Nie można włączyć zapory systemu windows, steama itd...

[kacpik6676]

Witam, mam problem z tym, że nie mogę włączyć zapory systemu windows, steama (piszę, że internetu nie mam), wiele plików jak antywirusy przy skanowaniu nagle przestają skanować i jest "brak odpowiedzi", tak jakby coś to blokowało, komputer chodzi o dużo wolniej niż normalnie, nie mogę nic włączyć nawet jako "uruchom jako administrator"

 

Filmy na youtube/strony na które wchodzę, żeby się załadowały, muszę zastopować i jeszcze raz włączyć / odświeżyć stronę.

 

Logi załączam, proszę o pomoc i z góry dziękuje.

 

A i jeszcze jedno: przywracanie systemu windows też robi się nieskończoność, zostawiłem na jakieś 6 h i nic się nie zrobiło.

Addition.txtPobieranie informacji ...

FRST.txtPobieranie informacji ...

[kacpik6676]

GMER nie mogę dodać, tzn mam odznaczone w GMER opcje od "System do Biblioteki" i nie da się ich zaznaczyć bo AVAST je blokuje, niestety nie mogę go wyłączyć na jakiś czas bo go się nie da zaznaczyć, usunięcie go też nie bo piszę, że muszę mieć uprawnienia administratora (mój komputer i tylko jeden profil jest), zakończyć procesu w menadżer zadań też się nie da.

 

 

  Pokaż ukrytą zawartość

 

 

#Edit

 

Zrobiłem skan z wszystkim co mogłem i o to wyszło:

 

GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-05-22 19:16:21
Windows 6.1.7601 Service Pack 1 x64
Running: 31cs9bkf.exe


---- Registry - GMER 2.2 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\Instup_14943321356782294@SetupOperations  ????????Port_#0005.Hub_#0004?m??????????????????USB\VID_07D1&PID_3C03&REV_0001?USB\VID_07D1&PID_3C03????{4d36e967-e325-11ce-bfc1-08002be10318}??????{eec5ad98-8080-425f-922a-dabf3de3f69a}??????????????LegacyDriver????{8ECC055D-047F-11D1-A537-0000F8753ED1}?000 ?LegacyDriver??????$???????????????e?????? ???j??? ?????0GH???d???????????B??oem24.inf????????????i???d??????????????????ks.inf?wdmaudio.inf??i??? X??????=?????LPo??????????????????????????@input.inf,%hid.devicedesc%;Urz?dzenie wej?ciowe USB?l??WUDFCoinstaller.dll???????"??????????????????????.??4????????????0??????????{8ECC055D-047F-11D1-A537-0000F8753ED1}???3????N????????????D?????????????????????????r???????????????????????????????5??56??DriverInterface?????? ???????p???????????a???????? ??? ?????????@%systemroot%\system32\sstpsvc.dll,-202??????????????????????????????n??ws????????????????????????N??????t????D??d??@C:\Program Files\Microsoft Security Client\MpAsDesc.dll,-240???? b??????1??????????{8ECC055D-047F-11D1-A537-0000F8753ED1}?????????????????
Reg  HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\Instup_14943321356782294@SetupOperations      ?????T??????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|RPort=3540|App=%SystemRoot%\system32\svchost.exe|Svc=PNRPSvc|Name=@FirewallAPI.dll,-32023|Desc=@FirewallAPI.dll,-32026|EmbedCtxt=@FirewallAPI.dll,-32002|??????T?T?f?f?f?f?f?d?d?d???????????????????????????s??? @?????? ??????????@%SystemRoot%\system32\tcpipcfg.dll,-50004??????????????? ???????n??????????Typ?????????????????????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|RPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=Ssdpsrv|Name=@FirewallAPI.dll,-32031|Desc=@FirewallAPI.dll,-32034|EmbedCtxt=@FirewallAPI.dll,-32002|???v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|LPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=Ssdpsrv|Name=@FirewallAPI.dll,-32027|Desc=@FirewallAPI.dll,-32030|EmbedCtxt=@FirewallAPI.dll,-32002|?A??atksgt???h??wpdmtp.inf??????@%SystemRoot%\system32\tcpipcfg.dll,-50003???? ?ReadyBoost???????&???????s???????????????????s???????????5???????????j?????

---- EOF - GMER 2.2 ----

 

Edytowane 22 Maja 2017 przez Rucek

[Miszel03]

Brakuje raportu Shortcut generowanego przez FRST- uzupełnij.

[kacpik6676]

Dodaje Shortcut

Shortcut.txtPobieranie informacji ...

[kacpik6676]

Kiedy można spodziewać się pomocy?

[Miszel03]

Teraz zauważyłem, że log Addition jest ucięty. Dostarcz nowy i przy okazji cały nowy zestaw.

Dodatkowo poproszę o log z FSS.

[kacpik6676]

FRST mi juz 3 lub 4 raz pod rząd się zacina (brak odpowiedzi) podczas skanu ;/

[Miszel03]

Spróbuj uruchomić go i wygenerować raporty z poziomu trybu awaryjnego (klik w klawisz F8 przed startem systemu).

[kacpik6676]

@Miszel03

 

W trybie awaryjnym z obsługą sieci też się zacina FRST, logi co prawda się zrobiły ale nie wiem czy są całe, jak na razie dołączam logi z FRST i proszę o powiedzenie czy się nadają, a FSS dodam o ile mi się pobierze za jakiś (tyle ile mi to zajmie)

Addition.txtPobieranie informacji ...

FRST.txtPobieranie informacji ...

Shortcut.txtPobieranie informacji ...

[kacpik6676]

 

  Pokaż ukrytą zawartość

E-Peek v 1.9.9.0 ENHANCED 4 © Emphyrio/Onsia Patrick 2013-2017
E Dev
Run at So 27 maj 2017 17:19
.
Windows 7 Home Premium SP 1 (64 bits)
C:\Windows [NTFS - Fixed]
Default Browser: Firefox
Boot mode: Normal boot
User logged in: Admin
.
Java x86: 1.8
Java x64: n/a
.
AV : Avast Antivirus [updated - Running]
AV : Microsoft Security Essentials [updated - Running]
AS : Microsoft Security Essentials [updated - Running]
AS : Windows Defender [updated - Not Running]
AS : Avast Antivirus [updated - Running]
FW : Windows firewall
.
==================== Files and Folders history =================================

 

Folders Created Last 30 days :

 

27-05-2017 ##### r-h-s-d+a- C:\Users\Admin\AppData\Roaming\E Dev
27-05-2017 ##### r-h-s-d+a- C:\Program Files (x86)\E Dev
26-05-2017 ##### r-h-s-d+a- C:\ProgramData\SWCUTemp
22-05-2017 ##### r-h-s-d+a- C:\Users\Admin\AppData\Roaming\QuickScan
22-05-2017 ##### r-h-s-d+a- C:\Program Files (x86)\Mozilla Firefox
17-05-2017 ##### r-h-s-d+a- C:\Users\Admin\AppData\Local\CrawlerNG
03-05-2017 ##### r-h-s-d+a- C:\Program Files (x86)\GUM4D45.tmp

 

Files Modified Last 30 days :

 

27-05-2017 01669190 r-h-s-d-a+ C:\Windows\system32\PerfStringBackup.INI
27-05-2017 00740098 r-h-s-d-a+ C:\Windows\system32\perfh015.dat
27-05-2017 00653930 r-h-s-d-a+ C:\Windows\system32\perfh009.dat
27-05-2017 00155672 r-h-s-d-a+ C:\Windows\system32\perfc015.dat
27-05-2017 00121802 r-h-s-d-a+ C:\Windows\system32\perfc009.dat
27-05-2017 00065536 r-h-s-d-a- C:\Windows\system32\Ikeext.etl
27-05-2017 00028352 r-h+s-d-a+ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
27-05-2017 00028352 r-h+s-d-a+ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
17-05-2017 00097856 r-h-s-d-a+ C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
11-05-2017 00803320 r-h-s-d-a+ C:\Windows\SysWOW64\FlashPlayerApp.exe
11-05-2017 00144888 r-h-s-d-a+ C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
09-05-2017 00400456 r-h-s-d-a+ C:\Windows\system32\aswBoot.exe
03-05-2017 07649280 r-h-s-d-a+ C:\Program Files (x86)\GUT4D46.tmp

 

Files Created Last 30 days :

 

27-05-2017 00000111 r-h-s-d-a+ C:\ProgramData\Microsoft.SqlServer.Compact.351.64.bc
26-05-2017 00000000 r-h-s-d-a+ C:\Users\Admin\AppData\Local\{75C5035E-1495-418E-8AB7-5222F9DAC2CE}
25-05-2017 00000000 r-h-s-d-a+ C:\Users\Admin\AppData\Local\{002E7047-D1A5-4758-B3FD-046DCE2E01CE}
24-05-2017 00000000 r-h-s-d-a+ C:\Users\Admin\AppData\Local\{26DA5EAD-1334-430C-AEB9-E5BD5CCB6FB5}
23-05-2017 00000000 r-h-s-d-a+ C:\Users\Admin\AppData\Local\{624CF5F2-19BA-4BD6-833B-1A7008037B61}
22-05-2017 00047655 r-h-s-d-a+ C:\ProgramData\1495466621.5788.bin
22-05-2017 00004689 r-h-s-d-a+ C:\ProgramData\1495466621.6364.bin
22-05-2017 00002892 r-h-s-d-a+ C:\ProgramData\1495466621.3192.bin
22-05-2017 00001777 r-h-s-d-a+ C:\ProgramData\1495466621.6404.bin
22-05-2017 00000610 r-h-s-d-a+ C:\ProgramData\1495466621.6412.bin
22-05-2017 00000000 r-h-s-d-a+ C:\Users\Admin\AppData\Local\{C81885BE-EFEE-41F0-9868-DF540FF6C622}
09-05-2017 00400456 r-h-s-d-a+ C:\Windows\system32\aswBoot.exe
03-05-2017 07649280 r-h-s-d-a+ C:\Program Files (x86)\GUT4D46.tmp

 

==================== RUNNING PROCESSES =========================================

 

[AdobeARM] -Admin- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe - (Adobe Systems Incorporated)
[armsvc] -SYSTEM- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe - (Adobe Systems Incorporated)
[aswidsagenta] -SYSTEM- C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe - (AVAST Software s.r.o.)
[audiodg] -USŁUGA LOKALNA- C:\Windows\System32\audiodg.exe - (audiodg.exe)
[AvastSvc] -SYSTEM- C:\Program Files\AVAST Software\Avast\AvastSvc.exe - (AVAST Software)
[AvastUI] -Admin- C:\Program Files\AVAST Software\Avast\AvastUI.exe - (AVAST Software)
[conhost] -Admin- C:\Windows\system32\conhost.exe - (Microsoft Corporation)
[csrss] -SYSTEM- C:\Windows\system32\csrss.exe - (Microsoft Corporation)
[csrss] -SYSTEM- C:\Windows\system32\csrss.exe - (Microsoft Corporation)
[dllhost] -Admin- C:\Windows\system32\DllHost.exe - (Microsoft Corporation)
[dwm] -Admin- C:\Windows\system32\Dwm.exe - (Microsoft Corporation)
[E-Peek 1.9.9.0] -Admin- C:\Program Files (x86)\E Dev\E-Peek\E-Peek 1.9.9.0.exe - (E Dev)
[E-Peek 1.9.9.0] -Admin- C:\Program Files (x86)\E Dev\E-Peek\E-Peek 1.9.9.0.exe - (E Dev)
[explorer] -Admin- C:\Windows\Explorer.EXE - (Microsoft Corporation)
[FAHWindow64] -Admin- C:\Program Files\WinZip\FAHWindow64.exe - (Nico Mak Computing)
[firefox] -Admin- C:\Program Files (x86)\Mozilla Firefox\firefox.exe - (Mozilla Corporation)
[firefox] -Admin- C:\Program Files (x86)\Mozilla Firefox\firefox.exe - (Mozilla Corporation)
[firefox] -Admin- C:\Program Files (x86)\Mozilla Firefox\firefox.exe - (Mozilla Corporation)
[FreemakeUtilsService] -SYSTEM- C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe - (Freemake)
[GoogleUpdate] -SYSTEM- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - (Google Inc.)
[GoogleUpdate] -SYSTEM- C:\Program Files (x86)\Google\Update\GoogleUpdate.exe - (Google Inc.)
[HD-UpdaterService] -SYSTEM- C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe - (BlueStack Systems, Inc.)
[jucheck] -Admin- C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe - (Oracle Corporation)
[jusched] -Admin- C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe - (Oracle Corporation)
[KHALMNPR] -Admin- C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE - (Logitech, Inc.)
[LMIGuardianSvc] -SYSTEM- C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe - (LogMeIn, Inc.)
[lsass] -SYSTEM- C:\Windows\system32\lsass.exe - (Microsoft Corporation)
[lsm] -SYSTEM- C:\Windows\system32\lsm.exe - (Microsoft Corporation)
[mdm] -SYSTEM- C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe - (Microsoft Corporation)
[MEGAsync] -Admin- C:\Users\Admin\AppData\Local\MEGAsync\MEGAsync.exe - ()
[msiexec] -SYSTEM- C:\Windows\system32\msiexec.exe - (Microsoft Corporation)
[MsMpEng] -SYSTEM- C:\Program Files\Microsoft Security Client\MsMpEng.exe - (Microsoft Corporation)
[msseces] -Admin- C:\Program Files\Microsoft Security Client\msseces.exe - (Microsoft Corporation)
[NclRSSrv] -SYSTEM- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclRSSrv.exe - ()
[NclUSBSrv64] -SYSTEM- C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe - ()
[NisSrv] -USŁUGA LOKALNA- C:\Program Files\Microsoft Security Client\NisSrv.exe - (Microsoft Corporation)
[NMBgMonitor] -Admin- C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe - (Nero AG)
[NMIndexingService] -SYSTEM- C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe - (Nero AG)
[NMIndexStoreSvr] -Admin- C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe - (Nero AG)
[nusb3mon] -Admin- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe - (Renesas Electronics Corporation)
[nvcontainer] -Admin- C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe - ()
[nvcontainer] -SYSTEM- C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe - ()
[NVIDIA Web Helper] -Admin- C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe - (Node.js)
[nvscpapisvr] -SYSTEM- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe - (NVIDIA Corporation)
[NvTelemetryContainer] -USŁUGA SIECIOWA- C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe - ()
[nvtray] -Admin- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe - (NVIDIA Corporation)
[nvvsvc] -SYSTEM- C:\Windows\system32\nvvsvc.exe - (NVIDIA Corporation)
[nvwirelesscontroller] -SYSTEM- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe - (NVIDIA Corporation)
[nvxdsync] -SYSTEM- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe - (NVIDIA Corporation)
[PCSuite] -Admin- C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PCSuite.exe - ()
[RtkNGUI64] -Admin- C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe - (Realtek Semiconductor)
[screenSHU] -Admin- C:\Program Files (x86)\screenSHU\screenSHU.exe - ()
[searchIndexer] -SYSTEM- C:\Windows\system32\SearchIndexer.exe - (Microsoft Corporation)
[serviceLayer] -SYSTEM- C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe - (Nokia.)
[services] -SYSTEM- C:\Windows\system32\services.exe - (Microsoft Corporation)
[setPoint] -Admin- C:\Program Files\Logitech\SetPointP\SetPoint.exe - (Logitech, Inc.)
[skype] -Admin- C:\Program Files (x86)\Skype\Phone\Skype.exe - (Skype Technologies S.A.)
[smss] -SYSTEM- C:\Windows\system32\smss.exe - (Microsoft Corporation)
[spoolsv] -SYSTEM- C:\Windows\System32\spoolsv.exe - (Microsoft Corporation)
[system] -N/A- - (System)
[taskeng] -Admin- C:\Windows\system32\taskeng.exe - (Microsoft Corporation)
[taskeng] -SYSTEM- C:\Windows\system32\taskeng.exe - (Microsoft Corporation)
[taskhost] -Admin- C:\Windows\system32\taskhost.exe - (Microsoft Corporation)
[taskhost] -Admin- C:\Windows\system32\taskhost.exe - (Microsoft Corporation)
[TrustedInstaller] -SYSTEM- C:\Windows\servicing\TrustedInstaller.exe - (Microsoft Corporation)
[wininit] -SYSTEM- C:\Windows\system32\wininit.exe - (Microsoft Corporation)
[winlogon] -SYSTEM- C:\Windows\system32\winlogon.exe - (Microsoft Corporation)
[WmiPrvSE] -USŁUGA SIECIOWA- C:\Windows\system32\wbem\wmiprvse.exe - (Microsoft Corporation)
[WzPreloader] -Admin- C:\Program Files\WinZip\WzPreloader.exe - (WinZip Computing, S.L.)
[WZUpdateNotifier] -Admin- C:\Program Files\WinZip\WZUpdateNotifier.exe - (Nico Mak Computing)

 

==================== IE PAGES ==================================================

 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main
Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
Local Page = C:\Windows\SysWOW64\blank.htm
Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes
DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
DisplayName = @ieframe.dll,-12512
URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

==================== IE PAGES x64 ==============================================

 

HKLM\Software\Microsoft\Internet Explorer\Main
Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
Local Page = C:\Windows\System32\blank.htm
Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141
Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896

 

HKLM\Software\Microsoft\Internet Explorer\SearchScopes
DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

 

HKLM\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}
DisplayName = @ieframe.dll,-12512
URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

==================== Auto Load =================================================

 

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = userinit.exe,
Shell = explorer.exe

 

==================== Auto Load x64 =============================================

 

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Userinit = C:\Windows\system32\userinit.exe,
Shell = explorer.exe

 

==================== Browsers present ==========================================

 

FIREFOX.EXE
Google Chrome
IEXPLORE.EXE
SafeZoneStable

 

==================== Firefox ===================================================

 

FF - ProfilePath - C:\Users\Admin\AppData\Roaming\Mozilla\firefox\Profiles\i21q21dg.default-1483006768462

 

FF - Ext: [Avast Online Security 12.0.211 ] - webextension - wrc@avast.com [ visible: True # active: False]
FF - Ext: [Avast SafePrice 12.0.211 ] - webextension - sp@avast.com [ visible: True # active: False]
FF - Ext: [Application Update Service Helper 2.0 ] - extension - aushelper@mozilla.org [ visible: True # active: True]
FF - Ext: [Multi-process staged rollout 1.14 ] - extension - e10srollout@mozilla.org [ visible: True # active: True]
FF - Ext: [Pocket 1.0.5 ] - extension - firefox@getpocket.com [ visible: True # active: True]
FF - Ext: [Web Compat 1.0 ] - extension - webcompat@mozilla.org [ visible: True # active: True]
FF - Ext: [Default 53.0.3 ] - theme - {972ce4c6-7e08-4474-a285-3208198ce6fd} [ visible: True # active: True]

 

FF - PlugIn: [Adobe® Flash® Player 25.0.0.171 Plugin] - C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll

 

==================== Google Chrome =============================================

 

GC - Local State Path: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

 

GC - Profile: [Default] Name: Osoba 1 - Shortcut name: - Username:

 

==================== Google Chrome Profile: Default ============================

 

GC - Prefpath: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

 

GC - Homepage: n/a

 

GC - Ext: [ Chrome Web Store ] version: 0.2
Description: Odkryj znakomite aplikacje, gry, rozszerzenia i motywy do przeglądarki Google Chrome.
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\web_store

 

GC - Ext: [ Bookmark Manager ] version: 0.1
Description: Bookmark Manager
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\bookmark_manager

 

GC - Ext: [ Settings ] version: 0.2
Description: Settings
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\settings_app

 

GC - Ext: [ Avast SafePrice ] version: 12.0.199
Description: Avast SafePrice - safe shopping extension.
Path: eofcbnmajmjmplflapaojjnihcjkigck\12.0.199_0

 

GC - Ext: [ Feedback ] version: 1.0
Description: User feedback extension
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\feedback

 

GC - Ext: [ Avast Online Security ] version: 12.0.209
Description: Avast Browser Security and Web Reputation Plugin.
Path: gomekmidlodglbbmalcneegieacbdmki\12.0.209_0

 

GC - Ext: [ CryptoTokenExtension ] version: 0.9.46
Description: CryptoToken Component Extension
Path: C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\resources\cryptotoken

 

GC - Ext: [ Skype ] version: 9.0.0.7200
Description: Quickly access Skype for Web and Share on Skype through your browser
Path: lifbcibllhkdhoafpjfnlhfpfgnpldfl\9.0.0.7200_0

 

GC - Ext: [ Cloud Print ] version: 0.1
Description: Cloud Print
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\cloud_print

 

GC - Ext: [ GaiaAuthExtension ] version: 0.0.1
Description: GAIA Component Extension
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\gaia_auth

 

GC - Ext: [ Chrome ] version: 0.1
Description: Szybka, prosta i bezpieczna przeglądarka na miarę współczesnego internetu.
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\chrome_app

 

GC - Ext: [ Chrome PDF Viewer ] version: 1
Description:
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\pdf

 

GC - Ext: [ Google Network Speech ] version: 1.0
Description: Component extension providing speech via the Google network text-to-speech service.
Path: C:\Program Files (x86)\Google\Chrome\Application\44.0.2403.155\resources\network_speech_synthesis

 

GC - Ext: [ Google Hangouts ] version: 1.3.2
Description:
Path: C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\resources\hangout_services

 

==================== Windows Host File =========================================

 

==================== BHO =======================================================

 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} Default = Java Plug-In SSV Helper
=> HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\InProcServer32 Default = C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll

 

{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
HKCR\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Default = avast! Online Security
=> HKCR\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}\InProcServer32 Default = C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll

 

{AF949550-9094-4807-95EC-D1C317803333}
HKCR\CLSID\{AF949550-9094-4807-95EC-D1C317803333} Default = Logitech SetPoint
=> HKCR\CLSID\{AF949550-9094-4807-95EC-D1C317803333}\InProcServer32 Default = C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll

 

{DBC80044-A445-435b-BC74-9C25C1C588A9}
HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} Default = Java Plug-In 2 SSV Helper
=> HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\InProcServer32 Default = C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll

 

==================== BHO x64 ===================================================

 

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects
{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}
HKCR\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06} Default = avast! Online Security
=> HKCR\CLSID\{8E5E2654-AD2D-48bf-AC2D-D17F00898D06}\InProcServer32 Default = C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll

 

{AF949550-9094-4807-95EC-D1C317803333}
HKCR\CLSID\{AF949550-9094-4807-95EC-D1C317803333} Default = Logitech SetPoint
=> HKCR\CLSID\{AF949550-9094-4807-95EC-D1C317803333}\InProcServer32 Default = C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll

 

==================== Auto Start Programs =======================================

 

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
BlueStacks Agent = C:\Program Files (x86)\BlueStacks\HD-Agent.exe
LogMeIn Hamachi Ui = "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
NUSB3MON = "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
SunJavaUpdateSched = "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

 

HKCU\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
EADM = "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
Innkeeper = C:\Users\Admin\AppData\Local\Innkeeper\Update.exe --processStart Innkeeper.exe --process-start-args="-startup"
MK LOL = "C:\Program Files (x86)\MKJogo\MK IM\Bin\MKIM.exe" -auto
S60 PC Suite Tray = "C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PCSuite.exe" -onlytray
screenSHU = "C:\Program Files (x86)\screenSHU\screenSHU.exe" --hidden
Skype = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

 

==================== Auto Start Programs x64 ===================================

 

HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
AvastUI.exe = "C:\Program Files\AVAST Software\Avast\AvLaunch.exe" /gui
EvtMgr6 = C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
MSC = "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
RTHDVCPL = C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
ShadowPlay = "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart

 

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} = "C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"
EADM = "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart
Innkeeper = C:\Users\Admin\AppData\Local\Innkeeper\Update.exe --processStart Innkeeper.exe --process-start-args="-startup"
MK LOL = "C:\Program Files (x86)\MKJogo\MK IM\Bin\MKIM.exe" -auto
S60 PC Suite Tray = "C:\Program Files (x86)\Samsung\Samsung PC Studio 7\PCSuite.exe" -onlytray
screenSHU = "C:\Program Files (x86)\screenSHU\screenSHU.exe" --hidden
Skype = "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

 

Startup - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk
Startup - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PlutoTV.lnk
CommonStartup - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FAH.lnk
CommonStartup - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Update Notifier.lnk
CommonStartup - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Preloader.lnk
==================== Extra Items IE ============================================

 

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCELERATED_GRAPHICS @ Text = Accelerated graphics
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY @ Text = Accessibility
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\BROWSE @ Text = Browsing
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO @ Text = Security
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\HTTP @ Text = HTTP settings
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL @ Text = International
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA @ Text = Multimedia

 

==================== Extra Items IE x64 ========================================

 

HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\ACCELERATED_GRAPHICS @ Text = Accelerated graphics
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY @ Text = Accessibility
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE @ Text = Browsing
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO @ Text = Security
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\HTTP @ Text = HTTP settings
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL @ Text = International
HKLM\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA @ Text = Multimedia

 

==================== Internet Default Prefix ===================================

 

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
Default = http://

 

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\URL\Prefixes
WWW = http://

 

==================== Internet Default Prefix x64 ===============================

 

HKLM\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix
Default = http://

 

HKLM\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes
WWW = http://

 

==================== ShellServiceObjectDelayLoad ===============================

 

HKLM\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
WebCheck = {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
=> HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} [CLSID not present]

 

==================== ShellServiceObjectDelayLoad x64 =========================

 

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
WebCheck = {E6FB5E20-DE35-11CF-9C87-00AA005127ED}
=> HKCR\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} [CLSID not present]

 

==================== Extra (Torpig/ConduitSearch) ==============================

 

HKCR\Directory\shellex\CopyHookHandlers\FileSystem @ Default = {217FC9C0-3AEA-1069-A2DB-08002B30309D}
=> HKCR\CLSID\{217FC9C0-3AEA-1069-A2DB-08002B30309D}\InProcServer32 @ Default = C:\Windows\system32\shell32.dll

 

HKCR\Directory\shellex\CopyHookHandlers\Samsung @ Default = {B062CBE9-07D9-4EA1-A103-3041708C2392}
=> HKCR\CLSID\{B062CBE9-07D9-4EA1-A103-3041708C2392}\InProcServer32 @ Default = C:\Program Files (x86)\Samsung\Samsung PC Studio 7\phonebrowser64.dll

 

HKCR\Directory\shellex\CopyHookHandlers\Sharing @ Default = {40dd6e20-7c17-11ce-a804-00aa003ca9f6}
=> HKCR\CLSID\{40dd6e20-7c17-11ce-a804-00aa003ca9f6}\InProcServer32 @ Default = C:\Windows\system32\ntshrui.dll

 

==================== DRIVERS and SERVICES ======================================

 

*** Win32OwnProcess ***

 

SERV - R2 - [AdobeARMservice] - Adobe Acrobat Update Service - c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
SERV - R2 - [bstHdUpdaterSvc] - BlueStacks Updater Service - c:\program files (x86)\bluestacks\hd-updaterservice.exe
SERV - R2 - [Freemake Improver] - Freemake Improver - c:\programdata\freemake\freemakeutilsservice\freemakeutilsservice.exe
SERV - R2 - [LMIGuardianSvc] - LMIGuardianSvc - c:\program files (x86)\logmein hamachi\x64\lmiguardiansvc.exe
SERV - R2 - [MsMpSvc] - Microsoft Antimalware Service - c:\program files\microsoft security client\msmpeng.exe
SERV - R2 - [NvContainerLocalSystem] - NVIDIA LocalSystem Container - c:\program files\nvidia corporation\nvcontainer\nvcontainer.exe
SERV - R2 - [NVIDIA Wireless Controller Service] - NVIDIA Wireless Controller Service - c:\program files\nvidia corporation\geforce experience service\nvwirelesscontroller.exe
SERV - R2 - [nvsvc] - NVIDIA Display Driver Service - c:\windows\system32\nvvsvc.exe
SERV - R2 - [NvTelemetryContainer] - NVIDIA Telemetry Container - c:\program files (x86)\nvidia corporation\nvtelemetry\nvtelemetrycontainer.exe
SERV - R2 - [stereo Service] - NVIDIA Stereoscopic 3D Driver Service - c:\program files (x86)\nvidia corporation\3d vision\nvscpapisvr.exe
SERV - R2 - [TrustedInstaller] - Instalator modułów systemu Windows - c:\windows\servicing\trustedinstaller.exe
SERV - R2 - [WSearch] - Windows Search - c:\windows\system32\searchindexer.exe
SERV - R3 - [aswbIDSAgent] - aswbIDSAgent - c:\program files\avast software\avast\x64\aswidsagenta.exe
SERV - R3 - [msiserver] - Instalator Windows - c:\windows\system32\msiexec.exe
SERV - R3 - [NMIndexingService] - NMIndexingService - c:\program files (x86)\common files\ahead\lib\nmindexingservice.exe
SERV - S2 - [clr_optimization_v4.0.30319_32] - Microsoft .NET Framework NGEN v4.0.30319_X86 - c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe
SERV - S2 - [clr_optimization_v4.0.30319_64] - Microsoft .NET Framework NGEN v4.0.30319_X64 - c:\windows\microsoft.net\framework64\v4.0.30319\mscorsvw.exe
SERV - S2 - [gupdate] - Usługa Google Update (gupdate) - c:\program files (x86)\google\update\googleupdate.exe
SERV - S2 - [HiPatchService] - Hi-Rez Studios Authenticate and Update Service - c:\program files (x86)\hi-rez studios\hipatchservice.exe
SERV - S2 - [Origin Web Helper Service] - Origin Web Helper Service - c:\program files (x86)\origin\originwebhelperservice.exe
SERV - S2 - [skypeUpdate] - Skype Updater - c:\program files (x86)\skype\updater\updater.exe
SERV - S2 - [sppsvc] - Ochrona oprogramowania - c:\windows\system32\sppsvc.exe
SERV - S2 - [WMPNetworkSvc] - Usługa udostępniania w sieci programu Windows Media Player - c:\program files\windows media player\wmpnetwk.exe
SERV - S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - c:\windows\syswow64\macromed\flash\flashplayerupdateservice.exe
SERV - S3 - [ALG] - Usługa bramy warstwy aplikacji - c:\windows\system32\alg.exe
SERV - S3 - [bstHdAndroidSvc] - BlueStacks Android Service - c:\program files (x86)\bluestacks\hd-service.exe
SERV - S3 - [bstHdLogRotatorSvc] - BlueStacks Log Rotator Service - c:\program files (x86)\bluestacks\hd-logrotatorservice.exe
SERV - S3 - [COMSysApp] - Aplikacja systemowa modelu COM+ - c:\windows\system32\dllhost.exe
SERV - S3 - [ehRecvr] - Usługa Odbiornik Windows Media Center - c:\windows\ehome\ehrecvr.exe
SERV - S3 - [ehSched] - Usługa harmonogramu programu Windows Media Center - c:\windows\ehome\ehsched.exe
SERV - S3 - [Fax] - Faks - c:\windows\system32\fxssvc.exe
SERV - S3 - [FontCache3.0.0.0] - Usługa buforowania czcionek platformy Windows Presentation Foundation, wersja 3.0.0.0 - c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe
SERV - S3 - [gupdatem] - Usługa Google Update (gupdatem) - c:\program files (x86)\google\update\googleupdate.exe
SERV - S3 - [gusvc] - Google Updater Service - c:\program files (x86)\google\common\google updater\googleupdaterservice.exe
SERV - S3 - [iEEtwCollectorService] - Internet Explorer ETW Collector Service - c:\windows\system32\ieetwcollector.exe
SERV - S3 - [LBTServ] - Logitech Bluetooth Service - c:\program files\common files\logishrd\bluetooth\lbtserv.exe
SERV - S3 - [McComponentHostService] - McAfee Security Scan Component Host Service - c:\program files\mcafee security scan\3.11.474\mcchsvc.exe [x]
SERV - S3 - [MozillaMaintenance] - Mozilla Maintenance Service - c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe
SERV - S3 - [MSDTC] - Koordynator transakcji rozproszonych - c:\windows\system32\msdtc.exe
SERV - S3 - [NvContainerNetworkService] - NVIDIA NetworkService Container - c:\program files\nvidia corporation\nvcontainer\nvcontainer.exe
SERV - S3 - [odserv] - Microsoft Office Diagnostics Service - c:\program files (x86)\common files\microsoft shared\office12\odserv.exe
SERV - S3 - [Origin Client Service] - Origin Client Service - c:\program files (x86)\origin\originclientservice.exe [x]
SERV - S3 - [ose] - Office Source Engine - c:\program files (x86)\common files\microsoft shared\source engine\ose.exe
SERV - S3 - [PerfHost] - Host bibliotek DLL liczników wydajności - c:\windows\syswow64\perfhost.exe
SERV - S3 - [RpcLocator] - Lokalizator usługi zdalnego wywołania procedury (RPC) - c:\windows\system32\locator.exe
SERV - S3 - [sNMPTRAP] - SNMP Trap - c:\windows\system32\snmptrap.exe
SERV - S3 - [steam Client Service] - Steam Client Service - c:\program files (x86)\common files\steam\steamservice.exe
SERV - S3 - [vds] - Dysk wirtualny - c:\windows\system32\vds.exe
SERV - S3 - [VSS] - Kopiowanie woluminów w tle - c:\windows\system32\vssvc.exe
SERV - S3 - [WatAdminSvc] - Usługa Technologie aktywacji systemu Windows - c:\windows\system32\wat\watadminsvc.exe
SERV - S3 - [wbengine] - Usługa Aparat kopii zapasowej na poziomie bloku - c:\windows\system32\wbengine.exe
SERV - S3 - [wmiApSrv] - WMI Performance Adapter - c:\windows\system32\wbem\wmiapsrv.exe
SERV - S4 - [aspnet_state] - ASP.NET State Service - c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_state.exe
SERV - S4 - [clr_optimization_v2.0.50727_32] - Microsoft .NET Framework NGEN v2.0.50727_X86 - c:\windows\microsoft.net\framework\v2.0.50727\mscorsvw.exe
SERV - S4 - [clr_optimization_v2.0.50727_64] - Microsoft .NET Framework NGEN v2.0.50727_X64 - c:\windows\microsoft.net\framework64\v2.0.50727\mscorsvw.exe
SERV - x3 - [NisSrv] - Inspekcja sieci firmy Microsoft - c:\program files\microsoft security client\nissrv.exe

