dllhost.exe COM Surrogate

Mizgal · September 5, 2015

Good morning!
I saw in task Manager a proces nammed: COM Surrogate. In internet i find out that it's a virus, however not only AVG but also Malwarebytes Anti-Malware don't detect it.
What should I do? Is my computer infected?

I would appreciate help!

kevinf80 · September 5, 2015

Hello and welcome to Malwarebytes.org

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here. Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Next,

Change the download folder setting in the default Browser so all tools we may use are saved to the Desktop:

Google Chrome - Click the "Customize and control Google Chrome" button in the upper right-corner of the browser.

Choose Settings. at the bottom of the screen click the
"Show advanced settings..." link. Scroll down to find the Downloads section and click the Change... button. Select your desktop and click OK.

Mozilla Firefox - Click the "Open Menu" button in the upper right-corner of the browser.

Choose Options. In the downloads section, click the Browse button, click on the Desktop folder and the click the "Select Folder" button. Click OK to get out of the Options menu.

Internet Explorer - Click the Tools menu in the upper right-corner of the browser.

Select View downloads. Select the Options link in the lower left of the window. Click Browse and select the Desktop and then choose the Select Folder button. Click OK to get out of the download options screen and then click Close to get out of the View Downloads screen.
NOTE: IE8 Does not support changing download locations in this manner. You will need to download the tool(s) to the default folder, usually Downloads, then copy them to the desktop.

Next,

Follow the instructions in the following link to show hidden files:

http://www.bleepingcomputer.com/tutorials/how-to-see-hidden-files-in-windows/

Next,

Please open Malwarebytes Anti-Malware.

On the Settings tab > Detection and Protection sub tab, Detection Options, tick the box "Scan for rootkits".
Under Non-Malware Protection sub tab Change PUP and PUM entries to Treat detections as Malware
Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
A Threat Scan will begin.
With some infections, you may or may not see this message box.

'Could not load DDA driver'
Click 'Yes' to this message, to allow the driver to load after a restart.
Allow the computer to restart. Continue with the rest of these instructions.
When the scan is complete, click Apply Actions.
Wait for the prompt to restart the computer to appear, then click on Yes.
After the restart once you are back at your desktop, open MBAM once more.

To get the log from Malwarebytes do the following:

Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click Export > From export you have three options:

Copy to Clipboard - if seleted right click to your reply and select "Paste" log will be pasted to your reply
Text file (*.txt) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
XML file (*.xml) - if selected you will have to name the file and save to a place of choice, recommend "Desktop" then attach to reply
Recommend you use "Copy to Clipboard, then Right click to your reply > select "Paste" that will copy the log to your reply…

If Malwarebytes is not installed follow these instructions first:

Download Malwarebytes Anti-Malware to your desktop.

Double-click mbam-setup and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
Launch Malwarebytes Anti-Malware
A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish. Follow the instructions above....

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

If your security alerts to FRST either accept the alert or disable your security and allow FRST to run...

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Next,

Please download RogueKiller and save it to your desktop from the following link: http://www.bleepingcomputer.com/download/roguekiller/

Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8/8.1/10, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes select "Report",in the next window select "Export txt" the log will open as a text file post that log... Also save to your Desktop for reference. log will open.
Close the program > Don't Fix anything!

Let me see those logs in your reply....

Thank you,

Kevin...

Mizgal · September 5, 2015

Malwarebytes Anti-Malware

www.malwarebytes.org

Data skanowania: 2015-09-06

Czas skanowania: 01:28

Raport:

Administrator: Tak

Wersja: 2.1.8.1057

Baza szkodliwego oprogramowania: v2015.09.05.07

Baza danych rootkitów: v2015.08.16.01

Licencja: Darmowa

Ochrona przed złośliwym oprogramowaniem: Wyłączony

Ochrona przed szkodliwymi stronami: Wyłączony

Samoobrona: Wyłączony

System operacyjny: Windows 8.1

Procesor: x64

System plików: NTFS

Użytkownik: Olek

Typ skanowania: Dokładne skanowanie

Wynik: Zakończono

Obiekty przeskanowane: 355879

Czas, który upłynął: 6 min, 42 s

Pamięć: Włączony

Autostart: Włączony

System plików: Włączony

Archiwa: Włączony

Rootkity: Włączony

Heurystyka: Włączony

PUP: Włączony

PUM: Włączony

Procesy: 0

(Nie wykryto zagrożeń)

