Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 08-05-2017
Uruchomiony przez Jurek (administrator)  JUREKKOMP (11-05-2017 18:00:45)
Uruchomiony z C:\Users\Jurek\Desktop
Załadowane profile: Jurek (Dostępne profile: Jurek)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: "C:\Program Files (x86)\Bagsarah\Application\chrome.exe" "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Greatis Software) C:\Program Files (x86)\UnHackMe\hackmon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Mouse\Amoumain.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Valve Corporation) C:\Program Files (x86)\steam\Steam.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Valve Corporation) C:\Program Files (x86)\steam\bin\cef\cef.win7\steamwebhelper.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe
(GOG.com) C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GOG Galaxy Notifications Renderer.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
() C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe
() C:\Users\Jurek\Desktop\adwcleaner_6.046.exe
(Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor)
HKLM\...\Run: [WheelMouse] => C:\Program Files\Mouse\Amoumain.exe [196608 2008-03-03] ()
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4859592 2015-11-18] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-29] (Intel Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5883912 2017-03-02] (LogMeIn Inc.)
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [Steam] => C:\Program Files (x86)\steam\steam.exe [3019552 2017-04-26] (Valve Corporation)
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3125280 2013-10-17] (Disc Soft Ltd)
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe [4876864 2017-04-25] (GOG.com)
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27793880 2017-04-26] (Skype Technologies S.A.)
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: J - J:\start95.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {24aed524-556a-11e5-905d-d43d7e33025b} - M:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {33c1faad-7ac6-11e2-87b0-d43d7e33025b} - I:\start95.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {4b4aaa7f-0dab-11e3-a3ad-d43d7e33025b} - J:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {4c717f21-8804-11e3-af9a-d43d7e33025b} - J:\setup.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {80e7f4f0-f588-11e4-81bb-d43d7e33025b} - K:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {923e1891-4b09-11e5-843c-d43d7e33025b} - K:\Startme.exe
IFEO\DisplaySwitch.exe: [Debugger] 
IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe
IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [Uchwyt nakładania ikony podpisu cyfrowego] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2011-02-04] (Autodesk, Inc.)
BootExecute: autocheck autochk * sh4native Sh4RemovalPartizan

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 89.206.32.32 193.110.228.2
Tcpip\..\Interfaces\{B35C82D2-8CD1-4234-B061-DD160DB798F3}: [DhcpNameServer] 89.206.32.32 193.110.228.2

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1970287958-98934462-1251740563-1000\Software\Microsoft\Internet Explorer\Main,Start Page = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll [2017-01-06] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll [2017-01-06] (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2017-03-14] (Skype Technologies)

FireFox:
========
FF DefaultProfile: vmdou99p.default
FF ProfilePath: C:\Users\Jurek\AppData\Roaming\Firefox\Firefox\Profiles\vmdou99p.default [2017-05-11]
FF Extension: (FF Adr) - C:\Users\Jurek\AppData\Roaming\Firefox\Firefox\Profiles\vmdou99p.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-05-11] [Brak podpisu cyfrowego]
FF Extension: (Polski Language Pack) - C:\Users\Jurek\AppData\Roaming\Firefox\Firefox\Profiles\vmdou99p.default\Extensions\langpack-pl@firefox.mozilla.org.xpi [2017-05-11] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Jurek\AppData\Roaming\Firefox\Firefox\Profiles\vmdou99p.default\searchplugins\startsearch.xml [2017-05-11]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_171.dll [2017-05-09] ()
FF Plugin: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2017-01-06] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2017-01-06] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-09] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-02-18] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-02] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default [2017-05-08]
CHR Extension: (Prezentacje Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-05-04]
CHR Extension: (Dokumenty Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]
CHR Extension: (Dysk Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Arkusze Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-05-04]
CHR Extension: (Dokumenty Google offline) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29]
CHR Extension: (Chrome Media Router) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-02]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

