Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04.03.2018
Ran by Daga (04-03-2018 17:45:11)
Running from F:\
Windows 10 Pro Version 1607 (X64) (2017-01-26 23:15:18)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3912383615-3260148415-1536492470-500 - Administrator - Disabled)
Daga (S-1-5-21-3912383615-3260148415-1536492470-1001 - Administrator - Enabled) => C:\Users\Daga
DefaultAccount (S-1-5-21-3912383615-3260148415-1536492470-503 - Limited - Disabled)
Guest (S-1-5-21-3912383615-3260148415-1536492470-501 - Limited - Disabled)
Mateusz (S-1-5-21-3912383615-3260148415-1536492470-1002 - Limited - Enabled) => C:\Users\Mateusz

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 16.04 (x64) (HKLM\...\7-Zip) (Version: 16.04 - Igor Pavlov)
Adobe Acrobat Reader DC - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-AC0F074E4100}) (Version: 18.011.20038 - Adobe Systems Incorporated)
Adobe Illustrator CC 2015 (HKLM-x32\...\{5680D629-B263-49CC-821E-3CEBD4507B51}) (Version: 19.0 - Adobe Systems Incorporated)
Brother MFL-Pro Suite DCP-J100 (HKLM-x32\...\{B742757A-7658-4E09-A51A-085CF0F7F4D3}) (Version: 1.0.0.0 - Brother Industries, Ltd.)
Dropbox (HKLM-x32\...\Dropbox) (Version: 44.4.58 - Dropbox, Inc.)
Dropbox Update Helper (HKLM-x32\...\{099218A5-A723-43DC-8DB5-6173656A1E94}) (Version: 1.3.65.1 - Dropbox, Inc.) Hidden
e5 Secure Download Manager (HKLM-x32\...\{B4B27A42-67BC-4728-A993-D567B37B6ACF}) (Version: 3.2.248.0 - Kivuto Solutions Inc.)
e-pity 8.0.14 za rok 2016 (HKLM-x32\...\{80D8170E-5590-218-B9ED-E24E4C99A11D}_is1) (Version: 8.0.14 - e-file sp. z o.o. sp.k.)
ETDWare PS/2-X64 10.7.17.5_WHQL (HKLM\...\Elantech) (Version: 10.7.17.5 - ELAN Microelectronic Corp.)
GIMP 2.8.18 (HKLM\...\GIMP-2_is1) (Version: 2.8.18 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 64.0.3282.186 - Google Inc.)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 - ClockworkMod)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.4276 - Intel Corporation)
IrfanView 4.44 (64-bit) (HKLM\...\IrfanView64) (Version: 4.44 - Irfan Skiljan)
Java 8 Update 161 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F32180161F0}) (Version: 8.0.1610.12 - Oracle Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\...\OneDriveSetup.exe) (Version: 17.3.7294.0108 - Microsoft Corporation)
Microsoft Project 2010 Service Pack 1 (SP1) (HKLM-x32\...\{91140000-003B-0000-0000-0000000FF1CE}_Office14.PRJPROR_{8A8F117F-8EDB-440D-B679-F08909D729F7}) (Version:  - Microsoft)
Microsoft Project Professional 2010 (HKLM-x32\...\Office14.PRJPROR) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23506 (HKLM-x32\...\{3ee5e5bb-b7cc-4556-8861-a00a82977d6c}) (Version: 14.0.23506.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 55.0.3 (x64 pl) (HKLM\...\Mozilla Firefox 55.0.3 (x64 pl)) (Version: 55.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 55.0.3 - Mozilla)
MPC-HC 1.7.10 (64-bit) (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.7.10 - MPC-HC Team)
NapiProjekt (2.2.0.2399) (HKLM-x32\...\NapiProjekt_is1) (Version:  - )
Narzędzia sprawdzające pakietu Microsoft Office 2013 — polski (HKLM\...\{90150000-001F-0415-1000-0000000FF1CE}) (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
nexusfont 2.6 (ver 2.6.2.1870) (HKLM-x32\...\{EFEDD205-43FE-4208-B682-0937E803E19E}_is1) (Version:  - xiles)
NVIDIA Graphics Driver 376.54 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 376.54 - NVIDIA Corporation)
OpenOffice 4.1.4 (HKLM-x32\...\{BA41785F-1DB1-4CEA-830A-149E940786B8}) (Version: 4.14.9788 - Apache Software Foundation)
OSPS-Odinstaluj (HKLM-x32\...\OSPS_is1) (Version:  - )
Pakiet zgodności dla systemu Office 2007 (HKLM-x32\...\{90120000-0020-0415-0000-0000000FF1CE}) (Version: 12.0.6514.5001 - Microsoft Corporation)
PDFBinder (HKLM-x32\...\{8BA03AC2-579F-41CD-A250-740137D86F7A}) (Version: 1.0.0 - Malamute.dk)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Promotic8 (HKLM-x32\...\{FCBAD026-A1B2-4AE5-97E2-709D7B50BD98}) (Version: 3.16.0000 - Microsys spol. s r. o.)
qBittorrent 3.3.10 (HKLM-x32\...\qBittorrent) (Version: 3.3.10 - The qBittorrent project)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7543 - Realtek Semiconductor Corp.)
Skype (wersja 8.11) (HKLM-x32\...\Skype_is1) (Version: 8.11 - Skype Technologies S.A.)
SourceTreeBeta (HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\...\SourceTreeBeta) (Version: 2.0.7-beta-001 - Mike Minns, Mike Corsaro)
Spotify (HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\...\Spotify) (Version: 1.0.75.483.g7ff4a0dc - Spotify AB)
STATISTICA TRIAL PL 64-bit 13.1.336.0 (HKLM\...\{35010F8F-E551-4594-B2CD-9B486D3F7E03}) (Version: 13.1.336.0 - Dell, Inc.)
