDataRepository.dll
2018-10-10 20:38 - 2018-09-08 05:27 - 000271872 _____ (Microsoft Corporation) C:\WINDOWS\system32\dafBth.dll
2018-10-10 20:38 - 2018-09-08 05:26 - 002328064 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmsipc.dll
2018-10-10 20:38 - 2018-09-08 05:26 - 000814592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll
2018-10-10 20:38 - 2018-09-08 05:26 - 000784896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ngcsvc.dll
2018-10-10 20:38 - 2018-09-08 05:26 - 000471552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\TileDataRepository.dll
2018-10-10 20:38 - 2018-09-08 05:25 - 003553792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\InputService.dll
2018-10-10 20:38 - 2018-09-08 05:25 - 002789376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msftedit.dll
2018-10-10 20:38 - 2018-09-08 05:25 - 000466432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll
2018-10-10 20:38 - 2018-09-08 05:25 - 000415744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2018-10-10 20:38 - 2018-09-08 05:24 - 001457664 _____ (Microsoft Corporation) C:\WINDOWS\system32\dosvc.dll
2018-10-10 20:38 - 2018-09-08 05:24 - 000899072 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2018-10-10 20:38 - 2018-09-08 05:24 - 000845824 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll
2018-10-10 20:38 - 2018-09-08 05:23 - 001655296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmsipc.dll
2018-10-10 20:38 - 2018-09-08 05:23 - 000667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fveapi.dll
2018-10-10 20:38 - 2018-09-08 05:22 - 000778240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2018-10-10 20:37 - 2018-09-21 11:23 - 000257848 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVFileSystemMetadata.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000954368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVManifest.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000825144 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVEntStreamingManager.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000749880 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVReporting.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000670008 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVCatalog.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000652288 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVPublishing.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000495416 _____ (Microsoft Corporation) C:\WINDOWS\system32\TransportDSA.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000399672 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVScripting.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000231424 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVShNotify.exe
2018-10-10 20:37 - 2018-09-21 11:21 - 000228152 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamMap.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000201528 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVStreamingUX.dll
2018-10-10 20:37 - 2018-09-21 11:21 - 000180736 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVDllSurrogate.exe
2018-10-10 20:37 - 2018-09-21 11:21 - 000173056 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppVNice.exe
2018-10-10 20:37 - 2018-09-21 11:21 - 000034304 _____ C:\WINDOWS\system32\SyncAppvPublishingServer.exe
2018-10-10 20:37 - 2018-09-21 11:01 - 000171520 _____ (Microsoft Corporation) C:\WINDOWS\system32\itss.dll
2018-10-10 20:37 - 2018-09-21 10:12 - 000150016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\itss.dll
2018-10-10 20:37 - 2018-09-21 06:09 - 001062920 _____ (Microsoft Corporation) C:\WINDOWS\system32\SecConfig.efi
2018-10-10 20:37 - 2018-09-21 06:09 - 000129088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfps.dll
2018-10-10 20:37 - 2018-09-21 06:08 - 000709936 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2018-10-10 20:37 - 2018-09-21 06:08 - 000261008 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2018-10-10 20:37 - 2018-09-21 06:08 - 000170808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2018-10-10 20:37 - 2018-09-21 06:07 - 000604664 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe
2018-10-10 20:37 - 2018-09-21 05:57 - 001361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSPhotography.dll
2018-10-10 20:37 - 2018-09-21 05:56 - 000331264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgeIso.dll
2018-10-10 20:37 - 2018-09-21 05:54 - 000251904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msIso.dll
2018-10-10 20:37 - 2018-09-21 05:42 - 000209408 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppXApplicabilityBlob.dll
2018-10-10 20:37 - 2018-09-21 05:39 - 001708544 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSPhotography.dll
2018-10-10 20:37 - 2018-09-21 05:39 - 001535488 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2018-10-10 20:37 - 2018-09-21 05:36 - 000932352 _____ (Microsoft Corporation) C:\WINDOWS\system32\rasmans.dll
2018-10-10 20:37 - 2018-09-21 05:36 - 000401920 _____ (Microsoft Corporation) C:\WINDOWS\system32\rascustom.dll
2018-10-10 20:37 - 2018-09-20 11:40 - 000348160 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotifyIcon.exe
2018-10-10 20:37 - 2018-09-20 11:19 - 001121792 _____ (Microsoft Corporation) C:\WINDOWS\system32\TSWorkspace.dll
2018-10-10 20:37 - 2018-09-20 11:18 - 000392192 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2018-10-10 20:37 - 2018-09-20 11:18 - 000327168 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpinit.exe
2018-10-10 20:37 - 2018-09-20 11:17 - 002874368 _____ (Microsoft Corporation) C:\WINDOWS\system32\themeui.dll
2018-10-10 20:37 - 2018-09-20 11:17 - 000463872 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpshell.exe
2018-10-10 20:37 - 2018-09-20 11:16 - 000127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmpshell.dll
2018-10-10 20:37 - 2018-09-20 10:30 - 000344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2018-10-10 20:37 - 2018-09-20 10:29 - 002824704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\themeui.dll
2018-10-10 20:37 - 2018-09-20 10:29 - 001586176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msxml3.dll
2018-10-10 20:37 - 2018-09-20 10:28 - 000102400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmpshell.dll
2018-10-10 20:37 - 2018-09-20 08:43 - 001008640 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.MixedRealityCapture.dll
2018-10-10 20:37 - 2018-09-20 07:52 - 000868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.MixedRealityCapture.dll
2018-10-10 20:37 - 2018-09-20 06:29 - 000357056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2018-10-10 20:37 - 2018-09-20 06:28 - 000581792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MSVideoDSP.dll
2018-10-10 20:37 - 2018-09-20 06:28 - 000567256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll
2018-10-10 20:37 - 2018-09-20 06:12 - 000272200 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave.dll
2018-10-10 20:37 - 2018-09-20 06:12 - 000269128 _____ (Microsoft Corporation) C:\WINDOWS\system32\SgrmEnclave_secure.dll
2018-10-10 20:37 - 2018-09-20 06:11 - 000578560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webplatstorageserver.dll
2018-10-10 20:37 - 2018-09-20 06:11 - 000561152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2018-10-10 20:37 - 2018-09-20 06:11 - 000074240 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dtdump.exe
2018-10-10 20:37 - 2018-09-20 06:10 - 000500536 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2018-10-10 20:37 - 2018-09-20 06:10 - 000355840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PhotoMetadataHandler.dll
2018-10-10 20:37 - 2018-09-20 06:10 - 000134968 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvloader.dll
2018-10-10 20:37 - 2018-09-20 06:10 - 000076088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hvservice.sys
2018-10-10 20:37 - 2018-09-20 06:09 - 001540096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpserverbase.dll
2018-10-10 20:37 - 2018-09-20 06:09 - 000885952 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll
2018-10-10 20:37 - 2018-09-20 06:09 - 000793088 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms2.sys