Moduły: 0

(Nie wykryto zagrożeń)

Klucze rejestru: 0

(Nie wykryto zagrożeń)

Wartości rejestru: 0

(Nie wykryto zagrożeń)

Dane rejestru: 0

(Nie wykryto zagrożeń)

Foldery: 0

(Nie wykryto zagrożeń)

Pliki: 0

(Nie wykryto zagrożeń)

Sektory fizyczne: 0

(Nie wykryto zagrożeń)

(end)\

Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:04-09-2015

Uruchomiony przez Olek (administrator) ALEKSANDERLAND (06-09-2015 01:36:19)

Uruchomiony z C:\Users\Olek\Desktop

Załadowane profile: Olek (Dostępne profile: Olek)

Platform: Windows 8.1 (X64) Język: Polski (Polska)

Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)

Tryb startu: Normal

Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe

(Microsoft Corporation) C:\Windows\System32\dllhost.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Valve Corporation) L:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) L:\Program Files (x86)\Steam\bin\steamwebhelper.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

() C:\Program Files (x86)\RocketDock\RocketDock.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe

(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [164080 2015-06-27] (IvoSoft)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634872 2015-08-18] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)

HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-06-08] (Oracle Corporation)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3780520 2015-07-31] (AVG Technologies CZ, s.r.o.)

HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [brStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)

HKU\S-1-5-21-3871865451-3501784630-1123502970-1001\...\Run: [steam] => L:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)

HKU\S-1-5-21-3871865451-3501784630-1123502970-1001\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()

HKU\S-1-5-21-3871865451-3501784630-1123502970-1001\...\Run: [GalaxyClient] => [X]

ShellIconOverlayIdentifiers: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-06-27] (IvoSoft)

ShellIconOverlayIdentifiers-x32: [shareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-06-27] (IvoSoft)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci..)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Tcpip\..\Interfaces\{6F4EA04A-47DC-4B90-AC8D-C8B5A0D366A5}: [DhcpNameServer] 192.168.1.1

Internet Explorer:

==================

HKU\S-1-5-21-3871865451-3501784630-1123502970-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp

BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-06-27] (IvoSoft)

BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2015-06-27] (IvoSoft)

BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-06-27] (IvoSoft)

BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-07-28] (Oracle Corporation)

BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-28] (Oracle Corporation)

BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2015-06-27] (IvoSoft)

Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2015-06-27] (IvoSoft)

Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2015-06-27] (IvoSoft)

FireFox:

========

FF ProfilePath: C:\Users\Olek\AppData\Roaming\Mozilla\Firefox\Profiles\bkjuiu6s.default

FF NetworkProxy: "type", 0

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-19] ()

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-19] ()

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-28] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-28] (Oracle Corporation)

FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-06-17] (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-06-17] (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-08-31] (Google Inc.)

Chrome:

=======

CHR Profile: C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Google Slides) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-28]

CHR Extension: (Google Docs) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-28]

CHR Extension: (Google Drive) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-28]

CHR Extension: (YouTube) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-07-28]

CHR Extension: (Google Search) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-28]

CHR Extension: (Google Sheets) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-28]

CHR Extension: (Google Docs Offline) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-04]

CHR Extension: (Mac OS theme) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jkpadlfbbnobnjaeodjfnkogiigdmgff [2015-07-28]

CHR Extension: (Chrome Web Store Payments) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]

CHR Extension: (Gmail) - C:\Users\Olek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-28]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3633576 2015-07-31] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [335656 2015-07-31] (AVG Technologies CZ, s.r.o.)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [brak podpisu cyfrowego]

S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1720888 2015-08-19] (GOG.com)

S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6920248 2015-08-30] (GOG.com)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155192 2015-08-18] (NVIDIA Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-08-18] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544568 2015-08-18] (NVIDIA Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [21152 2015-03-27] (AVG Technologies CZ, s.r.o.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [312752 2015-07-28] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)

R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)

R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [245680 2015-07-28] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)

R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [296896 2015-07-10] (AVG Technologies CZ, s.r.o.)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-09-06] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-08-18] (NVIDIA Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [50472 2015-08-11] (NVIDIA Corporation)

U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [35064 2015-08-10] ()

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-09-06 01:36 - 2015-09-06 01:36 - 00016059 _____ C:\Users\Olek\Desktop\FRST.txt