STATNOVAPDF (novaPDF 7.7 printer) (HKLM\...\STATNOVAPDF_is1) (Version:  - Softland)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.40.0 - Synaptics Incorporated)
Universal Adb Driver (HKLM-x32\...\{C0E08D8D-6076-4117-B644-2AF34F35B757}) (Version: 1.0.4 - ClockworkMod)
UpdateAssistant (HKLM-x32\...\{035FFC43-55D6-4F5C-BCC5-21FED122C8B4}) (Version: 1.11.0.0 - Microsoft Corporation) Hidden
Vulkan Run Time Libraries 1.0.26.0 (HKLM\...\VulkanRT1.0.26.0) (Version: 1.0.26.0 - LunarG, Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3912383615-3260148415-1536492470-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
ShellIconOverlayIdentifiers: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt01] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt02] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt03] -> {FB314EE1-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt04] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt05] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt06] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt07] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt08] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt09] -> {FB314EE2-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [   DropboxExt10] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ContextMenuHandlers1: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers1: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ContextMenuHandlers4: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)
ContextMenuHandlers4: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ContextMenuHandlers5: [DropboxExt] -> {ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.19.0.dll [2018-02-26] (Dropbox, Inc.)
ContextMenuHandlers5: [igfxcui] -> {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4} =>  -> No File
ContextMenuHandlers5: [igfxDTCM] -> {9B5F5829-A529-4B12-814A-E81BCB8D93FC} => C:\WINDOWS\system32\igfxDTCM.dll [2016-02-19] (Intel Corporation)
ContextMenuHandlers5: [NvCplDesktopContext] -> {3D1975AF-48C6-4f8e-A182-BE0E08FA86A9} => C:\WINDOWS\system32\nvshext.dll [2016-12-29] (NVIDIA Corporation)
ContextMenuHandlers6: [7-Zip] -> {23170F69-40C1-278A-1000-000100020000} => C:\Program Files\7-Zip\7-zip.dll [2016-10-04] (Igor Pavlov)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0615622A-B36E-435A-9443-AECE75AB63E5} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2018-02-09] (Adobe Systems Incorporated)
Task: {0C46497F-D463-4FE9-96A5-F1748CDC029E} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cleanup => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-03] (Microsoft Corporation)
Task: {16B5570E-D48A-4138-A003-FA515491AAE7} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-03] (Microsoft Corporation)
Task: {DC903D2F-56F4-4A5C-89B3-D0A85C4F7EA6} - System32\Tasks\Optimize Thumbnail Cache Files => wscript.exe //nologo //E:jscript //B "C:\ProgramData\InstallShield\Update\isuspm.ini" <==== ATTENTION
Task: {E5D00639-C581-460E-A2CA-3C7D5C0016BD} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-03] (Microsoft Corporation)
Task: {EE381FBC-FBFE-4DCC-9658-34BB0B250C95} - System32\Tasks\Microsoft\Windows\Windows Defender\Windows Defender Verification => C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MpCmdRun.exe [2018-03-03] (Microsoft Corporation)
Task: {FB5E85EC-E708-42F4-A0B6-758E07DF3E66} - System32\Tasks\InstallShield® Update Service Scheduler => C:\Program Files (x86)\Common Files\InstallShield\Update\ISUSPM.exe [2017-10-07] (InstallShield®)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2016-07-16 12:42 - 2016-07-16 12:42 - 000231424 _____ () C:\WINDOWS\SYSTEM32\ism32k.dll
2016-07-16 12:42 - 2018-03-04 16:23 - 002681200 _____ () C:\WINDOWS\System32\CoreUIComponents.dll
2017-01-27 00:07 - 2016-12-29 14:16 - 000134712 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-07-16 12:42 - 2018-03-04 16:18 - 000130048 _____ () C:\WINDOWS\SYSTEM32\CHARTV.dll
2016-07-16 12:42 - 2018-03-04 16:19 - 000134656 _____ () C:\Windows\ShellExperiences\Windows.UI.Shell.SharedUtilities.dll
2016-07-16 12:43 - 2018-03-04 16:21 - 000474112 _____ () C:\Windows\ShellExperiences\QuickActions.dll
2016-07-16 12:43 - 2018-03-04 16:22 - 009761280 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-07-16 12:43 - 2018-03-04 16:22 - 001400320 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-07-16 12:43 - 2018-03-04 16:22 - 000757248 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CSGSuggestLib.dll
2016-07-16 12:43 - 2018-03-04 16:22 - 002438144 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-07-16 12:43 - 2018-03-04 16:22 - 004853760 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2018-02-27 08:32 - 2018-02-22 04:57 - 004433752 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\libglesv2.dll