Opera: 
=======
OPR Session Restore: -> [funkcja włączona]
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [103064 2017-05-11] () <==== UWAGA
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [512576 2017-04-25] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7942208 2017-04-25] (GOG.com)
R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3416584 2017-03-02] (LogMeIn Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-03-29] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2017-02-27] (LogMeIn, Inc.)
R2 OneDirveSrv; C:\ProgramData\Microsoft OneDrive\setup\SyncTool.dll [129024 2017-05-10] () [Brak podpisu cyfrowego]
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2017-02-12] (Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184208 2017-02-12] (Electronic Arts)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [Brak podpisu cyfrowego]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WinInstallSvc; C:\ProgramData\Microsoft\AppV\Setup\Integrator.dll [105984 2017-05-08] () [Brak podpisu cyfrowego]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 Amfilter; C:\Windows\System32\DRIVERS\Amfltx64.sys [12288 2007-10-15] ((Standard mouse types))
R3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbx64.sys [17920 2008-02-13] (A4Tech Co.,Ltd.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd)
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-07-24] ()
U0 Partizan; C:\Windows\SysWOW64\drivers\Partizan.sys [40304 2017-05-04] (Greatis Software)
S3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation)
S3 MBAMWebProtection; \??\C:\Windows\system32\drivers\mwac.sys [X]
S3 MSICDSetup; \??\D:\CDriver64.sys [X]
S3 NTIOLib_1_0_C; \??\D:\NTIOLib_X64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-05-11 18:00 - 2017-05-11 17:50 - 00004165 _____ C:\Users\Jurek\Desktop\AdwCleaner[S23].txt
2017-05-11 17:56 - 2017-05-11 18:00 - 00019174 _____ C:\Users\Jurek\Desktop\FRST.txt
2017-05-11 17:56 - 2017-05-11 18:00 - 00000000 ____D C:\FRST
2017-05-11 17:56 - 2017-05-11 17:56 - 00044866 _____ C:\Users\Jurek\Desktop\Addition.txt
2017-05-11 17:48 - 2017-05-11 17:48 - 02429440 _____ (Farbar) C:\Users\Jurek\Desktop\FRST64.exe
2017-05-11 13:02 - 2017-05-11 13:02 - 00002158 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-05-11 13:02 - 2017-05-11 13:02 - 00002088 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-05-11 13:02 - 2017-05-11 13:02 - 00001978 _____ C:\Users\Jurek\Desktop\big_bang_empire.lnk
2017-05-11 13:02 - 2017-05-11 13:02 - 00001952 _____ C:\Users\Jurek\Desktop\BigFarm.lnk
2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 ____D C:\Users\Jurek\AppData\Local\Bagsarah
2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\3333333
2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\1111
2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\00
2017-05-11 13:01 - 2017-05-11 17:11 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-05-11 13:01 - 2017-05-11 13:01 - 00002000 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-05-11 13:01 - 2017-05-11 13:01 - 00001930 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-05-11 13:01 - 2017-05-11 13:01 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Firefox
2017-05-11 13:01 - 2017-05-11 13:01 - 00000000 ____D C:\Users\Jurek\AppData\Local\Firefox
2017-05-11 13:01 - 2017-05-11 13:01 - 00000000 ____D C:\Program Files (x86)\Firefox
2017-05-11 13:01 - 2017-05-11 13:01 - 00000000 ____D C:\Program Files (x86)\Bagsarah
2017-05-11 10:10 - 2017-05-11 13:02 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2017-05-08 14:03 - 2017-05-08 14:03 - 00000000 ____D C:\Users\Public\Documents\temp
2017-05-08 14:03 - 2017-05-08 14:03 - 00000000 ____D C:\Users\Public\Documents\chrome
2017-05-04 19:42 - 2017-05-11 10:08 - 00003106 _____ C:\Windows\SysWOW64\PARTIZAN.TXT
2017-05-04 19:41 - 2017-05-04 20:05 - 00000000 ____D C:\Users\Jurek\Desktop\fwbenefity
2017-05-04 19:33 - 2017-05-10 21:14 - 00000000 ____D C:\ProgramData\RegRun
