Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Generic User Avatar

Suspicious redirect


  • This topic is locked This topic is locked
9 replies to this topic

#1 Peppey332

Peppey332

  •  Avatar image
  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 05 May 2021 - 08:44 AM

Hello. So, i entered a website and it redirected me to this other side called. v4.s.arclk.net. Thankfully NoScript blocked it from working, but i still don't know if i'm 100% safe.I've read that it was adware website and i just wanted to check. Norton doesn't detect anything.

 

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 28-04-2021
Ran by kubsons07 (administrator) on DESKTOP-7J71UVT (05-05-2021 15:24:44)
Running from C:\Users\kubsons07\Desktop\FRST
Loaded Profiles: kubsons07
Platform: Windows 10 Home Version 2004 19041.928 (X64) Language: Polski (Polska)
Default browser: FF
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe
(Adobe Inc. -> Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Arvato Digital Services Canada Inc -> arvato digital services llc) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Arvato Digital Services Canada Inc -> arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Electronic Arts, Inc. -> ) C:\Program Files (x86)\Origin\QtWebEngineProcess.exe <2>
(Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Electronic Arts, Inc. -> Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Intel Corporation - Embedded Subsystems and IP Blocks Group -> Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) [File not signed] C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe
(Malwarebytes Inc -> Malwarebytes) D:\Program Files\MBAMService.exe
(Malwarebytes Inc -> Malwarebytes) D:\Program Files\mbamtray.exe
(Microsoft Corporation -> Microsoft Corporation) C:\Users\kubsons07\AppData\Local\Microsoft\Teams\current\Teams.exe <10>
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxOutlook.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.13426.20920.0_x64__8wekyb3d8bbwe\HxTsr.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.20122.11121.0_x64__8wekyb3d8bbwe\Music.UI.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\MoUsoCoreWorker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\mspaint.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\oobe\UserOOBEBroker.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Windows -> Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd.) C:\Windows\V0790Mon.exe
(Mozilla Corporation -> Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe <6>
(NortonLifeLock Inc. -> NortonLifeLock Inc.) C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\nsWscSvc.exe
(NortonLifeLock Inc. -> Symantec Corporation) C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\NortonSecurity.exe <2>
(NVIDIA Corporation -> Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe <2>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe <3>
(NVIDIA Corporation -> NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(Oracle America, Inc. -> Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Realtek Semiconductor Corp -> Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Skutta, Kristjan -> ) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\wallpaper32.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe <7>
(Valve -> Valve Corporation) C:\Program Files (x86)\Steam\steam.exe

==================== Registry (Whitelisted) ===================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8495320 2015-06-23] (Realtek Semiconductor Corp -> Realtek Semiconductor)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3412680 2021-02-17] (Adobe Inc. -> Adobe Systems, Incorporated)
HKLM-x32\...\Run: [V0790Mon.exe] => C:\WINDOWS\V0790Mon.exe [43120 2015-08-24] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [706288 2021-04-09] (Oracle America, Inc. -> Oracle Corporation)
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [4087528 2021-04-12] (Valve -> Valve Corporation)
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3144760 2021-04-27] (Electronic Arts, Inc. -> Electronic Arts)
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Run: [Discord] => C:\ProgramData\kubsons07\Discord\Update.exe [1512760 2020-12-03] (Discord Inc. -> GitHub)
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Run: [WallpaperEngine] => C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\wallpaper32.exe [2769000 2021-03-02] (Skutta, Kristjan -> )
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Run: [com.squirrel.Teams.Teams] => C:\Users\kubsons07\AppData\Local\Microsoft\Teams\Update.exe [2453728 2021-04-14] (Microsoft 3rd Party Application Component -> Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe /StartMinimized
HKLM\...\Print\Monitors\HP E611 Status Monitor: C:\Windows\system32\hpinkstsE611LM.dll [401920 2019-07-01] (Hewlett Packard -> HP Inc.)
HKLM\Software\Wow6432Node\Microsoft\Active Setup\Installed Components: [{8A69D345-D564-463c-AFF1-A69D9E530F96}] -> C:\Program Files (x86)\Google\Chrome\Application\90.0.4430.93\Installer\chrmstp.exe [2021-04-27] (Google LLC -> Google LLC)

==================== Scheduled Tasks (Whitelisted) ============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {026C09C6-6379-4323-88DD-5B91FE8EFA09} - System32\Tasks\CorelUpdateHelperTaskCore => C:\Program Files (x86)\Corel\CUH\v2\CUH.exe [3583264 2020-06-03] (Corel Corporation -> Corel Corporation)
Task: {06CAA493-F24B-4597-906E-9D6F4CD8C2B1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2017-06-13] (Google Inc -> Google Inc.)
Task: {28006914-A4CC-4E70-B028-2B6C815D2A3D} - System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA GeForce Experience.exe [3336560 2021-04-08] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {395517F0-9BE9-4E98-A87D-B0BA1F80D6CF} - System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [874472 2020-09-29] (NVIDIA Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvDriverUpdateCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerDriverUpdateCheck.log
Task: {3B60934E-99A0-4107-BCEA-7285F4784077} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\WSCStub.exe [643584 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
Task: {4B468D47-3B67-4E33-B9DA-C5B3D8D920C7} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Security\Upgrade.exe [2344608 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
Task: {60FB07F5-F819-45A1-A422-41909F26296E} - System32\Tasks\Norton Security\Norton Security Error Analyzer => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\SymErr.exe [115640 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc)
Task: {809E3FFB-F34C-400B-ABA3-3523B418E036} - System32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [874472 2020-09-29] (NVIDIA Corporation -> NVIDIA Corporation) -> -d "C:\Program Files\NVIDIA Corporation\NvBackend\NvBatteryBoostCheck" -l 3 -f C:\ProgramData\NVIDIA\NvContainerBatteryBoostCheck.log
Task: {883B83A5-A696-4E67-A76E-963271C55684} - System32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1260400 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {887773E8-7BC3-44CB-A468-DAE3DFF906D3} - System32\Tasks\AdobeGCInvoker-1.0 => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [3412680 2021-02-17] (Adobe Inc. -> Adobe Systems, Incorporated)
Task: {8CC62A65-6305-4FED-91E6-573D4752BFF7} - System32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1260400 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {B91B47A4-FAF5-4509-BFE9-2BD2268C3BC5} - System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [905584 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {CE35495F-E536-4372-88FA-C03C5C92CD42} - System32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1260400 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {DF26F89F-54B9-49E1-8760-798A296A3D1C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [153752 2017-06-13] (Google Inc -> Google Inc.)
Task: {E0ACAFA3-7A5B-4C8D-8EF1-8FE1BD7110B7} - System32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\NvBackend\NvTmRep.exe [1260400 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {E6C7861C-3D4D-47C5-B6B2-6DB4A8F28E55} - System32\Tasks\Norton Security\Norton Security Error Processor => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\SymErr.exe [115640 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc)
Task: {E9665764-65EC-40D5-BFF9-A8AC60069104} - System32\Tasks\Mozilla\Firefox Default Browser Agent E7CF176E110C211B => C:\Program Files (x86)\Mozilla Firefox\default-browser-agent.exe [696304 2021-04-21] (Mozilla Corporation -> Mozilla Foundation)
Task: {EF6E906B-AD98-45AE-AC74-566CFD909780} - System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe [645488 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {EFAD52E7-0C09-4469-B04C-903CA730E7C6} - System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} => C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe [905584 2021-04-07] (NVIDIA Corporation -> NVIDIA Corporation)
Task: {F8F565DB-EBFE-4860-8404-F64291EA178F} - System32\Tasks\Norton Security\Norton Security Autofix => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\SymErr.exe [115640 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.31.1
Tcpip\..\Interfaces\{5727f1df-f5f5-41d1-8aac-4618ca034e36}: [DhcpNameServer] 192.168.31.1

Edge:
=======
Edge Extension: (No Name) -> AutoFormFill_5ED10D46BD7E47DEB1F3685D2C0FCE08 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\AutoFormFill [not found]
Edge Extension: (No Name) -> BookReader_B171F20233094AC88D05A8EF7B9763E8 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\BookViewer [not found]
Edge Extension: (No Name) -> LearningTools_7706F933-971C-41D1-9899-8A026EB5D824 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\LearningTools [not found]
Edge Extension: (No Name) -> PinJSAPI_EC01B57063BE468FAB6DB7EBFC3BF368 => C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\Assets\HostExtensions\PinJSAPI [not found]
Edge Profile: C:\Users\kubsons07\AppData\Local\Microsoft\Edge\User Data\Default [2021-05-05]

FireFox:
========
FF DefaultProfile: aq3w9l33.default-1523276245035
FF ProfilePath: C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035 [2021-05-05]
FF Homepage: Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035 -> www.google.com
FF Extension: (Dark Reader) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\addon@darkreader.org.xpi [2021-04-22]
FF Extension: (Norton Password Manager) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\idsafe@norton.com.xpi [2021-04-20]
FF Extension: (Norton Home Page) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\nortonhomepage@symantec.com.xpi [2021-05-04] [UpdateUrl:hxxps://static.nortoncdn.com/idscp/firefox/nsss/hp/updates.json]
FF Extension: (Norton Safe Search) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\nortonsafesearch_ul_2@symantec.com.xpi [2021-05-04] [UpdateUrl:hxxps://static.nortoncdn.com/idscp/firefox/nsss/ds_modified/updates.json]
FF Extension: (Norton Safe Web) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\nortonsafeweb@symantec.com.xpi [2021-05-03]
FF Extension: (Light Sea) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\{124ac638-9949-4296-83e5-0a30089482fa}.xpi [2019-08-16]
FF Extension: (NoScript) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2021-05-04]
FF Extension: (rainbow blur) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\{7477cece-5973-41fe-a60e-2d2ffae6d21e}.xpi [2019-08-16]
FF Extension: (Adblock Plus - darmowy adblocker) - C:\Users\kubsons07\AppData\Roaming\Mozilla\Firefox\Profiles\aq3w9l33.default-1523276245035\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2021-01-29]
FF Plugin: @java.com/DTPlugin,version=11.291.2 -> C:\Program Files\Java\jre1.8.0_291\bin\dtplugin\npDeployJava1.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.291.2 -> C:\Program Files\Java\jre1.8.0_291\bin\plugin2\npjp2.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.68 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll [2015-04-21] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2015-04-21] (Intel® Identity Protection Technology Software -> Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.291.2 -> C:\Program Files (x86)\Java\jre1.8.0_291\bin\dtplugin\npDeployJava1.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.291.2 -> C:\Program Files (x86)\Java\jre1.8.0_291\bin\plugin2\npjp2.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)

