Forum.instalki.pl

HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [ETXI-nT5vY.exe] => C:\Program Files\GoldWave\XMJHQZCCV3OIHSCC\ETXI-nT5vY.exe
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [2AGM.exe] => C:\Users\Jarecki\AppData\Local\Temp\BEXY20LUU4\2AGM.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [W02C.exe] => C:\Users\Jarecki\AppData\Local\Temp\2LK404OCB6\W02C.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [EJ9H.exe] => C:\Users\Jarecki\AppData\Local\Temp\4TY1NEV8ED\EJ9H.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [GOCF.exe] => C:\Users\Jarecki\AppData\Local\Temp\3Z60IIEGYL\GOCF.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [TLXX.exe] => C:\Users\Jarecki\AppData\Local\Temp\GWRJR5X05Q\TLXX.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [VZNW.exe] => C:\Users\Jarecki\AppData\Local\Temp\OVZ9JU7W0T\VZNW.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [00RY.exe] => C:\Users\Jarecki\AppData\Local\Temp\3JQIXKSNBH\00RY.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [RL53.exe] => C:\Users\Jarecki\AppData\Local\Temp\RL533I65YP\RL53.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [HDP3.exe] => C:\Users\Jarecki\AppData\Local\Temp\HDP3BS35W3\HDP3.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [Q9Q9.exe] => C:\Users\Jarecki\AppData\Local\Temp\VSIJK51TEJ\Q9Q9.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\Run: [Z9PZ.exe] => C:\Users\Jarecki\AppData\Local\Temp\2SOJR58OJ6\Z9PZ.exe <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\RunOnce: [Application Restart #2] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [1588568 2018-06-22] (Google Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
RemoveDirectory: C:\Program Files\GoldWave\XMJHQZCCV3OIHSCC
FF Homepage: Mozilla\Firefox\Profiles\37wqittu.default -> file:///C:/ProgramData/Subairs/ff.HP
FF NewTab: Mozilla\Firefox\Profiles\37wqittu.default -> file:///C:/ProgramData/Subairs/ff.NT
Task: {0F73CB13-B4D1-46C3-91DB-8D85DF04293C} - System32\Tasks\NanoPackTask => C:\Program Files\Common Files\service_pack.bat [2018-07-21] () <==== UWAGA
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "Q9Q9.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "HDP3.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "RL53.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "00RY.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "VZNW.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "TLXX.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "GOCF.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "EJ9H.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "W02C.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "2AGM.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "ETXI-nT5vY.exe"
HKU\S-1-5-21-2179863463-2490515380-3909065564-1001\...\StartupApproved\Run: => "Z9PZ.exe"
RemoveDirectory: C:\Program Files\GoldWave\XMJHQZCCV3OIHSCC
RemoveDirectory: C:\Program Files (x86)\ggyoEsstymMAtvJtmyRGBLfBwYsaP
RemoveDirectory: C:\ProgramData\qddGHEDCBPKSMPVBAxHEpAQyEq
Powershell: wevtutil el | Foreach-Object {wevtutil cl "$_"}
EmptyTemp:

HKLM\...\Run: [JServicesManager] => C:\Program Files\SystemNanoPacks\Nano Service Pack\nano.ex
RemoveDirectory: C:\Program Files\SystemNanoPacks
HKLM-x32\...\Run: [JServicesManager] => C:\Program Files\SystemNanoPacks\Nano Service Pack\nano.ex
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
S3 NanoServicePackUpdate64; C:\Program Files\SystemNanoPacks\Nano Service Pack\NanoServicePackUpdater.exe [594432 2018-07-22] (SystemNanoPacks) [Brak podpisu cyfrowego]
C:\Users\Jarecki\Downloads\zszlpmtzze.txt
C:\Users\Jarecki\Downloads\xnhhuikxjnhpy.txt
C:\Users\Jarecki\Downloads\wrsjnjfkzmxubl.txt
C:\WINDOWS\System32\Tasks\NanoPackUpdate_6.0.1
RemoveDirectory: C:\ProgramData\SystemNanoPacks
Nano Service Pack (HKLM\...\{46100BDA-DC4C-4B20-BD54-33095057AEC5}) (Version: 6.0.1 - SystemNanoPacks) Hidden
DeleteKey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{46100BDA-DC4C-4B20-BD54-33095057AEC5}
DeleteKey: HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{46100BDA-DC4C-4B20-BD54-33095057AEC5}
Task: {213DE322-1DD2-4808-9BCB-301F6DE8CDCF} - System32\Tasks\AppLoaderHelpers => C:\Program Files\SystemNanoPacks\Nano Service Pack\nano.exe [2018-07-17] ()
Task: {2D51B051-B6CF-46FF-B2AF-B1E262F12AD0} - \NanoPackTask -> Brak pliku <==== UWAGA
Task: {69B3F87F-4BE7-4F9D-AC45-FA4A3CE0C575} - System32\Tasks\NanoPackUpdate_6.0.1 => C:\Program Files\SystemNanoPacks\Nano Service Pack\NanoServicePackUpdater.exe [2018-07-22] (SystemNanoPacks)
Task: {D1EFBF58-758A-4A06-BDAF-C5757741FF03} - System32\Tasks\AppLoaderPM => C:\Program Files\SystemNanoPacks\Nano Service Pack\nano.exe [2018-07-17] ()
HKLM\...\StartupApproved\Run: => "JServicesManager"
HKLM\...\StartupApproved\Run32: => "JServicesManager"
FirewallRules: [{2F086439-1CA9-4F42-9449-74BAD2AADEA8}] => (Allow) C:\WINDOWS\system32\rundll32.exe
FirewallRules: [{171A8328-DE18-4284-89C7-80C84EAA2F39}] => (Allow) C:\Windows\System32\rundll32.exe
FirewallRules: [{37ECBF41-BA07-447B-8691-A14A422EA113}] => (Allow) C:\Windows\System32\rundll32.exe
HOSTS:
EmptyTemp: