Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 08-05-2017 Uruchomiony przez Jurek (administrator) JUREKKOMP (12-05-2017 18:59:05) Uruchomiony z C:\Users\Jurek\Desktop Załadowane profile: Jurek (Dostępne profile: Jurek) Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe () C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\Program Files\Mouse\Amoumain.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\cnext.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe () C:\Program Files (x86)\DAEMON Tools Pro\DTShellHlp.exe (Valve Corporation) C:\Program Files (x86)\steam\Steam.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (Valve Corporation) C:\Program Files (x86)\steam\bin\cef\cef.win7\steamwebhelper.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe () C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe (GOG.com) C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe (GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe (GOG.com) C:\Program Files (x86)\GalaxyClient\GOG Galaxy Notifications Renderer.exe (GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe (GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Opera Software) C:\Program Files (x86)\Opera\44.0.2510.1449\opera.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe () C:\Users\Jurek\Desktop\adwcleaner_6.046.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6548112 2012-06-12] (Realtek Semiconductor) HKLM\...\Run: [WheelMouse] => C:\Program Files\Mouse\Amoumain.exe [196608 2008-03-03] () HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-09-23] (Apple Inc.) HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4859592 2015-11-18] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-03-29] (Intel Corporation) HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5883912 2017-03-02] (LogMeIn Inc.) HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [Steam] => C:\Program Files (x86)\steam\steam.exe [3019552 2017-04-26] (Valve Corporation) HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [DAEMON Tools Pro Agent] => C:\Program Files (x86)\DAEMON Tools Pro\DTAgent.exe [3125280 2013-10-17] (Disc Soft Ltd) HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe [4876864 2017-04-25] (GOG.com) HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27793880 2017-04-26] (Skype Technologies S.A.) HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: J - J:\start95.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {24aed524-556a-11e5-905d-d43d7e33025b} - M:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {33c1faad-7ac6-11e2-87b0-d43d7e33025b} - I:\start95.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {4b4aaa7f-0dab-11e3-a3ad-d43d7e33025b} - J:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {4c717f21-8804-11e3-af9a-d43d7e33025b} - J:\setup.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {80e7f4f0-f588-11e4-81bb-d43d7e33025b} - K:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1970287958-98934462-1251740563-1000\...\MountPoints2: {923e1891-4b09-11e5-843c-d43d7e33025b} - K:\Startme.exe ShellIconOverlayIdentifiers: [Uchwyt nakładania ikony podpisu cyfrowego] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2011-02-04] (Autodesk, Inc.) BootExecute: autocheck autochk * sh4native Sh4Removal ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 89.206.32.32 193.110.228.2 Tcpip\..