2018-02-27 08:32 - 2018-02-22 04:57 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\64.0.3282.186\libegl.dll
2018-02-04 21:54 - 2009-02-27 16:38 - 000139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2018-03-01 08:56 - 2018-02-26 12:24 - 000746312 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_watchdog.dll
2018-03-01 08:56 - 2018-02-26 12:24 - 002079048 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_crashpad.dll
2017-09-21 18:29 - 2018-02-26 12:24 - 000100312 _____ () C:\Program Files (x86)\Dropbox\Client\_ctypes.pyd
2017-06-15 09:43 - 2018-02-26 12:24 - 000018896 _____ () C:\Program Files (x86)\Dropbox\Client\select.pyd
2017-06-15 09:43 - 2018-02-26 12:26 - 000020808 _____ () C:\Program Files (x86)\Dropbox\Client\tornado.speedups.pyd
2017-10-05 11:20 - 2018-02-26 12:24 - 000035808 _____ () C:\Program Files (x86)\Dropbox\Client\_multiprocessing.pyd
2017-06-15 09:43 - 2018-02-26 12:24 - 000694232 _____ () C:\Program Files (x86)\Dropbox\Client\unicodedata.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000021856 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._constant_time.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000130520 _____ () C:\Program Files (x86)\Dropbox\Client\_cffi_backend.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 001856864 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._openssl.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000022880 _____ () C:\Program Files (x86)\Dropbox\Client\cryptography.hazmat.bindings._padding.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000145880 _____ () C:\Program Files (x86)\Dropbox\Client\pyexpat.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000116696 _____ () C:\Program Files (x86)\Dropbox\Client\pywintypes27.dll
2017-07-13 21:57 - 2018-02-26 12:24 - 000105944 _____ () C:\Program Files (x86)\Dropbox\Client\win32api.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000022872 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.crt.compiled._winffi_crt.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000063312 _____ () C:\Program Files (x86)\Dropbox\Client\psutil._psutil_windows.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000024536 _____ () C:\Program Files (x86)\Dropbox\Client\win32event.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000077120 _____ () C:\Program Files (x86)\Dropbox\Client\fastpath.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000020952 _____ () C:\Program Files (x86)\Dropbox\Client\mmapfile.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000124888 _____ () C:\Program Files (x86)\Dropbox\Client\win32file.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000116184 _____ () C:\Program Files (x86)\Dropbox\Client\win32security.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000392664 _____ () C:\Program Files (x86)\Dropbox\Client\pythoncom27.dll
2017-09-21 18:29 - 2018-02-26 12:26 - 000392520 _____ () C:\Program Files (x86)\Dropbox\Client\win32com.shell.shell.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000026464 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.kernel32.compiled._winffi_kernel32.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000024024 _____ () C:\Program Files (x86)\Dropbox\Client\win32clipboard.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000175576 _____ () C:\Program Files (x86)\Dropbox\Client\win32gui.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000030168 _____ () C:\Program Files (x86)\Dropbox\Client\win32pipe.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000043480 _____ () C:\Program Files (x86)\Dropbox\Client\win32process.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000026072 _____ () C:\Program Files (x86)\Dropbox\Client\win32job.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000048600 _____ () C:\Program Files (x86)\Dropbox\Client\win32service.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000057816 _____ () C:\Program Files (x86)\Dropbox\Client\win32evtlog.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000021840 _____ () C:\Program Files (x86)\Dropbox\Client\cpuid.compiled._cpuid.pyd
2017-09-21 18:29 - 2018-02-26 12:27 - 000023376 _____ () C:\Program Files (x86)\Dropbox\Client\winshell.compiled._winshell.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000022864 _____ () C:\Program Files (x86)\Dropbox\Client\crashpad.compiled._Crashpad.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000066400 _____ () C:\Program Files (x86)\Dropbox\Client\winenumhandles.compiled._WinEnumHandles.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 001798464 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtCore.pyd