Chrome:
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\kubsons07\AppData\Local\Google\Chrome\User Data\Default [2021-02-18]
CHR Notifications: Default -> hxxps://www.youtube.com
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\kubsons07\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2020-06-23]
CHR Extension: (Chrome Media Router) - C:\Users\kubsons07\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2020-12-01]
CHR Profile: C:\Users\kubsons07\AppData\Local\Google\Chrome\User Data\Guest Profile [2020-06-03]
CHR Profile: C:\Users\kubsons07\AppData\Local\Google\Chrome\User Data\System Profile [2020-06-03]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\Exts\Chrome.crx <not found>
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\Exts\Chrome.crx <not found>

==================== Services (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AGMService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGMService.exe [3780296 2021-02-17] (Adobe Inc. -> Adobe Systems, Incorporated)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [3548360 2021-02-17] (Adobe Inc. -> Adobe Systems, Incorporated)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [8736880 2020-11-07] (BattlEye Innovations e.K. -> )
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [802432 2019-08-14] (EasyAntiCheat Oy -> EasyAntiCheat Ltd)
S3 FvSvc; C:\Program Files\NVIDIA Corporation\FrameViewSDK\nvfvsdksvc_x64.exe [409456 2021-03-30] (NVIDIA Corporation -> NVIDIA)
R3 Intel® Security Assist; C:\Program Files (x86)\Intel\Intel® Security Assist\isa.exe [335872 2015-05-19] (Intel Corporation) [File not signed]
S2 isaHelperSvc; C:\Program Files (x86)\Intel\Intel® Security Assist\isaHelperService.exe [7680 2015-05-19] () [File not signed]
R2 MBAMService; D:\Program Files\MBAMService.exe [7456464 2021-04-09] (Malwarebytes Inc -> Malwarebytes)
R2 NortonSecurity; C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\NortonSecurity.exe [343336 2021-03-27] (NortonLifeLock Inc. -> Symantec Corporation)
R2 nsWscSvc; C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\nsWscSvc.exe [1054536 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2545752 2021-04-27] (Electronic Arts, Inc. -> Electronic Arts)
R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [3485784 2021-04-27] (Electronic Arts, Inc. -> Electronic Arts)
R2 PSI_SVC_2; C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe [277360 2014-04-30] (Arvato Digital Services Canada Inc -> arvato digital services llc)
R2 PSI_SVC_2_x64; C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (Arvato Digital Services Canada Inc -> arvato digital services llc)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [3004048 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103384 2019-12-07] (Microsoft Windows Publisher -> Microsoft Corporation)

===================== Drivers (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\Program Files\Norton Security\Norton Security\NortonData\22.20.2.57\Definitions\BASHDefs\20210427.011\BHDrvx64.sys [1995864 2021-03-16] (Symantec Corporation -> Broadcom)
R1 ccSet_NGC; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\ccSetx64.sys [192248 2021-03-27] (Symantec Corporation -> Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [516168 2021-02-03] (Symantec Corporation -> Broadcom)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [153672 2021-02-13] (Symantec Corporation -> Broadcom)
R1 IDSVia64; C:\Program Files\Norton Security\Norton Security\NortonData\22.20.2.57\Definitions\IPSDefs\20210504.061\IDSvia64.sys [1488976 2021-04-06] (Symantec Corporation -> Broadcom)
S3 Larmkanal; C:\WINDOWS\System32\drivers\Larmkanal.sys [33112 2015-09-02] (ADORIASOFT LLC -> Adoriasoft LLC)
S3 logi_joy_bus_enum; C:\WINDOWS\system32\drivers\logi_joy_bus_enum.sys [38136 2020-02-18] (Logitech Inc -> Logitech)
S3 logi_joy_vir_hid; C:\WINDOWS\system32\drivers\logi_joy_vir_hid.sys [26672 2020-08-10] (Logitech Inc -> Logitech)
S3 logi_joy_xlcore; C:\WINDOWS\system32\drivers\logi_joy_xlcore.sys [66808 2020-02-18] (Logitech Inc -> Logitech)
R2 MBAMChameleon; C:\WINDOWS\System32\Drivers\MbamChameleon.sys [220752 2021-05-01] (Malwarebytes Inc -> Malwarebytes)
S0 MbamElam; C:\WINDOWS\System32\DRIVERS\MbamElam.sys [19912 2021-04-09] (Microsoft Windows Early Launch Anti-malware Publisher -> Malwarebytes)
R3 MBAMSwissArmy; C:\WINDOWS\System32\Drivers\mbamswissarmy.sys [248992 2021-05-01] (Malwarebytes Inc -> Malwarebytes)
S3 nsvst_NGC; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\nsvst.sys [56912 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
S3 Phosgene; C:\WINDOWS\system32\DRIVERS\Phosgene.sys [34136 2015-09-02] (ADORIASOFT LLC -> Adoriasoft LLC)
R0 pwdrvio; C:\WINDOWS\System32\pwdrvio.sys [19152 2013-09-30] (MiniTool Solution Ltd -> )
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] (MiniTool Solution Ltd -> )
S3 RzCommon; C:\WINDOWS\System32\drivers\RzCommon.sys [51776 2020-02-17] (Razer USA Ltd. -> Razer Inc)
S3 RzDev_021e; C:\WINDOWS\System32\drivers\RzDev_021e.sys [52288 2020-02-17] (Razer USA Ltd. -> Razer Inc)
S3 RzDev_0306; C:\WINDOWS\System32\drivers\RzDev_0306.sys [52504 2020-02-17] (Razer USA Ltd. -> Razer Inc)
R3 SRTSP; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\SRTSP64.SYS [890464 2021-03-27] (Symantec Corporation -> Broadcom)
R1 SRTSPX; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\SRTSPX64.SYS [50272 2021-03-27] (Symantec Corporation -> Broadcom)
S3 sshid; C:\WINDOWS\System32\drivers\sshid.sys [48040 2018-09-25] (SteelSeries ApS -> SteelSeries ApS)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166760 2019-09-26] (Samsung Electronics Co., Ltd. -> Samsung Electronics Co., Ltd.)
R3 SteamStreamingMicrophone; C:\WINDOWS\system32\drivers\SteamStreamingMicrophone.sys [40736 2017-07-28] (Valve Corp. -> )
R3 SteamStreamingSpeakers; C:\WINDOWS\system32\drivers\SteamStreamingSpeakers.sys [40736 2017-07-21] (Valve Corp. -> )
R0 SymEFASI; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\SYMEFASI64.SYS [2060656 2021-03-27] (Symantec Corporation -> Broadcom)
S0 SymELAM; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\SymELAM.sys [25080 2021-03-27] (Microsoft Windows Early Launch Anti-malware Publisher -> Broadcom Corporation)
R3 SymEvent; C:\WINDOWS\system32\Drivers\SYMEVENT64x86.SYS [100064 2019-07-28] (Symantec Corporation -> Symantec Corporation)
R3 SymEvnt; C:\Program Files\Norton Security\Norton Security\NortonData\22.20.2.57\SymPlatform\SymEvnt.sys [712368 2020-03-20] (Symantec Corporation -> Symantec Corporation)
R1 SymIRON; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\Ironx64.SYS [316488 2021-03-27] (Symantec Corporation -> Symantec Corporation)
R1 SymNetS; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\symnets.sys [575328 2021-03-27] (Symantec Corporation -> Symantec Corporation)
R3 tap0901; C:\WINDOWS\System32\drivers\tap0901.sys [27136 2016-04-21] (OpenVPN Technologies, Inc. -> The OpenVPN Project)
S3 tapnordvpn; C:\WINDOWS\System32\drivers\tapnordvpn.sys [44896 2018-07-24] (TEFINCOM S.A. -> The OpenVPN Project)
S3 V0790Vid; C:\WINDOWS\system32\DRIVERS\V0790Vid.sys [389128 2015-08-24] (Microsoft Windows Hardware Compatibility Publisher -> Creative Technology Ltd.)
S2 vcs; C:\Program Files (x86)\Common Files\Avnex\vcs64.sys [4096 2017-07-15] () [File not signed]
R3 VCSVADHWSer; C:\WINDOWS\System32\drivers\vcsvad.sys [29320 2015-10-01] (AVSOFT CORP. -> AVSOFT Corp.)
S3 VOICEMOD_Driver; C:\WINDOWS\system32\drivers\vmdrv.sys [45408 2018-03-15] (Voicemod Sociedad Limitada -> Windows ® Win 7 DDK provider)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [46688 2019-12-07] (Microsoft Windows Early Launch Anti-malware Publisher -> Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [350136 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [54200 2019-12-07] (Microsoft Windows -> Microsoft Corporation)
S3 wpCtrlDrv_NGC; C:\WINDOWS\System32\drivers\NGCx64\1615020.032\wpCtrlDrv.sys [1013792 2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One month (created) (Whitelisted) =========

