Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja: 03-10-2017 01 Uruchomiony przez Wojtek (04-10-2017 20:46:42) Uruchomiony z D:\Pobrane\FRST Windows 10 Pro Wersja 1703 (X64) (2017-09-22 22:24:59) Tryb startu: Normal ========================================================== ==================== Konta użytkowników: ============================= Administrator (S-1-5-21-1415446754-3198373632-3723623690-500 - Administrator - Disabled) Ewa (S-1-5-21-1415446754-3198373632-3723623690-1002 - Limited - Enabled) => C:\Users\Julia i Pati.Wojtek-laptop Gość (S-1-5-21-1415446754-3198373632-3723623690-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-1415446754-3198373632-3723623690-1004 - Limited - Enabled) Konto domyślne (S-1-5-21-1415446754-3198373632-3723623690-503 - Limited - Disabled) Wojtek (S-1-5-21-1415446754-3198373632-3723623690-1001 - Administrator - Enabled) => C:\Users\Wojtek ==================== Centrum zabezpieczeń ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Up to date) {4C1D9672-63FE-5C90-371E-8FDA591C5B75} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Zainstalowane programy ====================== (W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.) 4K Video Downloader 4.2 (HKLM-x32\...\4K Video Downloader_is1) (Version: 4.2.1.2185 - Open Media LLC) Adobe Flash Player 27 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 27.0.0.130 - Adobe Systems Incorporated) Adobe Reader 9.5.0 - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-A95000000001}) (Version: 9.5.0 - Adobe Systems Incorporated) Advanced IP Scanner 2.4 (HKLM-x32\...\{2E644D2D-993F-43B4-B85A-15363CA777C3}) (Version: 2.4.3021 - Famatech) AMD Catalyst Control Center (HKLM-x32\...\WUCCCApp) (Version: 1.00.0000 - AMD) AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.) AmiBroker 6.00.2 (HKLM-x32\...\AmiBroker_is1) (Version: 6.00 - AmiBroker.com) Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v9.10.32(T) - TOSHIBA CORPORATION) Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 6.30.223.227 - Broadcom Corporation) Citrix Online Launcher (HKLM-x32\...\{1EFF9E6C-76E1-43F9-81FB-BC8C037B0902}) (Version: 1.0.258 - Citrix) ConvertHelper 3.2 (HKLM\...\{27CC6AB1-E72B-4179-AF1A-EAE507EBAF52}}_is1) (Version: - DownloadHelper) DTS Sound (HKLM-x32\...\{793B70D2-41E9-46AB-9DDC-B34C99D07DB5}) (Version: 1.02.4100 - DTS, Inc.) ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - ) FileZilla Client 3.14.1 (HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\FileZilla Client) (Version: 3.14.1 - Tim Kosse) Firebird 1.5.6 (HKLM-x32\...\FBDBServer_1_5_is1) (Version: - Firebird Project) Genymotion version 2.6.0 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 2.6.0 - Genymobile) GoodSync (HKLM\...\{B26B00DA-2E5D-4CF2-83C5-911198C0F009}) (Version: 9.9.10.5 - Siber Systems) GoToMeeting 8.10.0.7495 (HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\GoToMeeting) (Version: 8.10.0.7495 - LogMeIn, Inc.) Hard Disk Low Level Format Tool 4.40 (HKLM-x32\...\Hard Disk Low Level Format Tool_is1) (Version: - HDDGURU) Intel(R) C++ Redistributables for Windows* on Intel(R) 64 (HKLM-x32\...\{D2437C5C-2D8C-40D2-8059-689AD7239FA3}) (Version: 11.1.048 - Intel Corporation) Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4549 - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.0.1001 - Intel Corporation) Java 8 Update 111 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180111F0}) (Version: 8.0.1110.14 - Oracle Corporation) KeePass Password Safe 2.36 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.36 - Dominik Reichl) K-Lite Codec Pack 10.9.0 Standard (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.9.0 - ) Malwarebytes (wersja 3.2.2.2029) (HKLM\...\{35065F43-4BB2-439A-BFF7-0F1014F2E0CD}_is1) (Version: 3.2.2.2029 - Malwarebytes) Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft OneDrive (HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\OneDriveSetup.exe) (Version: 17.3.6998.0830 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft Visual Studio Tools for Applications 2012 (HKLM-x32\...\{89ca2a32-2b52-4595-8dfd-6fe4757958d0}) (Version: 11.0.51108 - Microsoft Corporation) Mozilla Firefox 53.0.3 (x86 pl) (HKLM-x32\...\Mozilla Firefox 53.0.3 (x86 pl)) (Version: 53.0.3 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 53.0.3.6347 - Mozilla) NetWorx 5.3.3 (HKLM\...\NetWorx_is1) (Version: - Softperfect Research) Notepad++ (64-bit x64) (HKLM\...\Notepad++) (Version: 7.3.1 - Notepad++ Team) Oracle VM VirtualBox 5.0.10 (HKLM\...\{F6E922CF-068D-4AFC-8DBF-4636B84AF0A5}) (Version: 5.0.10 - Oracle Corporation) Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x64 Hosting Support - PTB (HKLM\...\{E237254B-36A1-3D27-815E-B37C13BE0796}) (Version: 11.0.51108 - Microsoft Corporation) Hidden Pacote de Idiomas do Microsoft Visual Studio Tools for Applications 2012 x86 Hosting Support - PTB (HKLM-x32\...\{03077B58-6ACF-32CA-B42A-EAA458C295A1}) (Version: 11.0.51108 - Microsoft Corporation) Hidden Polski pakiet językowy dla narzędzi Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - PLK) (Version: 10.0.50903 - Microsoft Corporation) Pro Surveillance System(EN) (HKLM-x32\...\{B28C9804-BFCE-4ADB-8C18-1DD9DA1C530A}) (Version: 4.0.0 - DH) PX Profile Update (HKLM-x32\...\{82159486-2D77-F83E-4057-66BAA2DE8ADB}) (Version: 1.00.1. - AMD) Hidden RadioSure (HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\RadioSure) (Version: - ) Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.9600.29077 - Realtek Semiconductor Corp.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.24.1218.2013 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7885 - Realtek Semiconductor Corp.) S Note (HKLM-x32\...\{4462A25C-1EE5-4701-84A3-ED7BA4672010}) (Version: 5.02.1026 - Samsung) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Smart View (HKLM-x32\...\{110B183E-0D44-49D6-B4C0-33D3296DAE84}) (Version: 1.0.0.0 - Samsung ) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.6.46 - Safer-Networking Ltd.) Statica mDM 4 (HKLM-x32\...\{35D3873C-FFEF-4989-86C6-959360FBA649}) (Version: 4.2.130.0 - Statica) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.4.3.38 - Synaptics Incorporated) TOSHIBA Desktop Assist (HKLM\...\{C4CDCEF0-0A7A-4425-887C-33E39533D758}) (Version: 1.03.08.6402 - Toshiba Corporation) TOSHIBA eco Utility (HKLM\...\{72EFCFA8-3923-451D-AF52-7CE9D87BC2A1}) (Version: 3.0.0.6406 - Toshiba Corporation) TOSHIBA Function Key (HKLM\...\{1844CFE2-EBA3-490A-8A5E-9BFC646342FD}) (Version: 1.1.5.6402 - Toshiba Corporation) TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.19 - TOSHIBA) TOSHIBA Password Utility (HKLM-x32\...\{2DB90351-FBAA-472B-9F12-6E1EBBB354DE}) (Version: v2.1.0.22 - Toshiba Corporation) TOSHIBA PC Health Monitor (HKLM\...\{B507386D-1F61-4E55-B05B-F56ACB0086B3}) (Version: 4.02.00.6400 - Toshiba Corporation) TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.2.00.56006005 - Toshiba Corporation) TOSHIBA Service Station (HKLM\...\{805C664C-17FA-4100-BB0D-5D5281D8B089}) (Version: 2.6.16.0 - Toshiba Corporation) TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0033 - Toshiba Corporation) TOSHIBA System Settings (HKLM-x32\...\{4D57ED72-6B01-40BD-9CA9-012B8FC09CEB}) (Version: 2.0.1.32003 - Toshiba Corporation) Toshiba TEMPRO (HKLM-x32\...\{E4C7D9D7-19D4-4623-AF0C-EA313C466411}) (Version: 5.0.0 - Toshiba Europe GmbH) Windows 10 Update and Privacy Settings (HKLM\...\{4DFCD818-036A-4229-A67D-CF17DC461D92}) (Version: 1.0.14.0 - Microsoft Corporation) WinRAR 5.20 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH) WinSplit Revolution (v11.04) (HKLM-x32\...\WinSplit Revolution) (Version: 11.04 - Raphael Lencrerot) Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x64) - RUS (HKLM\...\{25FB53C5-BE4C-3B6C-A0C9-D49A39227E1E}) (Version: 11.0.51108 - Microsoft Corporation) Hidden Языковой пакет для поддержки размещения набора средств Microsoft Visual Studio Tools для работы с приложениями 2012 (x86) - RUS (HKLM-x32\...\{68DC347D-C1C0-3DE2-A53E-CCC71DA53E57}) (Version: 11.0.51108 - Microsoft Corporation) Hidden ==================== Niestandardowe rejestracje CLSID (filtrowane): ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) CustomCLSID: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001_Classes\CLSID\{004B49B7-11B9-5058-FF22-08DD093ADC4B}\InprocServer32 -> {187DF4CA-9468-D082-9C64-0CE985889A47} => Brak pliku CustomCLSID: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Wojtek\AppData\Local\Citrix\GoToMeeting\4628\G2MOutlookAddin64.dll => Brak pliku CustomCLSID: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001_Classes\CLSID\{DD0822FF-3A09-4BDC-B749-4B00B9115850}\InprocServer32 -> {58AD1D9A-9468-D082-CC8D-DCA985889A47} => Brak pliku ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files\Notepad++\NppShell_06.dll [2017-01-17] () ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2017-05-23] (Safer-Networking Ltd.) ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2017-05-23] (Safer-Networking Ltd.) ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2014-12-02] (Alexander Roshal) ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2014-12-02] (Alexander Roshal) ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\atiacm64.dll [2015-07-15] (Advanced Micro Devices, Inc.) ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} => -> Brak pliku ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-12-02] (Intel Corporation) ContextMenuHandlers6: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2017-05-23] (Safer-Networking Ltd.) ContextMenuHandlers6: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDECon64.dll [2017-05-23] (Safer-Networking Ltd.) ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2014-12-02] (Alexander Roshal) ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2014-12-02] (Alexander Roshal) ==================== Zaplanowane zadania (filtrowane) ============= (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) Task: {049D09B8-2832-49F9-8EB6-B19AE6DB024A} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exe Task: {0A4A9412-7651-4316-BF96-B0D362FC846A} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA Task: {13C673D6-8983-4E8A-9C34-FD98296A01A6} - System32\Tasks\G2MUpdateTask-S-1-5-21-1415446754-3198373632-3723623690-1001 => C:\Users\Wojtek\AppData\Local\Citrix\GoToMeeting\6291\g2mupdate.exe [2017-01-25] (Citrix Online, a division of Citrix Systems, Inc.) Task: {243C128E-D8C6-487A-AF09-0400697FAF5A} - \OfficeSoftwareProtectionPlatform\SvcRestartTask -> Brak pliku <==== UWAGA Task: {326470D3-5250-49CB-892C-024019B3871C} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\WINDOWS\System32\AutoWorkplace.exe Task: {3ACD5F94-48AD-4260-B3E9-2E85B704FF63} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA Task: {44725A9B-2C67-4B07-A320-19D24B830456} - System32\Tasks\dts_apo_service_task => C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_task.exe [2015-05-27] () Task: {44B98CD0-DCB9-43E0-862B-3391FA2F265A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2017-05-23] (Safer-Networking Ltd.) Task: {4C393FDD-3743-4534-A3FA-A0C50C986FF2} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA Task: {51C53C5F-6FD1-49DB-83CC-64D227A21036} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA Task: {5281E02A-294A-4387-821B-7580F8BEF88E} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-09-14] (Adobe Systems Incorporated) Task: {843F3685-2F61-4E50-ACDD-0692F9CAB73D} - System32\Tasks\AutoKMSDaily => C:\Windows\AutoKMS.exe Task: {863B807B-33A2-4827-BBA9-EBD5873E8BF9} - System32\Tasks\G2MUploadTask-S-1-5-21-1415446754-3198373632-3723623690-1001 => C:\Users\Wojtek\AppData\Local\Citrix\GoToMeeting\6291\g2mupload.exe [2017-01-25] (Citrix Online, a division of Citrix Systems, Inc.) Task: {89B6FDDB-71E5-452C-BB1B-402D03DBA215} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2015-11-17] (Toshiba Europe GmbH) Task: {95EB6F3C-F0A2-4AE4-82C6-21B0733FD0FB} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA Task: {9F3D88E1-6B3E-4CFE-832A-44D91723A5CC} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2017-05-04] (Synaptics Incorporated) Task: {9F997FC8-675D-44B4-A7AF-97EC364EE683} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA Task: {A46BD89D-E707-4FDF-99B9-F39B02514B3A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2017-05-23] (Safer-Networking Ltd.) Task: {AEF9A10D-2D70-4B09-B156-64715931E4E0} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA Task: {BAED3869-D434-4AF7-9B78-4AEFCEC0C2D2} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA Task: {C7D841D4-012A-435C-BAB8-BE2F9BC7BCF9} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA Task: {DF44DEA4-D0DE-495D-8706-7FB54C564AF1} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2014-04-03] (TOSHIBA Corporation) Task: {F5C1A26F-F2E1-43D3-949B-9FF9411CDA3C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2017-05-23] (Safer-Networking Ltd.) Task: {FFFE8971-0FFF-4623-9505-236BE13BDDF1} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA (Załączenie wejścia w fixlist spowoduje przesunięcie pliku zadania (.job). Plik uruchamiany docelowo przez zadanie nie zostanie przeniesiony.) Task: C:\WINDOWS\Tasks\AutoKMS.job => C:\Windows\AutoKMS.exe Task: C:\WINDOWS\Tasks\AutoKMSDaily.job => C:\Windows\AutoKMS.exe Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-1415446754-3198373632-3723623690-1001.job => C:\Users\Wojtek\AppData\Local\GoToMeeting\7495\g2mupdate.exe Task: C:\WINDOWS\Tasks\G2MUploadTask-S-1-5-21-1415446754-3198373632-3723623690-1001.job => C:\Users\Wojtek\AppData\Local\GoToMeeting\7495\g2mupload.exe ==================== Skróty & WMI ======================== (Wybrane wejścia mogą zostać załączone w celu ich zresetowania lub usunięcia.) ==================== Załadowane moduły (filtrowane) ============== 2017-09-30 23:59 - 2017-08-24 11:27 - 002264528 _____ () C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\MwacLib.dll 2017-03-18 22:58 - 2017-03-18 22:58 - 000138000 _____ () C:\WINDOWS\SYSTEM32\inputhost.dll 2013-09-05 01:17 - 2013-09-05 01:17 - 004300456 _____ () C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF 2011-04-12 22:53 - 2011-04-12 22:53 - 000015360 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplitHook64.DLL 