 

*** Win32ShareProcess ***

 

SERV - R2 - [avast! Antivirus] - Avast Antivirus - c:\program files\avast software\avast\avastsvc.exe
SERV - R2 - [samSs] - Menedżer kont zabezpieczeń - c:\windows\system32\lsass.exe
SERV - R3 - [KeyIso] - Izolacja klucza CNG - c:\windows\system32\lsass.exe
SERV - S3 - [EFS] - System szyfrowania plików (EFS) - c:\windows\system32\lsass.exe
SERV - S3 - [idsvc] - Windows CardSpace - c:\windows\microsoft.net\framework64\v3.0\windows communication foundation\infocard.exe
SERV - S3 - [Netlogon] - Netlogon - c:\windows\system32\lsass.exe
SERV - S3 - [ProtectedStorage] - Magazyn chroniony - c:\windows\system32\lsass.exe
SERV - S3 - [VaultSvc] - Menedżer poświadczeń - c:\windows\system32\lsass.exe
SERV - S4 - [NetMsmqActivator] - Net.Msmq Listener Adapter - c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
SERV - S4 - [NetPipeActivator] - Net.Pipe Listener Adapter - c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
SERV - S4 - [NetTcpActivator] - Net.Tcp Listener Adapter - c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe
SERV - S4 - [NetTcpPortSharing] - Net.Tcp Port Sharing Service - c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe

 

*** Others ***

 

SERV - R2 - [MDM] - Machine Debug Manager - c:\program files (x86)\common files\microsoft shared\vs7debug\mdm.exe
SERV - R2 - [spooler] - Bufor wydruku - c:\windows\system32\spoolsv.exe
SERV - R3 - [serviceLayer] - ServiceLayer - c:\program files (x86)\pc connectivity solution\servicelayer.exe
SERV - S2 - [Hamachi2Svc] - LogMeIn Hamachi Tunneling Engine - c:\program files (x86)\logmein hamachi\x64\hamachi-2.exe [x]
SERV - S3 - [NBService] - NBService - c:\program files (x86)\nero\nero 7\nero backitup\nbservice.exe
SERV - S3 - [npggsvc] - nProtect GameGuard Service - c:\windows\system32\gamemon.des -service
SERV - S3 - [uI0Detect] - Wykrywanie usług interakcyjnych - c:\windows\system32\ui0detect.exe

 

*** File System Driver ***

 

DRV - R0 - [aswbidsh] - aswbidsh - C:\Windows\system32\Drivers\aswbidsh.sys [x]
DRV - R0 - [aswblog] - aswblog - C:\Windows\system32\Drivers\aswblog.sys [x]
DRV - R0 - [aswbuniv] - aswbuniv - C:\Windows\system32\Drivers\aswbuniv.sys [x]
DRV - R0 - [FileInfo] - File Information FS MiniFilter - C:\Windows\system32\Drivers\FileInfo.sys
DRV - R0 - [FltMgr] - FltMgr - C:\Windows\system32\Drivers\FltMgr.sys
DRV - R0 - [MpFilter] - Microsoft Malware Protection Driver - C:\Windows\system32\Drivers\MpFilter.sys
DRV - R0 - [Mup] - Mup - C:\Windows\system32\Drivers\Mup.sys
DRV - R1 - [NetBIOS] - NetBIOS Interface - C:\Windows\system32\Drivers\NetBIOS.sys
DRV - R3 - [srv] - Sterownik serwera SMB 1.xxx - C:\Windows\system32\Drivers\srv.sys
DRV - R3 - [srv2] - Sterownik serwera SMB 2.xxx - C:\Windows\system32\Drivers\srv2.sys

 

*** Kernel Driver ***

 

