Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 18-06-2017 01 Uruchomiony przez Tomek (administrator) LILLITH (19-06-2017 16:58:50) Uruchomiony z C:\Users\Tomek\Desktop\Downloads Załadowane profile: Tomek (Dostępne profile: Tomek & DefaultAppPool) Platform: Windows 10 Home Wersja 1607 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE () C:\Program Files (x86)\ASUS\ATK Hotkey\AsLdrSrv.exe () C:\Program Files\ATKGFNEX\GFNEXSrv.exe (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe (Microsoft Corporation) C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe (Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe () C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE (Microsoft Corporation) C:\Windows\System32\mqsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Windows\SysWOW64\perfhost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe Brak dostępu do procesu -> FastBootAgent.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Microsoft Corporation) C:\Windows\System32\LocationNotificationWindows.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe () C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe (McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation) C:\Windows\System32\TieringEngineService.exe (McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe Brak dostępu do procesu -> ElanTPCfg64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe (ALLPlayer Group Ltd.) C:\Program Files (x86)\ALLPlayer Remote\ALLPlayerRemoteControl.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\SpotifyWebHelper.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Premium Sound Control Panel\SRSPremiumPanel_64.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ADS\Adobe Desktop Service.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\HEX\Adobe CEF Helper.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\CCXProcess.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCXProcess\libs\node.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\CCLibrary.exe (Node.js) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CCLibrary\libs\node.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Spotify Ltd) C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.17.420.0_x64__kzf8qxf38zg5c\SkypeHost.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (OldTimer Tools) C:\Users\Tomek\Desktop\Downloads\OTL.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\smartscreen.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3738344 2015-10-08] (ELAN Microelectronics Corp.) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [508128 2016-07-01] (Adobe Systems Incorporated) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1794888 2015-06-29] (NVIDIA Corporation) HKLM\...\Run: [Windows Mobile Device Center] => C:\WINDOWS\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2780112 2017-01-20] (Malwarebytes) HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2017-04-28] (Microsoft Corporation) HKLM-x32\...\Run: [UpdateLBPShortCut] => C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.) HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation) HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [97512 2017-05-22] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2406496 2017-06-04] (Adobe Systems Incorporated) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [ALLUpdate] => C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3670472 2015-07-28] (ALLPlayer Group Ltd.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Facebook Update] => C:\Users\Tomek\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-11] (Facebook Inc.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Google Update] => C:\Users\Tomek\AppData\Local\Google\Update\1.3.33.5\GoogleUpdateCore.exe [601168 2017-04-29] (Google Inc.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Tomek\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [uTorrent] => C:\Users\Tomek\AppData\Roaming\uTorrent\uTorrent.exe [1980608 2017-06-16] (BitTorrent Inc.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-30] (Disc Soft Ltd) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Napisy24Update] => C:\Program Files (x86)\Napisy24\Napisy24Update.exe [3709896 2015-11-04] (Napisy24.pl) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [ALLPlayer WiFi Remote] => C:\Program Files (x86)\ALLPlayer Remote\ALLPlayerRemoteControl.exe [5975264 2016-03-14] (ALLPlayer Group Ltd.) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Napisy24.pl] => C:\Program Files (x86)\Napisy24\Napisy24.exe [6570496 2016-11-03] (Napisy24.pl) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Spotify Web Helper] => C:\Users\Tomek\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1560176 2017-06-12] (Spotify Ltd) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [Spotify] => C:\Users\Tomek\AppData\Roaming\Spotify\Spotify.exe [6949488 2017-06-12] (Spotify Ltd) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9803992 2017-06-13] (Piriform Ltd) HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\RunOnce: [ALLPlayer Remote Update] => C:\Users\Tomek\AppData\Local\Temp\ALLRemote.exe [2200144 2017-06-19] (ALLPlayer ) <===== UWAGA HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\MountPoints2: {0a6e26ce-f473-11e6-9c63-90e6ba5e19b1} - "F:\LG_PC_Programs.exe" HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\MountPoints2: {dbf1761c-3884-11e7-9c83-90e6ba5e19b1} - "F:\HiSuiteDownLoader.exe" HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\MountPoints2: {dbf176cd-3884-11e7-9c83-90e6ba5e19b1} - "F:\HiSuiteDownLoader.exe" Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter "C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter" ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSyncExtension\CoreSync_x64.dll [2017-05-26] () ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\amd64\FileSyncShell64.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\amd64\FileSyncShell64.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\amd64\FileSyncShell64.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku ShellIconOverlayIdentifiers: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt64.dll [2007-06-15] () ShellIconOverlayIdentifiers: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x64\OverlayIconShlExt1_64.dll [2007-06-02] () ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\FileSyncShell.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\FileSyncShell.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Tomek\AppData\Local\Microsoft\OneDrive\17.3.6799.0327\FileSyncShell.dll [2017-04-17] (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon] -> {A825576B-0042-4F0F-8FB0-93CE0F054E69} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt.dll [2007-06-15] () ShellIconOverlayIdentifiers-x32: [ADSMOverlayIcon1] -> {A8D448F4-0431-45AC-9F5E-E1B434AB2249} => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ShlExt\x86\OverlayIconShlExt1.dll [2007-06-02] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2014-03-25] ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SRS Premium Sound.lnk [2009-09-29] ShortcutTarget: SRS Premium Sound.lnk -> C:\Windows\Installer\{D42F84B6-3709-4A50-8502-6719D16AE6C8}\NewShortcut5_21C7B668029A47458B27645FE6E4A715.exe (Acresso Software Inc.) CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) AutoConfigURL: [S-1-5-21-2301361929-2734908496-1913397766-1000] => hxxp://unstopp.me/wpad.dat?02cbd4dcd4b7105ea0f34c9c068358654459524 Tcpip\Parameters: [DhcpNameServer] 195.189.32.34 195.189.32.3 8.8.8.8 192.168.1.1 Tcpip\..\Interfaces\{0c5be345-5711-4dda-ad32-31423d15f2a4}: [DhcpNameServer] 195.189.32.34 195.189.32.3 8.8.8.8 192.168.1.1 Tcpip\..\Interfaces\{fc73c5f7-8294-4f61-a497-2fae36ce7da1}: [DhcpNameServer] 192.168.0.1 ManualProxies: 0hxxp://unstopp.me/wpad.dat?02cbd4dcd4b7105ea0f34c9c068358654459524 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gazeta.pl/0,0.html?p=190 HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678 SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {3037CEF1-7256-481F-9860-B39599896B3E} URL = hxxp://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {81459163-EE4E-40F5-B9CD-3207A6493E01} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=SPC2&o=15000&src=crm&q={searchTerms}&locale=&apn_ptnrs=PV&apn_dtid=YYYYYYYYPL&apn_uid=9d54d475-3ef1-4dc6-9bba-1c8151ebbdfa&apn_sauid=A51ABC01-72FA-4F82-9C8E-4B47A02A3CB0 SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2786678 SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms} SearchScopes: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> {szukaj.gazeta.pl} URL = hxxp://szukaj.gazeta.pl/internet/0,0.html?slowo={searchTerms} BHO: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-05] (Intel Security) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-05] (Intel Security) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2015-07-02] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2015-07-02] (Oracle Corporation) Toolbar: HKLM - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-05] (Intel Security) Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2017-06-05] (Intel Security) Toolbar: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> Brak nazwy - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - Brak pliku Toolbar: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> Brak nazwy - {D4027C7F-154A-4066-A1AD-4243D8127440} - Brak pliku Toolbar: HKU\S-1-5-21-2301361929-2734908496-1913397766-1000 -> True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie64.dll [2017-06-05] (Intel Security) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2017-01-02] (Skype Technologies) FireFox: ======== FF ProfilePath: C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default [2017-06-19] FF NewTab: Mozilla\Firefox\Profiles\a8k1ppal.default -> chrome://quick_start/content/index.html FF DefaultSearchEngine: Mozilla\Firefox\Profiles\a8k1ppal.default -> Google (avast) FF DefaultSearchEngine,S: Mozilla\Firefox\Profiles\a8k1ppal.default -> WebSearch FF DefaultSearchUrl: Mozilla\Firefox\Profiles\a8k1ppal.default -> hxxps://www.google.com/search/?trackid=sp-006 FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\a8k1ppal.default -> Google (avast) FF SearchEngineOrder.1,S: Mozilla\Firefox\Profiles\a8k1ppal.default -> WebSearch FF SelectedSearchEngine: Mozilla\Firefox\Profiles\a8k1ppal.default -> Google (avast) FF SelectedSearchEngine,S: Mozilla\Firefox\Profiles\a8k1ppal.default -> WebSearch FF Homepage: Mozilla\Firefox\Profiles\a8k1ppal.default -> hxxp://www.gazeta.pl/0,0.html?p=190 FF Keyword.URL: Mozilla\Firefox\Profiles\a8k1ppal.default -> hxxps://www.google.com/search/?trackid=sp-006 FF NetworkProxy: Mozilla\Firefox\Profiles\a8k1ppal.default -> http", "60.29.101.130" FF NetworkProxy: Mozilla\Firefox\Profiles\a8k1ppal.default -> http_port", 8080 FF NetworkProxy: Mozilla\Firefox\Profiles\a8k1ppal.default -> type", 4 FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\2tpMP80Ua@Zi.edu [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\2Uf@8ar5B.org [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\8@dwRZ.edu [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Avira Browser Safety) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\abs@avira.com [2017-04-09] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\BKWai@3Sl.org [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\deskCutv2@gmail.com [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\Dpz@rl5Q2Y.net [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\EXNcTyBnL@Ge.net [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Iplex to ALLPlayer) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\IplextoALL@ALLPlayer.org.xpi [2012-05-27] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\Iwd7tmax@b.edu [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Avira Password Manager) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\passwordmanager@avira.com [2017-04-09] FF Extension: (Avira SafeSearch Plus) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\safesearchplus2@avira.com [2017-04-09] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\ukwgWQQU@67G.com [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\vbvoX@8e6UF.edu [2016-02-23] [Brak podpisu cyfrowego] FF Extension: (Easy YouTube Video Downloader) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b} [2013-04-10] [Brak podpisu cyfrowego] FF Extension: (Easy YouTube Video Downloader) - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013-04-09] [Brak podpisu cyfrowego] FF SearchPlugin: C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\searchplugins\askcom.xml [2012-01-03] FF SearchPlugin: C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\searchplugins\google-avast.xml [2015-02-26] FF SearchPlugin: C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\searchplugins\szukaj-gazeta-pl.xml [2015-01-13] FF HKLM-x32\...\Firefox\Extensions: [ocr@babylon.com] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\ocr@babylon.com => nie znaleziono FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-03-25] [Brak podpisu cyfrowego] FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\Tomek\AppData\Roaming\Mozilla\Firefox\Profiles\a8k1ppal.default\extensions\deskCutv2@gmail.com FF HKU\.DEFAULT\...\Firefox\Extensions: [{b64982b1-d112-42b5-b1e4-d3867c4533f8}] - C:\ProgramData\Browser Manager\2.3.762.17\{16cdff19-861d-48e3-a751-d99a27784753}\FirefoxExtension => nie znaleziono FF HKU\S-1-5-21-2301361929-2734908496-1913397766-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_26_0_0_131.dll [2017-06-16] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2017-06-04] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-16] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1224194.dll [2016-02-19] (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2015-07-02] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.80.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2015-07-02] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.3 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2008-11-13] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku] FF Plugin-x32: @scout.avira-update.com/Avira Scout Update;version=3 -> C:\Program Files (x86)\Avira\Scout Update\1.3.32.7\npScoutUpdate3.dll [2017-04-19] (Avira Operations GmbH & Co. KG) FF Plugin-x32: @scout.avira-update.com/Avira Scout Update;version=9 -> C:\Program Files (x86)\Avira\Scout Update\1.3.32.7\npScoutUpdate3.dll [2017-04-19] (Avira Operations GmbH & Co. KG) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2017-06-04] (Adobe Systems) FF Plugin HKU\S-1-5-21-2301361929-2734908496-1913397766-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Tomek\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-2301361929-2734908496-1913397766-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Tomek\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.) FF Plugin HKU\S-1-5-21-2301361929-2734908496-1913397766-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Tomek\AppData\Local\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.) Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> search-results.com/?gct=hp CHR StartupUrls: Default -> "hxxp://www.gazeta.pl/0,0.html?p=190" CHR Profile: C:\Users\Tomek\AppData\Local\Google\Chrome\User Data\Default [2017-06-19] CHR Extension: (AdBlock) - C:\Users\Tomek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-10] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== UWAGA CHR Extension: (Google Wallet) - C:\Users\Tomek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-19] [UpdateUrl: hxxps://epicunitscan.info/00service/update2/crx] <==== UWAGA CHR Extension: (Chrome Media Router) - C:\Users\Tomek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-14] CHR HKLM\...\Chrome\Extension: [bbhlhknkakjfjgdcedehbilkpibmfmod] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\bbhlhknkakjfjgdcedehbilkpibmfmod.crx [2015-11-05] CHR HKLM\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ajhcekcffkpnaednoeoegnmnjdlnjjmg] - C:\ProgramData\wxDfast\ajhcekcffkpnaednoeoegnmnjdlnjjmg.crx CHR HKLM-x32\...\Chrome\Extension: [bbhlhknkakjfjgdcedehbilkpibmfmod] - C:\ProgramData\AskPartnerNetwork\Toolbar\Shared\CRX\bbhlhknkakjfjgdcedehbilkpibmfmod.crx [2015-11-05] CHR HKLM-x32\...