\Interfaces\{B35C82D2-8CD1-4234-B061-DD160DB798F3}: [DhcpNameServer] 89.206.32.32 193.110.228.2 Internet Explorer: ================== BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll [2017-01-06] (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll [2017-01-06] (Oracle Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2017-03-14] (Skype Technologies) Chrome: ======= CHR DefaultProfile: Default CHR Profile: C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default [2017-05-12] CHR Extension: (Prezentacje Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-05-04] CHR Extension: (Dokumenty Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Dysk Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23] CHR Extension: (YouTube) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25] CHR Extension: (uBlock Origin) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\cjpalhdlnbpafiamejdnhcphjbkeiagm [2017-05-12] CHR Extension: (Google Search) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Arkusze Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-05-04] CHR Extension: (Dokumenty Google offline) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09] CHR Extension: (Gmail) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] CHR Extension: (Chrome Media Router) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-02] CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx Opera: ======= OPR Session Restore: -> [funkcja włączona] StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-09-02] (Apple Inc.) R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] () S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [512576 2017-04-25] (GOG.com) S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7942208 2017-04-25] (GOG.com) R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [3416584 2017-03-02] (LogMeIn Inc.) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-03-29] (Intel Corporation) R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2017-02-27] (LogMeIn, Inc.) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2017-02-12] (Electronic Arts) S2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184208 2017-02-12] (Electronic Arts) R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [Brak podpisu cyfrowego] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 Amfilter; C:\Windows\System32\DRIVERS\Amfltx64.sys [12288 2007-10-15] ((Standard mouse types)) R3 Amusbprt; C:\Windows\System32\DRIVERS\Amusbx64.sys [17920 2008-02-13] (A4Tech Co.,Ltd.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-28] (Disc Soft Ltd) R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-07-24] () S3 xb1usb; C:\Windows\System32\DRIVERS\xb1usb.sys [34016 2014-05-27] (Microsoft Corporation) U0 Partizan; system32\drivers\Partizan.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-05-12 18:47 - 2017-05-12 18:47 - 00013774 _____ C:\Users\Jurek\Desktop\Fixlog.txt 2017-05-12 17:48 - 2017-05-12 17:48 - 00096475 _____ C:\Users\Jurek\Desktop\GMER.txt 2017-05-12 17:29 - 2017-05-12 17:29 - 00380928 _____ C:\Users\Jurek\Desktop\zejlw2rk.exe 2017-05-11 20:18 - 2017-05-12 18:53 - 00003070 _____ C:\Users\Jurek\Desktop\SearchReg.txt 2017-05-11 18:55 - 2017-05-11 18:55 - 63035592 _____ (Malwarebytes ) C:\Users\Jurek\Desktop\mb3-setup-consumer-3.1.2.1733.exe 2017-05-11 18:01 - 2017-05-11 18:01 - 00060515 _____ C:\Users\Jurek\Desktop\Shortcut.txt 2017-05-11 18:00 - 2017-05-11 17:50 - 00004165 _____ C:\Users\Jurek\Desktop\AdwCleaner[S23].txt 2017-05-11 17:56 - 2017-05-12 18:59 - 00014391 _____ C:\Users\Jurek\Desktop\FRST.txt 2017-05-11 17:56 - 2017-05-12 18:59 - 00000000 ____D C:\FRST 2017-05-11 17:56 - 2017-05-11 18:01 - 00044918 _____ C:\Users\Jurek\Desktop\Addition.txt 2017-05-11 17:48 - 2017-05-11 17:48 - 02429440 _____ (Farbar) C:\Users\Jurek\Desktop\FRST64.exe 2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 ____D C:\ProgramData\Microsoft OneDrive 2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\3333333 2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\1111 2017-05-11 13:02 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\00 2017-05-11 13:01 - 2017-05-12 18:30 - 00000000 _____ C:\Users\Public\Documents\report.dat 2017-05-11 10:10 - 2017-05-12 18:20 - 00000000 _____ C:\Users\Public\Documents\temp.dat 2017-05-08 14:03 - 2017-05-08 14:03 - 00000000 ____D C:\Users\Public\Documents\temp 