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-05-05 15:23 - 2021-05-05 15:24 - 000000000 ____D C:\Users\kubsons07\Desktop\FRST
2021-05-05 13:06 - 2021-05-05 13:06 - 000015158 _____ C:\Users\kubsons07\AppData\Local\recently-used.xbel
2021-05-05 10:44 - 2021-05-05 10:44 - 000000000 ____D C:\WINDOWS\system32\Tasks\Remediation
2021-05-04 21:29 - 2021-05-04 21:30 - 000000000 ____D C:\Users\kubsons07\Desktop\hitsound pack1
2021-05-03 15:41 - 2021-05-03 15:42 - 001299185 _____ C:\Users\kubsons07\Desktop\sfm.dem
2021-05-03 15:21 - 2021-05-03 15:21 - 000000000 _____ C:\Users\kubsons07\Desktop\Nowy dokument tekstowy.txt
2021-05-03 15:18 - 2021-05-03 15:18 - 000083342 _____ C:\Users\kubsons07\Desktop\bbb.jpeg
2021-05-03 15:16 - 2021-05-03 15:16 - 000001041 _____ C:\Users\kubsons07\Desktop\hammer — skrót.lnk
2021-05-02 14:21 - 2021-05-04 21:21 - 000000000 ____D C:\Users\kubsons07\Desktop\toonhud
2021-05-01 13:06 - 2021-05-01 13:06 - 000248992 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamswissarmy.sys
2021-05-01 13:06 - 2021-05-01 13:06 - 000220752 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamChameleon.sys
2021-04-29 21:57 - 2021-04-29 21:58 - 000000000 ____D C:\WINDOWS\LastGood
2021-04-29 21:53 - 2021-04-28 15:54 - 001855192 _____ C:\WINDOWS\system32\vulkaninfo-1-999-0-0-0.exe
2021-04-29 21:53 - 2021-04-28 15:54 - 001855192 _____ C:\WINDOWS\system32\vulkaninfo.exe
2021-04-29 21:53 - 2021-04-28 15:54 - 001453344 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2021-04-29 21:53 - 2021-04-28 15:54 - 001435864 _____ C:\WINDOWS\SysWOW64\vulkaninfo-1-999-0-0-0.exe
2021-04-29 21:53 - 2021-04-28 15:54 - 001435864 _____ C:\WINDOWS\SysWOW64\vulkaninfo.exe
2021-04-29 21:53 - 2021-04-28 15:54 - 001192728 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2021-04-29 21:53 - 2021-04-28 15:54 - 001094880 _____ C:\WINDOWS\system32\vulkan-1-999-0-0-0.dll
2021-04-29 21:53 - 2021-04-28 15:54 - 001094880 _____ C:\WINDOWS\system32\vulkan-1.dll
2021-04-29 21:53 - 2021-04-28 15:54 - 000948952 _____ C:\WINDOWS\SysWOW64\vulkan-1-999-0-0-0.dll
2021-04-29 21:53 - 2021-04-28 15:54 - 000948952 _____ C:\WINDOWS\SysWOW64\vulkan-1.dll
2021-04-29 21:53 - 2021-04-28 15:52 - 000715552 _____ C:\WINDOWS\system32\nvofapi64.dll
2021-04-29 21:53 - 2021-04-28 15:52 - 000575776 _____ C:\WINDOWS\SysWOW64\nvofapi.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 002106144 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 001590560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 001514776 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 001166104 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 000675120 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2021-04-29 21:53 - 2021-04-28 15:51 - 000564016 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 008317216 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 007434032 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 004795160 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 002823448 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 001730864 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6446627.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 001490224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6446627.dll
2021-04-29 21:53 - 2021-04-28 15:50 - 000811800 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2021-04-29 21:52 - 2021-04-28 15:42 - 006159152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2021-04-27 20:41 - 2021-04-27 20:41 - 000012246 _____ C:\Users\kubsons07\Desktop\killsound1.wav
2021-04-24 17:27 - 2021-04-24 17:26 - 000191776 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-64.dll
2021-04-24 16:39 - 2021-04-24 21:05 - 000000000 ____D C:\Users\kubsons07\Desktop\1.8.9
2021-04-23 21:37 - 2021-04-23 21:37 - 049061420 _____ C:\Users\kubsons07\Desktop\after dark.wav
2021-04-23 16:46 - 2021-05-02 14:28 - 000000000 ____D C:\Users\kubsons07\Desktop\nocritsounds
2021-04-22 10:47 - 2021-04-22 10:47 - 000000000 ____D C:\WINDOWS\system32\Tasks\Mozilla
2021-04-21 20:34 - 2021-04-24 17:06 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2021-04-16 11:37 - 2021-04-16 11:37 - 000011357 _____ C:\WINDOWS\system32\DrtmAuthTxt.wim
2021-04-16 11:35 - 2021-04-16 11:35 - 001823304 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2021-04-16 11:35 - 2021-04-16 11:35 - 000231248 _____ C:\WINDOWS\system32\containerdevicemanagement.dll
2021-04-15 14:23 - 2021-04-15 14:24 - 000000000 ____D C:\Users\kubsons07\Desktop\AdvHUD files
2021-04-14 18:13 - 2020-08-14 09:59 - 000043416 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\NvModuleTracker.sys
2021-04-13 16:29 - 2021-05-05 11:36 - 000000000 ____D C:\WINDOWS\system32\Tasks\Norton Security
2021-04-13 16:28 - 2021-04-13 16:49 - 000000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
2021-04-13 16:28 - 2021-04-13 16:28 - 000003408 _____ C:\WINDOWS\system32\Tasks\Norton WSC Integration
2021-04-09 16:28 - 2021-04-09 16:28 - 000000650 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes.lnk
2021-04-09 16:28 - 2021-04-09 16:27 - 000199128 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbae64.sys
2021-04-09 16:28 - 2021-04-09 16:27 - 000019912 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MbamElam.sys
2021-04-08 18:16 - 2021-04-08 18:16 - 000000000 ____D C:\WINDOWS\SysWOW64\Macromed

==================== One month (modified) ==================

(If an entry is included in the fixlist, the file/folder will be moved.)