2018-10-10 20:37 - 2018-09-20 06:09 - 000713472 _____ (Microsoft Corporation) C:\WINDOWS\system32\MSVideoDSP.dll
2018-10-10 20:37 - 2018-09-20 06:09 - 000412984 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2018-10-10 20:37 - 2018-09-20 05:43 - 000052736 _____ C:\WINDOWS\system32\runexehelper.exe
2018-10-10 20:37 - 2018-09-20 05:42 - 000099328 _____ (Microsoft Corporation) C:\WINDOWS\system32\utcutil.dll
2018-10-10 20:37 - 2018-09-20 05:41 - 000319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe
2018-10-10 20:37 - 2018-09-20 05:41 - 000154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll
2018-10-10 20:37 - 2018-09-20 05:40 - 000726528 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2018-10-10 20:37 - 2018-09-20 05:38 - 000433664 _____ (Microsoft Corporation) C:\WINDOWS\system32\PhotoMetadataHandler.dll
2018-10-10 20:37 - 2018-09-20 04:21 - 000001312 _____ C:\WINDOWS\system32\tcbres.wim
2018-10-10 20:37 - 2018-09-20 03:28 - 000343552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrd3x40.dll
2018-10-10 20:37 - 2018-09-08 10:07 - 000069944 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32appinventorycsp.dll
2018-10-10 20:37 - 2018-09-08 10:02 - 000645112 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll
2018-10-10 20:37 - 2018-09-08 09:58 - 001639352 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2018-10-10 20:37 - 2018-09-08 09:57 - 000204800 _____ (Microsoft Corporation) C:\WINDOWS\system32\basecsp.dll
2018-10-10 20:37 - 2018-09-08 09:44 - 000068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdBth.dll
2018-10-10 20:37 - 2018-09-08 09:43 - 000085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\INETRES.dll
2018-10-10 20:37 - 2018-09-08 09:43 - 000047616 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardBi.dll
2018-10-10 20:37 - 2018-09-08 09:42 - 000256000 _____ (Microsoft Corporation) C:\WINDOWS\system32\scksp.dll
2018-10-10 20:37 - 2018-09-08 09:42 - 000188928 _____ (Microsoft Corporation) C:\WINDOWS\system32\certprop.dll
2018-10-10 20:37 - 2018-09-08 09:42 - 000114176 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthci.dll
2018-10-10 20:37 - 2018-09-08 09:41 - 000258560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SCardSvr.dll
2018-10-10 20:37 - 2018-09-08 09:40 - 000402944 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll
2018-10-10 20:37 - 2018-09-08 09:40 - 000249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthprops.cpl
2018-10-10 20:37 - 2018-09-08 09:39 - 005505024 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2018-10-10 20:37 - 2018-09-08 09:38 - 000986112 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2018-10-10 20:37 - 2018-09-08 09:37 - 000091136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mcbuilder.exe
2018-10-10 20:37 - 2018-09-08 09:16 - 000482080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll
2018-10-10 20:37 - 2018-09-08 09:13 - 001626656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2018-10-10 20:37 - 2018-09-08 09:13 - 000181288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\basecsp.dll
2018-10-10 20:37 - 2018-09-08 09:03 - 000084992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\INETRES.dll
2018-10-10 20:37 - 2018-09-08 09:03 - 000059392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdBth.dll
2018-10-10 20:37 - 2018-09-08 09:02 - 000236032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\scksp.dll
2018-10-10 20:37 - 2018-09-08 08:58 - 000897536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2018-10-10 20:37 - 2018-09-08 08:57 - 005391360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2018-10-10 20:37 - 2018-09-08 08:57 - 000223744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bthprops.cpl
2018-10-10 20:37 - 2018-09-08 08:56 - 000080384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mcbuilder.exe
2018-10-10 20:37 - 2018-09-08 05:58 - 000368440 _____ (Microsoft Corporation) C:\WINDOWS\system32\thumbcache.dll
2018-10-10 20:37 - 2018-09-08 05:57 - 000368448 _____ (Microsoft Corporation) C:\WINDOWS\system32\sechost.dll
2018-10-10 20:37 - 2018-09-08 05:45 - 000295416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\thumbcache.dll
2018-10-10 20:37 - 2018-09-08 05:43 - 000269104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sechost.dll
2018-10-10 20:37 - 2018-09-08 05:32 - 000025600 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\Dumpstorport.sys
2018-10-10 20:37 - 2018-09-08 05:31 - 000342528 _____ (Microsoft Corporation) C:\WINDOWS\system32\browserexport.exe
2018-10-10 20:37 - 2018-09-08 05:31 - 000272384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Microsoft.Bluetooth.Proxy.dll
2018-10-10 20:37 - 2018-09-08 05:30 - 000189440 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2018-10-10 20:37 - 2018-09-08 05:30 - 000137728 _____ (Microsoft Corporation) C:\WINDOWS\system32\InputLocaleManager.dll
2018-10-10 20:37 - 2018-09-08 05:30 - 000115200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidbth.sys
2018-10-10 20:37 - 2018-09-08 05:30 - 000101888 _____ (Microsoft Corporation) C:\WINDOWS\system32\BthRadioMedia.dll
2018-10-10 20:37 - 2018-09-08 05:29 - 000183808 _____ (Microsoft Corporation) C:\WINDOWS\system32\bthserv.dll
2018-10-10 20:37 - 2018-09-08 05:29 - 000174080 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhosdeployment.dll
2018-10-10 20:37 - 2018-09-08 05:28 - 000153088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Microsoft.Bluetooth.Proxy.dll
2018-10-10 20:37 - 2018-09-08 05:27 - 000499200 _____ (Microsoft Corporation) C:\WINDOWS\system32\winipcfile.dll
2018-10-10 20:37 - 2018-09-08 05:27 - 000301056 _____ (Microsoft Corporation) C:\WINDOWS\system32\ProximityService.dll
2018-10-10 20:37 - 2018-09-08 05:26 - 000387584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ngccredprov.dll
2018-10-10 20:37 - 2018-09-08 05:26 - 000365568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll
2018-10-10 20:37 - 2018-09-08 05:26 - 000359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcfile.dll
2018-10-10 20:37 - 2018-09-08 05:26 - 000142848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2018-10-10 20:37 - 2018-09-08 05:25 - 000882688 _____ (Microsoft Corporation) C:\WINDOWS\system32\winipcsecproc.dll
2018-10-10 20:37 - 2018-09-08 05:25 - 000341504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.Proximity.dll
2018-10-10 20:37 - 2018-09-08 05:24 - 000463360 _____ (Microsoft Corporation) C:\WINDOWS\system32\das.dll
2018-10-10 20:37 - 2018-09-08 05:23 - 000807936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winipcsecproc.dll
2018-10-10 20:37 - 2018-09-08 05:23 - 000314368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.Proximity.dll
2018-10-09 21:47 - 2018-10-21 00:49 - 000000000 ____D C:\Users\waria\Documents\Euro Truck Simulator 2
2018-10-09 21:47 - 2018-10-13 20:41 - 000000000 ____D C:\Users\waria\Documents\ETS2MP
2018-10-09 21:46 - 2018-10-21 00:37 - 000000000 ____D C:\ProgramData\TruckersMP
2018-10-09 21:35 - 2018-10-09 21:35 - 000667351 _____ C:\Users\waria\Downloads\launcher_1004.zip
2018-10-09 18:50 - 2018-10-09 18:50 - 000000211 _____ C:\Users\waria\Desktop\Euro Truck Simulator 2.url
2018-10-07 17:36 - 2018-10-07 17:36 - 000002471 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002459 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002444 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002438 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002405 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000002395 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk
2018-10-07 17:36 - 2018-10-07 17:36 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Narzędzia pakietu Microsoft Office
2018-09-30 14:42 - 2018-10-06 19:02 - 000000000 __SHD C:\Users\waria\AppData\Local\Canon Network Tool_rt
2018-09-30 14:42 - 2018-09-30 14:42 - 000325632 _____ C:\Users\waria\AppData\Local\_rtProcess.exe
2018-09-30 14:42 - 2018-09-30 14:42 - 000000000 ____D C:\Users\waria\AppData\Local\_bin_explorer
2018-09-23 14:42 - 2018-09-23 19:23 - 000000000 __SHD C:\Users\waria\AppData\Local\backup_log
2018-09-23 14:42 - 2018-09-23 17:23 - 000000000 ____D C:\WINDOWS\kjhgdjhkjqwgk