DRV - R0 - [ACPI] - Sterownik Microsoft ACPI - C:\Windows\system32\Drivers\ACPI.sys
DRV - R0 - [amdxata] - amdxata - C:\Windows\system32\Drivers\amdxata.sys
DRV - R0 - [aswRvrt] - aswRvrt - C:\Windows\system32\Drivers\aswRvrt.sys
DRV - R0 - [aswVmm] - aswVmm - C:\Windows\system32\Drivers\aswVmm.sys
DRV - R0 - [atapi] - Kanał IDE - C:\Windows\system32\Drivers\atapi.sys
DRV - R0 - [CLFS] - System Common Log (CLFS) - C:\Windows\system32\Drivers\CLFS.sys [x]
DRV - R0 - [CNG] - CNG - C:\Windows\system32\Drivers\CNG.sys
DRV - R0 - [Disk] - Sterownik dysku - C:\Windows\system32\Drivers\Disk.sys
DRV - R0 - [fvevol] - Sterownik filtru szyfrowania dysków funkcją BitLocker - C:\Windows\system32\Drivers\fvevol.sys
DRV - R0 - [hwpolicy] - Hardware Policy Driver - C:\Windows\system32\Drivers\hwpolicy.sys
DRV - R0 - [KSecDD] - KSecDD - C:\Windows\system32\Drivers\KSecDD.sys
DRV - R0 - [KSecPkg] - KSecPkg - C:\Windows\system32\Drivers\KSecPkg.sys
DRV - R0 - [mountmgr] - Menedżer punktów instalacji - C:\Windows\system32\Drivers\mountmgr.sys
DRV - R0 - [msisadrv] - msisadrv - C:\Windows\system32\Drivers\msisadrv.sys
DRV - R0 - [NDIS] - Sterownik systemowy NDIS - C:\Windows\system32\Drivers\NDIS.sys
DRV - R0 - [partmgr] - Menedżer partycji - C:\Windows\system32\Drivers\partmgr.sys
DRV - R0 - [pci] - Sterownik magistrali PCI - C:\Windows\system32\Drivers\pci.sys
DRV - R0 - [pciide] - pciide - C:\Windows\system32\Drivers\pciide.sys
DRV - R0 - [pcw] - Performance Counters for Windows Driver - C:\Windows\system32\Drivers\pcw.sys
DRV - R0 - [rdyboost] - ReadyBoost - C:\Windows\system32\Drivers\rdyboost.sys
DRV - R0 - [spldr] - Security Processor Loader Driver - C:\Windows\system32\Drivers\spldr.sys
DRV - R0 - [Tcpip] - Sterownik protokołu TCP/IP - C:\Windows\system32\Drivers\Tcpip.sys
DRV - R0 - [vdrvroot] - Sterownik modułu wyliczającego dysku wirtualnego Microsoft - C:\Windows\system32\Drivers\vdrvroot.sys
DRV - R0 - [volmgr] - Sterownik Menedżera woluminów - C:\Windows\system32\Drivers\volmgr.sys
DRV - R0 - [volmgrx] - Menedżer woluminów dynamicznych - C:\Windows\system32\Drivers\volmgrx.sys
DRV - R0 - [volsnap] - Woluminy magazynu - C:\Windows\system32\Drivers\volsnap.sys
DRV - R0 - [Wdf01000] - Usługa struktur sterowników trybu jądra - C:\Windows\system32\Drivers\Wdf01000.sys
DRV - R1 - [AFD] - Ancillary Function Driver for Winsock - C:\Windows\system32\Drivers\AFD.sys
DRV - R1 - [beep] - Beep - C:\Windows\system32\Drivers\Beep.sys
DRV - R1 - [tdx] - Sterownik obsługi starszych urządzeń TDI NetIO - C:\Windows\system32\Drivers\tdx.sys
DRV - R2 - [tcpipreg] - TCP/IP Registry Compatibility - C:\Windows\system32\Drivers\tcpipreg.sys

 

==================== SvcHost - White Listed ====================================

 

WOW x64 - All Ok

 

==================== SvcHost x64 - White Listed ================================

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost@LocalServiceAndNoImpersonation
Mcx2Svc = ServiceDll = C:\Windows\system32\Mcx2Svc.dll [0be09cd858abf9df6ed259d57a1a1663]

 

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost@utcsvc
DiagTrack = ServiceDll = C:\Windows\system32\diagtrack.dll [ee9954237f15be4dd9304d12e4d305ed]

 

 

 

==================== SigCheck x86 Fast =========================================

 

Fast Scan All ok

 

==================== SigCheck x64 Fast =========================================

 

Fast Scan All ok

 

==================== Software Installed ========================================

 