2021-05-05 15:29 - 2020-11-15 03:37 - 000000000 ____D C:\FRST
2021-05-05 15:23 - 2019-12-07 11:14 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2021-05-05 14:18 - 2017-06-13 11:22 - 000000000 ____D C:\ProgramData\NVIDIA
2021-05-05 14:17 - 2017-06-14 19:39 - 000000000 ____D C:\Program Files (x86)\Steam
2021-05-05 13:08 - 2020-10-30 13:51 - 000000000 ____D C:\Users\kubsons07\AppData\Local\babl-0.1
2021-05-05 13:06 - 2017-07-28 23:24 - 000000000 ____D C:\Users\kubsons07\AppData\Local\gtk-2.0
2021-05-05 07:40 - 2019-02-06 13:38 - 000000000 ____D C:\ProgramData\Mozilla
2021-05-05 07:39 - 2017-08-19 21:16 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\Origin
2021-05-05 07:39 - 2017-08-19 20:26 - 000000000 ____D C:\ProgramData\Origin
2021-05-05 07:39 - 2017-06-14 17:11 - 000000000 ____D C:\Users\kubsons07\AppData\LocalLow\Mozilla
2021-05-05 07:36 - 2017-08-19 21:16 - 000000000 ____D C:\Users\kubsons07\AppData\Local\Origin
2021-05-04 23:54 - 2017-09-13 17:36 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\discord
2021-05-04 20:48 - 2020-10-12 18:09 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2021-05-04 20:26 - 2017-08-19 20:26 - 000000000 ____D C:\Program Files (x86)\Origin
2021-05-04 17:44 - 2019-10-12 12:47 - 000000000 ___HD C:\Users\Public\Documents\AdobeGCData
2021-05-04 13:23 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\AppReadiness
2021-05-03 16:12 - 2018-05-15 20:19 - 000000000 ____D C:\Users\kubsons07\AppData\Local\PlaceholderTileLogoFolder
2021-05-03 15:37 - 2017-06-15 10:43 - 000000000 ____D C:\Users\kubsons07\AppData\Local\CrashDumps
2021-05-03 15:19 - 2018-01-20 23:55 - 000000000 ____D C:\Users\kubsons07\AppData\Local\Packages
2021-05-03 15:18 - 2019-12-07 11:14 - 000000000 ___HD C:\Program Files\WindowsApps
2021-04-30 22:51 - 2020-12-21 00:44 - 000002455 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk
2021-04-30 19:11 - 2019-12-07 11:13 - 000000000 ____D C:\WINDOWS\INF
2021-04-30 14:33 - 2019-10-29 20:07 - 000000000 ____D C:\Users\kubsons07\AppData\Local\NVIDIA
2021-04-29 20:37 - 2018-05-16 17:33 - 000000000 ____D C:\Users\kubsons07\AppData\Local\D3DSCache
2021-04-29 16:34 - 2020-10-12 18:24 - 000003388 _____ C:\WINDOWS\system32\Tasks\OneDrive Standalone Update Task-S-1-5-21-2944253907-4126696763-4153681683-1001
2021-04-29 16:33 - 2020-10-12 18:15 - 000002430 _____ C:\Users\kubsons07\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2021-04-29 16:33 - 2017-06-14 17:11 - 000000000 ___RD C:\Users\kubsons07\OneDrive
2021-04-29 14:37 - 2019-06-02 11:55 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\.minecraft
2021-04-29 12:36 - 2017-06-22 20:45 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\obs-studio
2021-04-29 12:02 - 2018-01-10 20:03 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\audacity
2021-04-28 15:50 - 2021-02-26 14:35 - 000656152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2021-04-28 15:42 - 2020-10-09 21:49 - 007212248 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvapi64.dll
2021-04-27 20:42 - 2019-03-13 15:03 - 000000000 ____D C:\Users\kubsons07\Desktop\My TF2 stuff
2021-04-27 12:44 - 2017-06-13 11:28 - 000002314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2021-04-26 07:49 - 2020-12-21 00:44 - 000003510 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineUA
2021-04-26 07:49 - 2020-12-21 00:44 - 000003386 _____ C:\WINDOWS\system32\Tasks\MicrosoftEdgeUpdateTaskMachineCore
2021-04-24 17:27 - 2017-12-29 23:42 - 000000000 ____D C:\Program Files (x86)\Java
2021-04-24 17:27 - 2017-09-16 16:08 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2021-04-24 17:27 - 2017-06-25 10:55 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2021-04-24 17:26 - 2017-09-16 16:09 - 000191776 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2021-04-24 17:25 - 2020-05-25 02:50 - 000164640 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2021-04-24 17:25 - 2017-09-16 16:08 - 000000000 ____D C:\Program Files\Java
2021-04-24 17:14 - 2020-10-12 18:28 - 001758684 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2021-04-24 17:14 - 2019-12-07 17:08 - 000780534 _____ C:\WINDOWS\system32\perfh015.dat
2021-04-24 17:14 - 2019-12-07 17:08 - 000151102 _____ C:\WINDOWS\system32\perfc015.dat
2021-04-24 17:11 - 2019-12-07 11:03 - 000032768 _____ C:\WINDOWS\system32\config\ELAM
2021-04-24 17:07 - 2020-10-12 18:24 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2021-04-24 17:07 - 2020-10-12 18:09 - 000008192 ___SH C:\DumpStack.log.tmp
2021-04-24 17:06 - 2017-06-13 11:27 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2021-04-24 17:05 - 2019-12-07 11:03 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2021-04-24 13:44 - 2020-11-27 20:37 - 000000000 ____D C:\Users\kubsons07\AppData\Local\Battle.net
2021-04-24 03:10 - 2020-10-09 21:49 - 000063943 _____ C:\WINDOWS\system32\nvinfo.pb
2021-04-23 23:13 - 2019-10-29 20:06 - 005667696 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2021-04-23 23:13 - 2019-10-29 20:06 - 002637680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2021-04-23 23:13 - 2019-10-29 20:06 - 001758064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2021-04-23 23:13 - 2019-10-29 20:06 - 000990064 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2021-04-23 23:13 - 2019-10-29 20:06 - 000120176 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2021-04-23 23:13 - 2019-10-29 20:06 - 000082288 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2021-04-23 22:18 - 2021-01-03 16:56 - 000000000 ____D C:\Users\kubsons07\AppData\Local\GeometryDash
2021-04-22 10:47 - 2017-06-13 11:27 - 000001235 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2021-04-21 08:39 - 2020-10-15 16:26 - 000003568 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineUA
2021-04-21 08:39 - 2020-10-15 16:26 - 000003444 _____ C:\WINDOWS\system32\Tasks\GoogleUpdateTaskMachineCore
2021-04-16 22:14 - 2020-10-12 18:09 - 000320520 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ___SD C:\WINDOWS\system32\DiagSvcs
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\SystemResources
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\setup
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\oobe
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\lv-LV
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\lt-LT
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\et-EE
2021-04-16 22:10 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\system32\es-MX
2021-04-16 22:09 - 2019-12-07 11:14 - 000000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2021-04-16 22:09 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\Provisioning
2021-04-16 22:09 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\PolicyDefinitions
2021-04-16 22:09 - 2019-12-07 11:14 - 000000000 ____D C:\WINDOWS\bcastdvr
2021-04-16 13:36 - 2019-03-30 23:04 - 000000000 ____D C:\Users\kubsons07\Desktop\Launchers
2021-04-16 13:26 - 2018-04-21 11:26 - 000000000 ____D C:\Users\kubsons07\AppData\Local\Ubisoft Game Launcher
2021-04-16 11:45 - 2019-12-07 11:03 - 000000000 ____D C:\WINDOWS\CbsTemp
2021-04-16 11:34 - 2020-10-12 18:12 - 002877440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintConfig.dll
2021-04-16 09:02 - 2019-10-29 20:06 - 009536587 _____ C:\WINDOWS\system32\nvcoproc.bin
2021-04-15 23:35 - 2017-06-15 18:39 - 000000000 ____D C:\WINDOWS\system32\MRT
2021-04-15 23:32 - 2017-06-15 18:39 - 131963968 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2021-04-15 14:25 - 2019-03-30 23:03 - 000000000 ____D C:\Users\kubsons07\Desktop\Games Stuff
2021-04-15 14:24 - 2018-06-15 19:42 - 000000000 ___RD C:\Users\kubsons07\Desktop\Everything
2021-04-15 14:23 - 2020-10-18 20:43 - 000000000 ____D C:\Users\kubsons07\Desktop\passes
2021-04-15 14:23 - 2019-03-30 23:04 - 000000000 ___RD C:\Users\kubsons07\Desktop\Tools
2021-04-15 14:23 - 2019-03-30 23:04 - 000000000 ____D C:\Users\kubsons07\Desktop\Calls
2021-04-14 18:15 - 2017-06-13 11:21 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2021-04-14 18:14 - 2020-10-12 18:24 - 000004308 _____ C:\WINDOWS\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000004106 _____ C:\WINDOWS\system32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003976 _____ C:\WINDOWS\system32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003940 _____ C:\WINDOWS\system32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport4_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2020-10-12 18:24 - 000003858 _____ C:\WINDOWS\system32\Tasks\NvTmRep_CrashReport1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:14 - 2017-06-13 11:21 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2021-04-14 18:14 - 2017-06-13 11:19 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2021-04-14 18:13 - 2020-10-12 18:24 - 000003894 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 18:13 - 2020-10-12 18:24 - 000003654 _____ C:\WINDOWS\system32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2021-04-14 14:09 - 2020-10-19 07:38 - 000002395 _____ C:\Users\kubsons07\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Teams.lnk
2021-04-13 16:54 - 2017-06-26 20:29 - 000000000 ____D C:\Program Files\Common Files\AV
2021-04-13 16:28 - 2019-07-21 18:17 - 000000000 ____D C:\WINDOWS\system32\Drivers\NGCx64
2021-04-13 11:21 - 2021-02-26 14:35 - 000656152 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\SETE230.tmp
2021-04-13 11:17 - 2020-10-09 21:49 - 007212248 _____ (NVIDIA Corporation) C:\WINDOWS\system32\SETC207.tmp
2021-04-12 15:04 - 2017-08-06 15:01 - 000000251 _____ C:\Users\kubsons07\AppData\LocalLow\rbxcsettings.rbx
2021-04-09 16:28 - 2019-12-07 11:14 - 000000000 ___HD C:\WINDOWS\ELAMBKUP
2021-04-08 18:02 - 2018-04-07 12:52 - 000000000 ____D C:\Users\kubsons07\AppData\Roaming\Adobe
2021-04-08 17:20 - 2017-07-23 23:28 - 000000000 ____D C:\Users\kubsons07\AppData\Local\NPE
2021-04-07 13:38 - 2019-10-29 20:07 - 002817904 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2021-04-07 13:38 - 2019-10-29 20:07 - 002171760 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2021-04-07 13:38 - 2019-10-29 20:07 - 001293680 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvRtmpStreamer64.dll
2021-04-07 00:01 - 2020-10-12 18:15 - 000000000 ____D C:\Users\kubsons07
2021-04-06 15:02 - 2020-10-12 18:15 - 000000000 ____D C:\Users\defaultuser0

==================== Files in the root of some directories ========

2020-11-04 23:18 - 2021-01-29 16:23 - 000000015 _____ () C:\Users\kubsons07\AppData\Roaming\obs-virtualcam.txt
2020-06-05 13:14 - 2020-06-05 13:14 - 000000000 _____ () C:\Users\kubsons07\AppData\Local\oobelibMkey.log
2021-05-05 13:06 - 2021-05-05 13:06 - 000015158 _____ () C:\Users\kubsons07\AppData\Local\recently-used.xbel

==================== SigCheck ============================

(There is no automatic fix for files that do not pass verification.)

==================== End of FRST.txt ========================



BC AdBot (Login to Remove)

 


#2 Peppey332

Peppey332
  • Topic Starter

  •  Avatar image
  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 05 May 2021 - 08:45 AM

