Rezultat naprawy Farbar Recovery Scan Tool (x64) Wersja: 17-07-2023 Uruchomiony przez Admin (17-07-2023 21:43:33) Run:2 Uruchomiony z C:\Users\Admin\Downloads Załadowane profile: Admin Tryb startu: Normal ============================================== fixlist - zawartość: ***************** CreateRestorePoint: CloseProcesses: EmptyTemp: HKU\S-1-5-18\...\Run: [Synapse3] => C:\Program Files (x86)\Razer\Synapse3\WPFUI\Framework\Razer Synapse 3 Host\Razer Synapse 3.exe /StartMinimized (Brak pliku) HKU\S-1-5-18\...\Run: [RzAppEngine] => "C:\Program Files\Razer\RzAppEngine\rzappengine.exe" --url-params=autoStart=1&apps=virtual-ring-light (Brak pliku) Task: {D95645F2-04D2-4237-931B-B9FB9A13AF20} - System32\Tasks\ExitLag-S-1-5-21-3585109043-4011664137-1646137907-1001 => D:\Program Files (x86)\ExitLag\ExitLag.exe --minimized (Brak pliku) Task: {2A054FD6-D0F1-49B1-8F7B-6DC814BAC1D3} - System32\Tasks\OneDrive Reporting Task-S-1-5-21-3585109043-4011664137-1646137907-1001 => %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe /reporting (Brak pliku) Tcpip\..\Interfaces\{c18906dd-18cf-499b-895d-e7563fada5e8}: [DhcpNameServer] 192.168.100.1 Tcpip\..\Interfaces\{d9340183-e185-44f0-9c36-cad695f1e1ab}: [DhcpNameServer] 192.168.43.1 CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileCoAuth.exe" => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileSyncShell64.dll => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileSyncShell64.dll => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\Microsoft.SharePoint.exe" => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /autoplay => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileSyncShell64.dll => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32 -> C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileSyncShell64.dll => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\Microsoft.SharePoint.exe" => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\22.227.1030.0001\FileCoAuth.exe" => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Brak pliku CustomCLSID: HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /cci /client=Personal => Brak pliku AlternateDataStreams: C:\ProgramData\DP45977C.lfl:677104FCAA [3442] AlternateDataStreams: C:\ProgramData\mntemp:8EAD8B3507 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini:B1DA6C571C [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk:74809202C5 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini:41964AA945 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk:8096E45125 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk:DC8F23BC3A [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk:E77773B271 [3442] AlternateDataStreams: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk:F20EF51E1F [3442] FirewallRules: [TCP Query User{F7B885D2-1894-4DA6-98D6-3E026E7F3DCD}D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe => Brak pliku FirewallRules: [UDP Query User{C0E7847A-4737-4EDE-8055-A60ABE8181E1}D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe => Brak pliku FirewallRules: [{5E7504C6-C42D-41D4-B56C-9B974F758766}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\FPSAimTrainer\FPSAimTrainer\Binaries\Win64\FPSAimTrainer-Win64-Shipping.exe => Brak pliku FirewallRules: [{E65081F9-DE77-41A5-AE77-6D1538B00482}] => (Allow) D:\Program Files (x86)\Steam\steamapps\common\FPSAimTrainer\FPSAimTrainer\Binaries\Win64\FPSAimTrainer-Win64-Shipping.exe => Brak pliku FirewallRules: [TCP Query User{62F7A257-DB56-4921-BC5C-95B3130D2C4A}C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe] => (Allow) C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe => Brak pliku FirewallRules: [UDP Query User{4F3EB050-6016-431E-AF0B-DEB843220A4E}C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe] => (Allow) C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe => Brak pliku FirewallRules: [{A4A038B0-8D3D-4700-B9C0-938B7E181954}] => (Allow) C:\Users\Admin\Desktop\msofice\Office.2019.ProPlusPL.x86.x64\32-bit\vlmcsd.exe => Brak pliku FirewallRules: [TCP Query User{402AF02F-DA39-463F-9B34-79ACCB24C0C8}D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe => Brak pliku FirewallRules: [UDP Query User{0DBED1CE-6BC6-4AF7-8B1E-9B89777AAA81}D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe => Brak pliku FirewallRules: [{65FBDBF0-F86B-4C3D-894F-253D7C4C793F}] => (Allow) d:\program files (x86)\exitlag\exitlag.exe => Brak pliku FirewallRules: [{1204E7F9-4DDD-4016-9DC8-548DB081AD56}] => (Allow) d:\program files (x86)\exitlag\exitlag.exe => Brak pliku FirewallRules: [TCP Query User{37B7C035-9E0C-41FA-98E7-ABFD003C9634}C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe] => (Allow) C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe => Brak pliku FirewallRules: [UDP Query User{E0AE5C25-564A-4F9D-A0F7-4CC05E469040}C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe] => (Allow) C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe => Brak pliku FirewallRules: [TCP Query User{929AC8FA-C036-47C9-B368-3D84B2ADE9F6}D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Brak pliku FirewallRules: [UDP Query