Adobe AIR | Vers: 24.0.0.180 | Pub: Adobe Systems Incorporated
Adobe Flash Player 25 ActiveX | Vers: 25.0.0.171 | Pub: Adobe Systems Incorporated
Adobe Flash Player 25 NPAPI | Vers: 25.0.0.171 | Pub: Adobe Systems Incorporated
Adobe Reader XI (11.0.18) - Polish | Vers: 11.0.18 | Pub: Adobe Systems Incorporated
Aktualizacja produktu Microsoft Office Excel 2007 Help (KB963678) | Pub: Microsoft
Aktualizacja produktu Microsoft Office Powerpoint 2007 Help (KB963669) | Pub: Microsoft
Aktualizacja produktu Microsoft Office Word 2007 Help (KB963665) | Pub: Microsoft
Aplikacja Blizzard | Pub: Blizzard Entertainment
Archiwizator WinRAR
Asmedia ASM104x USB 3.0 Host Controller Driver | Vers: 1.16.2.0 | Pub: Asmedia Technology
Avast Free Antivirus | Vers: 17.4.2294 | Pub: AVAST Software
BlueStacks App Player | Vers: 0.10.7.5601 | Pub: BlueStack Systems, Inc.
Counter-Strike: Global Offensive | Pub: Valve
E-Peek | Vers: 1.0.9 | Pub: E Dev
Epic Games Launcher | Vers: 1.1.78.0 | Pub: Epic Games, Inc.
eReg | Vers: 1.20.138.34 | Pub: Logitech, Inc.
Fraps
Freemake Video Converter wersja 4.1.5 | Vers: 4.1.5 | Pub: Ellora Assets Corporation
Google Chrome | Vers: 58.0.3029.110 | Pub: Google Inc.
Google Update Helper | Vers: 1.3.21.169 | Pub: Google Inc.
Google Update Helper | Vers: 1.3.32.7 | Pub: Google Inc.
GS Auto Clicker | Vers: V3.1.3 | Pub: goldensoft.org
Hearthstone | Pub: Blizzard Entertainment
Hi-Rez Studios Authenticate and Update Service | Vers: 3.0.0.0 | Pub: Hi-Rez Studios
Java 8 Update 111 | Vers: 8.0.1110.14 | Pub: Oracle Corporation
Java Auto Updater | Vers: 2.8.111.14 | Pub: Oracle Corporation
Kao - 2nd round (demo) | Vers: 1.0
K-Lite Codec Pack 8.8.0 (Full) | Vers: 8.8.0
KMPlayer (remove only) | Vers: 3.9.0.128 | Pub: PandoraTV
Launcher Prerequisites (x64) | Vers: 1.0.0.0 | Pub: Epic Games, Inc.
League of Legends | Vers: 3.0.1 | Pub: Riot Games
LogMeIn Hamachi | Vers: 2.2.0.558 | Pub: LogMeIn, Inc.
Malwarebytes Anti-Malware wersja 2.1.6.1022 | Vers: 2.1.6.1022 | Pub: Malwarebytes Corporation
MEGAsync | Vers: | Pub: Mega Limited
Microsoft ASP.NET MVC 4 Runtime | Vers: 4.0.40804.0 | Pub: Microsoft
Microsoft Office 2007 Service Pack 3 (SP3) | Pub: Microsoft
Microsoft Office Access MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Enterprise 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Excel MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office File Validation Add-In | Vers: 14.0.5130.5003 | Pub: Microsoft
Microsoft Office Groove MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office InfoPath MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office OneNote MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Outlook MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office PowerPoint MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Proof (English) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Proof (German) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Proof (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Proofing (Polish) 2007 | Vers: 12.0.4518.1020 | Pub: Microsoft
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) | Pub: Microsoft
Microsoft Office Publisher MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Shared MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Office Word MUI (Polish) 2007 | Vers: 12.0.6612.1000 | Pub: Microsoft
Microsoft Visual C++ 2005 Redistributable | Vers: 8.0.56336 | Pub: Microsoft
Microsoft Visual C++ 2005 Redistributable | Vers: 8.0.61001 | Pub: Microsoft
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 | Vers: 9.0.30729.6161 | Pub: Microsoft
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 | Vers: 10.0.40219 | Pub: Microsoft
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 | Vers: 11.0.60610.1 | Pub: Microsoft
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 | Vers: 11.0.61030.0 | Pub: Microsoft
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 | Vers: 11.0.61030 | Pub: Microsoft
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 | Vers: 11.0.61030 | Pub: Microsoft
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 | Vers: 12.0.30501.0 | Pub: Microsoft
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 | Vers: 12.0.30501.0 | Pub: Microsoft
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 | Vers: 12.0.21005 | Pub: Microsoft
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 | Vers: 12.0.21005 | Pub: Microsoft
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 | Vers: 14.0.24215.1 | Pub: Microsoft
Microsoft Visual C++ 2015 x86 Additional Runtime - 14.0.24215 | Vers: 14.0.24215 | Pub: Microsoft
Microsoft Visual C++ 2015 x86 Minimum Runtime - 14.0.24215 | Vers: 14.0.24215 | Pub: Microsoft
Mozilla Maintenance Service | Vers: 53.0.2.6333 | Pub: Mozilla
MSVC80_x86 | Vers: 1.0.1.0 | Pub: Nokia
MSXML 4.0 SP2 (KB954430) | Vers: 4.20.9870.0 | Pub: Microsoft
MSXML 4.0 SP2 (KB973688) | Vers: 4.20.9876.0 | Pub: Microsoft
Nero 7 Ultra Edition | Vers: 7.02.6446 | Pub: Nero AG
neroxml | Vers: 1.0.0 | Pub: Nero AG
NVIDIA Stereoscopic 3D Driver | Vers: 7.17.12.6514 | Pub: NVIDIA Corporation
Origin | Vers: 10.1.1.35466 | Pub: Electronic Arts, Inc.
PAYDAY 2 | Pub: OVERKILL - a Starbreeze Studio.
PC Connectivity Solution | Vers: 8.47.7.0 | Pub: Nokia
Picasa 3 | Vers: 3.9 | Pub: Google, Inc.
PIT-Y 2015 | Vers: 4.1.3 | Pub: GP SOFT
Ravia.eu
Realtek Ethernet Controller Driver | Vers: 7.61.612.2012 | Pub: Realtek
Realtek High Definition Audio Driver | Vers: 6.0.1.6657 | Pub: Realtek Semiconductor Corp.
Renesas Electronics USB 3.0 Host Controller Driver | Vers: 2.1.36.0 | Pub: Renesas Electronics Corporation
SafeZone Stable 3.55.2393.590 | Vers: 3.55.2393.590 | Pub: Avast Software
Samsung PC Studio 7 | Vers: 7.2.24.9 | Pub: Samsung
SamsungConnectivityCableDriver | Vers: 6.83.6.2.1 | Pub: Samsung
screenSHU - the fastest screen capture ever.
Security Update for Microsoft .NET Framework 4.6.1 (KB3122661) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3127233) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3136000) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3136000v2) | Vers: 2 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3142037) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3143693) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft .NET Framework 4.6.1 (KB3164025) | Vers: 1 | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2596650) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2825645) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2881067) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2956110) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2984938) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2984943) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB2986253) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB3085549) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB3114442) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB3127945) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB3128020) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office 2007 suites (KB3141535) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Access 2007 (KB2596614) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3178677) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Compatibility Pack Service Pack 3 (KB3178682) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Excel 2007 (KB3178676) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office InfoPath 2007 (KB3114426) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office OneNote 2007 (KB3114456) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Outlook 2007 (KB3118303) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office PowerPoint 2007 (KB3114744) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Publisher 2007 (KB2880506) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Visio Viewer 2007 (KB2596915) 32-Bit Edition | Pub: Microsoft
Security Update for Microsoft Office Word 2007 (KB3178683) 32-Bit Edition | Pub: Microsoft
SimCity 2000 Special Edition | Vers: 2.0.0.1 | Pub: Electronic Arts
Skype Click to Call | Vers: 8.5.0.9167 | Pub: Microsoft
Skype™ 7.36 | Vers: 7.36.101 | Pub: Skype Technologies S.A.
Smite | Vers: 2.13.2948.1 | Pub: Hi-Rez Studios
Steam | Vers: 2.10.91.91 | Pub: Valve Corporation
Update for 2007 Microsoft Office System (KB967642) | Pub: Microsoft
Update for Microsoft .NET Framework 4.6.1 (KB3210136) | Vers: 1 | Pub: Microsoft
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition | Pub: Microsoft
Update for Microsoft Office 2007 suites (KB2596787) 32-Bit Edition | Pub: Microsoft
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition | Pub: Microsoft
Update for Microsoft Office 2007 suites (KB2965286) 32-Bit Edition | Pub: Microsoft
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition | Pub: Microsoft
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB3115461) 32-Bit Edition | Pub: Microsoft
Warface | Pub: Crytek
WERSJA DEMO FIFA 16 | Vers: 1.0.0.0 | Pub: Electronic Arts
Wiedźmin | Vers: 1.00.0000 | Pub: CD Projekt Red
Zumas Revenge | Vers: 1.0.5.600 | Pub: PopCap Games

 

==================== Job tasks at C:\Windows\Tasks =============================

 

C:\Windows\Tasks\SA.DAT 6 bytes [ 2009-07-14 07:08:49 ]

 

C:\Windows\Tasks\SCHEDLGU.TXT 32604 bytes [ 2009-07-14 07:08:49 ]

 

==================== Job tasks at C:\Windows\system32\Tasks ====================

 

C:\Windows\system32\Tasks\AdminReinoculateCurbingsV2 3448 bytes [ 2016-01-11 16:07:00 ]
=> rundll32.exe

 

C:\Windows\system32\Tasks\Adobe Acrobat Update Task 4476 bytes [ 2016-04-30 12:31:40 ]
=> C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

 

C:\Windows\system32\Tasks\Adobe Flash Player Updater 4412 bytes [ 2014-09-27 18:47:50 ]
=> C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

 

C:\Windows\system32\Tasks\Avast Emergency Update 3914 bytes [ 2017-03-12 21:12:12 ]
=> C:\Program Files\AVAST Software\Avast\AvEmUpdate.exe

 

C:\Windows\system32\Tasks\GoogleUpdateTaskMachineCore 3352 bytes [ 2015-08-17 16:52:29 ]
=> C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

C:\Windows\system32\Tasks\GoogleUpdateTaskMachineUA 3480 bytes [ 2015-08-17 16:52:31 ]
=> C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

 

C:\Windows\system32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 4252 bytes [ 2017-01-06 23:11:19 ]
=> C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe

 

C:\Windows\system32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3848 bytes [ 2017-01-06 23:11:56 ]
=> C:\Program Files (x86)\NVIDIA Corporation\NvNode\nvnodejslauncher.exe

 

C:\Windows\system32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3844 bytes [ 2017-01-06 23:11:06 ]
=> C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe

 

C:\Windows\system32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3600 bytes [ 2017-01-06 23:11:05 ]
=> C:\Program Files\NVIDIA Corporation\Update Core\NvProfileUpdater64.exe

 

C:\Windows\system32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3836 bytes [ 2017-01-06 23:11:06 ]
=> C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmMon.exe

 

C:\Windows\system32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3660 bytes [ 2017-01-06 23:11:07 ]
=> C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe

 

C:\Windows\system32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 3844 bytes [ 2017-01-06 23:11:07 ]
=> C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvTmRep.exe

 

C:\Windows\system32\Tasks\SafeZone scheduled Autoupdate 1458318892 3972 bytes [ 2016-03-18 17:35:08 ]
=> C:\Program Files\AVAST Software\SZBrowser\launcher.exe

 

==================== Job tasks at C:\Windows\SysWOW64\Tasks ====================

 

There are no .job files found.

 

==================== End scanning at So 27 maj 2017 17:20 (0 Min 21 Sec ) ======

 

 

GMER dodaje, ktory nie jest z wszystkimi opcjami zaptaszkowanymi bo avast blokuje, a go się nie da wylaczyc chyba przez brak uprawnien administratora.

GMER.txtPobieranie informacji ...