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-04-2021
Ran by kubsons07 (05-05-2021 15:32:31)
Running from C:\Users\kubsons07\Desktop\FRST
Windows 10 Home Version 2004 19041.928 (X64) (2020-10-12 16:46:50)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-2944253907-4126696763-4153681683-500 - Administrator - Disabled)
defaultuser0 (S-1-5-21-2944253907-4126696763-4153681683-1000 - Limited - Disabled) => C:\Users\defaultuser0
Gość (S-1-5-21-2944253907-4126696763-4153681683-501 - Limited - Disabled)
Konto domyślne (S-1-5-21-2944253907-4126696763-4153681683-503 - Limited - Disabled)
kubsons07 (S-1-5-21-2944253907-4126696763-4153681683-1001 - Administrator - Enabled) => C:\Users\kubsons07
postgres (S-1-5-21-2944253907-4126696763-4153681683-1004 - Limited - Enabled) => C:\Users\postgres
WDAGUtilityAccount (S-1-5-21-2944253907-4126696763-4153681683-504 - Limited - Disabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security (Enabled - Up to date) {1122B19A-E671-38EC-8EAC-87048FD4528D}
AV: Norton Security (Enabled - Up to date) {A2708B76-6835-6565-CB96-694212954A75}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton Security (Enabled - Up to date) {9E3FD331-C4C2-7AC4-0537-131EEF1B1F8A}
FW: Norton Security (Enabled) {9A4B0A53-225A-643D-E0C9-C077EC460D0E}
FW: Norton Security (Enabled) {A6045214-8EAD-7B9C-2E68-BA2B11C858F1}
FW: Norton Security (Enabled) {291930BF-AC1E-39B4-A5F3-2E31710715F6}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Genuine Service (HKLM-x32\...\AdobeGenuineService) (Version:  - Adobe)
Audacity 2.2.1 (HKLM-x32\...\Audacity_is1) (Version: 2.2.1 - Audacity Team)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Blackmagic RAW Common Components (HKLM\...\{28612306-CE2C-429F-8288-D707C9A84838}) (Version: 1.8.1 - Blackmagic Design)
Brother Driver Deployment Wizard (HKLM-x32\...\{0ED38503-B69A-44B4-98BE-21BFF284A9B6}) (Version: 1.09.000 - Brother)
Corel Painter Essentials 6 - Content (HKLM\...\{56F051E4-C179-425E-9AA8-4B3FBC2F05B7}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - Core (HKLM\...\{FA3FA2BE-94D1-41CA-89BF-29AE2EB61E46}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - CT (HKLM\...\{404B42A1-47EF-44D5-B390-E0CB3F879497}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - DE (HKLM\...\{13CD16A8-0B5E-469D-A8C2-1BD41B58999F}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - EN (HKLM\...\{1B3DFFA0-0CE7-4607-8E55-FB64B8628995}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - FR (HKLM\...\{E39BC105-2204-4BA8-BB9F-D08E5BDD1493}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - IPM (HKLM\...\{B1AA1DD1-FC10-499C-B802-6C9558CBBC1A}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - IPM Content (HKLM\...\{68FC3BC5-C3AA-4B36-86F7-D4ED105E1D7B}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 - JP (HKLM\...\{9BAC9F81-DE28-450F-B0F8-C319D08C2A6A}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Essentials 6 (HKLM\...\_{0EDEDA40-4B3A-46D0-A0D8-0FE8834390DE}) (Version: 6.1.0.238 - Corel Corpopration)
Corel Painter Essentials 6 (HKLM\...\{D5ACBF88-A251-4E63-8DFE-1EF7491D601E}) (Version: 6.1 - Corel Corporation) Hidden
Corel Painter Thumbnail Previewer (HKLM\...\{50139369-99B2-496A-8726-D3DC5D6D4235}) (Version: 18.0 - Corel Corporation)
Corel Update Manager (HKLM\...\{5039B7BE-F79B-4121-A9D3-D66ED4169414}) (Version: 2.13.594 - Corel corporation) Hidden
DaVinci Resolve (HKLM\...\{8CD009CC-08AB-4873-BA5C-DC4AEA8BACEB}) (Version: 16.2.7010 - Blackmagic Design)
DaVinci Resolve Keyboards (HKLM\...\{04F776FB-37A2-4116-84F2-6CF3D731999D}) (Version: 1.0.0.0 - Blackmagic Design)
DaVinci Resolve Panels (HKLM\...\{567706B7-1501-43BC-81AB-C7E306B40C73}) (Version: 1.3.2.0 - Blackmagic Design)
Discord (HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Discord) (Version: 0.0.309 - Discord Inc.)
dwdinst (HKLM-x32\...\{8EC8F7F1-DBF1-4137-B8A9-9DE690605F85}) (Version: 1.0.0.0 - HanWIS GmbH)
Epic Games Launcher Prerequisites (x64) (HKLM\...\{66C5838F-B854-4A55-89E6-A6138747A4DF}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
GCFScape 1.8.6 (HKLM\...\GCFScape_is1) (Version:  - Ryan Gregg)
GIMP 2.10.22 (HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\GIMP-2_is1) (Version: 2.10.22 - The GIMP Team)
Glorious Model O Software (HKLM-x32\...\{0969D386-B5B4-41BD-98E3-4A1A7D32CB97}_is1) (Version: 1.0.9 - Glorious PC Gaming Race LLC.)
Google Chrome (HKLM-x32\...\{ABB67988-B698-39BE-99E3-E41B2027AC1F}) (Version: 90.0.4430.93 - Google, Inc.)
ICA (HKLM\...\{0EDEDA40-4B3A-46D0-A0D8-0FE8834390DE}) (Version: 6.1 - Corel Corpopration) Hidden
Intel® Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 11.0.0.1158 - Intel Corporation)
Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4463 - Intel Corporation)
Intel® Security Assist (HKLM-x32\...\{4B230374-6475-4A73-BA6E-41015E9C5013}) (Version: 1.0.0.532 - Intel Corporation)
IrfanView 4.44 (64-bit) (HKLM\...\IrfanView64) (Version: 4.44 - Irfan Skiljan)
Java 8 Update 291 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180291F0}) (Version: 8.0.2910.10 - Oracle Corporation)
Java 8 Update 291 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180291F0}) (Version: 8.0.2910.10 - Oracle Corporation)
Java SE Development Kit 8 Update 151 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180151}) (Version: 8.0.1510.12 - Oracle Corporation)
Java SE Development Kit 8 Update 20 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180200}) (Version: 8.0.200.26 - Oracle Corporation)
Launcher Prerequisites (x64) (HKLM-x32\...\{c6c5a357-c7ca-4a5f-9789-3bb1af579253}) (Version: 1.0.0.0 - Epic Games, Inc.) Hidden
Live! Cam Chat HD VF0790 Driver (1.00.06.00) (HKLM\...\Creative VF0790) (Version:  - Creative Technology Ltd.)
Malwarebytes version 4.3.0.98 (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 4.3.0.98 - Malwarebytes)
Microsoft Edge (HKLM-x32\...\Microsoft Edge) (Version: 90.0.818.51 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\OneDriveSetup.exe) (Version: 21.062.0328.0001 - Microsoft Corporation)
Microsoft Teams (HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\Teams) (Version: 1.4.00.8872 - Microsoft Corporation)
Microsoft Update Health Tools (HKLM\...\{A0E1B43D-5F4A-46AF-9925-ABA3423325DC}) (Version: 2.77.0.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.40660 (HKLM-x32\...\{ef6b00ec-13e1-4c25-9064-b2f383cb8412}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.40660 (HKLM-x32\...\{61087a79-ac85-455c-934d-1fa22cc64f36}) (Version: 12.0.40660.0 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x64) - 14.25.28508 (HKLM-x32\...\{6913e92a-b64e-41c9-a5e6-cef39207fe89}) (Version: 14.25.28508.3 - Microsoft Corporation)
Microsoft Visual C++ 2015-2019 Redistributable (x86) - 14.24.28127 (HKLM-x32\...\{e31cb1a4-76b5-46a5-a084-3fa419e82201}) (Version: 14.24.28127.4 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 88.0 (x64 pl) (HKLM\...\Mozilla Firefox 88.0 (x64 pl)) (Version: 88.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 88.0.0.7775 - Mozilla)
Norton Security (HKLM-x32\...\NGC) (Version: 22.21.2.50 - Symantec Corporation)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.6.6 - Notepad++ Team)
NVIDIA FrameView SDK 1.1.4923.29781331 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_FrameViewSdk) (Version: 1.1.4923.29781331 - NVIDIA Corporation)
NVIDIA GeForce Experience 3.22.0.32 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 3.22.0.32 - NVIDIA Corporation)
NVIDIA Oprogramowanie systemu PhysX 9.19.0218 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.19.0218 - NVIDIA Corporation)
NVIDIA Sterownik dźwięku HD 1.3.38.40 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.38.40 - NVIDIA Corporation)
NVIDIA Sterownik graficzny 466.27 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 466.27 - NVIDIA Corporation)
OBS Studio (HKLM-x32\...\OBS Studio) (Version: 26.0.2 - OBS Project)
Oprogramowanie mikroukładu Intel® (HKLM-x32\...\{60c073df-e736-4210-9c3a-5fc2b651cef3}) (Version: 10.1.1.7 - Intel® Corporation) Hidden
Origin (HKLM-x32\...\Origin) (Version: 10.5.97.47554 - Electronic Arts, Inc.)
Overwatch (HKLM-x32\...\Overwatch) (Version:  - Blizzard Entertainment)
paint.net (HKLM\...\{B56F4594-AA51-450A-BBD0-2CE48675D33A}) (Version: 4.2.14 - dotPDN LLC)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7543 - Realtek Semiconductor Corp.)
STAR WARS™ Battlefront™ II (HKLM-x32\...\{8a882ce0-0c0b-4eb2-850c-28ebadab4f50}) (Version: 1.1.8.16162 - Electronic Arts)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TAP-Windows 9.21.2 (HKLM\...\TAP-Windows) (Version: 9.21.2 - )
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
TP-LINK TL-WN821N Driver (HKLM-x32\...\{03468BE2-4451-416D-B045-60F2101122D4}) (Version: 1.3.1 - TP-LINK)
Ubisoft Connect (HKLM-x32\...\Uplay) (Version: 10.0 - Ubisoft)
Update for Windows 10 for x64-based Systems (KB4023057) (HKLM\...\{16AD6161-2E47-4BF1-AA77-0946EFE93E08}) (Version: 2.61.0.0 - Microsoft Corporation)
VTFEdit 1.3.3 (HKLM\...\VTFEdit_is1) (Version:  - Neil Jedrzejewski & Ryan Gregg)
Vulkan Run Time Libraries 1.0.54.1 (HKLM\...\VulkanRT1.0.54.1) (Version: 1.0.54.1 - Intel Corporation Inc.)
WinRAR 5.70 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.70.0 - win.rar GmbH)
WorldPainter 2.7.17 (HKLM\...\4144-4862-0472-7103) (Version: 2.7.17 - pepsoft.org)

Packages:
=========
Adobe Photoshop Express: edytor obrazów, regulacje, filtry, efekty, krawędzie -> C:\Program Files\WindowsApps\AdobeSystemsIncorporated.AdobePhotoshopExpress_3.4.8.0_x64__ynb6jyjzte8ga [2020-11-25] (Adobe Inc.)
Dodatek Aparat multimediów dla aplikacji Zdjęcia -> C:\Program Files\WindowsApps\Microsoft.Photos.MediaEngineDLC_1.0.0.0_x64__8wekyb3d8bbwe [2021-05-03] (Microsoft Corporation)
Dodatek Zdjęcia -> C:\Program Files\WindowsApps\Microsoft.Windows.Photos.DLC.Main_2021.39122.10110.0_x64__8wekyb3d8bbwe [2021-05-01] (Microsoft Corporation)
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x64__8wekyb3d8bbwe [2019-02-09] (Microsoft Corporation) [MS Ad]
Microsoft Advertising SDK for XAML -> C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1811.1.0_x86__8wekyb3d8bbwe [2019-02-09] (Microsoft Corporation) [MS Ad]
Microsoft Solitaire Collection -> C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.9.4213.0_x64__8wekyb3d8bbwe [2021-05-01] (Microsoft Studios) [MS Ad]

==================== Custom CLSID (Whitelisted): ==============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-2944253907-4126696763-4153681683-1001_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32 -> C:\Users\kubsons07\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.20339.4\x64\Microsoft.Teams.AddinLoader.dll (Microsoft Corporation -> Microsoft Corporation)
ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ShellIconOverlayIdentifiers-x32: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ShellIconOverlayIdentifiers-x32: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ShellIconOverlayIdentifiers-x32: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2017-12-05] (Notepad++ -> )
ContextMenuHandlers1: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers1: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\NavShExt.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2019-02-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2019-02-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers2: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\NavShExt.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers3: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => D:\Program Files\mbshlext.dll [2021-04-09] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2021-04-23] (NVIDIA Corporation -> NVIDIA Corporation)
ContextMenuHandlers6: [BUContextMenu] -> {F7CAA2A1-67A2-44BB-B20F-202FD8EB1DAB} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\buShell.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers6: [MBAMShlExt] -> {57CE581A-0CB6-4266-9CA0-19364C90A0B3} => D:\Program Files\mbshlext.dll [2021-04-09] (Malwarebytes Corporation -> Malwarebytes)
ContextMenuHandlers6: [NortonLifeLock.Norton.Antivirus.IEContextMenu] -> {FAD61B3D-699D-49B2-BE16-7F82CB4C59CA} => C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\NavShExt.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2019-02-24] (win.rar GmbH -> Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2019-02-24] (win.rar GmbH -> Alexander Roshal)

