Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja: 27-11-2016 Uruchomiony przez a (29-11-2016 19:47:56) Run:2 Uruchomiony z C:\Users\a\Desktop\Nowy folder (2) Załadowane profile: a (Dostępne profile: a) Tryb startu: Normal ============================================== fixlist - zawartość: ***************** CloseProcesses: CreateRestorePoint: Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-3029930857-75846965-513736063-1000\...\Run: [a] => explorer.exe hxxp://kb-ribaki.org <===== UWAGA HKU\S-1-5-21-3029930857-75846965-513736063-1000\...\Policies\system: [LogonHoursAction] 2 HKU\S-1-5-21-3029930857-75846965-513736063-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 ShellIconOverlayIdentifiers: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => Brak pliku ShellIconOverlayIdentifiers: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => Brak pliku ShellIconOverlayIdentifiers: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => Brak pliku ShellIconOverlayIdentifiers-x32: [###MegaShellExtPending] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => Brak pliku ShellIconOverlayIdentifiers-x32: [###MegaShellExtSynced] -> {05B38830-F4E9-4329-978B-1DD28605D202} => Brak pliku ShellIconOverlayIdentifiers-x32: [###MegaShellExtSyncing] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => Brak pliku GroupPolicy\User: Ograniczenia <======= UWAGA GroupPolicyUsers\S-1-5-21-3029930857-75846965-513736063-1004\User: Ograniczenia <======= UWAGA OPR StartupUrls: "hxxp://www.viceice.com/" S3 ALSysIO; \??\C:\Users\a\AppData\Local\Temp\ALSysIO64.sys [X] U4 aspnet_state; Brak ImagePath Task: {0E290C5A-E448-4B52-88D2-C0D6CC124D04} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> Brak pliku <==== UWAGA Task: {190EE76C-8FD2-4ED3-9409-FA9CF48F1022} - \Safer-Networking\Spybot - Search and Destroy\Check for updates -> Brak pliku <==== UWAGA Task: {25163D73-4287-496E-90DB-C889AED68EC6} - \{81E27DC7-FE6C-43C1-B00C-D6438B953CBE} -> Brak pliku <==== UWAGA Task: {3BB0A579-F9E0-4210-940C-EA198390F9A6} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> Brak pliku <==== UWAGA Task: {4716494B-9F5F-404A-97AB-53DC5C45CE09} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> Brak pliku <==== UWAGA Task: {4C00A19B-E4F1-4D56-8DCF-0E47CA04F081} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> Brak pliku <==== UWAGA Task: {624F7E00-A058-4937-87B6-8387A89DE4CA} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> Brak pliku <==== UWAGA Task: {9014E7D0-6D5A-419F-8FCC-E7CFCA808A98} - \Safer-Networking\Spybot - Search and Destroy\Scan the system -> Brak pliku <==== UWAGA Task: {96C8EDD4-4AAB-42DA-B57A-F46B0F7A15A9} - System32\Tasks\a => /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v a /t REG_SZ /d "explorer.exe hxxp://kb-ribaki.org" <==== UWAGA Task: {9D7D9F7B-EDCD-4090-812D-C71191EE713E} - \{98CA4D20-FC4D-4B3B-8F85-2F12EACB9230} -> Brak pliku <==== UWAGA Task: {B5815E6D-0BB7-4C42-BAD8-A880475B6934} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> Brak pliku <==== UWAGA Task: {CB6BA3EF-32A0-4858-9671-3C45C3195E10} - \Safer-Networking\Spybot - Search and Destroy\Refresh immunization -> Brak pliku <==== UWAGA Task: {CC6AB63C-6A63-4B3C-9F18-B852972AC3AF} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> Brak pliku <==== UWAGA Task: {DC82B4C0-854D-43B3-82BE-1D873E44AEC1} - System32\Tasks\Realtek HD Audio => C:\Users\a\AppData\Local\SniperV2\Realtek HD\rthdcpl.exe <==== UWAGA Task: {E3C491BE-030E-46EF-B1AA-2977622B3949} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> Brak pliku <==== UWAGA Task: {E7BEB8AA-E05B-48E5-9C89-238A40DC7CFD} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> Brak pliku <==== UWAGA Task: {EC3DA0C2-10B2-42E5-BEAB-CD63D6D00E9D} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> Brak pliku <==== UWAGA Task: {F7A31922-4D2D-494E-B566-4E7C81784E13} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> Brak pliku <==== UWAGA Folder: C:\Users\a\AppData\Local\SniperV2\Realtek HD CMD: dir /a "C:\Program Files" CMD: dir /a "C:\Program Files (x86)" CMD: dir /a "C:\Program Files\Common Files\System" CMD: dir /a "C:\Program Files (x86)\Common Files\System" CMD: dir /a C:\ProgramData CMD: dir /a C:\Users\a\AppData\Local CMD: dir /a C:\Users\a\AppData\LocalLow CMD: dir /a C:\Users\a\AppData\Roaming DeleteKey: HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains DeleteKey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains Hosts: EmptyTemp: ***************** Procesy zostały pomyślnie zamknięte. Punkt przywracania został pomyślnie utworzony. "HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SDWinLogon" => klucz pomyślnie usunięto HKU\S-1-5-21-3029930857-75846965-513736063-1000\Software\Microsoft\Windows\CurrentVersion\Run\\a => Wartość pomyślnie usunięto HKU\S-1-5-21-3029930857-75846965-513736063-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\LogonHoursAction => Wartość pomyślnie usunięto HKU\S-1-5-21-3029930857-75846965-513736063-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\\DontDisplayLogonHoursWarnings => Wartość pomyślnie usunięto "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtPending" => klucz pomyślnie usunięto HKCR\CLSID\{056D528D-CE28-4194-9BA3-BA2E9197FF8C} => klucz nie znaleziono. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtSynced" => klucz pomyślnie usunięto HKCR\CLSID\{05B38830-F4E9-4329-978B-1DD28605D202} => klucz nie znaleziono. "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtSyncing" => klucz pomyślnie usunięto HKCR\CLSID\{0596C850-7BDD-4C9D-AFDF-873BE6890637} => klucz nie znaleziono. "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtPending" => klucz pomyślnie usunięto HKCR\Wow6432Node\CLSID\{056D528D-CE28-4194-9BA3-BA2E9197FF8C} => klucz nie znaleziono. "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtSynced" => klucz pomyślnie usunięto HKCR\Wow6432Node\CLSID\{05B38830-F4E9-4329-978B-1DD28605D202} => klucz nie znaleziono. "HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\###MegaShellExtSyncing" => klucz pomyślnie usunięto HKCR\Wow6432Node\CLSID\{0596C850-7BDD-4C9D-AFDF-873BE6890637} => klucz nie znaleziono. C:\WINDOWS\system32\GroupPolicy\User => pomyślnie przeniesiono C:\WINDOWS\system32\GroupPolicy\GPT.ini => pomyślnie przeniesiono C:\WINDOWS\system32\GroupPolicyUsers\S-1-5-21-3029930857-75846965-513736063-1004\User => pomyślnie przeniesiono OPR StartupUrls: "hxxp://www.viceice.com/" => pomyślnie usunięto ALSysIO => serwis pomyślnie usunięto aspnet_state => serwis pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{0E290C5A-E448-4B52-88D2-C0D6CC124D04}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0E290C5A-E448-4B52-88D2-C0D6CC124D04}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{190EE76C-8FD2-4ED3-9409-FA9CF48F1022}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{190EE76C-8FD2-4ED3-9409-FA9CF48F1022}" => klucz pomyślnie usunięto HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Check for updates => klucz nie znaleziono. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{25163D73-4287-496E-90DB-C889AED68EC6}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{25163D73-4287-496E-90DB-C889AED68EC6}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{81E27DC7-FE6C-43C1-B00C-D6438B953CBE}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{3BB0A579-F9E0-4210-940C-EA198390F9A6}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{3BB0A579-F9E0-4210-940C-EA198390F9A6}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4716494B-9F5F-404A-97AB-53DC5C45CE09}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4716494B-9F5F-404A-97AB-53DC5C45CE09}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{4C00A19B-E4F1-4D56-8DCF-0E47CA04F081}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4C00A19B-E4F1-4D56-8DCF-0E47CA04F081}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{624F7E00-A058-4937-87B6-8387A89DE4CA}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{624F7E00-A058-4937-87B6-8387A89DE4CA}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9014E7D0-6D5A-419F-8FCC-E7CFCA808A98}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9014E7D0-6D5A-419F-8FCC-E7CFCA808A98}" => klucz pomyślnie usunięto HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Scan the system => klucz nie znaleziono. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{96C8EDD4-4AAB-42DA-B57A-F46B0F7A15A9}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{96C8EDD4-4AAB-42DA-B57A-F46B0F7A15A9}" => klucz pomyślnie usunięto C:\WINDOWS\System32\Tasks\a => pomyślnie przeniesiono "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\a" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{9D7D9F7B-EDCD-4090-812D-C71191EE713E}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{9D7D9F7B-EDCD-4090-812D-C71191EE713E}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\{98CA4D20-FC4D-4B3B-8F85-2F12EACB9230}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{B5815E6D-0BB7-4C42-BAD8-A880475B6934}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{B5815E6D-0BB7-4C42-BAD8-A880475B6934}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxconfig" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CB6BA3EF-32A0-4858-9671-3C45C3195E10}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CB6BA3EF-32A0-4858-9671-3C45C3195E10}" => klucz pomyślnie usunięto HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => klucz nie znaleziono. "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{CC6AB63C-6A63-4B3C-9F18-B852972AC3AF}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{CC6AB63C-6A63-4B3C-9F18-B852972AC3AF}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\refreshgwxcontent" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{DC82B4C0-854D-43B3-82BE-1D873E44AEC1}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{DC82B4C0-854D-43B3-82BE-1D873E44AEC1}" => klucz pomyślnie usunięto C:\WINDOWS\System32\Tasks\Realtek HD Audio => pomyślnie przeniesiono "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Realtek HD Audio" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E3C491BE-030E-46EF-B1AA-2977622B3949}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E3C491BE-030E-46EF-B1AA-2977622B3949}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Time-5d" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E7BEB8AA-E05B-48E5-9C89-238A40DC7CFD}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E7BEB8AA-E05B-48E5-9C89-238A40DC7CFD}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EC3DA0C2-10B2-42E5-BEAB-CD63D6D00E9D}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EC3DA0C2-10B2-42E5-BEAB-CD63D6D00E9D}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\gwx\launchtrayprocess" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F7A31922-4D2D-494E-B566-4E7C81784E13}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F7A31922-4D2D-494E-B566-4E7C81784E13}" => klucz pomyślnie usunięto "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Setup\GWXTriggers\Logon-5d" => klucz pomyślnie usunięto ========================= Folder: C:\Users\a\AppData\Local\SniperV2\Realtek HD ======================== 2016-04-23 23:52 - 2016-04-23 23:52 - 0003242 _____ () C:\Users\a\AppData\Local\SniperV2\Realtek HD\config.xml 2016-04-23 23:52 - 2016-04-23 23:52 - 0278016 _____ (The cURL library, http://curl.haxx.se/) C:\Users\a\AppData\Local\SniperV2\Realtek HD\libcurl.dll 2016-04-23 23:52 - 2016-04-23 23:52 - 0094208 _____ (Free Software Foundation) C:\Users\a\AppData\Local\SniperV2\Realtek HD\libmicrohttpd-dll.dll 2016-04-23 23:52 - 2016-04-23 23:52 - 0660128 _____ (Microsoft Corporation) C:\Users\a\AppData\Local\SniperV2\Realtek HD\msvcp120.dll 2016-04-23 23:52 - 2016-04-23 23:52 - 0963232 _____ (Microsoft Corporation) C:\Users\a\AppData\Local\SniperV2\Realtek HD\msvcr120.dll 2016-04-23 23:52 - 2016-04-23 23:52 - 0021504 _____ () C:\Users\a\AppData\Local\SniperV2\Realtek HD\OpenCL.dll 2016-04-26 08:20 - 2016-04-26 08:20 - 0000001 _____ () C:\Users\a\AppData\Local\SniperV2\Realtek HD\setting.ini 2016-04-23 23:52 - 2016-04-23 23:52 - 0113166 _____ () C:\Users\a\AppData\Local\SniperV2\Realtek HD\zlib1.dll ====== Koniec Folder: ====== ========= dir /a "C:\Program Files" ========= Volume in drive C has no label. Volume Serial Number is 7CFC-7C7C Directory of C:\Program Files 2016-11-29 17:24