\Chrome\Extension: [caljgklbbfbcjjanaijlacgncafpegll] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ccbpbkebodcjkknkfkpmfeciinhidaeh] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [ipmkfpcnmccejididiaagpgchgjfajgp] - hxxps://clients2.google.com/service/update2/crx Opera: ======= OPR StartupUrls: "hxxp://www.gazeta.pl/0,0.html?p=156" ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 AdobeUpdateService; C:\Program Files (x86)\Common Files\Adobe\Adobe Desktop Common\ElevationManager\AdobeUpdateService.exe [814688 2017-06-04] (Adobe Systems Incorporated) R3 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [Brak podpisu cyfrowego] R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2246256 2017-05-18] (Adobe Systems, Incorporated) R2 ASLDRService; C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe [100920 2008-08-14] () R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] () [Brak podpisu cyfrowego] R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [374352 2017-05-22] (Avira Operations GmbH & Co. KG) S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L) R2 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1368408 2015-11-30] (Disc Soft Ltd) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [144104 2015-10-08] (ELAN Microelectronics Corp.) S2 FastBootAgent; C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe [306232 2009-07-24] (ASUSTeK Computer Inc.) R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] S2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [321056 2017-06-01] (HP Inc.) R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2017-04-11] () [Brak podpisu cyfrowego] S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2012-02-23] () [Brak podpisu cyfrowego] R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4355024 2017-01-20] (Malwarebytes) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [Brak podpisu cyfrowego] S2 PCLEPCI; C:\Windows\SysWOW64\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH) [Brak podpisu cyfrowego] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [Brak podpisu cyfrowego] R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [294616 2015-05-22] (Realtek Semiconductor) S2 scupdate; C:\Program Files (x86)\Avira\Scout Update\ScoutUpdate.exe [116312 2017-04-09] (Avira Operations GmbH & Co. KG) S3 scupdatem; C:\Program Files (x86)\Avira\Scout Update\ScoutUpdate.exe [116312 2017-04-09] (Avira Operations GmbH & Co. KG) S2 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego] R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [1001920 2017-05-26] (McAfee, Inc.) R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [16928 2017-05-26] (McAfee, Inc.) S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [87760 2017-05-26] (McAfee, Inc.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347320 2017-04-28] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103712 2017-04-28] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 AndNetDiag; C:\WINDOWS\system32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.) S3 ANDNetModem; C:\WINDOWS\system32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.) R2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] () S2 atksgt; C:\WINDOWS\System32\DRIVERS\atksgt.sys [303616 2016-01-16] () [Brak podpisu cyfrowego] S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-01-14] (Disc Soft Ltd) R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [46392 2016-01-14] (Disc Soft Ltd) R1 ESProtectionDriver; C:\WINDOWS\system32\drivers\mbae64.sys [77440 2017-04-15] () U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2017-04-11] (Huawei Technologies Co., Ltd.) R3 kbfiltr; C:\WINDOWS\System32\drivers\kbfiltr.sys [15416 2009-07-20] ( ) S2 lirsgt; C:\WINDOWS\System32\DRIVERS\lirsgt.sys [35328 2016-01-16] () [Brak podpisu cyfrowego] S3 MarvinBus; C:\WINDOWS\System32\DRIVERS\MarvinBus64.sys [261120 2005-09-23] (Pinnacle Systems GmbH) [Brak podpisu cyfrowego] S3 MBAMFarflt; C:\WINDOWS\system32\drivers\farflt.sys [111544 2017-04-24] (Malwarebytes) S3 MBAMProtection; C:\WINDOWS\system32\drivers\mbam.sys [43968 2017-04-24] (Malwarebytes) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251832 2017-06-19] (Malwarebytes) S3 MBAMWebProtection; C:\WINDOWS\system32\drivers\mwac.sys [92096 2017-04-25] (Malwarebytes) S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] () R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [589824 2016-07-16] (Realtek ) S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) S3 ssudserd; C:\WINDOWS\system32\DRIVERS\ssudserd.sys [214832 2015-12-08] (DEVGURU Co., LTD.(www.devguru.co.kr)) S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation) S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB) R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation) S3 aswHdsKe; \??\C:\WINDOWS\system32\drivers\aswHdsKe.sys [X] U3 idsvc; Brak ImagePath S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-19 16:58 - 2017-06-19 16:58 - 00000000 ____D C:\FRST 2017-06-19 14:27 - 2017-06-19 14:27 - 00002854 _____ C:\WINDOWS\System32\Tasks\CCleanerSkipUAC 2017-06-19 14:27 - 2017-06-19 14:27 - 00000865 _____ C:\Users\Public\Desktop\CCleaner.lnk 2017-06-19 14:27 - 2017-06-19 14:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2017-06-19 14:26 - 2017-06-19 14:27 - 00000000 ____D C:\Program Files\CCleaner 2017-06-19 12:55 - 2017-06-19 12:55 - 00000000 ____D C:\Users\Tomek\Desktop\ch2m 2017-06-18 21:16 - 2017-06-18 21:16 - 00000000 ____D C:\Users\Tomek\AppData\LocalLow\uTorrent 2017-06-16 21:16 - 2017-06-16 21:16 - 00000000 ___SD C:\WINDOWS\UpdateAssistantV2 2017-06-16 18:06 - 2017-06-03 12:50 - 00315744 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2017-06-16 18:06 - 2017-06-03 12:06 - 02048496 _____ C:\WINDOWS\SysWOW64\CoreUIComponents.dll 2017-06-16 18:06 - 2017-06-03 11:55 - 00780640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WWAHost.exe 2017-06-16 18:06 - 2017-06-03 11:52 - 01021784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll 2017-06-16 18:06 - 2017-06-03 11:52 - 00607072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll 2017-06-16 18:06 - 2017-06-03 11:49 - 20967840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2017-06-16 