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-10-23 21:16 - 2018-03-24 18:08 - 070237530 _____ C:\WINDOWS\system32\Drivers\whitelist2.sa
2018-10-23 21:14 - 2018-04-11 23:04 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-10-23 21:14 - 2018-03-24 18:15 - 000055168 _____ C:\WINDOWS\ZAM.krnl.trace
2018-10-23 21:14 - 2018-03-24 18:15 - 000028754 _____ C:\WINDOWS\ZAM_Guard.krnl.trace
2018-10-23 21:13 - 2018-06-03 10:59 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-10-23 21:13 - 2018-06-03 10:45 - 000000000 ____D C:\Users\waria
2018-10-23 21:13 - 2018-04-12 01:38 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-10-23 21:13 - 2018-03-24 12:12 - 000000000 ____D C:\ProgramData\NVIDIA
2018-10-23 21:12 - 2018-06-03 10:41 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-10-22 22:29 - 2018-07-09 20:41 - 000000000 ____D C:\ProgramData\Packages
2018-10-22 22:29 - 2018-04-12 01:38 - 000000000 ___HD C:\Program Files\WindowsApps
2018-10-22 22:29 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-10-22 19:40 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files\Common Files\microsoft shared
2018-10-22 19:38 - 2018-04-09 19:40 - 000000000 ____D C:\Program Files\Microsoft Office
2018-10-21 14:03 - 2018-04-12 01:34 - 000044520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\svchost.exe
2018-10-21 01:16 - 2018-03-24 20:21 - 000000000 ____D C:\Users\waria\AppData\Roaming\TS3Client
2018-10-21 00:35 - 2018-03-24 19:53 - 000000000 ____D C:\Users\waria\AppData\Local\CrashDumps
2018-10-20 22:56 - 2018-04-12 01:30 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-10-20 22:53 - 2018-06-03 10:59 - 000003380 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-53239187-4198146118-2327049702-1001
2018-10-20 22:51 - 2018-06-03 10:45 - 000002407 _____ C:\Users\waria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-10-20 22:51 - 2018-03-24 17:56 - 000000000 ___RD C:\Users\waria\OneDrive
2018-10-20 22:42 - 2018-06-03 10:59 - 000004210 _____ C:\WINDOWS\System32\Tasks\CCleaner Update
2018-10-13 21:58 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-10-11 20:05 - 2018-06-03 10:56 - 001763504 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2018-10-11 20:05 - 2018-04-12 17:54 - 000782334 _____ C:\WINDOWS\system32\perfh015.dat
2018-10-11 20:05 - 2018-04-12 17:54 - 000151496 _____ C:\WINDOWS\system32\perfc015.dat
2018-10-11 20:05 - 2018-04-12 01:36 - 000000000 ____D C:\WINDOWS\INF
2018-10-11 20:01 - 2018-03-24 13:54 - 000000000 __RHD C:\Users\Public\AccountPictures
2018-10-11 20:01 - 2018-03-24 13:54 - 000000000 ___RD C:\Users\waria\3D Objects
2018-10-11 19:59 - 2018-06-03 10:41 - 000401768 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2018-10-11 19:57 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\TextInput
2018-10-11 19:57 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\system32\ShellExperiences
2018-10-11 19:56 - 2018-04-12 01:38 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2018-10-11 19:56 - 2018-04-12 01:38 - 000000000 ___RD C:\Program Files\Windows Defender
2018-10-11 19:56 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2018-10-11 19:56 - 2018-04-12 01:38 - 000000000 ____D C:\WINDOWS\bcastdvr
2018-10-11 19:56 - 2018-04-12 01:38 - 000000000 ____D C:\Program Files (x86)\Windows Defender
2018-10-10 20:36 - 2018-03-25 10:29 - 000000000 ____D C:\WINDOWS\system32\MRT
2018-10-10 20:34 - 2018-03-25 10:29 - 136745976 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2018-10-07 19:09 - 2018-09-01 19:07 - 000000000 ____D C:\Users\waria\AppData\Local\Battle.net
2018-10-07 16:30 - 2018-06-03 18:07 - 000000000 ____D C:\Users\waria\AppData\Local\D3DSCache
2018-10-06 18:51 - 2018-04-11 21:57 - 000000000 ____D C:\Users\waria\AppData\Roaming\uTorrent
2018-10-02 22:13 - 2018-04-12 01:41 - 000835152 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-10-02 22:13 - 2018-04-12 01:41 - 000179792 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-09-23 17:23 - 2018-09-19 14:43 - 000326144 _____ C:\WINDOWS\SysWOW64\x64Payload.exp
2018-09-23 17:21 - 2018-09-19 14:42 - 000000000 __SHD C:\Users\waria\AppData\Local\uTorrentDir
2018-09-23 17:21 - 2018-09-16 19:37 - 000000000 __SHD C:\Users\waria\AppData\Local\PortableApps.com
2018-09-23 17:21 - 2018-09-12 20:03 - 000000000 __SHD C:\Users\waria\AppData\Local\NET.Remote Assistance
2018-09-23 12:20 - 2018-03-24 17:55 - 000002307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-09-23 12:20 - 2018-03-24 17:55 - 000002266 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Pliki w katalogu głównym wybranych folderów =======