2015-09-06 01:35 - 2015-09-06 01:36 - 00000000 ____D C:\FRST

2015-09-06 01:35 - 2015-09-06 01:35 - 02188800 _____ (Farbar) C:\Users\Olek\Desktop\FRST64.exe

2015-09-06 01:35 - 2015-09-06 01:35 - 00001108 _____ C:\Users\Olek\Downloads\scan-mam.txt

2015-09-05 16:13 - 2015-09-05 16:13 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf

2015-09-05 03:06 - 2015-09-05 03:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wiedźmin 3® - Dziki Gon [GOG.com]

2015-09-02 18:59 - 2015-09-02 19:00 - 00000000 ____D C:\NPE

2015-09-02 18:51 - 2015-09-02 19:02 - 00000000 ____D C:\Users\Olek\AppData\Local\NPE

2015-09-02 18:51 - 2015-09-02 18:51 - 03088296 _____ (Symantec Corporation) C:\Users\Olek\Downloads\NPE.exe

2015-09-02 18:51 - 2015-09-02 18:51 - 00000000 ____D C:\ProgramData\Norton

2015-09-01 02:44 - 2015-09-01 02:44 - 00000718 _____ C:\Users\Olek\Downloads\Pulpit — skrót.lnk

2015-08-31 20:08 - 2015-09-02 18:59 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-08-31 17:25 - 2015-08-31 17:25 - 00000000 ____D C:\Windows\LastGood.Tmp

2015-08-31 17:25 - 2015-08-11 06:52 - 00069416 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll

2015-08-31 17:25 - 2015-08-11 06:52 - 00050472 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys

2015-08-22 00:19 - 2015-08-22 00:19 - 00162816 _____ C:\Users\Olek\Downloads\13_107_i_rok_plan_20152016.xls

2015-08-20 22:38 - 2015-09-03 01:09 - 00000000 ____D C:\Users\Olek\AppData\Roaming\TS3Client

2015-08-20 22:38 - 2015-08-20 22:38 - 00000979 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk

2015-08-20 22:38 - 2015-08-20 22:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client

2015-08-20 22:38 - 2015-08-20 22:38 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client

2015-08-20 22:35 - 2015-08-20 22:35 - 31071896 _____ (TeamSpeak Systems GmbH) C:\Users\Olek\Downloads\TeamSpeak3-Client-win64-3.0.17.exe

2015-08-20 21:07 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2015-08-20 21:07 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2015-08-19 23:59 - 2015-09-06 01:20 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-08-19 23:59 - 2015-08-19 23:59 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

2015-08-19 15:33 - 2015-07-30 16:04 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll

2015-08-19 15:33 - 2015-07-30 15:48 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll

2015-08-18 22:32 - 2015-08-18 22:32 - 00001011 _____ C:\Users\Public\Desktop\AVG 2015.lnk

2015-08-18 22:32 - 2015-08-18 22:32 - 00000000 ____D C:\Users\Olek\AppData\Local\Avg

2015-08-18 22:14 - 2015-08-18 22:15 - 00000000 ____D C:\Users\Olek\AppData\Local\CrashDumps

2015-08-18 20:58 - 2015-07-19 03:58 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2015-08-18 20:58 - 2015-07-18 20:51 - 03704320 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2015-08-18 20:58 - 2015-07-18 20:31 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2015-08-18 20:58 - 2015-07-18 20:31 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2015-08-18 20:58 - 2015-07-18 20:31 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2015-08-18 20:58 - 2015-07-18 20:29 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll

2015-08-18 20:58 - 2015-07-18 20:29 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2015-08-18 20:58 - 2015-07-18 20:29 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2015-08-18 20:58 - 2015-07-18 20:28 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2015-08-18 20:58 - 2015-07-18 20:12 - 02228736 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2015-08-18 20:58 - 2015-07-18 20:10 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2015-08-18 20:58 - 2015-07-18 20:09 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2015-08-18 20:57 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2015-08-18 20:57 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec

2015-08-18 20:57 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2015-08-18 20:57 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2015-08-18 20:57 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2015-08-18 20:57 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2015-08-18 20:57 - 2015-07-16 21:53 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll

2015-08-18 20:57 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2015-08-18 20:57 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec

2015-08-18 20:57 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2015-08-18 20:57 - 2015-07-16 21:45 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll

2015-08-18 20:57 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2015-08-18 20:57 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2015-08-18 20:57 - 2015-07-16 21:38 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll

2015-08-18 20:57 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2015-08-18 20:57 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2015-08-18 20:57 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2015-08-18 20:57 - 2015-07-16 21:14 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll

2015-08-18 20:57 - 2015-07-16 21:13 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll

2015-08-18 20:57 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2015-08-18 20:57 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2015-08-18 20:57 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2015-08-18 20:57 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2015-08-18 20:57 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2015-08-18 20:57 - 2015-07-16 20:52 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll

2015-08-18 20:57 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2015-08-18 20:57 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2015-08-18 20:57 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2015-08-18 20:57 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2015-08-18 20:57 - 2015-07-16 02:29 - 07458648 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-08-18 20:57 - 2015-07-16 02:29 - 01735000 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll

2015-08-18 20:57 - 2015-07-16 02:29 - 00101720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys

2015-08-18 20:57 - 2015-07-16 02:28 - 01499920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll

2015-08-18 20:57 - 2015-07-10 19:54 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll

2015-08-18 20:56 - 2015-07-29 01:24 - 00025776 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe

2015-08-18 20:56 - 2015-07-28 16:24 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2015-08-18 20:56 - 2015-07-28 16:24 - 01116160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll

2015-08-18 20:56 - 2015-07-28 16:24 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll

2015-08-18 20:56 - 2015-07-28 16:24 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll

2015-08-18 20:56 - 2015-07-28 16:24 - 00437248 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll

2015-08-18 20:56 - 2015-07-28 16:24 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll

2015-08-18 20:56 - 2015-07-07 11:40 - 00270168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys

2015-08-18 20:56 - 2015-07-07 11:40 - 00114520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdNisDrv.sys

2015-08-18 20:56 - 2015-07-07 11:40 - 00044560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys

2015-08-18 20:56 - 2015-07-02 00:19 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll

2015-08-18 20:56 - 2015-07-02 00:16 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll

2015-08-18 20:56 - 2015-07-01 23:37 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll

2015-08-18 20:56 - 2015-07-01 23:35 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll

2015-08-18 20:55 - 2015-07-29 16:37 - 01994752 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2015-08-18 20:55 - 2015-07-29 16:30 - 01381888 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll

2015-08-18 20:55 - 2015-07-29 16:23 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2015-08-18 20:55 - 2015-07-24 20:57 - 04177408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2015-08-18 20:55 - 2015-07-24 20:57 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll

2015-08-18 20:55 - 2015-07-24 20:52 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll

2015-08-18 20:55 - 2015-07-24 19:27 - 00301568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll

2015-08-18 20:55 - 2015-07-24 19:23 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll

2015-08-18 20:55 - 2015-07-14 05:22 - 02529880 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll

2015-08-18 20:55 - 2015-07-14 05:21 - 01901776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll

2015-08-18 20:55 - 2015-07-13 21:46 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll

2015-08-18 20:55 - 2015-07-13 21:45 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll

2015-08-18 20:55 - 2015-07-10 20:19 - 01101824 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2015-08-18 20:55 - 2015-07-10 19:42 - 02345472 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2015-08-18 20:55 - 2015-07-10 19:14 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2015-08-18 20:55 - 2015-07-10 19:13 - 07032320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2015-08-18 20:55 - 2015-07-10 18:47 - 01556992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2015-08-18 20:55 - 2015-07-10 18:31 - 06213120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2015-08-18 20:55 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe

2015-08-18 20:55 - 2015-07-09 19:13 - 00221184 _____ (Microsoft Corporation) C:\Windows\notepad.exe

2015-08-18 20:55 - 2015-07-09 18:30 - 00212992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

2015-08-10 21:04 - 2015-08-10 21:04 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf

2015-08-10 16:36 - 2015-08-10 16:36 - 00051200 _____ C:\Users\Olek\Downloads\12_sub_21_1412669442_terminy_składania_dokumentow_na_stronę2 (1).xls

2015-08-10 11:10 - 2015-08-10 11:13 - 00000408 _____ C:\DelFix.txt

2015-08-10 00:22 - 2015-08-10 00:31 - 00000000 ____D C:\ProgramData\RogueKiller

2015-08-10 00:22 - 2015-08-10 00:22 - 00035064 _____ C:\Windows\system32\Drivers\TrueSight.sys

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-09-06 01:26 - 2015-07-29 22:19 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-09-06 01:24 - 2015-07-28 18:55 - 00000000 ____D C:\Users\Olek\AppData\Local\ClassicShell