18:06 - 2017-06-03 11:44 - 01412640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32full.dll 2017-06-16 18:06 - 2017-06-03 11:44 - 00545944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2017-06-16 18:06 - 2017-06-03 11:39 - 05686272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2017-06-16 18:06 - 2017-06-03 11:31 - 00224256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ExSMime.dll 2017-06-16 18:06 - 2017-06-03 11:31 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2017-06-16 18:06 - 2017-06-03 11:28 - 00285184 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.BlockedShutdown.dll 2017-06-16 18:06 - 2017-06-03 11:26 - 00231936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.LockScreen.dll 2017-06-16 18:06 - 2017-06-03 11:20 - 00755712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll 2017-06-16 18:06 - 2017-06-03 11:16 - 00709120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CPFilters.dll 2017-06-16 18:06 - 2017-06-03 11:15 - 00886272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aadtb.dll 2017-06-16 18:06 - 2017-06-03 11:08 - 02643968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tquery.dll 2017-06-16 18:06 - 2017-06-03 11:08 - 01221120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.Audio.dll 2017-06-16 18:06 - 2017-06-03 11:05 - 01883648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2017-06-16 18:06 - 2017-06-03 11:04 - 02006528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWrite.dll 2017-06-16 18:06 - 2017-06-03 11:03 - 01988096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mssrch.dll 2017-06-16 18:06 - 2017-06-03 11:02 - 02997760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\win32kfull.sys 2017-06-16 18:06 - 2017-06-03 10:40 - 00483840 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\CoreMessaging.dll 2017-06-16 18:06 - 2017-03-04 08:16 - 00368128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll 2017-06-16 18:05 - 2017-06-03 12:16 - 00279904 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\sdbus.sys 2017-06-16 18:05 - 2017-06-03 12:11 - 01706488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll 2017-06-16 18:05 - 2017-06-03 12:09 - 02213760 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll 2017-06-16 18:05 - 2017-06-03 12:08 - 07783256 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2017-06-16 18:05 - 2017-06-03 12:01 - 02681200 _____ C:\WINDOWS\system32\CoreUIComponents.dll 2017-06-16 18:05 - 2017-06-03 11:59 - 01181024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys 2017-06-16 18:05 - 2017-06-03 11:59 - 00118112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys 2017-06-16 18:05 - 2017-06-03 11:58 - 00340832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msv1_0.dll 2017-06-16 18:05 - 2017-06-03 11:54 - 00187232 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dumpsd.sys 2017-06-16 18:05 - 2017-06-03 11:52 - 00111968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll 2017-06-16 18:05 - 2017-06-03 11:51 - 02187104 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys 2017-06-16 18:05 - 2017-06-03 11:51 - 00402272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys 2017-06-16 18:05 - 2017-06-03 11:50 - 00857440 _____ (Microsoft Corporation) C:\WINDOWS\system32\WWAHost.exe 2017-06-16 18:05 - 2017-06-03 11:50 - 00381792 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS 2017-06-16 18:05 - 2017-06-03 11:48 - 00857952 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll 2017-06-16 18:05 - 2017-06-03 11:48 - 00148832 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll 2017-06-16 18:05 - 2017-06-03 11:45 - 22220864 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2017-06-16 18:05 - 2017-06-03 11:39 - 02532192 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2017-06-16 18:05 - 2017-06-03 11:33 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UserDataTimeUtil.dll 2017-06-16 18:05 - 2017-06-03 11:32 - 00002560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tzres.dll 2017-06-16 18:05 - 2017-06-03 11:28 - 00232448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edputil.dll 2017-06-16 18:05 - 2017-06-03 11:26 - 00100352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AuthBrokerUI.dll 2017-06-16 18:05 - 2017-06-03 11:23 - 00306688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieproxy.dll 2017-06-16 18:05 - 2017-06-03 11:22 - 00364544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll 2017-06-16 18:05 - 2017-06-03 11:22 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcorehc.dll 2017-06-16 18:05 - 2017-06-03 11:22 - 00181760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tcpipcfg.dll 2017-06-16 18:05 - 2017-06-03 11:19 - 01164288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certutil.exe 2017-06-16 18:05 - 2017-06-03 11:18 - 22569984 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2017-06-16 18:05 - 2017-06-03 11:16 - 00119808 _____ (Microsoft Corporation) C:\WINDOWS\system32\UserDataTimeUtil.dll 2017-06-16 18:05 - 2017-06-03 11:15 - 19414016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2017-06-16 18:05 - 2017-06-03 11:15 - 18364928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll 2017-06-16 18:05 - 2017-06-03 11:15 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\musdialoghandlers.dll 2017-06-16 18:05 - 2017-06-03 11:15 - 00041472 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\BasicRender.sys 2017-06-16 18:05 - 2017-06-03 11:14 - 00238592 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2017-06-16 18:05 - 2017-06-03 11:14 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssprxy.dll 2017-06-16 18:05 - 