2018-04-12 01:34 - 2018-04-12 01:34 - 000059904 ____N (Microsoft Corporation) C:\Users\waria\Izei.exe
2018-04-15 11:17 - 2018-04-15 11:17 - 000000000 ___SH () C:\Users\waria\AppData\Local\LumaEmu
2018-06-26 20:42 - 2018-06-26 20:42 - 000000002 _____ () C:\Users\waria\AppData\Local\WMI.ini
2018-09-30 14:42 - 2018-09-30 14:42 - 000325632 _____ () C:\Users\waria\AppData\Local\_rtProcess.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-06-03 10:41

==================== Koniec  FRST.txt ============================



Addition : 
[spoiler]
[code]Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja: 10.10.2018
Uruchomiony przez Komputer (23-10-2018 21:17:51)
Uruchomiony z C:\Users\waria\Downloads
Windows 10 Pro Wersja 1803 17134.345 (X64) (2018-06-03 09:00:57)
Tryb startu: Safe Mode (with Networking)
==========================================================


==================== Konta użytkowników: =============================

Administrator (S-1-5-21-53239187-4198146118-2327049702-500 - Administrator - Disabled)
Gość (S-1-5-21-53239187-4198146118-2327049702-501 - Limited - Disabled)
Komputer (S-1-5-21-53239187-4198146118-2327049702-1001 - Administrator - Enabled) => C:\Users\waria
Konto domyślne (S-1-5-21-53239187-4198146118-2327049702-503 - Limited - Disabled)
WDAGUtilityAccount (S-1-5-21-53239187-4198146118-2327049702-504 - Limited - Disabled)

==================== Centrum zabezpieczeń ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: SecureAPlus (Enabled - Up to date) {2D6B21EC-E770-FC0D-2ACE-E56149F1814C}

==================== Zainstalowane programy ======================

(W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.)

µTorrent (HKU\S-1-5-21-53239187-4198146118-2327049702-1001\...\uTorrent) (Version: 3.5.3.44494 - BitTorrent Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Call of Duty Ghosts (HKLM-x32\...\Q2FsbG9mRHV0eUdob3N0cw==_is1) (Version: 1 - )
CCleaner (HKLM\...\CCleaner) (Version: 5.46 - Piriform)
Cheat Engine 6.7 (HKLM-x32\...\Cheat Engine 6.7_is1) (Version:  - Cheat Engine)
DAEMON Tools Lite (HKLM\...\DAEMON Tools Lite) (Version: 10.8.0.0410 - Disc Soft Ltd)
Epic Games Launcher (HKLM-x32\...\{C1DEC9EF-012B-40E4-A5DD-350AAD153DCD}) (Version: 1.1.151.0 - Epic Games, Inc.)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 69.0.3497.100 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.17 - Google Inc.) Hidden
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
HiPatch (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF000}) (Version: 6.0.3.2 - Hi-Rez Studios)
Hi-Rez Studios Authenticate and Update Service (HKLM-x32\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Microsoft Office Professional 2016 - pl-pl (HKLM\...\ProfessionalRetail - pl-pl) (Version: 16.0.10827.20181 - Microsoft Corporation)
Microsoft OneDrive (HKU\.DEFAULT\...\OneDriveSetup.exe) (Version: 17.3.6743.1212 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-53239187-4198146118-2327049702-1001\...\OneDriveSetup.exe) (Version: 18.172.0826.0010 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.24215 (HKLM-x32\...\{d992c12e-cab2-426f-bde3-fb8c53950b0d}) (Version: 14.0.24215.1 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23026 (HKLM-x32\...\{74d0e5db-b326-4dae-a6b2-445b9de1836e}) (Version: 14.0.23026.0 - Microsoft Corporation)
Office 16 Click-to-Run Extensibility Component (HKLM\...\{90160000-008C-0000-1000-0000000FF1CE}) (Version: 16.0.10827.20181 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (HKLM\...\{90160000-007E-0000-1000-0000000FF1CE}) (Version: 16.0.10827.20181 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (HKLM\...\{90160000-008C-0415-1000-0000000FF1CE}) (Version: 16.0.10827.20181 - Microsoft Corporation) Hidden
Panel sterowania NVIDIA 388.13 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel) (Version: 388.13 - NVIDIA Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.8169 - Realtek Semiconductor Corp.)
SecureAPlus v4.12.0 (HKLM\...\SecureAPlus) (Version: 4.12.0 - SecureAge Technology)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
The Sims 4: Deluxe Edition (HKLM-x32\...\The Sims 4: Deluxe Edition_is1) (Version: 1.36.102.1020 - )
TruckersMP Launcher 1.0.0.4 (HKLM\...\{A227B892-C548-4490-9C5D-DB341F8194A6}_is1) (Version: 1.0.0.4 - TruckersMP Team)
WinRAR 5.50 (64-bitowy) (HKLM\...\WinRAR archiver) (Version: 5.50.0 - win.rar GmbH)
Zemana AntiMalware (HKLM-x32\...\{8F0CD7D1-42F3-4195-95CD-833578D45057}_is1) (Version: 2.74.0.150 - Zemana Ltd.)