2017-06-15 09:43 - 2018-02-26 12:24 - 000084944 _____ () C:\Program Files (x86)\Dropbox\Client\sip.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 001959232 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtGui.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 003863880 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWidgets.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000155472 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineWidgets.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000521544 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtNetwork.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000051024 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngineCore.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000043336 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebChannel.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000131400 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKit.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000219984 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebKitWidgets.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000204104 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtPrintSupport.pyd
2017-09-21 18:29 - 2018-02-26 12:27 - 000025440 _____ () C:\Program Files (x86)\Dropbox\Client\winscreenshot.compiled._CaptureScreenshot.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000060888 _____ () C:\Program Files (x86)\Dropbox\Client\win32print.pyd
2017-09-21 18:29 - 2018-02-26 12:27 - 000054616 _____ () C:\Program Files (x86)\Dropbox\Client\winrpcserver.compiled._RPCServer.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000024024 _____ () C:\Program Files (x86)\Dropbox\Client\win32profile.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000022880 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.user32.compiled._winffi_user32.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000087904 _____ () C:\Program Files (x86)\Dropbox\Client\windisplaytoast.compiled._DisplayToast.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000028632 _____ () C:\Program Files (x86)\Dropbox\Client\win32ts.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000022368 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.iphlpapi.compiled._winffi_iphlpapi.pyd
2017-09-21 18:29 - 2018-02-26 12:26 - 000021856 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winerror.compiled._winffi_winerror.pyd
2017-09-21 18:29 - 2018-02-26 12:27 - 000022368 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.wininet.compiled._winffi_wininet.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000027496 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox.infinite.win.compiled._driverinstallation.pyd
2017-09-21 18:29 - 2018-02-26 12:24 - 000349144 _____ () C:\Program Files (x86)\Dropbox\Client\winxpgui.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000101704 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWinExtras.pyd
2017-09-21 18:29 - 2018-02-26 12:27 - 000023904 _____ () C:\Program Files (x86)\Dropbox\Client\winverifysignature.compiled._VerifySignature.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000025432 _____ () C:\Program Files (x86)\Dropbox\Client\librsyncffi.compiled._librsyncffi.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000036312 _____ () C:\Program Files (x86)\Dropbox\Client\librsync.dll
2018-03-01 08:56 - 2018-02-26 12:26 - 000032608 _____ () C:\Program Files (x86)\Dropbox\Client\enterprise_data.compiled._enterprise_data.pyd
2018-03-01 08:56 - 2018-02-26 12:24 - 000293392 _____ () C:\Program Files (x86)\Dropbox\Client\EnterpriseDataAdapter.dll
2018-01-11 23:50 - 2018-02-26 12:26 - 000021856 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.advapi32.compiled._winffi_advapi32.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000181064 _____ () C:\Program Files (x86)\Dropbox\Client\dropbox_sqlite_ext.DLL
2017-09-21 18:29 - 2018-02-26 12:26 - 000030544 _____ () C:\Program Files (x86)\Dropbox\Client\wind3d11.compiled._wind3d11.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000024384 _____ () C:\Program Files (x86)\Dropbox\Client\libEGL.DLL
2018-03-01 08:56 - 2018-02-26 12:26 - 001638208 _____ () C:\Program Files (x86)\Dropbox\Client\libGLESv2.dll
2017-09-21 18:29 - 2018-02-26 12:26 - 000026464 _____ () C:\Program Files (x86)\Dropbox\Client\winffi.winhttp.compiled._winffi_winhttp.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000546632 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQuick.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000359744 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtQml.pyd
2018-03-01 08:56 - 2018-02-26 12:26 - 000038216 _____ () C:\Program Files (x86)\Dropbox\Client\PyQt5.QtWebEngine.pyd