2017-06-03 11:14 - 00098304 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotificationUx.exe 2017-06-16 18:05 - 2017-06-03 11:12 - 00027136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fdProxy.dll 2017-06-16 18:05 - 2017-06-03 11:09 - 00441344 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcorehc.dll 2017-06-16 18:05 - 2017-06-03 11:08 - 12187648 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2017-06-16 18:05 - 2017-06-03 11:08 - 00691200 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieproxy.dll 2017-06-16 18:05 - 2017-06-03 11:07 - 00552960 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2017-06-16 18:05 - 2017-06-03 11:07 - 00456192 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll 2017-06-16 18:05 - 2017-06-03 11:06 - 03664384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2017-06-16 18:05 - 2017-06-03 11:05 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hnetcfg.dll 2017-06-16 18:05 - 2017-06-03 11:04 - 06042624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2017-06-16 18:05 - 2017-06-03 11:04 - 00773120 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SearchIndexer.exe 2017-06-16 18:05 - 2017-06-03 11:03 - 00932864 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll 2017-06-16 18:05 - 2017-06-03 11:00 - 23677440 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2017-06-16 18:05 - 2017-06-03 10:56 - 13091840 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2017-06-16 18:05 - 2017-06-03 10:54 - 01217024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.Audio.dll 2017-06-16 18:05 - 2017-06-03 10:53 - 08125440 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2017-06-16 18:05 - 2017-06-03 10:52 - 03403264 _____ (Microsoft Corporation) C:\WINDOWS\system32\tquery.dll 2017-06-16 18:05 - 2017-06-03 10:51 - 00266752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll 2017-06-16 18:05 - 2017-06-03 10:50 - 04744704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2017-06-16 18:05 - 2017-06-03 10:50 - 02538496 _____ (Microsoft Corporation) C:\WINDOWS\system32\mssrch.dll 2017-06-16 18:05 - 2017-06-03 10:49 - 02475520 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWrite.dll 2017-06-16 18:05 - 2017-06-03 10:49 - 01845248 _____ (Microsoft Corporation) C:\WINDOWS\system32\FntCache.dll 2017-06-16 18:05 - 2017-06-03 10:49 - 01513472 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kbase.sys 2017-06-16 18:05 - 2017-06-03 10:49 - 00903680 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchIndexer.exe 2017-06-16 18:05 - 2017-06-03 10:48 - 01131008 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll 2017-06-16 18:05 - 2017-06-03 10:48 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2017-06-16 18:05 - 2017-06-03 10:48 - 00391168 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuuhext.dll 2017-06-16 18:05 - 2017-05-25 07:56 - 00038752 _____ (Microsoft Corporation) C:\WINDOWS\system32\OOBEUpdater.exe 2017-06-16 18:05 - 2017-03-04 08:22 - 00822784 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2017-06-16 18:05 - 2017-03-04 08:19 - 00635904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll 2017-06-16 18:05 - 2017-03-04 08:16 - 00100864 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpninprc.dll 2017-06-16 18:05 - 2016-09-07 06:53 - 00118272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppointmentActivation.dll 2017-06-16 18:04 - 2017-06-03 12:50 - 00192856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aepic.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 01564512 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 01214816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00629088 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00544096 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00379232 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00335712 _____ (Microsoft Corporation) C:\WINDOWS\system32\dcntel.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00334176 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00233824 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00136032 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00136024 _____ (Microsoft Corporation) C:\WINDOWS\system32\ImplatSetup.dll 2017-06-16 18:04 - 2017-06-03 12:14 - 00096608 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe 2017-06-16 18:04 - 2017-06-03 12:14 - 00034648 _____ (Microsoft Corporation) C:\WINDOWS\system32\DeviceCensus.exe 2017-06-16 18:04 - 2017-06-03 12:11 - 00128864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tm.sys 2017-06-16 18:04 - 2017-06-03 11:59 - 00764392 _____ (Microsoft Corporation) C:\WINDOWS\system32\CoreMessaging.dll 2017-06-16 18:04 - 2017-06-03 11:53 - 00404824 _____ (Microsoft Corporation) C:\WINDOWS\system32\msv1_0.dll 2017-06-16 18:04 - 2017-06-03 11:49 - 00624048 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2017-06-16 18:04 - 2017-06-03 11:49 - 00509280 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys 2017-06-16 18:04 - 2017-06-03 11:48 - 01112416 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll 2017-06-16 18:04 - 2017-06-03 11:48 - 01100128 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvix64.exe 2017-06-16 18:04 - 2017-06-03 11:48 - 00989024 _____ (Microsoft Corporation) C:\WINDOWS\system32\hvax64.exe 2017-06-16 18:04 - 2017-06-03 11:44 - 01600624 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppobjs.dll 2017-06-16 18:04 - 2017-06-03 11:40 - 01566552 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32full.dll 2017-06-16 18:04 - 2017-06-03 11:40 - 00628552 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2017-06-16 18:04 - 2017-06-03 