==================== Niestandardowe rejestracje CLSID (filtrowane): ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

ContextMenuHandlers1: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => D:\Programy\Zemana AntiMalware\ZAMShellExt64.dll [2018-03-24] ()
ContextMenuHandlers1: [SAScanShlExt] -> {94243EC1-AEE5-4d44-A6CF-6407ED967FED} => C:\Program Files\SecureAge\AntiVirus\SAScanCtx.dll [2018-08-31] (SecureAge Technology)
ContextMenuHandlers1: [SATrustCtxMenuExt] -> {E748C929-2F5A-475d-AB81-0632B725425C} => C:\Program Files\SecureAge\Whitelist\SATrustCtx.dll [2018-08-31] (SecureAge Technology Pte. Ltd.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => D:\Programy\WinRAR\rarext.dll [2017-09-13] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => D:\Programy\WinRAR\rarext32.dll [2017-09-13] (Alexander Roshal)
ContextMenuHandlers2: [DaemonShellExtDriveLite] -> {C06369D6-E77D-4626-9656-1256312BD576} => D:\Programy\DAEMON Tools Lite\DTShl64.dll [2018-04-03] (Disc Soft Ltd)
ContextMenuHandlers3: [DaemonShellExtImageLite] -> {1D1B5D7B-0FC9-452E-902C-12BACD4FBC20} => D:\Programy\DAEMON Tools Lite\DTShl64.dll [2018-04-03] (Disc Soft Ltd)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2017-10-27] (NVIDIA Corporation)
ContextMenuHandlers6: [2.0 Zemana AntiMalware] -> {6ABB1C11-E261-4CEA-BBB5-3836225689DD} => D:\Programy\Zemana AntiMalware\ZAMShellExt64.dll [2018-03-24] ()
ContextMenuHandlers6: [SAScanShlExt] -> {94243EC1-AEE5-4d44-A6CF-6407ED967FED} => C:\Program Files\SecureAge\AntiVirus\SAScanCtx.dll [2018-08-31] (SecureAge Technology)
ContextMenuHandlers6: [SATrustCtxMenuExt] -> {E748C929-2F5A-475d-AB81-0632B725425C} => C:\Program Files\SecureAge\Whitelist\SATrustCtx.dll [2018-08-31] (SecureAge Technology Pte. Ltd.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => D:\Programy\WinRAR\rarext.dll [2017-09-13] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => D:\Programy\WinRAR\rarext32.dll [2017-09-13] (Alexander Roshal)

==================== Zaplanowane zadania (filtrowane) =============

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
 System operacyjny: windows_ten Przeglądarka: chrome
#2
RE: Samoczynne otwieranie sie stron z reklamami
Daj jeszcze log Addition.txt, bo nie zmieścił się cały
 System operacyjny: windows_seven Przeglądarka: seamonkey
#3
RE: Samoczynne otwieranie sie stron z reklamami
Addition : http://www.wklejto.pl/650088
Adwcleaner przed : http://www.wklejto.pl/650089
Adwcleaner teraz : http://www.wklejto.pl/650090
 System operacyjny: windows_ten Przeglądarka: chrome
#4
RE: Samoczynne otwieranie sie stron z reklamami
Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.Otworzy się Notatnik - wklej do niego:

Kod:
Task: {82D0EAEA-DCDE-4E84-8CF8-0E029CABEB84} - System32\Tasks\{35265DEB-E246-BF87-4A43-DFDD185AA1AB} => C:\WINDOWS\SysWOW64\fTUlYuAWQA.exe [2018-04-12] (Microsoft Corporation) <==== UWAGA
Task: {128CD771-EE0E-4D9C-8C34-A4D47678380B} - System32\Tasks\{6518F3EB-ABD5-65B3-C2DF-6160BF75BDEF} => "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" hxxp://blog-smile.com/cl/?guid=1mdf313qybttvbt7m1kgurs9zm0ohmk8&prid=1&pid=4_1324_0
C:\WINDOWS\SysWOW64\fTUlYuAWQA.exe
S3 mracsvc; C:\Windows\System32\mracsvc.exe [10654992 2018-06-23] (LLC Mail.Ru)
C:\Windows\System32\mracsvc.exe
S3 mracdrv; C:\WINDOWS\System32\drivers\mracdrv.sys [9871128 2018-06-23] (LLC Mail.Ru)
C:\WINDOWS\System32\drivers\mracdrv.sys
C:\Users\waria\Izei.exe
RemoveDirectory: C:\WINDOWS\kjhgdjhkjqwgk
irewallRules: [{53588810-200C-40D6-9075-539185629CFE}] => (Allow) C:\WINDOWS\SysWOW64\msiexec.exe
FirewallRules: [{86FAD07B-B9FD-4E01-B871-205AD7B8E35D}] => (Allow) C:\Users\waria\Izei.exe
FirewallRules: [{53F811BA-0ECB-4846-AEEF-15DCFE2F8EDE}] => (Allow) C:\WINDOWS\SysWOW64\fTUlYuAWQA.exe
FirewallRules: [{AB41A2A4-B935-4281-A1D5-79387D9CA251}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{78829756-2EB0-4EC4-8DE6-9A3C70CB13F7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{638EFDA1-1637-42DC-946C-F9324A5AEE0E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C504838C-CBDC-46C6-911D-91A017D22922}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A19B3FCA-25D2-4B0B-84C3-F41BBC54D9BE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1D495CDB-BA07-49CA-BB01-D7DC3AF22CE5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9A4E5123-667F-4EFA-B80E-C36AA1DD0D6E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0CE83EAF-10DB-49C2-BBEC-F831FE0DC95C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{62421587-1CC4-4A1E-A0A0-B0CCE38A8426}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{0018438A-80E4-4A6E-96ED-EE62FF03CAA3}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{BB9452FC-D85C-44AC-836B-3E989447ADF1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A2E49CAA-F950-43FC-8AA3-965C33D9EFE6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2444EA1F-9740-4FDD-AE39-47029CB27E42}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{7DCA8061-66A5-42CD-86FC-80F81C0E36DA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F12838B0-C5EC-423F-91DE-54DA17B95F7A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A97EF55D-96B5-47FF-A669-CE7CA147DDA4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A80A48F6-05D4-4160-8C74-CA5A627CDC7A}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{8603D6A0-8302-4C75-BBF7-B4029F357210}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A7476EDB-A435-471B-8791-B25C3F94ACCA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{198E3450-B610-465B-83CD-834BEB6AAE36}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{26F6C77B-A889-4EE7-91CC-28D3DDE64132}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{478F3AC7-7F7C-486C-9F5F-29BD8C5F8858}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2E78EF7E-28FC-43CF-95A9-92299440376A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{432B4BA5-DC0E-487B-A6D4-A4DF4C8F52A7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2E0C0B05-EC1E-4526-870D-DB2A6A5ADB9B}] => (Allow) C:\Users\waria\AppData\Local\Windows Workflow Foundation\msiexec64.exe
FirewallRules: [{9290E68E-B3C1-4A8B-B086-5668CC41AC51}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{E51657E3-CCC8-4BB1-B4FA-6B92FA411F4B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3F48BEDC-F491-4C94-B00B-7E29E85B7689}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B7C2BD99-51CD-43BC-A695-9882B8D31413}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3F81B916-62AB-499C-85B2-3062F80EF15F}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{8DC2D31E-EB2F-425E-B77C-14F56C01C02D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{62249F49-1641-4F75-857E-FF48EEA11C0E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{45E14094-3C39-401B-872E-8C7DD1E2C4FC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B469F80D-C850-4210-9727-FE8C3F8132DA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4DC4FBFB-9704-4509-A610-2A49F1DDE373}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{74604BA8-7F18-4C31-A4B6-590B240C83A2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7077C1D3-1DA0-49F6-A21D-798DC58493EA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1B6D73B3-D550-4832-9DBE-BA486448D0DB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CA914656-EB09-43DB-9A1E-7D8D8B46E396}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{6043665B-D646-4B3B-8212-6944A5AE9CE1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{6816A4A2-EF48-4775-860C-C6F08568FF78}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{58936BA5-4785-4E30-A36C-7DCC97BD6BB7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{500679EE-9137-4EA0-94C1-0C65842A6EF1}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{EB3A163A-F588-4F5E-85D5-043E040C7918}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{6DC190C2-1F91-46EE-86D6-E38A8CE95B79}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{37261957-C4BF-4264-A359-39EDC260967F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0B5D49C4-C509-4343-AD7B-876289DFEE24}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{1352D762-139F-4B38-ADB4-7CB830199F80}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1760FAA6-E623-4045-8E0B-78924A20BED8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C085D351-5C4C-49E3-9883-E2262C453D30}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CB460E1F-1D96-4D8B-8CA0-542E6DB47E62}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{91E795A4-C73D-4B85-B569-5790DFE4D4A9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F52A30C2-FDDA-43F3-848D-A2DFB6B2717F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{EAD0D22F-1E23-4C1E-9958-B20C808A3C5F}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{66177CB3-6FFE-4059-A33F-CE7198AB4AAF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1910CB03-B05D-40B0-A95C-74AF7B303C4F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7B4D29B0-231D-4B92-8DD3-0D34C4F17B7B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CE18C7B9-BCCE-4818-8ACA-9E85CA16B103}] => (Allow) C:\Users\waria\AppData\Local\_restore{E415C293-1C11-4005-B5E5-91EC1A0BAE7D}\msiexec64.exe
FirewallRules: [{AAE66D06-84EC-461B-9D11-CAF465FA1E2F}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{1B980402-BF47-4B65-8F1D-AD6947CCF7E1}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{62434B5B-8FF3-4163-8A62-2BF656A21954}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8127DEFE-E3D3-4DFE-A898-432A4EA836D8}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{AB47A017-13FF-467C-89EE-658A1BA44AFD}] => (Allow) C:\Users\waria\AppData\Local\_restore{E415C293-1C11-4005-B5E5-91EC1A0BAE7D}\msiexec64.exe
FirewallRules: [{DD6BD515-B2C4-427F-9E5A-C7FB5E5812C6}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{EB4894E2-B2F4-4712-8668-621675BC2C17}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4C2A9CC7-357F-44AE-BF0D-24123FD369C2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C4BF7828-F8E4-4526-A3CF-BAFC2A0D0408}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0C46B138-73D8-4363-B0D9-4AFEB0ED7C7A}] => (Allow) C:\Users\waria\AppData\Local\_restore{E415C293-1C11-4005-B5E5-91EC1A0BAE7D}\msiexec64.exe