==================== Codecs (Whitelisted) ====================

==================== Shortcuts & WMI ========================

==================== Loaded Modules (Whitelisted) =============

2017-08-19 20:42 - 2017-08-19 20:42 - 000266240 _____ () [File not signed] C:\Program Files (x86)\Origin\imageformats\qmng.dll
2021-02-17 09:30 - 2021-04-27 10:05 - 000015360 _____ () [File not signed] C:\Program Files (x86)\Origin\libEGL.DLL
2021-02-17 09:30 - 2021-04-27 10:05 - 003090944 _____ () [File not signed] C:\Program Files (x86)\Origin\libGLESv2.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000002560 _____ (The ICU Project) [File not signed] C:\Program Files (x86)\Origin\icudt58.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 001252864 _____ (The ICU Project) [File not signed] C:\Program Files (x86)\Origin\icuuc58.dll
2021-02-17 09:30 - 2021-04-27 10:05 - 001282048 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files (x86)\Origin\LIBEAY32.dll
2020-08-26 09:48 - 2021-04-27 10:05 - 000279040 _____ (The OpenSSL Project, hxxp://www.openssl.org/) [File not signed] C:\Program Files (x86)\Origin\ssleay32.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000030208 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qgif.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000032768 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qico.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000256512 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qjpeg.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000026112 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qtga.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000305152 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qtiff.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000025600 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\imageformats\qwbmp.dll
2021-02-17 09:30 - 2021-04-27 10:05 - 000278016 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\mediaservice\dsengine.dll
2021-02-17 09:30 - 2021-04-27 10:05 - 001611264 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\platforms\qwindows.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 005487104 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Core.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 005841920 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Gui.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000709120 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Multimedia.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 001179136 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Network.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000207360 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Positioning.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000310272 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5PrintSupport.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 003513344 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Qml.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 003390976 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Quick.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000068096 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5QuickWidgets.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000045568 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5TextToSpeech.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000116224 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5WebChannel.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 054071296 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5WebEngineCore.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000211456 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5WebEngineWidgets.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000146432 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5WebSockets.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 005089792 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Widgets.dll
2021-04-27 10:05 - 2021-04-27 10:05 - 000184832 _____ (The Qt Company Ltd) [File not signed] C:\Program Files (x86)\Origin\Qt5Xml.dll

==================== Alternate Data Streams (Whitelisted) ========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Public\Shared Files:VersionCache [3012]

==================== Safe Mode (Whitelisted) ==================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service"

==================== Association (Whitelisted) =================

==================== Internet Explorer (Whitelisted) ==========

BHO: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\coIEPlg.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_291\bin\ssv.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_291\bin\jp2ssv.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Norton Password Manager -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files\Norton Security\Norton Security\Engine32\22.21.2.50\coIEPlg.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_291\bin\ssv.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_291\bin\jp2ssv.dll [2021-04-24] (Oracle America, Inc. -> Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Norton Security\Engine\22.21.2.50\coIEPlg.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security\Norton Security\Engine32\22.21.2.50\coIEPlg.dll [2021-03-27] (NortonLifeLock Inc. -> NortonLifeLock Inc.)

==================== Hosts content: =========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2016-07-16 13:47 - 2020-07-11 10:17 - 000000000 ____N C:\WINDOWS\system32\drivers\etc\hosts

==================== Other Areas ===========================

(Currently there is no automatic fix for this section.)

HKLM\System\CurrentControlSet\Control\Session Manager\Environment\\Path -> C:\Program Files (x86)\Razer Chroma SDK\bin;C:\Program Files\Razer Chroma SDK\bin;C:\Program Files (x86)\Razer\ChromaBroadcast\bin;C:\Program Files\Razer\ChromaBroadcast\bin;C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\ProgramData\Oracle\Java\javapath;C:\Program Files (x86)\Intel\iCLS Client\;C:\Program Files\Intel\iCLS Client\;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL;C:\Program Files\Intel\Intel® Management Engine Components\DAL;C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT;C:\Program Files\Intel\Intel® Management Engine Components\IPT;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;C:\Program Files\NVIDIA Corporation\NVIDIA NvDLISR;C:\WINDOWS\system32\config\systemprofile\AppData\Local\Microsoft\WindowsApps;;D:\GRY\WorldPainter;C:\Users\kubsons07\AppData\Local\Microsoft\WindowsApps;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;%SYSTEMROOT%\System32\OpenSSH\
HKCU\Environment\\Path -> %USERPROFILE%\AppData\Local\Microsoft\WindowsApps
HKU\S-1-5-21-2944253907-4126696763-4153681683-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\Windows\img0.jpg
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\kubsons07\Desktop\Bez tytułu.png
DNS Servers: 192.168.31.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

(If an entry is included in the fixlist, it will be removed.)

MSCONFIG\Services: Origin Client Service => 3
MSCONFIG\Services: Origin Web Helper Service => 2
HKLM\...\StartupApproved\Run: => "WinZip FAH"
HKLM\...\StartupApproved\Run: => "WinZip PreLoader"
HKLM\...\StartupApproved\Run: => "WinZip UN"
HKLM\...\StartupApproved\Run: => "XMouseButtonControl"
HKLM\...\StartupApproved\Run: => "AdobeGCInvoker-1.0"
HKLM\...\StartupApproved\Run32: => "LogMeIn Hamachi Ui"
HKLM\...\StartupApproved\Run32: => "RoccatKoneXTD"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\StartupFolder: => "Twitch.lnk"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\StartupFolder: => "MEGAsync.lnk"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "Discord"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "OmikronService"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "EpicGamesLauncher"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "ProductAuthenticationService"
HKU\S-1-5-21-2944253907-4126696763-4153681683-1001\...\StartupApproved\Run: => "SteamServerBrowser"