2017-05-08 14:03 - 2017-05-08 14:03 - 00000000 ____D C:\Users\Public\Documents\chrome 2017-05-04 19:42 - 2017-05-11 10:08 - 00003106 _____ C:\Windows\SysWOW64\PARTIZAN.TXT 2017-05-04 19:41 - 2017-05-04 20:05 - 00000000 ____D C:\Users\Jurek\Desktop\fwbenefity 2017-05-04 19:33 - 2017-05-10 21:14 - 00000000 ____D C:\ProgramData\RegRun 2017-05-04 19:32 - 2017-05-11 18:11 - 00000000 ____D C:\Program Files (x86)\UnHackMe 2017-05-04 19:32 - 2017-05-11 14:12 - 00000000 ____D C:\Users\Jurek\Documents\RegRun2 2017-05-04 19:32 - 2017-05-04 19:32 - 00000002 RSHOT C:\Windows\winstart.bat 2017-05-04 19:32 - 2017-05-04 19:32 - 00000002 RSHOT C:\Windows\SysWOW64\AUTOEXEC.NT 2017-05-04 19:31 - 2017-05-04 19:31 - 00001733 _____ C:\Users\Jurek\Desktop\chrome — skrót.lnk 2017-05-04 18:32 - 2017-05-04 18:34 - 18325664 _____ C:\Users\Jurek\Desktop\UnHackMe.8.40.Build.540.rar 2017-05-04 18:18 - 2017-05-04 19:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-05-04 17:55 - 2017-05-04 19:12 - 00000000 ___HD C:\GP2HLBCayYlmzReY 2017-05-04 11:32 - 2017-05-04 11:32 - 00000000 ____D C:\Users\Public\Documents\Google 2017-05-03 15:06 - 2017-05-04 17:14 - 55566792 _____ (Malwarebytes ) C:\Users\Jurek\Downloads\Malwarebytes Free 3.0.6.1469 [1].exe 2017-05-03 14:34 - 2017-05-03 14:34 - 00017192 _____ C:\Users\Jurek\Documents\cc_20170503_143408.reg 2017-05-03 14:15 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\33 2017-05-03 14:15 - 2017-05-11 13:02 - 00000000 _____ C:\Windows\SysWOW64\1111111 2017-04-27 17:35 - 2017-04-27 17:35 - 04102600 _____ C:\Users\Jurek\Desktop\adwcleaner_6.046.exe 2017-04-27 15:24 - 2017-04-27 15:24 - 00011470 _____ C:\Users\Jurek\Desktop\przedszkolna.xlsx 2017-04-25 18:09 - 2017-04-25 18:09 - 04102600 _____ C:\Users\Jurek\Downloads\adwcleaner_6.046.exe 2017-04-25 18:07 - 2017-04-25 18:07 - 00000000 ____D C:\Users\Jurek\AppData\Local\GOG.com 2017-04-23 20:06 - 2017-05-12 18:57 - 00000000 ____D C:\AdwCleaner 2017-04-22 12:43 - 2017-04-22 12:43 - 00247056 _____ C:\Users\Jurek\Downloads\4_Gdansk_Jasien (1).pdf 2017-04-22 12:36 - 2017-04-22 12:36 - 00324182 _____ C:\Users\Jurek\Downloads\SKM-S1-12.03.17-10.06.172.pdf 2017-04-22 12:36 - 2017-04-22 12:36 - 00247056 _____ C:\Users\Jurek\Downloads\4_Gdansk_Jasien.pdf 2017-04-21 22:15 - 2017-04-21 22:15 - 00516551 _____ C:\Users\Jurek\Downloads\marta-tabelkaaa.pdf 2017-04-21 16:26 - 2017-04-21 16:26 - 00178001 _____ C:\Users\Jurek\Downloads\0798B4F545304C1FBD31061A68E28A3E_1_19-56-05-543.pdf 2017-04-21 16:24 - 2017-04-21 16:24 - 00178554 _____ C:\Users\Jurek\Downloads\22F47EB109074B03934D47FCA74C2DC9_0_19-56-05-543.pdf 2017-04-21 16:19 - 2017-04-21 16:19 - 00177667 _____ C:\Users\Jurek\Downloads\4E6B38D6DBFF4725967B7B78C2812D54_0_20-31-32-382.pdf 2017-04-21 12:26 - 2017-04-23 20:08 - 00000000 ____D C:\Windows\system32\log 2017-04-20 20:33 - 2017-05-03 19:19 - 00000000 ____D C:\Users\Jurek\Desktop\gwint talie 2017-04-20 18:15 - 2017-04-20 18:15 - 01328722 _____ C:\Users\Jurek\Downloads\regulamin.pdf 2017-04-20 08:27 - 2017-05-11 13:01 - 00000000 _____ C:\Windows\SysWOW64\11 2017-04-20 08:27 - 2017-04-25 18:07 - 00000000 _____ C:\Windows\SysWOW64\22 2017-04-17 19:02 - 2017-05-11 13:02 - 00000000 ____D C:\Users\Jurek\AppData\LocalLow\Mozilla 2017-04-17 19:02 - 2017-04-17 19:02 - 00000000 ____D C:\ProgramData\Software 2017-04-13 14:50 - 2017-04-13 14:50 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\SSMgre 2017-04-12 19:24 - 2017-04-12 19:24 - 00000000 ____D C:\ProgramData\.mono ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-05-12 18:56 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-05-12 18:56 - 2009-07-14 06:45 - 00021472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-05-12 18:54 - 2011-04-12 15:21 - 00743808 _____ C:\Windows\system32\perfh015.dat 2017-05-12 18:54 - 2011-04-12 15:21 - 00157290 _____ C:\Windows\system32\perfc015.dat 