2015-09-06 01:12 - 2015-07-28 18:42 - 01064402 _____ C:\Windows\WindowsUpdate.log

2015-09-06 01:09 - 2015-07-28 21:40 - 00001086 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-09-06 01:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru

2015-09-05 23:09 - 2015-07-28 21:40 - 00001082 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-09-05 19:10 - 2015-07-31 22:04 - 00000000 ____D C:\Users\Olek\Documents\The Witcher 3

2015-09-05 16:13 - 2013-08-22 16:46 - 00024533 _____ C:\Windows\setupact.log

2015-09-05 14:57 - 2015-07-28 18:52 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3871865451-3501784630-1123502970-1001

2015-09-05 14:05 - 2015-07-28 19:17 - 00000000 ____D C:\ProgramData\MFAData

2015-09-05 13:14 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness

2015-09-05 01:32 - 2015-07-28 18:52 - 00004004 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{7CE8F19A-DB06-4119-AA3A-7107FBCE0C8F}

2015-09-03 13:32 - 2015-07-29 14:53 - 00000000 ____D C:\Users\Olek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam

2015-09-02 19:05 - 2014-11-21 06:46 - 01825074 _____ C:\Windows\system32\PerfStringBackup.INI

2015-09-02 19:05 - 2014-11-21 06:07 - 00805918 _____ C:\Windows\system32\perfh015.dat

2015-09-02 19:05 - 2014-11-21 06:07 - 00163272 _____ C:\Windows\system32\perfc015.dat

2015-09-02 18:59 - 2015-07-29 22:24 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-09-02 18:59 - 2015-07-28 19:02 - 00000000 ____D C:\ProgramData\NVIDIA

2015-09-02 18:59 - 2014-11-20 21:36 - 00009078 _____ C:\Windows\PFRO.log

2015-09-02 18:59 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2015-08-31 23:04 - 2015-07-28 21:40 - 00004058 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2015-08-31 23:04 - 2015-07-28 21:40 - 00003822 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2015-08-31 17:26 - 2015-07-28 19:11 - 00000000 ____D C:\ProgramData\NVIDIA Corporation

2015-08-30 16:45 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM

2015-08-21 18:07 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache

2015-08-20 21:07 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp

2015-08-19 23:56 - 2013-08-22 16:44 - 00484320 _____ C:\Windows\system32\FNTCACHE.DAT

2015-08-19 23:27 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-08-19 23:27 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools

2015-08-19 23:27 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Defender

2015-08-19 23:27 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2015-08-19 15:34 - 2015-07-28 22:32 - 00000000 ____D C:\ProgramData\Microsoft Help

2015-08-19 15:33 - 2015-07-28 19:42 - 00000000 ____D C:\Windows\system32\MRT

2015-08-19 15:30 - 2015-07-28 19:42 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-08-19 15:29 - 2015-07-28 20:56 - 00000000 ____D C:\Windows\system32\appraiser

2015-08-19 15:29 - 2014-11-21 11:02 - 00000000 ___SD C:\Windows\system32\CompatTel

2015-08-19 15:29 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-19 15:29 - 2013-08-22 17:36 - 00000000 ___RD C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories

2015-08-19 00:33 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI

2015-08-18 22:32 - 2015-07-28 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG

2015-08-18 22:12 - 2015-07-28 18:47 - 00000000 ____D C:\Users\Olek

2015-08-18 01:30 - 2015-07-28 19:12 - 01423120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll

2015-08-18 01:30 - 2015-07-28 19:12 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll

2015-08-18 01:29 - 2015-07-28 19:12 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll

2015-08-18 01:29 - 2015-07-28 19:12 - 01710568 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll

2015-08-14 03:50 - 2015-07-28 20:59 - 00794088 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2015-08-14 03:50 - 2015-07-28 20:59 - 00179688 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2015-08-11 06:52 - 2015-07-28 19:11 - 00072504 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll

2015-08-10 11:18 - 2015-08-06 14:51 - 00000000 ____D C:\Users\Olek\AppData\Roaming\ControlCenter4

2015-08-10 11:15 - 2015-07-28 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell

2015-08-10 11:15 - 2015-07-28 18:54 - 00000000 ____D C:\Program Files\Classic Shell

Niektóre pliki w TEMP:

====================

C:\Users\Olek\AppData\Local\Temp\dllnt_dump.dll

C:\Users\Olek\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo

C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo

C:\Windows\explorer.exe => Plik podpisany cyfrowo

C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo

C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo

C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo

C:\Windows\system32\services.exe => Plik podpisany cyfrowo

C:\Windows\system32\User32.dll => Plik podpisany cyfrowo

C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo

C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo

C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo

C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo

C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo

C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo

C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2015-08-31 12:58

==================== Koniec FRST.txt ============================

RogueKiller V10.10.4.0 [sep 4 2015] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/software/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 8.1 (6.3.9600) 64 bits version

Started in : Normal mode

User : Olek [Administrator]

Started from : C:\Users\Olek\Desktop\RogueKiller.exe

Mode : Scan -- Date : 09/06/2015 01:46:46

¤¤¤ Processes : 0 ¤¤¤

¤¤¤ Registry : 2 ¤¤¤

[PUM.SearchPage] (X64) HKEY_USERS\RK_Olek_ON_D_A4C8\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

[PUM.SearchPage] (X86) HKEY_USERS\RK_Olek_ON_D_A4C8\Software\Microsoft\Internet Explorer\Main | Search Bar : Preserve -> Found

¤¤¤ Tasks : 0 ¤¤¤

¤¤¤ Files : 0 ¤¤¤

¤¤¤ Hosts File : 0 ¤¤¤

¤¤¤ Antirootkit : 0 (Driver: Not loaded [0xc000036b]) ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: KINGSTON SHSS37A120G ATA Device +++++

--- User ---

[MBR] c1a84b6bc997f444709c1acbaad5c11b

[bSP] 5e2b501b3a827763da811cd736796499 : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 718848 | Size: 114121 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 ... OK

User = LL2 ... OK

+++++ PhysicalDrive1: ST1000DM003-1ER162 ATA Device +++++

--- User ---

[MBR] de162284bea1c995a282dc8a40e57ed2

[bSP] 7bb2a941d1f7291bfe1062514ea75f18 : Windows Vista/7/8|VT.Unknown MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 200000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 409602048 | Size: 200000 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 819202048 | Size: 553866 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

User = LL1 ... OK

User = LL2 ... OK

+++++ PhysicalDrive2: SAMSUNG HD103SJ ATA Device +++++

--- User ---

[MBR] c9795eeb96bef37f789827d6d3d30c13

[bSP] a1031a6751ec99804f5b02a819fb4836 : Windows XP|VT.Unknown MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 63 | Size: 99998 MB [Windows Vista/7/8 Bootstrap | Windows Vista/7/8 Bootloader]

1 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 204796620 | Size: 853861 MB

User = LL1 ... OK

User = LL2 ... OK

Addition.txt

kevinf80 · September 6, 2015

Those logs are clean, no obvious malware or infection. Com Surrogate is a recognized system process so no need to worry...

Here is a quote from Microsoft regarding Com Surrogate process...

COM Surrogate is a fancy name for Sacrificial process for a COM object that is run outside of the process that requested it. Explorer uses the COM Surrogate when extracting thumbnails, for example. If you go to a folder with thumbnails enabled, Explorer will fire off a COM Surrogate and use it to compute the thumbnails for the documents in the folder. It does this because Explorer has learned not to trust thumbnail extractors; they have a poor track record for stability.

Explorer has decided to absorb the performance penalty in exchange for the improved reliability resulting in moving these dodgy bits of code out of the main Explorer process. When the thumbnail extractor crashes, the crash destroys the COM Surrogate process instead of Explorer.

Do you have any other remaining issues or concerns?

Thank you,

Kevin...

Mizgal · September 6, 2015

I dont have. Thanks to your answer and solving this problem.

kevinf80 · September 6, 2015

Thanks for the update, run the following to clean up:

Download "Delfix by Xplode" and save it to your desktop.

Or use the following if first link is down:

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

Remove disinfection tools
Purge System Restore <--- this will remove all previous and possibly exploited restore points, a new point relative to system status at present will be created.
Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any remnant files/logs from tools we have used can be deleted…

Next,

Read the following link to fully understand PC security and best practices, you may find it useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

Will close out shortly...

Thank you,

Kevin...

Mizgal · September 7, 2015

Again, thank you very much for fast help.

kevinf80 · September 7, 2015

You`re very welcome...

Take care and surf safe,

Kevin...

AdvancedSetup · September 14, 2015

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

dllhost.exe COM Surrogate

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information