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\Users\Daga\Desktop\Standard Kartotek.docx:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Daga\Desktop\~WRL0791.tmp:com.dropbox.attributes [168]
AlternateDataStreams: C:\Users\Daga\Desktop\~WRL0791.tmp:com.dropbox.attrs [58]

==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2015-10-30 08:24 - 2015-10-30 08:21 - 000000824 _____ C:\WINDOWS\system32\Drivers\etc\hosts


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Daga\AppData\Local\Packages\Microsoft.Windows.Photos_8wekyb3d8bbwe\LocalState\PhotosAppBackground\{614e83cc-eb37-4186-8526-57c28f3b5815}.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer => (SmartScreenEnabled: Off)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-3912383615-3260148415-1536492470-1001\...\StartupApproved\Run: => "Skype"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [{F2A14CCD-E0DB-4AB2-81C8-FE953CA0EBEA}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{E1A9C4F7-319B-42E1-9F4C-D1061E9388B9}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{A830CEDC-D876-4DCE-9B0B-E6A86FCAA32C}] => (Allow) C:\Windows\KMS-R@1n.exe
FirewallRules: [{FC35EAE4-9806-40B9-8570-30B22724A321}] => (Allow) C:\Windows\KMS-R@1n.exe
FirewallRules: [{D775C986-E4FD-4438-9D29-90CC09BFFDC4}] => (Allow) C:\WINDOWS\system32\hasplms.exe
FirewallRules: [TCP Query User{CA460C37-DA89-4839-9B4C-DD6008C3957E}C:\pm\promotic.exe] => (Block) C:\pm\promotic.exe
FirewallRules: [UDP Query User{C2030CEA-AB4C-4866-8D14-C481EE67F50F}C:\pm\promotic.exe] => (Block) C:\pm\promotic.exe
FirewallRules: [{6AA513C6-EFC8-4C5A-8C41-499528126291}] => (Allow) C:\Program Files (x86)\Mouse Server\MouseServer.exe
FirewallRules: [{7589757D-A969-41BF-BDC3-6E239C1F5627}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{3F8FE89C-C054-4306-ACA5-326C258DE29C}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{85DF3AA5-C6BA-4A39-8D70-26102E75A4A7}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{33C89DC9-3C3E-453A-A423-AF55C9C6C176}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [TCP Query User{7CA58735-2DF0-435D-9DAC-07CE3F257647}C:\users\daga\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\daga\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{E867C772-104F-4FF5-ADA1-8C680F67BB31}C:\users\daga\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\daga\appdata\roaming\spotify\spotify.exe
FirewallRules: [{7A32F5B0-39C3-4062-9691-94B26BFC941C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{576B9BFB-0993-4305-8887-0F33A7AA23BF}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe

==================== Restore Points =========================

ATTENTION: System Restore is disabled

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/04/2018 05:45:07 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:41:07Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:44:37 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:40:37Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:44:07 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:41:07Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:43:37 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:40:37Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:43:07 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:41:07Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:42:37 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:40:37Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:42:07 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:41:07Z. Kod błędu: 0x80070002.

Error: (03/04/2018 05:41:37 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Nie można zaplanować restartu usługi ochrony oprogramowania o 2018-04-03T14:40:37Z. Kod błędu: 0x80070002.


System errors:
=============
Error: (03/04/2018 04:56:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 i identyfikatorem aplikacji APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 użytkownikowi NT AUTHORITY\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:56:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 i identyfikatorem aplikacji APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 użytkownikowi NT AUTHORITY\LOCAL SERVICE o identyfikatorze zabezpieczeń SID (S-1-5-19) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:56:27 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 i identyfikatorem aplikacji APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 użytkownikowi NT AUTHORITY\LOCAL SERVICE o identyfikatorze zabezpieczeń SID (S-1-5-19) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:55:04 PM) (Source: DCOM) (EventID: 10010) (User: DESKTOP-JBOVC3M)
Description: Serwer {F9717507-6651-4EDB-BFF7-AE615179BCCF} nie zarejestrował się w modelu DCOM w wymaganym czasie.