2015-10-16 12:02 - 2015-10-16 12:02 - 000043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll 2017-03-18 22:59 - 2017-03-20 05:59 - 001731072 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2017-08-02 22:15 - 2017-08-02 22:20 - 000074752 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\SkypeHost.exe 2017-08-02 22:15 - 2017-08-02 22:20 - 000203264 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\SkypeBackgroundTasks.dll 2017-08-02 22:15 - 2017-08-02 22:21 - 043573248 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\SkyWrap.dll 2017-08-02 22:15 - 2017-08-02 22:20 - 002435584 _____ () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.19.820.0_x64__kzf8qxf38zg5c\skypert.dll 2012-07-18 19:38 - 2012-07-18 19:38 - 000020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll 2014-12-19 00:36 - 2014-06-06 16:41 - 000718336 _____ () C:\Program Files\NetWorx\sqlite.dll 2014-10-31 17:29 - 2014-10-31 17:29 - 012124816 _____ () C:\Program Files\Siber Systems\GoodSync\GoodSync.exe 2011-04-12 22:53 - 2011-04-12 22:53 - 003951616 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplit.exe 2011-04-12 22:53 - 2011-04-12 22:53 - 000015872 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr32.exe 2011-04-12 22:53 - 2011-04-12 22:53 - 000017920 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplitDrvr64.exe 2015-05-27 12:46 - 2015-05-27 12:46 - 000019960 _____ () C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe 2017-09-23 02:05 - 2017-09-05 07:19 - 004125088 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentDeliveryManager.Background.dll 2017-03-18 22:59 - 2017-03-20 06:00 - 002487712 _____ () C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\ContentManagementSDK.dll 2017-10-01 14:41 - 2017-05-12 11:36 - 000507464 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2017-10-01 14:41 - 2016-09-13 14:00 - 000109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2017-10-01 14:41 - 2016-09-13 14:00 - 000167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2017-10-01 14:41 - 2016-09-13 14:00 - 000416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2011-04-12 22:53 - 2011-04-12 22:53 - 000013312 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplitHook32.DLL 2013-09-05 01:14 - 2013-09-05 01:14 - 004300456 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF 2011-04-12 22:53 - 2011-04-12 22:53 - 000011264 _____ () C:\Program Files (x86)\WinSplit Revolution\WinSplitLib.dll 2014-12-17 07:34 - 2013-12-09 16:26 - 001242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll ==================== Alternate Data Streams (filtrowane) ========= (Załączenie wejścia w fixlist spowoduje usunięcie strumienia ADS.) ==================== Tryb awaryjny (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Wartość "AlternateShell" zostanie przywrócona.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMService => ""="Service" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMService => ""="Service" ==================== Powiązania plików (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci.) ==================== Internet Explorer - Witryny zaufane i z ograniczeniami =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru.) IE restricted site: HKU\.DEFAULT\...\007guard.com -> install.007guard.com IE restricted site: HKU\.DEFAULT\...\008i.com -> 008i.com IE restricted site: HKU\.DEFAULT\...\008k.com -> www.008k.com IE restricted site: HKU\.DEFAULT\...\00hq.com -> www.00hq.com IE restricted site: HKU\.DEFAULT\...\010402.com -> 010402.com IE restricted site: HKU\.DEFAULT\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\.DEFAULT\...\0scan.com -> www.0scan.com IE restricted site: HKU\.DEFAULT\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\.DEFAULT\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\.DEFAULT\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\.DEFAULT\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\.DEFAULT\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\.DEFAULT\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\.DEFAULT\...\10sek.com -> www.10sek.com IE restricted site: HKU\.DEFAULT\...\12-26.net -> user1.12-26.net IE restricted site: HKU\.DEFAULT\...\12-27.net -> user1.12-27.net IE restricted site: HKU\.DEFAULT\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\.DEFAULT\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\.DEFAULT\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\.DEFAULT\...\123simsen.com -> www.123simsen.com Wykryto więcej niż wyliczono: 7936 witryn. IE trusted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\mdm.pl -> hxxps://inwestor.mdm.pl IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\007guard.com -> install.007guard.