Edytowane 27 Maja 2017 przez Rucek

[Miszel03]

W raportach brak oznak infekcji (kosmetykę systemową pomijam), więc to nie sprawka infekcji. Poszerzam diagnostykę i przenoszę temat do działu Windows 7.

 

P.S: Te dane co ucina FRST są nieistotne zbyt w tej sytuacji, wiec odpuszczam sobie to.

 

1. Przejdź do skanowania i naprawy systemu Windows.

• Kliknij jednocześnie klawisz  oraz R. Uruchomi się narzędzie Uruchamianie.
• W polu ścieżek wpisz CMD.EXE i kliknij klawisz ENTER.
• Uruchomi się okno konsoli komend. 
• W oknie konsoli komend wklej poniższą komendę. 

sfc /scannow

• Rozpocznie się weryfikacji integralności systemu, czekaj, a gdy proces dobiegnie końca wklej i użyj poniższa komendę. 

findstr /c:"[sR]" %windir%\Logs\CBS\CBS.log >"%userprofile%\Desktop\sfc.txt"

• Na pulpicie powstanie plik SFC - zaprezentuj go na forum. 

2. Zrób log z Farbar Service Scanner w celu weryfikacji poniższych usług.

• Centrum Akcji / Centrum Zabezpieczeń;
• Przywracanie systemu;
• Windows Update;
• Windows Defender;
• Zapora systemu Windows;
• Kompleks usług sieciowych. 

[kacpik6676]

@Miszel03 jest juz FSS log w spoilerze

 

 

A jednak nie, przepraszam ale nie ten plik z odnośnika się włączył i myślałem, że już dałem, proszę o usunięcie tego posta.

[Miszel03]

Nie, to jest log z E-Peek. Pomyliłeś narzędzia.

[kacpik6676]

Gdy piszę w tej konsoli komendę, wyskakuje mi:

 

 

"Aby móc używać narzędzia sfc, musisz być administratorem z uruchomioną sesją konsoli"

 

 

Log:

 

 

 

Farbar Service Scanner Version: 27-01-2016
Ran by Admin (administrator) on 28-05-2017 at 17:55:36
Running from "C:\Users\Admin\Downloads"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

[Miszel03]

  Cytat

"Aby móc używać narzędzia sfc, musisz być administratorem z uruchomioną sesją konsoli"

 

Z menu start wybierz CMD.EXE i z prawokliku Uruchom jako administrator.

[kacpik6676]

Funkcja Ochrona zasobów systemu Windows nie może uruchomić usługi naprawczej.

 

a tej drugiej komendy nie mogę wpisać bo nie znam nie których znaków, a wkleić się nie da bo tworzy się jakieś "^U"

[Groszexxx]

Wkleić można w ten sposób, że klikasz prawym przyciskiem myszy na czarne tło w linii komend i wybierasz opcję wklej, niemniej to jest niepotrzebne. 

 

Proszę zapoznać się z tym tematem: 

https://www.fixitpc.pl/topic/1236-weryfikacja-integralno%C5%9Bci-plik%C3%B3w-via-narz%C4%99dzie-sfc/?do=findComment&comment=174122

Dokładniej post trzeci. 

 

Musisz uruchomić WinRE i tam uruchomić narzędzie do sprawdzania weryfikacji plików (sfc). 

W razie pytań - pisz. 

[kacpik6676]

Microsoft Windows [Wersja 6.1.7601]
Copyright © 2009 Microsoft Corporation. Wszelkie prawa zastrzeżone.

C:\Windows\system32>^V
Nazwa '▬' nie jest rozpoznawana jako polecenie wewnętrzne lub zewnętrzne,
program wykonywalny lub plik wsadowy.

C:\Windows\system32>sfc /scannow

Funkcja Ochrona zasobów systemu Windows nie może uruchomić usługi naprawczej.

C:\Windows\system32>sfc /scannow /offbootdir=Y:\ /offwindir=Z:\windows

Funkcja Ochrona zasobów systemu Windows nie może uruchomić usługi naprawczej.

C:\Windows\system32>DISM /Image:Z: /Cleanup-Image /RevertPendingActions

Wersja narzędzia do obsługi obrazu wdrażania
i zarządzania nim: 6.1.7600.16385


Błąd: 3

Nie można uzyskać dostępu do obrazu.
Upewnij się, że ścieżka obrazu i katalog systemu Windows dla obrazu istnieją ora
z że masz uprawnienia do odczytu z folderu.

Plik dziennika narzędzia DISM można znaleźć w folderze C:\Windows\Logs\DISM\dism
.log

C:\Windows\system32>

[Groszexxx]

Drogi Kolego, niestety, ale musisz otworzyć swój umysł na nowe rzeczy, bo tego nikt za Ciebie nie zrobi. W Twoim przypadku w uruchomionym systemie usługa, która uruchamia sfc nie działa. Ciężko stwierdzić dlaczego. 

 

W celu obejścia masz skorzystać ze środowiska ratunkowego WinRE. W linku, który Ci dałem jest napisane jak tam wejść. Ty masz windows 7. Jest link do instrukcji jak uruchomić WinRE w windows 7. Sprawdź go. 

Gdy będziesz w winre to musisz wpisać w wierszu polecenia 

 

sfc /scannow /offbootdir=Y:\ /offwindir=Z:\windows

 

gdzie: 

Y - Do podstawienia litera kierująca na partycję z plikami startowymi Windows
Z - Do podstawienia litera kierująca na partycję z zainstalowanym Windows 

 

Najczęściej: 

sfc /scannow /offbootdir=c:\ /offwindir=c:\windows

ewentualnie 

sfc /scannow /offbootdir=c:\ /offwindir=d:\windows

[kacpik6676]

Resetuje ten komputer i resetuje i nie ma dalej opcji Napraw po wciśnięciu F8, ale ciągle jak włączam komputer pojawia się komunikat:

 

Ten sterownik został zablokowany z powodu problemów z zgodnością.

 

Sterownik: Tages SA

 

Na internecie trochę poczytałem o tym Tages Protection to ponoć to robi problemy z system, że nie można włączyć sporo rzeczy, blokuje itd

 

Pisali, aby to zaktualizować, albo odinstalować całkiem.

 

Czekam na Wasze zdanie.

[Groszexxx]

Czy gdy wciskasz f8 pojawia się menu, w którym mozesz np. wybrac tryb awaryjny? Mozesz zrobic zdjecie tego? Musi sie pokazac...

[kacpik6676]

Tak mam tam 4 opcje

-normalna co zawsze

-z paskiem zadan czy jakas tak

- z internetem

- i jakas jeszcze jest tak mi sie wydaje, ale po kliknieciu f8 nic się nie pojawia

[kacpik6676]

Tak mam, nie stety zdjęcie się nie dodaje bo waży za dużo (9 mb) ale ze zdjęcia opcje podam:

 

-Tryb Awaryjny

 

-Tryb Awaryjny z obsługą sieci

 

-Tryb Awaryjny z wierszem polecenia

 

-Uruchom system windows ze zwykłymi ustawieniami. (z tego zawsze korzystam)

 

 

A tamten sterownik tego nie powoduje?

[Groszexxx]

Wpisz w wiersz polecenia uruchomiony jako administrator: 

reagentc/info 

i przepisz zawartosc tutaj. 

 

Mozesz pobrac instalkę windows 7 home premium za pomocą tego narzędzia: 

https://www.heidoc.net/php/Windows%20ISO%20Downloader.exe

Wybierz tam windows 7 i home premium sp1 

Następnie ten obraz wgraj na pendrive'a za pomocą programu Rufus. Jest duzo poradników na necie. 

 

Zbootuj się z tego pendrive'a i wtedy majac do wyboru instal i repair - wybierz wlasnie repair. Następnie wiersz polecenia i tak jak wczesniej, chodzi o ta komende sfc i reszte. 

[kacpik6676]

Mam zresetować kompa i wybrać opcje:

-Tryb Awaryjny z wierszem polecenia?

i tam wpisać: "reagentc/info"

 

zrobić zdjęcie i z zdjęcia przepisać tutaj?