Error: (03/04/2018 04:35:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 i identyfikatorem aplikacji APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 użytkownikowi NT AUTHORITY\LOCAL SERVICE o identyfikatorze zabezpieczeń SID (S-1-5-19) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:35:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{6B3B8D23-FA8D-40B9-8DBD-B950333E2C52}
 i identyfikatorem aplikacji APPID 
{4839DDB7-58C2-48F5-8283-E1D1807D0D7D}
 użytkownikowi NT AUTHORITY\LOCAL SERVICE o identyfikatorze zabezpieczeń SID (S-1-5-19) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:35:39 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: Zgodnie z ustawieniami uprawnienia application-specific nie jest udzielane uprawnienie Local Activation do aplikacji serwera COM z identyfikatorem klasy CLSID 
{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}
 i identyfikatorem aplikacji APPID 
{F72671A9-012C-4725-9D2F-2A4D32D65169}
 użytkownikowi NT AUTHORITY\SYSTEM o identyfikatorze zabezpieczeń SID (S-1-5-18) z adresu LocalHost (Using LRPC) działającemu w kontenerze aplikacji o identyfikatorze SID Unavailable (Unavailable). To uprawnienie zabezpieczeń można modyfikować przy użyciu narzędzia administracyjnego Usługi składowe.

Error: (03/04/2018 04:27:21 PM) (Source: Microsoft-Windows-Eventlog) (EventID: 30) (User: NT AUTHORITY)
Description: Usługa rejestrowania zdarzeń napotkała błąd (5) podczas włączania wydawcy {0BF2FB94-7B60-4B4D-9766-E82F658DF540} w kanale Microsoft-Windows-Kernel-ShimEngine/Operational. Nie wpływa to na działanie kanału, ale wpływa na zdolność wydawcy do wywoływania zdarzeń w kanale. Często ten błąd wynika z faktu, że dostawca korzysta z zabezpieczeń dostawcy ETW i nie udzielił tożsamości usługi Dziennik zdarzeń uprawnień do włączania.