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\008i.com -> 008i.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\008k.com -> www.008k.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\00hq.com -> www.00hq.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\010402.com -> 010402.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\032439.com -> 80gw6ry3i3x3qbrkwhxhw.032439.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\0scan.com -> www.0scan.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\1-2005-search.com -> www.1-2005-search.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\1-domains-registrations.com -> www.1-domains-registrations.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\1000gratisproben.com -> www.1000gratisproben.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\1001namen.com -> www.1001namen.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\100888290cs.com -> mir.100888290cs.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\100sexlinks.com -> www.100sexlinks.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\10sek.com -> www.10sek.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\12-26.net -> user1.12-26.net IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\12-27.net -> user1.12-27.net IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\123fporn.info -> www.123fporn.info IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\123haustiereundmehr.com -> www.123haustiereundmehr.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\123moviedownload.com -> www.123moviedownload.com IE restricted site: HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\123simsen.com -> www.123simsen.com Wykryto więcej niż wyliczono: 7936 witryn. ==================== Hosts - zawartość: ========================== (Użycie dyrektywy Hosts: w fixlist spowoduje reset pliku Hosts.) 2013-08-22 15:25 - 2017-10-02 22:42 - 000454512 ____R C:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 127.0.0.1 www.0scan.com 127.0.0.1 0scan.com 127.0.0.1 1000gratisproben.com 127.0.0.1 www.1000gratisproben.com 127.0.0.1 1001namen.com 127.0.0.1 www.1001namen.com 127.0.0.1 100888290cs.com 127.0.0.1 www.100888290cs.com 127.0.0.1 www.100sexlinks.com 127.0.0.1 100sexlinks.com 127.0.0.1 10sek.com 127.0.0.1 www.10sek.com 127.0.0.1 www.1-2005-search.com 127.0.0.1 1-2005-search.com 127.0.0.1 123fporn.info 127.0.0.1 www.123fporn.info 127.0.0.1 www.123haustiereundmehr.com 127.0.0.1 123haustiereundmehr.com 127.0.0.1 123moviedownload.com 127.0.0.1 www.123moviedownload.com Wykryto więcej niż wyliczono: 15600 linii. ==================== Inne obszary ============================ (Obecnie brak automatycznej naprawy dla tej sekcji.) HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\Control Panel\Desktop\\Wallpaper -> D:\Moje dokumenty\do synchronizacji\Think_Different_Apple-1998-771623.jpg DNS Servers: 192.168.12.1 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: RequireAdmin) Zapora systemu Windows [funkcja włączona] ==================== MSCONFIG/TASK MANAGER - Wyłączone elementy == HKLM\...\StartupApproved\Run: => "TosWaitSrv" HKLM\...\StartupApproved\Run32: => "StartCCC" HKLM\...\StartupApproved\Run32: => "TSVU" HKLM\...\StartupApproved\Run32: => "Raptr" HKLM\...\StartupApproved\Run32: => "ITSecMng" HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\StartupApproved\Run: => "Spotify Web Helper" HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\StartupApproved\Run: => "ALLUpdate" HKU\S-1-5-21-1415446754-3198373632-3723623690-1001\...\StartupApproved\Run: => "Napisy24Update" ==================== Reguły Zapory systemu Windows (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) FirewallRules: [UDP Query User{C967E778-1D4D-43F7-80AF-0D6670811BA2}C:\users\wojtek\appdata\local\temp\e9f4.tmp\kmservice.exe] => (Block) C:\users\wojtek\appdata\local\temp\e9f4.tmp\kmservice.exe FirewallRules: [TCP Query User{C2998937-B3E5-4F72-B78C-8CC9F590D9FA}C:\users\wojtek\appdata\local\temp\e9f4.tmp\kmservice.exe] => (Block) C:\users\wojtek\appdata\local\temp\e9f4.tmp\kmservice.exe FirewallRules: [{4AE24AD3-0F03-4DB9-9C16-579AE37FB6ED}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{84D7142E-E331-4C1C-B4CC-D5280E5E6844}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [UDP Query User{BB086A28-399C-44C7-9F1B-C05126D086C2}C:\program files (x86)\java\jre1.8.0_60\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_60\bin\jp2launcher.exe FirewallRules: [TCP Query User{DB380BA7-4292-4BC7-B802-99E0CEBFAB19}C:\program files (x86)\java\jre1.8.0_60\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_60\bin\jp2launcher.exe FirewallRules: [{D91B5E68-EA5C-44D2-89DC-9BACB3058F41}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe FirewallRules: [{9EA5CE55-A3F4-4F91-8F9C-126D63DD8745}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe FirewallRules: [{49776951-250F-4331-B2B8-0B50B209E052}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe FirewallRules: [{ADD1FAB0-52E8-47EA-977C-0D9FCF6357B2}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe FirewallRules: [{EFD27994-73EE-4DC4-B062-933ED014CE56}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe FirewallRules: [{39B50C1F-8A4A-4B02-A4E4-CB634A4A4EEF}] => (Allow) C:\Program Files\Siber Systems\GoodSync\GoodSync.exe FirewallRules: [{AC88CE69-D642-4B05-B296-EA466DAE4C65}] => (Allow) C:\Program Files\Siber Systems\GoodSync\GoodSync.exe FirewallRules: [{AE622EDF-9523-44EB-9FFA-B70FA4E1693F}] => (Allow) C:\Program Files\Siber Systems\GoodSync\GsExplorer.exe FirewallRules: [{F53233D8-9D9A-4BCA-87ED-9741970FC7B3}] => (Allow) C:\Program Files\Siber Systems\GoodSync\GsExplorer.exe FirewallRules: [{1911606D-0BC6-4A5D-AF69-22D2FF8433DC}] => (Allow) C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe FirewallRules: [{18C785F6-E9FA-4082-90D9-7E75222B0762}] => (Allow) C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe FirewallRules: [{DA2C5988-8F54-431A-9751-6CD00976F960}] => (Allow) LPort=33333 FirewallRules: [{39D4EF8E-2B52-48DD-9A2D-5D8DFBC8E483}] => (Allow) LPort=33338 FirewallRules: [{E8CE2240-A6DD-4922-899C-05AB6D9740AD}] => (Allow) C:\Program Files\NetWorx\networx.exe FirewallRules: [{4F4E2D64-21F7-4DD9-BA53-E988BB81E3DA}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{65918AE4-7B42-43F9-BFC1-5413FBC6AFA2}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe FirewallRules: [{AFA5CF30-B417-448A-9CCF-853EC23F7094}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [{B850D689-C5E3-4C08-9CFB-4E1C2169F4A5}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe FirewallRules: [TCP Query User{916AA2EA-04FF-48EC-B74A-CEF3C9F3AD24}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe FirewallRules: [UDP Query User{10AA378D-6ACA-441C-88E1-81909086A20E}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe FirewallRules: [{EDB6DD8F-CACF-4AAB-A81D-A73D221AB1AE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{0271CFC0-CC9F-42A4-B71A-86B587201968}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [TCP Query User{42F0259A-B488-4F74-984F-8596289808FD}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe FirewallRules: [UDP Query User{40B275E3-79A7-4C10-BF55-D948CDDEECA1}C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_25\bin\jp2launcher.exe FirewallRules: [TCP Query User{5A1CC067-B962-48E4-9D9D-A06FCAE34170}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [UDP Query User{ADCB2C55-AD69-4076-9E4A-E9CA06A8F411}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe FirewallRules: [TCP Query User{462EB170-F914-456E-B744-2ECE6DB4593B}C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe FirewallRules: [UDP Query User{11EE3966-72F2-408B-ADDD-7920185124B6}C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe FirewallRules: [{C4631591-EEFA-43AA-9856-11B5C8FA2CE2}] => (Block) C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe FirewallRules: [{DFA088A2-FC48-4D5E-8478-F3815FC79A00}] => (Block) C:\program files (x86)\java\jre1.8.0_45\bin\jp2launcher.exe FirewallRules: [TCP Query User{C39A0606-31C4-43BF-8ED1-5B1B1A40D01C}C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe FirewallRules: [UDP Query User{C575B773-6424-40C3-B426-AA48FBB4AFEF}C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe FirewallRules: [{6F43230A-2042-4BAC-A1CB-CB982D343984}] => (Block) C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe FirewallRules: [{C11DBD4B-A43E-4442-92DC-73B3084B3192}] => (Block) C:\program files (x86)\java\jre1.8.0_51\bin\jp2launcher.exe FirewallRules: [TCP Query User{AA69DBB9-3764-4452-961E-09FAABA0D0F8}C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe] => (Allow) C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe FirewallRules: [UDP Query User{52C5DF8C-4FBA-4082-BDA1-E503924CF15D}C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe] => (Allow) C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe FirewallRules: [{64F591A6-7C8D-4CC7-A477-E421BB8672C1}] => (Block) C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe FirewallRules: [{29B70324-C9E8-4E11-A115-09F5832F6499}] => (Block) C:\users\wojtek\appdata\local\temp\e735.tmp\kmservice.exe FirewallRules: [TCP Query User{9AA01174-E0CE-4FC2-AEBC-0256928B3ED0}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe FirewallRules: [UDP Query User{362ABD74-D611-4584-8D24-58D85338DF7F}C:\program files (x86)\smart view\smart view.exe] => (Allow) C:\program files (x86)\smart view\smart view.exe FirewallRules: [TCP Query User{10EB1FD2-466C-4166-B594-647A992F6818}C:\program files (x86)\java\jre1.8.0_66\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\jp2launcher.exe FirewallRules: [UDP Query User{C70B6F89-8B66-4CF2-872F-49343EE34E3E}C:\program files (x86)\java\jre1.8.0_66\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_66\bin\jp2launcher.exe FirewallRules: [TCP Query User{9F1E38EB-7F59-46A7-BD68-CFC6E009229E}C:\users\wojtek\appdata\local\temp\1555.tmp\kmservice.exe] => (Block) C:\users\wojtek\appdata\local\temp\1555.tmp\kmservice.exe FirewallRules: [UDP Query User{86B551C2-13BE-4421-9578-AC7F3FF93BEF}C:\users\wojtek\appdata\local\temp\1555.tmp\kmservice.exe] => (Block) C:\users\wojtek\appdata\local\temp\1555.tmp\kmservice.exe FirewallRules: [{D537915E-E326-4949-9BE8-0EF8D76D7EF9}] => (Block) %ProgramFiles%\Corel\CorelDRAW Graphics Suite X7\Programs64\CorelDRW.exe FirewallRules: [TCP Query User{4582EFED-DDEA-48D9-8159-F93E58BD801C}C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe FirewallRules: [UDP Query User{40F819CE-B34C-4651-A8C6-E8D1A1C9020F}C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe] => (Block) C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe FirewallRules: [TCP Query User{AA60D0C2-D8B2-434B-AF24-4BF1BD76275B}C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe FirewallRules: [UDP Query User{96587355-9C16-49E5-94D6-41335C3F49A2}C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_91\bin\jp2launcher.exe FirewallRules: [TCP Query User{CF434F7A-8D56-46EE-AC97-B7074059F253}C:\users\wojtek\appdata\local\temp\b69f.tmp\kmservice.exe] => (Allow) C:\users\wojtek\appdata\local\temp\b69f.tmp\kmservice.exe FirewallRules: [UDP Query User{1B97030C-4ABA-456D-94BD-F9376097B3C9}C:\users\wojtek\appdata\local\temp\b69f.tmp\kmservice.exe] => (Allow) C:\users\wojtek\appdata\local\temp\b69f.tmp\kmservice.exe FirewallRules: [TCP Query User{4ABF0EF9-EE8C-457C-8FAC-FC1A65B85950}C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe FirewallRules: [UDP Query User{77AC5E34-DFE5-465B-9338-B5FC21414AE9}C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe FirewallRules: [TCP Query User{56667B74-F3C7-457E-BCF0-F227452AFE9D}C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe FirewallRules: [UDP Query User{D4E841AA-988B-4455-801F-D9670FB87396}C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe] => (Allow) C:\program files (x86)\java\jre1.8.0_111\bin\jp2launcher.exe StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service ==================== Punkty Przywracania systemu ========================= 02-10-2017 22:25:00 Usunięto: KB4023057 02-10-2017 23:21:22 JRT Pre-Junkware Removal ==================== Wadliwe urządzenia w Menedżerze urządzeń ============= ==================== Błędy w Dzienniku zdarzeń: ========================= Dziennik Aplikacja: ================== Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Windows\System32\sdnclean64.exe". Błąd w pliku manifestu lub w pliku zasad "C:\Windows\System32\sdnclean64.exe" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTasks.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTasks.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\Tools.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\Tools.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWinLogon.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWinLogon.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDResources.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDResources.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunizeLibrary.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunizeLibrary.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLists.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLists.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLicense.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDLicense.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFileScanLibrary.dll". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFileScanLibrary.dll" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Error: (10/04/2017 08:41:16 PM) (Source: SideBySide) (EventID: 9) (User: ) Description: Nie można wygenerować kontekstu aktywacji dla "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFileScanHelper.exe". Błąd w pliku manifestu lub w pliku zasad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFileScanHelper.exe" w wierszu 2. Element główny pliku manifestu musi być zmontowany. Dziennik System: ============= Error: (10/04/2017 08:37:40 PM) (Source: DCOM) (EventID: 10016) (User: ZARZĄDZANIE NT) Description: Zgodnie z ustawieniami uprawnienia właściwe dla aplikacji nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} i identyfikatorem aplikacji APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} użytkownikowi ZARZĄDZANIE NT\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Niedostępny (Niedostępny). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe. Error: (10/03/2017 09:42:12 PM) (Source: DCOM) (EventID: 10010) (User: ZARZĄDZANIE NT) Description: Serwer {F3B4E234-7A68-4E43-B813-E4BA55A065F6} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/03/2017 08:06:18 PM) (Source: DCOM) (EventID: 10016) (User: ZARZĄDZANIE NT) Description: Zgodnie z ustawieniami uprawnienia właściwe dla aplikacji nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} i identyfikatorem aplikacji APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} użytkownikowi ZARZĄDZANIE NT\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Niedostępny (Niedostępny). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe. Error: (10/02/2017 11:26:54 PM) (Source: DCOM) (EventID: 10010) (User: ZARZĄDZANIE NT) Description: Serwer {784E29F4-5EBE-4279-9948-1E8FE941646D} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/02/2017 11:23:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi CldFlt z powodu następującego błędu: Żądanie nie jest obsługiwane. Error: (10/02/2017 11:17:45 PM) (Source: DCOM) (EventID: 10010) (User: ZARZĄDZANIE NT) Description: Serwer {F3B4E234-7A68-4E43-B813-E4BA55A065F6} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error: (10/02/2017 08:54:21 PM) (Source: DCOM) (EventID: 10016) (User: ZARZĄDZANIE NT) Description: Zgodnie z ustawieniami uprawnienia właściwe dla aplikacji nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} i identyfikatorem aplikacji APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} użytkownikowi ZARZĄDZANIE NT\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Niedostępny (Niedostępny). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe. Error: (10/01/2017 10:50:32 PM) (Source: DCOM) (EventID: 10016) (User: ZARZĄDZANIE NT) Description: Zgodnie z ustawieniami uprawnienia właściwe dla aplikacji nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} i identyfikatorem aplikacji APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} użytkownikowi ZARZĄDZANIE NT\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Niedostępny (Niedostępny). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe. Error: (10/01/2017 10:02:09 PM) (Source: DCOM) (EventID: 10016) (User: ZARZĄDZANIE NT) Description: Zgodnie z ustawieniami uprawnienia właściwe dla aplikacji nie jest udzielane uprawnienie Lokalny Aktywacja do aplikacji serwera COM z identyfikatorem klasy CLSID {D63B10C5-BB46-4990-A94F-E40B9D520160} i identyfikatorem aplikacji APPID {9CA88EE3-ACB7-47C8-AFC4-AB702511C276} użytkownikowi ZARZĄDZANIE NT\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (użycie LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Niedostępny (Niedostępny). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe. Error: (10/01/2017 07:15:19 PM) (Source: DCOM) (EventID: 10010) (User: ZARZĄDZANIE NT) Description: Serwer {784E29F4-5EBE-4279-9948-1E8FE941646D} nie zarejestrował się w modelu DCOM w wymaganym czasie. CodeIntegrity: =================================== Date: 2017-10-03 21:40:20.376 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-10-03 21:40:20.300 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2017-10-02 22:51:01.247 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:51:00.800 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:50:56.709 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:50:14.282 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:50:10.259 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:49:37.999 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-02 22:49:37.817 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe) attempted to load \Device\HarddiskVolume4\Program Files\Malwarebytes\Anti-Malware\mbae64.dll that did not meet the Store signing level requirements. Date: 2017-10-01 19:54:48.415 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Windows\System32\amdhdl64.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Statystyki pamięci =========================== Procesor: Intel(R) Core(TM) i5-4210U CPU @ 1.70GHz Procent pamięci w użyciu: 42% Całkowita pamięć fizyczna: 8104.02 MB Dostępna pamięć fizyczna: 4695.59 MB Całkowita pamięć wirtualna: 9384.02 MB Dostępna pamięć wirtualna: 5763.02 MB ==================== Dyski ================================ Drive c: (System) (Fixed) (Total:122.31 GB) (Free:68.08 GB) NTFS Drive d: (Dokumenty i pliki) (Fixed) (Total:97.66 GB) (Free:61.7 GB) NTFS ==================== MBR & Tablica partycji ================== ======================================================== Disk: 0 (Size: 232.9 GB) (Disk ID: 00000000) Partition: GPT. ==================== Koniec Addition.txt ============================