2017-05-04 19:33 - 2017-05-04 19:33 - 00040304 _____ (Greatis Software) C:\Windows\SysWOW64\Drivers\Partizan.sys
2017-05-04 19:32 - 2017-05-11 14:12 - 00000000 ____D C:\Users\Public\Documents\regruninfo
2017-05-04 19:32 - 2017-05-11 14:12 - 00000000 ____D C:\Users\Jurek\Documents\RegRun2
2017-05-04 19:32 - 2017-05-04 19:45 - 00000000 ____D C:\Program Files (x86)\UnHackMe
2017-05-04 19:32 - 2017-05-04 19:32 - 00003326 _____ C:\Windows\System32\Tasks\UnHackMe Task Scheduler
2017-05-04 19:32 - 2017-05-04 19:32 - 00001007 _____ C:\Users\Jurek\Desktop\UnHackMe.lnk
2017-05-04 19:32 - 2017-05-04 19:32 - 00000002 RSHOT C:\Windows\winstart.bat
2017-05-04 19:32 - 2017-05-04 19:32 - 00000002 RSHOT C:\Windows\SysWOW64\AUTOEXEC.NT
2017-05-04 19:32 - 2017-05-04 19:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UnHackMe
2017-05-04 19:32 - 2016-11-01 13:08 - 00015016 _____ (Greatis Software, LLC.) C:\Windows\SysWOW64\Drivers\UnHackMeDrv.sys
2017-05-04 19:32 - 2015-12-28 11:32 - 00049968 _____ (Greatis Software) C:\Windows\system32\partizan.exe
2017-05-04 19:31 - 2017-05-04 19:31 - 00001733 _____ C:\Users\Jurek\Desktop\chrome — skrót.lnk
2017-05-04 18:32 - 2017-05-04 18:34 - 18325664 _____ C:\Users\Jurek\Desktop\UnHackMe.8.40.Build.540.rar
2017-05-04 18:18 - 2017-05-04 19:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-04 17:55 - 2017-05-04 19:12 - 00000000 ___HD C:\GP2HLBCayYlmzReY
2017-05-04 11:32 - 2017-05-04 11:32 - 00000000 ____D C:\Users\Public\Documents\Google
2017-05-03 15:06 - 2017-05-04 17:14 - 55566792 _____ (Malwarebytes ) C:\Users\Jurek\Downloads\Malwarebytes Free 3.0.6.1469 [1].exe
2017-05-03 14:50 - 2017-05-03 15:01 - 70702111 _____ C:\Users\Jurek\Desktop\SpyHunter 4.21.10.4585 Portable.rar
2017-05-03 14:34 - 2017-05-03 14:34 - 00017192 _____ C:\Users\Jurek\Documents\cc_20170503_143408.reg
2017-05-03 14:15 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\33
2017-05-03 14:15 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\1111111
2017-04-27 17:35 - 2017-04-27 17:35 - 04102600 _____ C:\Users\Jurek\Desktop\adwcleaner_6.046.exe
2017-04-27 15:24 - 2017-04-27 15:24 - 00011470 _____ C:\Users\Jurek\Desktop\przedszkolna.xlsx
2017-04-25 18:09 - 2017-04-25 18:09 - 04102600 _____ C:\Users\Jurek\Downloads\adwcleaner_6.046.exe
2017-04-25 18:07 - 2017-04-25 18:07 - 00000000 ____D C:\Users\Jurek\AppData\Local\GOG.com
2017-04-23 20:06 - 2017-05-11 17:50 - 00000000 ____D C:\AdwCleaner
2017-04-22 12:43 - 2017-04-22 12:43 - 00247056 _____ C:\Users\Jurek\Downloads\4_Gdansk_Jasien (1).pdf
2017-04-22 12:36 - 2017-04-22 12:36 - 00324182 _____ C:\Users\Jurek\Downloads\SKM-S1-12.03.17-10.06.172.pdf
2017-04-22 12:36 - 2017-04-22 12:36 - 00247056 _____ C:\Users\Jurek\Downloads\4_Gdansk_Jasien.pdf
2017-04-21 22:15 - 2017-04-21 22:15 - 00516551 _____ C:\Users\Jurek\Downloads\marta-tabelkaaa.pdf
2017-04-21 16:26 - 2017-04-21 16:26 - 00178001 _____ C:\Users\Jurek\Downloads\0798B4F545304C1FBD31061A68E28A3E_1_19-56-05-543.pdf
2017-04-21 16:24 - 2017-04-21 16:24 - 00178554 _____ C:\Users\Jurek\Downloads\22F47EB109074B03934D47FCA74C2DC9_0_19-56-05-543.pdf
2017-04-21 16:19 - 2017-04-21 16:19 - 00177667 _____ C:\Users\Jurek\Downloads\4E6B38D6DBFF4725967B7B78C2812D54_0_20-31-32-382.pdf
2017-04-21 12:26 - 2017-04-23 20:08 - 00000000 ____D C:\Windows\system32\log
2017-04-20 20:33 - 2017-05-03 19:19 - 00000000 ____D C:\Users\Jurek\Desktop\gwint talie
2017-04-20 18:15 - 2017-04-20 18:15 - 01328722 _____ C:\Users\Jurek\Downloads\regulamin.pdf
2017-04-20 08:27 - 2017-05-11 13:01 - 00000000 _____ C:\Windows\SysWOW64\11
2017-04-20 08:27 - 2017-04-25 18:07 - 00000000 _____ C:\Windows\SysWOW64\22
2017-04-17 19:02 - 2017-05-11 13:02 - 00000000 ____D C:\Users\Jurek\AppData\LocalLow\Mozilla
2017-04-17 19:02 - 2017-04-17 19:02 - 00000000 ____D C:\ProgramData\Software
2017-04-13 14:51 - 2017-04-13 14:51 - 00003576 _____ C:\Windows\System32\Tasks\Windows-WoShiBeiYongDe
2017-04-13 14:50 - 2017-04-13 14:50 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\SSMgre
2017-04-12 19:24 - 2017-04-12 19:24 - 00000000 ____D C:\ProgramData\.mono