FirewallRules: [{43426AF0-E1E4-4A17-8895-1C72D49B4E3B}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{A7525907-5297-46D0-AAEA-4A40D2D428EF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5BF43E4A-603E-44CC-9D13-55C995513F04}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{26F12550-9C9F-4D16-A086-483D5486F458}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3A86B0AA-1A07-4FB1-BA7B-1AE33A187222}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{E9691CF4-7E4B-4261-B263-A2411B146596}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D51A2806-1A89-480F-B5D9-173491BBCCAA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{22827D7B-7498-4513-8344-14E0870C0B2A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{865CE6B4-AE06-4716-AE58-6E3C2EF7662C}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{D773F0D8-5087-4F1E-88EC-80C9B53EB780}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8CE65BD8-F1B3-44F8-A260-757EA6C03139}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F769B4A8-70E8-4519-A536-933BB0B1451B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5A23D79F-F72F-4E2A-AF71-6398156DF3BC}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C59B7F55-3037-40E0-B273-B5167D9B1AAE}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{67D3B106-FB4F-48D2-87DB-863E930FC030}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4809ED18-783E-4F46-8263-009E1A86F2CB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1147DBA1-80A1-4533-8A0D-DA0A0836ADE7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F6232DE0-7709-4576-9111-A56F6C059EDA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D6365B27-D5BC-4C29-8433-C3F310660131}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{C98176C4-5A55-4AE8-ACB5-DAB484BD98A2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{6507982B-9C57-4DB3-8FE9-CC47B7851D86}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{88B29FC9-02AE-4CC8-BF63-44E6CC2275DD}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{FE99AFAF-6860-4904-AAE3-4891465D63A8}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{8BAF1FC3-76EC-4957-B811-49B5B26C8481}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{BB12DB01-546E-4845-82F5-6E9AB091D599}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{017FE0D1-B979-460A-A405-C781303888CF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7DBAEFED-2D23-4EC7-86CB-3A025616226D}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{4A0D1437-1914-4B48-ACD5-48EDE2568E6E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{6E90B41A-4B59-475F-B41F-4D9785F51F81}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{85D580E8-D06E-46D1-8CED-6EF4817411E3}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{44EF745D-6D98-46B5-883A-B9535D978594}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9AD6CB7D-627E-4760-95F5-3996E69F773F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{15BBCD54-643B-429C-AFA0-C59E73C81B71}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{15FA672D-3106-4711-BEC5-AEBCAD8E6503}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{C88ACF5B-9B25-4982-84DF-C869537A9F09}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{9C03E621-E01F-4D97-9696-E4EA7A620B5C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{98E21EF4-1644-40BC-96A4-5FF37484DDAB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{53CD7C29-F6CC-4183-9FE0-056726E699AE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{31A653F7-C95B-4F6E-B7AA-E0DC005F5E02}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E8578EAC-CA58-4306-A810-F08C24AEF08C}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{E8F87193-7BCC-4477-BC63-809838EEAA1D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{BC8F106C-6677-4F85-9C0A-CA7AD07C8087}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{EAF3C19A-2A0C-464C-94CC-C133E1113081}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A75DC729-0BA1-47B0-BF53-795401E245E7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C8B284D4-9639-4535-BDA6-0EA8B68B3C03}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{92022921-FDA0-4B04-B810-1FB41476BFFB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B69F8288-9DAF-4C9B-8245-76BFD8248E69}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{41CADB52-F82D-4B55-851B-4C5DB9E8A953}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9546DC9D-F184-442B-9173-B3BFCAA6E56B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{695A61E8-2759-4802-8BBC-2B1EB3220848}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{39F49D18-DEEB-4CF3-B5AA-42A85B6CA180}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{1345B91E-156E-4B21-A955-809DEB0BA8F4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CD3BC641-55CB-4631-B841-740236D64D93}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F039B785-1B5E-4B6A-85A1-A1F07996C247}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{641ED1FC-E703-4E26-A8C6-F2F23D35B669}] => (Allow) C:\WINDOWS\SysWOW64\rundll32.exe
FirewallRules: [{7A155D64-30B3-4C64-9442-B2CA6BDDC057}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{9A2E4841-7896-48BE-852A-21AC2401D0A0}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2F59E5F1-4467-4F91-AB4B-47C6793F7F03}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E1B899DE-3328-49D7-890E-3D9A2A9CBDA2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{655B1274-FB3C-4020-822F-59CC8743C7A5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E79616F2-7790-43C4-808D-DDD87A4F9C42}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2000BBD8-93B0-487E-9FE2-B8536936E360}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{FB3D5247-86A8-4297-BC2B-2EA128653D70}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F882D668-D0DA-40E5-9A1A-2E7A23DF4AE6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D51153D4-5011-4C5F-97B6-21E47F290B81}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{83B0DB60-4A5F-48EF-B046-679CA5CAB3EF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8978C19F-8CFD-41B5-BD5C-F95EF6646349}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{711F43C0-BA9C-4D93-B230-069E784BB891}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{BA195240-423C-45F6-8FD3-CC39D6201141}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{90C47801-8CB3-48D6-A8E3-836B86DFBE8C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{AFC8BB68-7C99-4336-9FB8-71E9519EC2C3}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{B4F12871-BAEB-4DCD-8573-63FEDAFEA158}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A2DEE4FC-7B2F-4954-BC48-1E9E1FB7CC15}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D1713F02-9163-46A2-9043-6A7638269AAA}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CE1281E2-F377-4B23-8E2E-6BFECB0DF81B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F0BC125D-EAF1-4395-B022-1D8DCC492803}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C9F65E72-A327-4948-95AF-2CA11303C665}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4671528D-AA35-4989-B906-45AC281D8711}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C6E9F9D0-840E-4A5F-83A3-4B40723C7503}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{653896CC-0E15-4C6F-ABCF-5C62319B1DEB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{56257796-EBD4-42DE-BFB2-722DB03E367B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{AC39F072-8033-4EF9-B81B-E4C3DFDDCBAE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3691A29F-7E78-4213-B5F5-4A5D6EE9961A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F4900F69-E44D-415F-A340-CD16D62205DF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{35713E09-95E4-440D-96F7-19DEC8F4100D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{AB70C5B1-5785-4222-8880-F0B8AA1EAFCE}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C998543C-A1FF-4527-B19E-3CE4B80D0C41}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5952DD6B-D7C9-4994-AEA2-7A1BF3BA1857}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1CB27433-C34A-41AC-9B4F-794EF219DB47}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C4BB7177-10EF-46D2-AF56-D3EBEB893A64}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{73E237A8-EC6A-4800-B712-02F4C41E3169}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8FF1C284-5AD6-4E7C-86CC-8D739A85DAD7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8D5EA782-1953-4F34-BFF9-78A931703669}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{442FFFE8-DE65-4EAB-B517-9DA3C54693D2}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D5C639B4-11A9-4909-87DA-8E924E1FA2FD}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{468B2FD7-868F-4361-8E5E-C1444F2C4F22}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8D6279A4-019F-4A7F-90C3-CBD712993B41}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{8DF27491-E9A5-46F3-AED5-58FC11FF200F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A16F8083-CB6C-4126-907D-CC630734B84F}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4FEB2E01-DE6C-45CB-9191-15E7FFC3B4AF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CCB11FA9-B647-45CD-86EE-9807BAC4387C}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{5C923B4E-893D-4849-B49A-17ABAD8B7A6E}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D5AFD0F7-514A-43FD-9BE1-6B0E7633AD27}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{965A1CAB-7C82-400D-A796-B8793A1268D6}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F69C5264-1327-47EC-B1E3-12ADACC80A3B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{3A784966-04FA-49CB-A354-02E9FA371544}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
GroupPolicy: Ograniczenia ? <==== UWAGA
C:\Users\waria\setup08.ini
C:\Users\waria\setup07.ini
EmptyTemp:
Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).