Windows Defender:
===================================
Date: 2018-03-04 15:32:23.865
Description: 
Produkt Windows Defender wykrył złośliwe oprogramowanie lub inne potencjalnie niechciane oprogramowanie.
Aby uzyskać więcej informacji, zobacz:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:MSIL/AutoKMS&threatid=2147711767&enterprise=0
Nazwa: HackTool:MSIL/AutoKMS
Identyfikator: 2147711767
Ważność: Medium
Kategoria: Tool
Ścieżka: file:_C:\Program Files\KMSpico\AutoPico.exe;file:_C:\Program Files\KMSpico\KMSELDI.exe;file:_C:\Program Files\KMSpico\Service_KMS.exe;file:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnk;file:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnk;file:_C:\WINDOWS\System32\Tasks\AutoPico Daily Restart;process:_pid:2504,ProcessStart:131646474792854533;regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0759F7A7-CD99-4EC2-A192-6D610D4D4B72};regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart;regkey:_HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1;service:_Service KMSELDI;startup:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnk;startup:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnk;taskscheduler:_C:\WINDOWS\System32\Tasks\AutoPico Daily Restart;uninstall:_HKLM\SOFTWARE\MICROSOFT\W
Pochodzenie wykrycia: Komputer lokalny
Typ wykrycia: Konkretne
Źródło wykrycia: System
Użytkownik: NT AUTHORITY\SYSTEM
Nazwa procesu: C:\Program Files\KMSpico\Service_KMS.exe
Wersja podpisu: AV: 1.263.129.0, AS: 1.263.129.0, NIS: 118.2.0.0
Wersja aparatu: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-04 15:32:23.864
Description: 
Produkt Windows Defender wykrył złośliwe oprogramowanie lub inne potencjalnie niechciane oprogramowanie.
Aby uzyskać więcej informacji, zobacz:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/AutoKMS&threatid=2147685180&enterprise=0
Nazwa: HackTool:Win32/AutoKMS
Identyfikator: 2147685180
Ważność: Medium
Kategoria: Tool
Ścieżka: file:_C:\Program Files\KMSpico\scripts\Install_Service.cmd;file:_C:\Program Files\KMSpico\scripts\Install_Task.cmd;file:_C:\Users\Daga\AppData\Local\Temp\is-6E0I8.tmp\_setup.exe
Pochodzenie wykrycia: Komputer lokalny
Typ wykrycia: Konkretne
Źródło wykrycia: System
Użytkownik: NT AUTHORITY\SYSTEM
Nazwa procesu: Unknown
Wersja podpisu: AV: 1.263.129.0, AS: 1.263.129.0, NIS: 118.2.0.0
Wersja aparatu: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-04 13:34:34.527
Description: 
Produkt Windows Defender wykrył złośliwe oprogramowanie lub inne potencjalnie niechciane oprogramowanie.
Aby uzyskać więcej informacji, zobacz:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:MSIL/AutoKMS&threatid=2147711767&enterprise=0
Nazwa: HackTool:MSIL/AutoKMS
Identyfikator: 2147711767
Ważność: Medium
Kategoria: Tool
Ścieżka: file:_C:\Program Files\KMSpico\AutoPico.exe;file:_C:\Program Files\KMSpico\KMSELDI.exe;file:_C:\Program Files\KMSpico\Service_KMS.exe;file:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnk;file:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnk;file:_C:\WINDOWS\System32\Tasks\AutoPico Daily Restart;process:_pid:2388,ProcessStart:131646403808262868;regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0759F7A7-CD99-4EC2-A192-6D610D4D4B72};regkey:_HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AutoPico Daily Restart;regkey:_HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{8B29D47F-92E2-4C20-9EE0-F710991F5D7C}_is1;service:_Service KMSELDI;startup:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnk;startup:_C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnk;taskscheduler:_C:\WINDOWS\System32\Tasks\AutoPico Daily Restart;uninstall:_HKLM\SOFTWARE\MICROSOFT\W
Pochodzenie wykrycia: Komputer lokalny
Typ wykrycia: Konkretne
Źródło wykrycia: System
Użytkownik: NT AUTHORITY\SYSTEM
Nazwa procesu: C:\Program Files\KMSpico\Service_KMS.exe
Wersja podpisu: AV: 1.263.71.0, AS: 1.263.71.0, NIS: 118.2.0.0
Wersja aparatu: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-04 13:34:34.525
Description: 
Produkt Windows Defender wykrył złośliwe oprogramowanie lub inne potencjalnie niechciane oprogramowanie.
Aby uzyskać więcej informacji, zobacz:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/AutoKMS&threatid=2147685180&enterprise=0
Nazwa: HackTool:Win32/AutoKMS
Identyfikator: 2147685180
Ważność: Medium
Kategoria: Tool
Ścieżka: file:_C:\Program Files\KMSpico\scripts\Install_Service.cmd;file:_C:\Program Files\KMSpico\scripts\Install_Task.cmd;file:_C:\Users\Daga\AppData\Local\Temp\is-6E0I8.tmp\_setup.exe
Pochodzenie wykrycia: Komputer lokalny
Typ wykrycia: Konkretne
Źródło wykrycia: System
Użytkownik: NT AUTHORITY\SYSTEM
Nazwa procesu: Unknown
Wersja podpisu: AV: 1.263.71.0, AS: 1.263.71.0, NIS: 118.2.0.0
Wersja aparatu: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-04 13:34:24.189
Description: 
Produkt Windows Defender wykrył złośliwe oprogramowanie lub inne potencjalnie niechciane oprogramowanie.
Aby uzyskać więcej informacji, zobacz:
https://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:MSIL/AutoKMS&threatid=2147711767&enterprise=0
Nazwa: HackTool:MSIL/AutoKMS
Identyfikator: 2147711767
Ważność: Medium
Kategoria: Tool
Ścieżka: file:_C:\Program Files\KMSpico\Service_KMS.exe;process:_pid:2388,ProcessStart:131646403808262868
Pochodzenie wykrycia: Komputer lokalny
Typ wykrycia: Konkretne
Źródło wykrycia: System
Użytkownik: NT AUTHORITY\SYSTEM
Nazwa procesu: C:\Program Files\KMSpico\Service_KMS.exe
Wersja podpisu: AV: 1.263.71.0, AS: 1.263.71.0, NIS: 118.2.0.0
Wersja aparatu: AM: 1.1.14600.4, NIS: 2.1.14202.0