11:39 - 00455520 _____ (Microsoft Corporation) C:\WINDOWS\system32\securekernel.exe 2017-06-16 18:04 - 2017-06-03 11:22 - 07217152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2017-06-16 18:04 - 2017-06-03 11:16 - 00002560 _____ (Microsoft Corporation) C:\WINDOWS\system32\tzres.dll 2017-06-16 18:04 - 2017-06-03 11:14 - 00045056 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2017-06-16 18:04 - 2017-06-03 11:11 - 00353792 _____ (Microsoft Corporation) C:\WINDOWS\system32\cloudAP.dll 2017-06-16 18:04 - 2017-06-03 11:10 - 00418304 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.BlockedShutdown.dll 2017-06-16 18:04 - 2017-06-03 11:10 - 00252928 _____ (Microsoft Corporation) C:\WINDOWS\system32\edputil.dll 2017-06-16 18:04 - 2017-06-03 11:10 - 00117760 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthBrokerUI.dll 2017-06-16 18:04 - 2017-06-03 11:09 - 00489472 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll 2017-06-16 18:04 - 2017-06-03 11:09 - 00337408 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll 2017-06-16 18:04 - 2017-06-03 11:08 - 00324608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.LockScreen.dll 2017-06-16 18:04 - 2017-06-03 11:08 - 00147456 _____ (Microsoft Corporation) C:\WINDOWS\system32\winsrv.dll 2017-06-16 18:04 - 2017-06-03 11:07 - 00255488 _____ (Microsoft Corporation) C:\WINDOWS\system32\HNetCfgClient.dll 2017-06-16 18:04 - 2017-06-03 11:06 - 00198144 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpapisrv.dll 2017-06-16 18:04 - 2017-06-03 11:01 - 00856064 _____ (Microsoft Corporation) C:\WINDOWS\system32\efscore.dll 2017-06-16 18:04 - 2017-06-03 10:58 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\fdProxy.dll 2017-06-16 18:04 - 2017-06-03 10:52 - 02510848 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkMobileSettings.dll 2017-06-16 18:04 - 2017-06-03 10:52 - 00975872 _____ (Microsoft Corporation) C:\WINDOWS\HelpPane.exe 2017-06-16 18:04 - 2017-06-03 10:52 - 00886784 _____ (Microsoft Corporation) C:\WINDOWS\system32\CPFilters.dll 2017-06-16 18:04 - 2017-06-03 10:51 - 01418240 _____ (Microsoft Corporation) C:\WINDOWS\system32\certutil.exe 2017-06-16 18:04 - 2017-06-03 10:49 - 03615744 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2017-06-16 18:04 - 2017-06-03 10:49 - 02691072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2017-06-16 18:04 - 2017-06-03 10:49 - 02318848 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2017-06-16 18:04 - 2017-06-03 10:49 - 00351744 _____ (Microsoft Corporation) C:\WINDOWS\system32\hnetcfg.dll 2017-06-16 18:04 - 2017-06-03 10:48 - 01490432 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2017-06-16 18:04 - 2017-06-03 10:46 - 01121280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aadtb.dll 2017-06-16 18:04 - 2017-06-03 08:08 - 00080078 _____ C:\WINDOWS\system32\normidna.nls 2017-06-12 17:45 - 2017-06-12 17:45 - 00001207 _____ C:\Users\Public\Desktop\Avira Connect.lnk 2017-06-07 19:57 - 2017-06-07 19:57 - 00001228 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Creative Cloud.lnk 2017-06-07 19:57 - 2017-06-07 19:57 - 00001216 _____ C:\Users\Public\Desktop\Adobe Creative Cloud.lnk 2017-06-06 11:03 - 2017-06-06 11:03 - 00000000 ____D C:\Users\Tomek\Desktop\Śnieżnik 2017-05-31 10:04 - 2017-05-31 10:05 - 00030720 _____ C:\Users\Tomek\Desktop\karta uczestnictwa.dot 2017-05-26 23:20 - 2017-05-26 23:33 - 75118700 _____ C:\Users\Tomek\Desktop\[trt.pl] 360_Westworld_S01E10_The_Bicameral_Mind_FiNAL_LEKTOR_PL.mp4 2017-05-22 10:07 - 2017-05-22 10:07 - 00000000 ____D C:\Users\Tomek\AppData\Local\Tempzxpsign7e235dbd73197871 2017-05-22 10:07 - 2017-05-22 10:07 - 00000000 ____D C:\Users\Tomek\AppData\Local\Tempzxpsign6c2f7e3201d99dea 2017-05-22 10:06 - 2017-05-22 10:06 - 00000000 ____D C:\Users\Tomek\AppData\Local\Tempzxpsignfa047191a686f318 2017-05-22 10:06 - 2017-05-22 10:06 - 00000000 ____D C:\Users\Tomek\AppData\Local\Tempzxpsignd40aec5c523d7185 ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-19 17:02 - 2016-07-16 13:45 - 00000000 ____D C:\WINDOWS\INF 2017-06-19 17:00 - 2016-01-30 18:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-06-19 17:00 - 2013-03-23 18:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-06-19 16:47 - 2017-04-17 14:29 - 00000000 ____D C:\Users\Tomek\AppData\Roaming\Spotify 2017-06-19 16:46 - 2017-05-09 18:40 - 00000000 ___RD C:\Users\Tomek\Creative Cloud Files 2017-06-19 16:46 - 2017-04-17 14:30 - 00000000 ____D C:\Users\Tomek\AppData\Local\Spotify 2017-06-19 16:46 - 2012-01-11 09:53 - 00000000 ____D C:\Users\Tomek\AppData\Local\Adobe 2017-06-19 16:42 - 2017-04-10 14:37 - 00251832 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2017-06-19 16:40 - 2017-04-09 22:51 - 00000000 ____D C:\Program Files (x86)\Avira 2017-06-19 16:40 - 2016-10-18 03:30 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2017-06-19 16:39 - 2016-07-16 08:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI 2017-06-19 16:38 - 2016-10-18 02:47 - 00000000 ____D C:\Users\Tomek 2017-06-19 16:36 - 2017-04-09 22:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2017-06-19 16:36 - 2017-04-09 22:51 - 00000000 ____D C:\ProgramData\Avira 2017-06-19 16:31 - 2016-07-16 08:04 - 00032768 _____ C:\WINDOWS\system32\config\ELAM 2017-06-19 16:04 - 2016-10-18 02:36 - 00000000 ____D C:\WINDOWS\system32\SleepStudy 2017-06-19 16:04 - 2016-10-18 02:35 - 05088456 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2017-06-19 15:24 - 2016-07-16 13:36 - 00000000 ____D C:\WINDOWS\CbsTemp 2017-06-19 14:40 - 2012-01-07 21:29 - 00000000 ____D C:\Users\Tomek\AppData\Roaming\TS3Client 2017-06-19 14:40 - 2012-01-06 13:52 - 00000000 ____D C:\Users\Tomek\AppData\Roaming\uTorrent 2017-06-19 14:36 - 2016-12-24 15:56 - 00000000 ____D C:\WINDOWS\Minidump 2017-06-19 14:18 - 2012-01-14 13:42 - 00000000 ____D C:\Users\Tomek\Desktop\Programy 2017-06-19 14:16 - 2016-07-16 13:47 - 00000000 ___HD C:\Program Files\WindowsApps 2017-06-19 14:16 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\AppReadiness 2017-06-19 14:16 - 2015-11-15 10:20 - 00000000 ____D C:\Users\Tomek\AppData\Local\Packages 2017-06-19 13:50 - 2017-05-14 11:54 - 00000000 ____D C:\Users\Tomek\Desktop\Zdjęcia półka 2017-06-19 12:41 - 2016-10-18 02:45 - 02695054 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2017-06-19 12:41 - 2016-07-17 00:05 - 01072460 _____ C:\WINDOWS\system32\perfh015.dat 2017-06-19 12:41 - 2016-07-17 00:05 - 00273078 _____ C:\WINDOWS\system32\perfc015.dat 2017-06-18 21:56 - 2016-01-31 23:16 - 00002570 _____ C:\Users\Tomek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome Canary.lnk 2017-06-18 00:55 - 2016-05-24 23:47 - 00000000 ____D C:\ProgramData\Napisy24 2017-06-16 21:24 - 2015-11-15 10:20 - 00000000 __RHD C:\Users\Public\AccountPictures 2017-06-16 21:18 - 2013-03-14 10:43 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2017-06-16 21:18 - 2013-03-14 10:43 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2017-06-16 21:16 - 2016-07-16 13:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel 2017-06-16 21:16 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\system32\appraiser 2017-06-16 21:16 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\ShellExperiences 2017-06-16 18:44 - 2013-03-14 10:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2017-06-16 18:40 - 2013-08-09 10:43 - 00000000 ____D C:\WINDOWS\system32\MRT 2017-06-16 18:28 - 2012-09-11 16:24 - 133627792 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2017-06-16 17:12 - 2016-04-22 20:33 - 00000000 ____D C:\Program Files (x86)\McAfee 2017-06-16 17:12 - 2009-09-29 02:08 - 00004799 _____ C:\WINDOWS\system32\ServiceFilter.ini 2017-06-16 17:11 - 2016-04-22 20:10 - 00000000 ____D C:\Program Files\TrueKey 2017-06-16 17:03 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed 2017-06-16 17:03 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\system32\Macromed 2017-06-12 22:37 - 2017-04-24 14:24 - 00000000 ____D C:\Users\Tomek\Desktop\Fargo Season 1 S01 720p BluRay x265 HEVC SUJAIDR 2017-06-12 19:58 - 2017-05-04 10:48 - 00001230 _____ C:\Users\Public\Desktop\True Key.lnk 2017-06-12 19:58 - 2016-04-22 20:33 - 00001244 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\True Key.lnk 2017-06-12 17:45 - 2015-03-22 22:53 - 00000000 ____D C:\ProgramData\Package Cache 2017-06-12 16:35 - 2013-08-05 18:51 - 00565416 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe 2017-06-12 08:04 - 2011-12-29 14:35 - 00000000 ____D C:\Users\Tomek\AppData\Roaming\Adobe 2017-06-11 16:03 - 2016-10-18 02:47 - 00000000 ____D C:\Users\DefaultAppPool 2017-06-07 19:53 - 2009-09-29 01:51 - 00000000 ____D C:\Program Files (x86)\Adobe 2017-06-06 10:40 - 2012-01-02 21:44 - 00000000 ____D C:\ProgramData\boost_interprocess 2017-06-03 08:36 - 2016-07-16 13:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2017-06-03 08:36 - 2016-07-16 13:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2017-05-26 23:49 - 2012-01-06 19:44 - 00000000 ____D C:\Users\Tomek\AppData\Roaming\BESTplayer 2017-05-26 00:20 - 2013-02-12 00:39 - 00000000 ____D C:\Users\Tomek\AppData\Local\ElevatedDiagnostics 2017-05-26 00:19 - 2016-07-16 13:47 - 00000000 ____D C:\WINDOWS\system32\NDF ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-02-05 20:33 - 2015-03-13 12:57 - 0000020 _____ () C:\Users\Tomek\AppData\Roaming\appdataFr3.bin 2012-11-27 19:06 - 2012-11-27 19:06 - 0000207 _____ () C:\Users\Tomek\AppData\Roaming\LILLITH.MTBF.txt 2012-11-27 19:11 - 2015-01-12 22:46 - 0005120 _____ () C:\Users\Tomek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-05-24 18:06 - 2013-05-24 18:06 - 0000093 _____ () C:\Users\Tomek\AppData\Local\fusioncache.dat 2012-11-27 21:54 - 2012-11-27 21:54 - 0000855 _____ () C:\Users\Tomek\AppData\Local\recently-used.xbel 2012-10-04 15:14 - 2012-10-04 15:14 - 0007610 _____ () C:\Users\Tomek\AppData\Local\Resmon.ResmonCfg 2012-04-14 12:12 - 2017-02-14 18:49 - 0012194 _____ () C:\Users\Tomek\AppData\Local\unins000.dat 2012-04-14 12:12 - 2017-02-14 18:49 - 0011761 _____ () C:\Users\Tomek\AppData\Local\unins000.msg 2014-02-01 11:04 - 2014-02-01 11:04 - 0000000 _____ () C:\Users\Tomek\AppData\Local\{4DD614F5-5BB6-4B09-8675-648826004433} 2012-12-03 20:03 - 2013-04-20 12:30 - 0000088 __RSH () C:\ProgramData\33C66AEF4F.sys 2012-11-15 10:02 - 2012-11-15 10:02 - 0000057 _____ () C:\ProgramData\Ament.ini 2014-03-25 14:04 - 2015-11-03 20:47 - 0005608 _____ () C:\ProgramData\hpzinstall.log 2012-12-03 20:03 - 2013-04-20 12:30 - 0002828 ___SH () C:\ProgramData\KGyGaAvL.sys 2012-11-27 13:02 - 2012-11-27 13:15 - 0000024 _____ () C:\ProgramData\__FileUploader.log 2009-09-29 01:48 - 2009-09-29 01:49 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2009-09-29 01:48 - 2009-09-29 01:48 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log Pliki do przeniesienia lub usunięcia: ==================== C:\Users\Tomek\AppData\Local\Temp\ALLRemote.exe Niektóre pliki w TEMP: ==================== 2017-04-26 13:31 - 2017-06-19 16:45 - 2200144 _____ (ALLPlayer ) C:\Users\Tomek\AppData\Local\Temp\ALLRemote.exe 2017-04-26 13:30 - 2017-04-26 13:30 - 4131895 _____ (Napisy24.pl ) C:\Users\Tomek\AppData\Local\Temp\Napisy24.exe ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-06-19 13:07 ==================== Koniec FRST.txt ============================