2017-05-12 18:54 - 2009-07-14 07:13 - 01679362 _____ C:\Windows\system32\PerfStringBackup.INI 2017-05-12 18:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2017-05-12 18:53 - 2013-06-08 23:45 - 00000000 ____D C:\Program Files (x86)\steam 2017-05-12 18:49 - 2013-02-20 19:27 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Skype 2017-05-12 18:48 - 2013-03-15 22:26 - 00000000 ____D C:\Users\Jurek\AppData\Local\LogMeIn Hamachi 2017-05-12 18:48 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-05-12 17:27 - 2009-07-14 07:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-05-11 21:41 - 2015-07-07 22:37 - 00000000 ____D C:\Users\Jurek\AppData\Local\JDownloader 2.0 2017-05-10 21:11 - 2013-12-02 19:49 - 00000000 ____D C:\Users\Jurek\AppData\Local\CrashDumps 2017-05-09 17:27 - 2015-09-12 21:45 - 00004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-05-09 17:27 - 2015-07-25 17:48 - 00004552 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2017-05-09 17:27 - 2013-02-19 22:31 - 00803320 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-05-09 17:27 - 2013-02-19 22:31 - 00144888 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-05-09 17:27 - 2013-02-19 22:31 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-05-09 17:27 - 2013-02-19 22:31 - 00000000 ____D C:\Windows\system32\Macromed 2017-05-06 20:00 - 2013-02-18 22:40 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Winamp 2017-05-04 19:35 - 2014-10-05 18:26 - 00000000 ____D C:\Windows\System32\Tasks\NCH Software 2017-05-04 11:32 - 2014-09-18 19:57 - 00000000 ____D C:\ProgramData\Package Cache 2017-05-03 14:42 - 2013-02-19 21:02 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\Media Player Classic 2017-05-03 14:32 - 2013-02-18 20:33 - 00000997 _____ C:\Users\Jurek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2017-05-03 11:47 - 2017-03-02 09:57 - 00000000 ___RD C:\Program Files (x86)\Skype 2017-05-03 11:47 - 2013-02-20 19:27 - 00000000 ____D C:\ProgramData\Skype 2017-05-02 20:17 - 2013-02-18 21:26 - 00003480 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-05-02 20:17 - 2013-02-18 21:26 - 00003352 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-04-27 17:31 - 2015-10-17 20:04 - 00000000 ____D C:\ProgramData\Apple 2017-04-27 11:13 - 2014-12-11 21:23 - 00003890 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1418325800 2017-04-27 11:13 - 2014-10-04 10:27 - 00000000 ____D C:\Program Files (x86)\Opera 2017-04-25 18:07 - 2014-11-28 21:11 - 00000000 ____D C:\Program Files (x86)\GalaxyClient 2017-04-23 20:08 - 2013-02-18 20:32 - 00000000 ____D C:\Users\Jurek 2017-04-17 19:02 - 2013-02-18 20:39 - 00000000 ___HD C:\Program Files (x86)\Temp 2017-04-13 14:50 - 2017-04-02 10:32 - 00000000 ____D C:\Users\Jurek\AppData\Roaming\ScreenShot ==================== Pliki w katalogu głównym wybranych folderów ======= 2013-04-25 19:29 - 2015-08-10 09:23 - 0016384 _____ () C:\Users\Jurek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-03-10 21:27 - 2014-03-10 22:18 - 0007620 _____ () C:\Users\Jurek\AppData\Local\Resmon.ResmonCfg 2014-02-08 23:37 - 2014-02-08 23:37 - 0487160 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1391895466384 2014-02-22 13:40 - 2014-02-22 13:40 - 0487538 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1393069205679 2014-09-14 22:27 - 2014-09-14 22:27 - 0491709 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1410726448499 2017-01-27 19:30 - 2017-01-27 19:30 - 0590145 _____ () C:\Users\Jurek\AppData\Local\soulseek-client.dat.1485538206338 2013-12-01 21:16 - 2013-12-01 21:22 - 0000088 __RSH () C:\ProgramData\05C4454ABF.sys 2013-12-01 21:16 - 2013-12-01 21:22 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys 2016-08-13 18:25 - 2016-08-13 18:25 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-05-04 19:10 ==================== Koniec FRST.txt ============================