Zrób nowe logi FRST.
.
 System operacyjny: windows_seven Przeglądarka: seamonkey
#5
RE: Samoczynne otwieranie sie stron z reklamami
FRST.txt - http://wklejto.pl/651706
Addition.txt - http://wklejto.pl/651707
 System operacyjny: windows_ten Przeglądarka: chrome
#6
RE: Samoczynne otwieranie sie stron z reklamami
Log Addition.txt jest zniekształcony - na "wklejto" trzeba wklejać tekst, a nie plik!

Uruchom FRST. Na klawiaturze naciśnij jednocześnie CTRL+Y.Otworzy się Notatnik - wklej do niego:

Kod:
Task: {51BF7749-0FE4-4BFD-82B4-3DEA7F2A5B8D} - System32\Tasks\{029FDAE1-4CC6-C99E-53FA-E9951807FC42} => C:\Users\waria\Izei.exe
C:\Users\waria\Izei.exe
FirewallRules: [{C213C99E-18E5-4965-B411-110C6E71C8C4}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7ABED2B1-17F7-47CB-AA04-99B63975D8F9}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{4B62D2D9-BA4F-4677-9AE0-B4AAD2D05825}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{417A5A1E-767A-4DCF-8F19-1AE54C2F0FEF}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{2323F6EA-79BF-4EA3-AD1F-4A5727B5738A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{A5DCCF6B-6179-49AB-8912-270ECC85C4D0}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{D1E4AFF0-4071-4869-9AF2-C4F0405B362A}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0A9004D5-6940-48CA-AEC0-3BF96803848D}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C9CF7ED5-FA96-4924-9186-B78CC03D7821}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{F5A7A278-9B72-4B6D-89CD-53A085DF6E8B}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{0EACD638-CDF1-4F4D-8CD3-318D11A39407}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{1237D563-2D29-446F-9489-3B78193A5495}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{E6841634-8CAA-4650-AC4B-721338F883A5}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{976A4DD0-55EC-4B18-A9E4-A2E67FB18CFB}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{CF2C3069-8C6F-42C1-A33E-2985D1ECD747}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{C2AEFEF5-8A1B-4E14-AC61-3A13C84BE803}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
FirewallRules: [{7D962C11-D6DE-4C51-9F23-3FC7AE107BF7}] => (Allow) C:\WINDOWS\SysWOW64\svchost.exe
 EmptyTemp:
Na klawiaturze naciśnij jednocześnie CTRL+S. W FRST kliknij na Fix (NAPRAW).


Jak oceniasz sytuację po tych usuwaniach?
.
 System operacyjny: windows_seven Przeglądarka: seamonkey
Programy: Polecane / Nowe / Inne




Podobne wątki (Samoczynne otwieranie sie stron z reklamami)
Wątek: Autor Odpowiedzi: Wyświetleń: Ostatni post
  samoczynne otwieranie się stron baro990 6 3386 14.04.2019, 11:38
Ostatni post: baro990
  Samoistne otwieranie niechcianych stron Google Chrome Cloud 6 3271 03.04.2019, 13:47
Ostatni post: Cloud
  Samoistne otwieranie niechcianych stron Google Chrome ZooMM 10 7251 19.03.2019, 13:11
Ostatni post: ZooMM

Skocz do:


Wybrane wątki (Samoczynne otwieranie sie stron z reklamami)
Wątek: Autor Odpowiedzi: Wyświetleń: Ostatni post
  Witam i proszę o sprawdzenie logów FRST majeda 3 4910 04.08.2018 04:54
Ostatni post: chuoiit25
  Wpisywanie hasła bankowego,a ciasteczka z innych stron. wodoodporny 1 4100 30.07.2018 16:30
Ostatni post: morderca
  Robak uruchamia różne strony podczas uruchamiania systemu aqu32 4 1004 27.07.2018 09:14
Ostatni post: aqu32
Question Dziwny suwak w Google Chrome krzysiek3542 2 4318 19.07.2018 16:46
Ostatni post: krzysiek3542
  Gameorplay.info wirus krzysiek3542 3 5060 06.07.2018 23:05
Ostatni post: krzysiek3542
  wolna praca systemu ricardo59 2 4804 06.07.2018 15:36
Ostatni post: ricardo59
Toungue Jak usunąć yahoo z przeglądarki. berneros 4 4141 02.07.2018 20:20
Ostatni post: berneros
  Queteex, Dtdump stevie1 10 9442 27.06.2018 09:32
Ostatni post: stevie1
  Samoczynne otwieranie się stron internetowych Ahmed69 8 4787 24.06.2018 19:39
Ostatni post: Ahmed69
  Proszę o sprawdzenie logów kacperex44 10 9187 17.06.2018 20:11
Ostatni post: kacperex44
  Skrót do pendrivea po podłączeniu go do komputera winuszka 4 4866 08.06.2018 16:29
Ostatni post: morderca
  Jak usunąć wyszukiwarkę yahoo Bobson1337 6 1338 06.06.2018 21:53
Ostatni post: Bobson1337
  Perfidnie wyskakujące Popup, dlaczego? waple 4 4582 05.06.2018 20:02
Ostatni post: avecezar
  Kaspersky niemoże usunąć rootkita Ymir6066 4 1132 03.06.2018 16:48
Ostatni post: morderca
  przekierowanie w Chrome robert14-83 2 5016 25.05.2018 12:45
Ostatni post: robert14-83