User{7511B75F-42EB-451C-A099-F46BD71C634C}D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe] => (Allow) D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe => Brak pliku ***************** Punkt przywracania został pomyślnie utworzony. Procesy zostały pomyślnie zamknięte. "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\Synapse3" => pomyślnie usunięto "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Run\\RzAppEngine" => pomyślnie usunięto "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{D95645F2-04D2-4237-931B-B9FB9A13AF20}" => pomyślnie usunięto "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{D95645F2-04D2-4237-931B-B9FB9A13AF20}" => pomyślnie usunięto C:\WINDOWS\System32\Tasks\ExitLag-S-1-5-21-3585109043-4011664137-1646137907-1001 => pomyślnie przeniesiono "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ExitLag-S-1-5-21-3585109043-4011664137-1646137907-1001" => pomyślnie usunięto "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{2A054FD6-D0F1-49B1-8F7B-6DC814BAC1D3}" => pomyślnie usunięto "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{2A054FD6-D0F1-49B1-8F7B-6DC814BAC1D3}" => pomyślnie usunięto C:\WINDOWS\System32\Tasks\OneDrive Reporting Task-S-1-5-21-3585109043-4011664137-1646137907-1001 => pomyślnie przeniesiono "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\OneDrive Reporting Task-S-1-5-21-3585109043-4011664137-1646137907-1001" => pomyślnie usunięto "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{c18906dd-18cf-499b-895d-e7563fada5e8}\\DhcpNameServer" => pomyślnie usunięto "HKLM\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{d9340183-e185-44f0-9c36-cad695f1e1ab}\\DhcpNameServer" => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{0827D883-485C-4D62-BA2C-A332DBF3D4B0} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3} => pomyślnie usunięto HKU\S-1-5-21-3585109043-4011664137-1646137907-1001_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B} => pomyślnie usunięto C:\ProgramData\DP45977C.lfl => ":677104FCAA" ADS pomyślnie usunięto C:\ProgramData\mntemp => ":8EAD8B3507" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini => ":B1DA6C571C" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk => ":74809202C5" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini => ":41964AA945" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk => ":8096E45125" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk => ":DC8F23BC3A" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk => ":E77773B271" ADS pomyślnie usunięto C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Health Check.lnk => ":F20EF51E1F" ADS pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{F7B885D2-1894-4DA6-98D6-3E026E7F3DCD}D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{C0E7847A-4737-4EDE-8055-A60ABE8181E1}D:\program files (x86)\steam\steamapps\common\fpsaimtrainer\fpsaimtrainer\binaries\win64\fpsaimtrainer-win64-shipping.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{5E7504C6-C42D-41D4-B56C-9B974F758766}" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{E65081F9-DE77-41A5-AE77-6D1538B00482}" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{62F7A257-DB56-4921-BC5C-95B3130D2C4A}C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{4F3EB050-6016-431E-AF0B-DEB843220A4E}C:\users\admin\desktop\smieci\sdio_1.12.7.747\sdio_x64_r747.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{A4A038B0-8D3D-4700-B9C0-938B7E181954}" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{402AF02F-DA39-463F-9B34-79ACCB24C0C8}D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{0DBED1CE-6BC6-4AF7-8B1E-9B89777AAA81}D:\program files (x86)\steam\steamapps\common\new world\bin64\newworld.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{65FBDBF0-F86B-4C3D-894F-253D7C4C793F}" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\{1204E7F9-4DDD-4016-9DC8-548DB081AD56}" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{37B7C035-9E0C-41FA-98E7-ABFD003C9634}C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{E0AE5C25-564A-4F9D-A0F7-4CC05E469040}C:\users\admin\appdata\local\discord\app-1.0.9013\discord.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\TCP Query User{929AC8FA-C036-47C9-B368-3D84B2ADE9F6}D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe" => pomyślnie usunięto "HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\\UDP Query User{7511B75F-42EB-451C-A099-F46BD71C634C}D:\program files (x86)\steam\steamapps\common\cyberpunk 2077\bin\x64\cyberpunk2077.exe" => pomyślnie usunięto =========== EmptyTemp: ========== FlushDNS => ukończone BITS transfer queue => 0 B DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 36251938 B Java, Discord, Steam htmlcache, WinHttpAutoProxySvc/winhttp *.cache => 840026102 B Windows/system/drivers => 4024997 B Edge => 0 B Chrome => 2774953703 B Firefox => 0 B Opera => 0 B Temp, IE cache, history, cookies, recent: Default => 0 B ProgramData => 0 B Public => 0 B systemprofile => 0 B systemprofile32 => 75314 B LocalService => 75314 B NetworkService => 920784 B Admin => 185805758 B RecycleBin => 213862699 B EmptyTemp: => 3.8 GB danych tymczasowych Usunięto. ================================ System wymagał restartu. ==== Koniec Fixlog 21:44:30 ====