Date: 2018-03-04 16:38:49.552
Description: 
Produkt Windows Defender napotkał błąd podczas próby aktualizacji podpisów.
Nowa wersja podpisu: 
Poprzednia wersja podpisu: 1.263.131.0
Źródło aktualizacji: Serwer usługi Microsoft Update
Typ podpisu: Oprogramowanie antywirusowe
Typ aktualizacji: Pełne
Użytkownik: NT AUTHORITY\SYSTEM
Bieżąca wersja aparatu: 
Poprzednia wersja aparatu: 1.1.14600.4
Kod błędu: 0x80240438
Opis błędu: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2018-03-04 16:21:58.167
Description: 
Produkt Windows Defender napotkał błąd podczas próby aktualizacji podpisów.
Nowa wersja podpisu: 
Poprzednia wersja podpisu: 1.263.131.0
Źródło aktualizacji: Serwer usługi Microsoft Update
Typ podpisu: Oprogramowanie antywirusowe
Typ aktualizacji: Pełne
Użytkownik: NT AUTHORITY\SYSTEM
Bieżąca wersja aparatu: 
Poprzednia wersja aparatu: 1.1.14600.4
Kod błędu: 0x80240438
Opis błędu: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2018-03-04 15:56:28.695
Description: 
Produkt Windows Defender napotkał błąd podczas próby aktualizacji podpisów.
Nowa wersja podpisu: 
Poprzednia wersja podpisu: 1.263.131.0
Źródło aktualizacji: Serwer usługi Microsoft Update
Typ podpisu: Oprogramowanie antywirusowe
Typ aktualizacji: Pełne
Użytkownik: NT AUTHORITY\SYSTEM
Bieżąca wersja aparatu: 
Poprzednia wersja aparatu: 1.1.14600.4
Kod błędu: 0x80240438
Opis błędu: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2018-03-04 15:41:29.760
Description: 
Produkt Windows Defender napotkał błąd podczas próby aktualizacji podpisów.
Nowa wersja podpisu: 
Poprzednia wersja podpisu: 1.263.129.0
Źródło aktualizacji: Serwer usługi Microsoft Update
Typ podpisu: Oprogramowanie antywirusowe
Typ aktualizacji: Pełne
Użytkownik: NT AUTHORITY\SYSTEM
Bieżąca wersja aparatu: 
Poprzednia wersja aparatu: 1.1.14600.4
Kod błędu: 0x80240438
Opis błędu: An unexpected problem occurred while checking for updates. For information on installing or troubleshooting updates, see Help and Support. 

Date: 2018-02-28 09:07:15.702
Description: 
Produkt Windows Defender napotkał błąd podczas próby aktualizacji podpisów.
Nowa wersja podpisu: 
Poprzednia wersja podpisu: 1.261.1676.0
Źródło aktualizacji: Centrum firmy Microsoft ds. ochrony przed złośliwym oprogramowaniem
Typ podpisu: Oprogramowanie antyszpiegowskie
Typ aktualizacji: Pełne
Użytkownik: NT AUTHORITY\NETWORK SERVICE
Bieżąca wersja aparatu: 
Poprzednia wersja aparatu: 1.1.14500.5
Kod błędu: 0x80072ee2
Opis błędu: The operation timed out 

CodeIntegrity:
===================================

Date: 2018-03-04 14:55:45.108
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\DriverStore\FileRepository\nvsmwu.inf_amd64_40e2f893a8ddfad8\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2018-03-04 14:55:45.048
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2018-03-04 13:33:02.248
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\Drivers\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-03-04 13:33:02.244
Description: 
Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\Drivers\WdBoot.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2018-02-26 12:27:51.564
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\DriverStore\FileRepository\nvsmwu.inf_amd64_40e2f893a8ddfad8\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2018-02-26 12:27:51.508
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2018-02-25 11:30:59.875
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Windows\System32\DriverStore\FileRepository\nvsmwu.inf_amd64_40e2f893a8ddfad8\nvinitx.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Date: 2018-02-25 11:30:59.824
Description: 
Code Integrity determined that a process (\Device\HarddiskVolume1\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe) attempted to load \Device\HarddiskVolume1\Program Files\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements.

==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3210M CPU @ 2.50GHz
Percentage of memory in use: 30%
Total physical RAM: 7973.53 MB
Available physical RAM: 5572.05 MB
Total Virtual: 9253.53 MB
Available Virtual: 7018.1 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:111.8 GB) (Free:23.2 GB) NTFS ==>[drive with boot components (obtained from BCD)]
Drive d: (Dysk lokalny) (Fixed) (Total:110.89 GB) (Free:30.02 GB) NTFS
Drive f: () (Removable) (Total:3.65 GB) (Free:2.09 GB) FAT32

\\?\Volume{42556465-0000-0000-0000-70f31b000000}\ () (Fixed) (Total:0.87 GB) (Free:0.34 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7/8/10) (Size: 223.6 GB) (Disk ID: 42556465)
Partition 1: (Active) - (Size=111.8 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=895 MB) - (Type=27)
Partition 3: (Not Active) - (Size=110.9 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 3.7 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0C)

==================== End of Addition.txt ============================