==================== FirewallRules (Whitelisted) ================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{B04FB8E0-E085-4E4D-A8F1-442AA022DFCB}] => (Allow) D:\GRY\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{6BB4325B-B175-4618-A3F8-F3FC62BB0FB2}] => (Allow) D:\GRY\STAR WARS Battlefront II\starwarsbattlefrontii.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{049FEAE1-4CB2-45FC-BE22-CCA3D777F47A}] => (Allow) D:\GRY\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{CF5EEE3C-52FA-4651-A989-7EA1C6467D8F}] => (Allow) D:\GRY\STAR WARS Battlefront II\starwarsbattlefrontii_trial.exe (Electronic Arts, Inc. -> Electronic Arts Inc.)
FirewallRules: [{3AA93A12-B139-434F-B4E1-E5C8108E21C7}] => (Allow) D:\Steam D\steamapps\common\Terraria\Terraria.exe (Re-Logic) [File not signed]
FirewallRules: [{4D360F8F-97B8-4E1D-95FA-AC58AF6AFAF5}] => (Allow) D:\Steam D\steamapps\common\Terraria\Terraria.exe (Re-Logic) [File not signed]
FirewallRules: [{84AB4C9D-CED3-447B-8AB9-3E02140775C9}] => (Allow) D:\Steam D\steamapps\common\The Escapists\TheEscapists.exe () [File not signed]
FirewallRules: [{5608D2C8-9727-4349-83D4-1594A81C67F8}] => (Allow) D:\Steam D\steamapps\common\The Escapists\TheEscapists.exe () [File not signed]
FirewallRules: [{DA444DE0-7D43-4977-ACD9-9243A2E6AB81}] => (Allow) D:\Steam D\steamapps\common\Armored Kitten\ArmoredKitten.exe () [File not signed]
FirewallRules: [{5FDF8EFE-490D-4893-9D1E-80885D4F8CB9}] => (Allow) D:\Steam D\steamapps\common\Armored Kitten\ArmoredKitten.exe () [File not signed]
FirewallRules: [{921B9159-2562-45ED-B337-05A20B59B2C6}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\launcher.exe (Skutta, Kristjan -> )
FirewallRules: [{877ACCA0-4952-475C-AEB6-DDF682CEF4C5}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\launcher.exe (Skutta, Kristjan -> )
FirewallRules: [{95CBB797-8519-4D1A-A510-5E04225F4676}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{E167BB23-BA07-4AB8-9C3A-0A40CC5D8A8E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{8E1FD117-5F4F-499E-B7F4-271298DB575F}] => (Block) D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe => No File
FirewallRules: [{B4BBBC12-9A0A-4435-BE5D-CC7750CA2F13}] => (Block) D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe => No File
FirewallRules: [UDP Query User{D6E6A466-CBE3-4A45-BBE4-28EF09AF597C}D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe => No File
FirewallRules: [TCP Query User{9214F16B-1B97-4A3E-947E-33421E0354DD}D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe] => (Allow) D:\gry\epic games\launcher\portal\binaries\win64\epicgameslauncher.exe => No File
FirewallRules: [{BAC8CE6D-F46D-4647-80EF-40DAEF03C446}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{0C95E7AE-FAFE-4129-814F-25BA82A1A1C7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation -> Mozilla Corporation)
FirewallRules: [{D2745A35-FCBF-460B-AA49-8DF8D520C018}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{F901D7B1-2EDF-4962-90A0-8764899B8BB0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe (Valve -> Valve Corporation)
FirewallRules: [{24743FD6-9EF7-49BE-B8A1-1FF6895C4EB7}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe () [File not signed]
FirewallRules: [{22A8F001-E55A-410D-9F61-1D01C1468239}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Portal 2\portal2.exe () [File not signed]
FirewallRules: [{C1F4908D-12EB-4C56-97F9-A6BDA3532E75}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe () [File not signed]
FirewallRules: [{8FE819B1-A6C6-475D-8735-17CD765FE2E9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\GarrysMod\hl2.exe () [File not signed]
FirewallRules: [{F1CB546F-F2C1-4225-B92C-E81D9A420390}] => (Allow) D:\Steam D\steamapps\common\SourceFilmmaker\game\sfm.exe => No File
FirewallRules: [{23167DCE-C28B-469F-A76C-892B74359652}] => (Allow) D:\Steam D\steamapps\common\SourceFilmmaker\game\sfm.exe => No File
FirewallRules: [{45ABC5C5-5B75-4CE3-8AA8-DDBB0C3BCFEA}] => (Allow) D:\Steam D\steamapps\common\SourceFilmmaker\game\bin\qsdklauncher.exe => No File
FirewallRules: [{A5B5E30B-EB1C-4CA5-A318-BE5C27912E55}] => (Allow) D:\Steam D\steamapps\common\SourceFilmmaker\game\bin\qsdklauncher.exe => No File
FirewallRules: [{76D911EE-8702-43C1-AC31-B19E57B0EC60}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [{F736BCCD-3AE3-4BD3-A6C6-97FFD59C0426}] => (Allow) C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe (Valve -> Valve Corporation)
FirewallRules: [{2D33B54F-1195-4355-8D9B-039801E015E0}] => (Allow) D:\Steam D\steamapps\common\GarrysMod\hl2.exe () [File not signed]
FirewallRules: [{9023ECB9-D893-4B03-ABF7-5E0BE596610B}] => (Allow) D:\Steam D\steamapps\common\GarrysMod\hl2.exe () [File not signed]
FirewallRules: [{20C735D8-D183-477D-8127-F9A76C2C136F}] => (Allow) D:\Steam D\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe => No File
FirewallRules: [{7B467097-853D-4AF2-BF00-9B2EFB0702AB}] => (Allow) D:\Steam D\steamapps\common\Grand Theft Auto San Andreas\gta-sa.exe => No File
FirewallRules: [{D9FCA675-A6A9-432D-A5E6-C897C8444F76}] => (Allow) D:\Steam D\steamapps\common\tModLoader\tModLoader.exe (Re-Logic) [File not signed]
FirewallRules: [{2F3BFB7D-E9CB-46BE-8388-7E4DC4885736}] => (Allow) D:\Steam D\steamapps\common\tModLoader\tModLoader.exe (Re-Logic) [File not signed]
FirewallRules: [{01BFC9A2-1240-42EF-944C-1DB9528CDFDE}] => (Allow) D:\Backups\Resolve.exe (Blackmagic Design Pty Ltd -> Blackmagic Design Pty. Ltd.)
FirewallRules: [{E65F1289-AD8A-49A7-B958-28AFBE6AC793}] => (Allow) D:\Backups\bmdpaneld.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{485A565F-362B-4652-9E72-8B8A10CB2C93}] => (Allow) D:\Backups\DaVinciPanelDaemon.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{481A0A1D-94BA-4EB7-AE30-E186241F517B}] => (Allow) D:\Backups\JLCooperPanelDaemon.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{3903E94C-489D-453F-B99E-6F474A6B7BC9}] => (Allow) D:\Backups\EuphonixPanelDaemon.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{0AA3E3DD-EB62-436F-A959-AAE6C0F8F55E}] => (Allow) D:\Backups\TangentPanelDaemon.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{9DEA6FB9-381E-4A3D-A641-41AE528B6386}] => (Allow) D:\Backups\DPDecoder.exe (Blackmagic Design Pty Ltd -> )
FirewallRules: [{171904A8-8283-4F4C-A105-E57B328C7CDB}] => (Allow) D:\Steam D\steamapps\common\Counter-Strike Source\hl2.exe (Valve -> )
FirewallRules: [{C91B84BB-DBDE-4A02-BF47-B18B9118076E}] => (Allow) D:\Steam D\steamapps\common\Counter-Strike Source\hl2.exe (Valve -> )
FirewallRules: [{76D8EB32-4A90-4B14-B93D-47A217ED8DE4}] => (Allow) D:\Steam D\steamapps\common\Refunct\Refunct\Binaries\Win32\Refunct-Win32-Shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{F3FF78F4-39B6-4BB7-90F5-DC0696682B36}] => (Allow) D:\Steam D\steamapps\common\Refunct\Refunct\Binaries\Win32\Refunct-Win32-Shipping.exe (Epic Games, Inc.) [File not signed]
FirewallRules: [{9496FA07-7795-4706-995C-EB66CA2B8A79}] => (Allow) D:\Steam D\steamapps\common\Half-Life 2\hl2.exe (Valve -> )
FirewallRules: [{93D6F400-33FF-4982-86E9-C2C1E794FAEE}] => (Allow) D:\Steam D\steamapps\common\Half-Life 2\hl2.exe (Valve -> )
FirewallRules: [{F0750252-98AF-4BA7-BD81-9A31F8D9298F}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe () [File not signed]
FirewallRules: [{DB8AE7F5-677F-44C9-9820-1BD09DE20CCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Geometry Dash\GeometryDash.exe () [File not signed]
FirewallRules: [{4F328AE1-B629-4AE0-BCA8-7BED4CCA8DA6}] => (Allow) D:\Steam D\steamapps\common\Aim Lab\AimLab_tb.exe () [File not signed]
FirewallRules: [{17E6CD66-3546-48E8-AC12-51023B46C8FD}] => (Allow) D:\Steam D\steamapps\common\Aim Lab\AimLab_tb.exe () [File not signed]
FirewallRules: [{CFCBE954-6577-47AC-AEF5-CDDEED73A40F}] => (Allow) D:\Steam D\steamapps\common\SUPERHOTMCD\SUPERHOTMCD.exe (SUPERHOT Sp. z o.o. -> SUPERHOT Sp. z o.o.)
FirewallRules: [{9B21DEFD-15F5-44E8-BBAC-669E68860CEF}] => (Allow) D:\Steam D\steamapps\common\SUPERHOTMCD\SUPERHOTMCD.exe (SUPERHOT Sp. z o.o. -> SUPERHOT Sp. z o.o.)
FirewallRules: [{F9BEF7AC-87E0-4824-99EE-295DBA3D91DA}] => (Allow) D:\Steam D\steamapps\common\Reventure\Reventure.exe () [File not signed]
FirewallRules: [{9A3111F2-6D3F-4ACE-A136-BC866DD03FC8}] => (Allow) D:\Steam D\steamapps\common\Reventure\Reventure.exe () [File not signed]
FirewallRules: [{AC34D523-40EB-41C7-B99E-12BEF35F67ED}] => (Allow) D:\Steam D\steamapps\common\Team Fortress 2\hl2.exe (Valve -> )
FirewallRules: [{ABD1086B-21B1-472C-BF5A-CFA86806B293}] => (Allow) D:\Steam D\steamapps\common\Team Fortress 2\hl2.exe (Valve -> )
FirewallRules: [{463E4659-824D-43CB-B41D-092111AE4BA3}] => (Allow) D:\Steam D\steamapps\common\HatinTime\Binaries\Win64\HatinTimeGame.exe => No File
FirewallRules: [{2D27F2D9-27C2-4AB8-8585-B3611340FB6D}] => (Allow) D:\Steam D\steamapps\common\HatinTime\Binaries\Win64\HatinTimeGame.exe => No File
FirewallRules: [{F4B7C52E-CF4A-4681-839E-F68634C0907B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\diagnostics32.exe (Skutta, Kristjan -> )
FirewallRules: [{EC89F88A-38D8-43D4-9EEE-1B444527DC5B}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\wallpaper_engine\bin\diagnostics32.exe (Skutta, Kristjan -> )
FirewallRules: [{A4836DCC-7520-47EC-9A30-3D1CFB4B7EE5}] => (Allow) D:\Steam D\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve -> )
FirewallRules: [{5D1FBFDF-EB7B-4F63-8E33-FD88E06768FB}] => (Allow) D:\Steam D\steamapps\common\Counter-Strike Global Offensive\csgo.exe (Valve -> )
FirewallRules: [TCP Query User{634D71E6-90F2-42A0-BD82-EFBDC78D4D48}C:\users\kubsons07\appdata\local\microsoft\teams\current\teams.exe] => (Block) C:\users\kubsons07\appdata\local\microsoft\teams\current\teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [UDP Query User{5A8AFE1E-3244-46B1-874F-BB9F95B76871}C:\users\kubsons07\appdata\local\microsoft\teams\current\teams.exe] => (Block) C:\users\kubsons07\appdata\local\microsoft\teams\current\teams.exe (Microsoft Corporation -> Microsoft Corporation)
FirewallRules: [{201FE9BF-E7A6-4155-B6F0-2229CDD0E308}] => (Allow) D:\Steam D\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
FirewallRules: [{8ECBDBC2-6FDC-4283-AB73-6C2836CBB48E}] => (Allow) D:\Steam D\steamapps\common\Half-Life\hl.exe (Valve -> Valve)
FirewallRules: [{A08DF162-C278-4C4D-B7D5-37110766D7D6}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{4548E199-B45A-4D35-8BCD-D88D49AFF641}] => (Allow) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{B01F798E-DF96-47F7-87BB-7D14FE9C7B6E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{E83721D6-46A7-4A45-AD26-3B69194964FA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe (NVIDIA Corporation -> NVIDIA Corporation)
FirewallRules: [{FDF3FB01-D302-4BD1-A39C-0F6B557E9E2A}] => (Allow) D:\Steam D\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe (Take-Two Interactive Software, Inc. -> Gearbox Software) [File not signed]
FirewallRules: [{B492C9F9-9D73-4D70-A15E-C701B47F439C}] => (Allow) D:\Steam D\steamapps\common\Borderlands 2\Binaries\Win32\Launcher.exe (Take-Two Interactive Software, Inc. -> Gearbox Software) [File not signed]
FirewallRules: [{1C6B9AE3-7F80-4F00-9BDC-FD50F58A0545}] => (Allow) D:\Steam D\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) [File not signed]
FirewallRules: [{4E0B74DD-CBB9-45C2-B5B0-8088E86C61FE}] => (Allow) D:\Steam D\steamapps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe (Take-Two Interactive Software, Inc. -> Take-Two Interactive Software, Inc.) [File not signed]
FirewallRules: [{1442672B-599C-468B-85AC-A8979F8F6722}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google LLC -> Google LLC)
FirewallRules: [{42F845AE-6271-4DF6-BBE1-38438D061893}] => (Allow) D:\Steam D\steamapps\common\Portal Reloaded\portal2.exe () [File not signed]
FirewallRules: [{E2E85B15-72B5-47AB-95D4-A19FDF5F066D}] => (Allow) D:\Steam D\steamapps\common\Portal Reloaded\portal2.exe () [File not signed]

==================== Restore Points =========================

21-04-2021 15:30:12 Zaplanowany punkt kontrolny
30-04-2021 13:40:45 Zaplanowany punkt kontrolny

==================== Faulty Device Manager Devices ============


==================== Event log errors: ========================

Application errors:
==================
Error: (05/05/2021 07:36:21 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (05/04/2021 08:18:42 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (05/03/2021 03:37:33 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Nazwa aplikacji powodującej błąd: hammer.exe, wersja: 0.0.0.0, sygnatura czasowa: 0x5f74fab3
Nazwa modułu powodującego błąd: hammer_dll.dll, wersja: 0.2.1.0, sygnatura czasowa: 0x5f74fab9
Kod wyjątku: 0xc0000409
Przesunięcie błędu: 0x00363c07
Identyfikator procesu powodującego błąd: 0x2b70
Godzina uruchomienia aplikacji powodującej błąd: 0x01d7401f5c95cfba
Ścieżka aplikacji powodującej błąd: D:\Steam D\steamapps\common\Team Fortress 2\bin\hammer.exe
Ścieżka modułu powodującego błąd: D:\Steam D\steamapps\common\Team Fortress 2\bin\hammer_dll.dll
Identyfikator raportu: 79f1747c-e4cd-4b3a-9130-3b225c2f2738
Pełna nazwa pakietu powodującego błąd:
Identyfikator aplikacji względem pakietu powodującego błąd:

Error: (05/03/2021 12:22:53 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (05/02/2021 12:14:20 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (05/01/2021 01:00:18 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (04/30/2021 11:48:15 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.