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-05-11 17:44 - 2013-02-20 19:27 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Skype
2017-05-11 15:08 - 2013-03-15 22:26 - 00000000 ____D C:\Users\Jurek\AppData\Local\LogMeIn Hamachi
2017-05-11 10:16 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-05-11 10:16 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-05-11 10:14 - 2011-04-12 15:21 - 00743808 _____ C:\Windows\system32\perfh015.dat
2017-05-11 10:14 - 2011-04-12 15:21 - 00157290 _____ C:\Windows\system32\perfc015.dat
2017-05-11 10:14 - 2009-07-14 07:13 - 01679362 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-11 10:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-05-11 10:13 - 2013-06-08 23:45 - 00000000 ____D C:\Program Files (x86)\steam
2017-05-11 10:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-05-10 21:11 - 2013-12-02 19:49 - 00000000 ____D C:\Users\Jurek\AppData\Local\CrashDumps
2017-05-10 18:23 - 2015-07-07 22:37 - 00000000 ____D C:\Users\Jurek\AppData\Local\JDownloader 2.0
2017-05-09 17:27 - 2015-09-12 21:45 - 00004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-05-09 17:27 - 2015-07-25 17:48 - 00004552 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-05-09 17:27 - 2013-02-19 22:31 - 00803320 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-05-09 17:27 - 2013-02-19 22:31 - 00144888 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-05-09 17:27 - 2013-02-19 22:31 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-05-09 17:27 - 2013-02-19 22:31 - 00000000 ____D C:\Windows\system32\Macromed
2017-05-06 20:00 - 2013-02-18 22:40 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Winamp
2017-05-04 19:35 - 2014-10-05 18:26 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software
2017-05-04 11:32 - 2014-09-18 19:57 - 00000000 ____D C:\ProgramData\Package Cache
2017-05-03 14:42 - 2013-02-19 21:02 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Media Player Classic
2017-05-03 14:32 - 2013-02-18 20:33 - 00000997 _____ C:\Users\Jurek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-05-03 11:47 - 2017-03-02 09:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-05-03 11:47 - 2013-02-20 19:27 - 00000000 ____D C:\ProgramData\Skype
2017-05-02 20:17 - 2013-02-18 21:26 - 00003480 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-05-02 20:17 - 2013-02-18 21:26 - 00003352 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-27 17:31 - 2015-10-17 20:04 - 00000000 ____D C:\ProgramData\Apple
2017-04-27 11:13 - 2014-12-11 21:23 - 00003890 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1418325800
2017-04-27 11:13 - 2014-10-04 10:27 - 00000000 ____D C:\Program Files (x86)\Opera
2017-04-25 18:07 - 2014-11-28 21:11 - 00000000 ____D C:\Program Files (x86)\GalaxyClient
2017-04-23 20:08 - 2013-02-18 20:32 - 00000000 ____D C:\Users\Jurek
2017-04-17 19:02 - 2013-02-18 20:39 - 00000000 ___HD C:\Program Files (x86)\Temp
2017-04-13 14:51 - 2017-04-10 11:31 - 00003566 _____ C:\Windows\System32\Tasks\PowerWord-SCT-JT
2017-04-13 14:50 - 2017-04-02 10:32 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\ScreenShot

==================== Pliki w katalogu głównym wybranych folderów =======

2013-04-25 19:29 - 2015-08-10 09:23 - 0016384 _____ () C:\Users\Jurek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-03-10 21:27 - 2014-03-10 22:18 - 0007620 _____ () C:\Users\Jurek\AppData\Local\Resmon.ResmonCfg
2014-02-08 23:37 - 2014-02-08 23:37 - 0487160 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1391895466384
2014-02-22 13:40 - 2014-02-22 13:40 - 0487538 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1393069205679
2014-09-14 22:27 - 2014-09-14 22:27 - 0491709 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1410726448499
2017-01-27 19:30 - 2017-01-27 19:30 - 0590145 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1485538206338
2013-12-01 21:16 - 2013-12-01 21:22 - 0000088 __RSH () C:\ProgramData\05C4454ABF.sys
2013-12-01 21:16 - 2013-12-01 21:22 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys
2016-08-13 18:25 - 2016-08-13 18:25 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Niektóre pliki w TEMP:
====================
2017-05-08 17:22 - 2017-05-08 17:22 - 0040448 ____N () C:\Users\Jurek\AppData\Local\Temp\proxy_vole977726182823470602.dll

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-05-04 19:10

==================== Koniec  FRST.txt ============================