Error: (04/29/2021 12:00:44 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Nie można wygenerować kontekstu aktywacji dla „D:\Audacity\audacity.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu .
Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna.
Składniki powodujące konflikt:
Składnik 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_ca00b6081b84eb1d.manifest.
Składnik 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.844_none_11adecdf30011423.manifest.


System errors:
=============
Error: (05/02/2021 12:17:21 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Nie można uruchomić usługi Steam Client Service z powodu następującego błędu:
Usługa nie odpowiada na sygnał uruchomienia lub sygnał sterujący w oczekiwanym czasie.

Error: (05/02/2021 12:17:21 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Upłynął limit czasu (30000 ms) podczas oczekiwania na połączenie się z usługą Steam Client Service.

Error: (04/30/2021 01:41:49 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: ZARZĄDZANIE NT)
Description: Instalacja nie powiodła się: system Windows nie mógł zainstalować następującej aktualizacji, ponieważ wystąpił błąd 0x80073d02: 9PGGJ4LF6SPV-Microsoft.Windows.Photos.DLC.Main.

Error: (04/29/2021 11:50:59 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7J71UVT)
Description: Serwer {9A4948D9-13FC-4FAC-B60A-FBA6EE0FB11C} nie zarejestrował się w modelu DCOM w wymaganym czasie.

Error: (04/29/2021 11:50:59 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7J71UVT)
Description: Serwer {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} nie zarejestrował się w modelu DCOM w wymaganym czasie.

Error: (04/29/2021 11:50:59 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7J71UVT)
Description: Serwer {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} nie zarejestrował się w modelu DCOM w wymaganym czasie.

Error: (04/29/2021 11:50:58 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7J71UVT)
Description: Serwer {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} nie zarejestrował się w modelu DCOM w wymaganym czasie.

Error: (04/29/2021 11:50:58 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-7J71UVT)
Description: Serwer {2593F8B9-4EAF-457C-B68A-50F6B8EA6B54} nie zarejestrował się w modelu DCOM w wymaganym czasie.


CodeIntegrity:
===============
Date: 2021-05-05 14:30:17
Description:
Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe) attempted to load \Device\HarddiskVolume3\Program Files\Norton Security\Norton Security\Engine32\22.21.2.50\symamsi.dll that did not meet the Microsoft signing level requirements.


==================== Memory info ===========================

BIOS: American Megatrends Inc. 2002 09/20/2016
Motherboard: ASUSTeK COMPUTER INC. H110M-D
Processor: Intel® Core™ i7-6700 CPU @ 3.40GHz
Percentage of memory in use: 59%
Total physical RAM: 16320.33 MB
Available physical RAM: 6628.18 MB
Total Virtual: 23758.94 MB
Available Virtual: 8007.9 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:249.35 GB) (Free:27.43 GB) NTFS
Drive d: (DATA) (Fixed) (Total:681.07 GB) (Free:395.14 GB) NTFS

\\?\Volume{2cc5fdfc-e689-4fe5-a27e-a85e25ca15a6}\ () (Fixed) (Total:0.52 GB) (Free:0.08 GB) NTFS
\\?\Volume{45487371-e36b-49e1-ae6f-6039d74e6d76}\ (SYSTEM) (Fixed) (Total:0.44 GB) (Free:0.41 GB) FAT32

==================== MBR & Partition Table ====================

==========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 36939A5E)

Partition: GPT.

==================== End of Addition.txt =======================



#3 iMacg3

iMacg3

    Bleepin' PowerPC G3


  •  Avatar image
  • Moderator
  • 9,829 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:127.0.0.1
  • Local time:05:16 PM

Posted 05 May 2021 - 09:57 AM

Welcome.

I'm reviewing your logs and will get back to you soon.

Regards, iMacg3

If I am helping you and haven't replied to your topic in 48 hours, send me a PM.
Please do not PM me asking for support - use the forums instead.

bwJ9zDr.jpg
Graduate of the Bleeping Computer malware removal study hall.


#4 Peppey332

Peppey332
  • Topic Starter

  •  Avatar image
  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 07 May 2021 - 10:53 AM

I also noticed, that some system files are bigger than usual. For example: fontdrvhost should be around 540 to 620 kb, but it's 800 kb for me.


Edited by Peppey332, 07 May 2021 - 10:53 AM.


#5 iMacg3

iMacg3

    Bleepin' PowerPC G3


  •  Avatar image
  • Moderator
  • 9,829 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:127.0.0.1
  • Local time:05:16 PM

Posted 07 May 2021 - 10:41 PM

Hi Peppey332,

I also noticed, that some system files are bigger than usual. For example: fontdrvhost should be around 540 to 620 kb, but it's 800 kb for me.


Where did you find this information?

Please do the following -

Download ESET Online Scanner and save it to your desktop.
  • Right-click on esetonlinescanner_enu.exe and select Run as Administrator.
  • When the tool opens, click Get Started.
  • Read and accept the license agreement.
  • At the Welcome to ESET Online Scanner window, click Get Started.
  • Select whether you would like to send anonymous data to ESET.
  • Note: if you see the "Welcome Back to ESET Online Scanner" screen, click Computer Scan > Full Scan.
  • Click on the Full Scan option.
  • Select Enable ESET to detect and remove potentially unwanted applications, then click Start scan.
  • ESET will now begin scanning your computer. This may take some time.
  • When the scan is finished and if threats have been detected, select Save scan log. Save it to your desktop as eset.txt. Click on Continue.
  • ESET Online Scanner may ask if you'd like to turn on the Periodic Scan feature. Click on Continue.
  • On the next screen, you can leave feedback about the program if you wish. Check the box for Delete application data on closing. If you left feedback, click Submit and continue. If not, Close without feedback.
  • Open the scan log on your desktop (eset.txt) and copy and paste its contents into your next reply.

Regards, iMacg3

If I am helping you and haven't replied to your topic in 48 hours, send me a PM.
Please do not PM me asking for support - use the forums instead.

bwJ9zDr.jpg
Graduate of the Bleeping Computer malware removal study hall.


#6 Peppey332

Peppey332
  • Topic Starter

  •  Avatar image
  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 08 May 2021 - 02:48 PM

is this it? this is the only log i could save

 

5/8/2021 21:42:29
Scanned files: 923475
Detected files: 0
Cured files: 0
Total scan time: 06:33:17
Scan Status: Complete


#7 iMacg3

iMacg3

    Bleepin' PowerPC G3


  •  Avatar image
  • Moderator
  • 9,829 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:127.0.0.1
  • Local time:05:16 PM

Posted 09 May 2021 - 11:11 AM

Yes, that is the correct log.

Are there currently any issues with this computer? Your logs are clear of malware.

Regards, iMacg3

If I am helping you and haven't replied to your topic in 48 hours, send me a PM.
Please do not PM me asking for support - use the forums instead.

bwJ9zDr.jpg
Graduate of the Bleeping Computer malware removal study hall.


#8 Peppey332

Peppey332
  • Topic Starter

  •  Avatar image
  • Members
  • 60 posts
  • OFFLINE
  •  
  • Local time:10:16 PM

Posted 09 May 2021 - 03:12 PM

no, not really. I just wanted to check if i got infected with that Adware and my previous antivirus was not that great. Thank You



#9 iMacg3

iMacg3

    Bleepin' PowerPC G3


  •  Avatar image
  • Moderator
  • 9,829 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:127.0.0.1
  • Local time:05:16 PM

Posted 13 May 2021 - 08:57 PM

Sorry for the delay...

The following will remove the tools we used as well as reset system restore points:

---------------------------------------------------
KpRm

Download KpRm by kernel-panik and save it to your desktop.

  • Right-click kprm_(version).exe and select Run as Administrator.
  • Read and accept the disclaimer.
  • When the tool opens, ensure all boxes under Actions are checked.
  • Under Delete Quarantines select Delete Now, then click Run.
  • Once complete, click OK.
  • A log will open in Notepad titled kprm-(date).txt.
  • Please copy and paste its contents in your next reply.
----------------------------------------------------
Some tips to keep your computer safe on the Internet

Make sure to use strong passwords. There are password managers (for example, Bitwarden) that can help you use secure passwords, and keep track of them.

How to create a strong password
----------------------------------------------------
Keeping software up-to-date is important as well. Programs such as UCheckHeimdal Free, or PatchMyPC can help keep software on your computer up-to-date.

To keep your operating system up-to-date, make sure that Windows Update is enabled on your computer.
----------------------------------------------------
I recommend backing up your PC regularly. There are several ways to back up your computer, such as using a cloud-based service online, external hard drive, or CD/DVD.

The following articles have more information about methods to back up your computer:

What's the Best Way to Back Up My Computer?

5 Ways to Back up Your Data
----------------------------------------------------
Here are some articles about how to keep your computer safe on the Internet -

Simple and easy ways to keep your computer safe and secure on the Internet - by Lawrence Abrams

Answers to common security questions - Best Practices - by quietman7

COMPUTER SECURITY - a short guide to staying safer online - Malware Removal


----------------------------------------------------

Safe surfing  :)

 


Edited by iMacg3, 13 May 2021 - 08:57 PM.

Regards, iMacg3

If I am helping you and haven't replied to your topic in 48 hours, send me a PM.
Please do not PM me asking for support - use the forums instead.

bwJ9zDr.jpg
Graduate of the Bleeping Computer malware removal study hall.


#10 iMacg3

iMacg3

    Bleepin' PowerPC G3


  •  Avatar image
  • Moderator
  • 9,829 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:127.0.0.1
  • Local time:05:16 PM

Posted 17 May 2021 - 09:49 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.

Regards, iMacg3

If I am helping you and haven't replied to your topic in 48 hours, send me a PM.
Please do not PM me asking for support - use the forums instead.

bwJ9zDr.jpg
Graduate of the Bleeping Computer malware removal study hall.





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users