Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 25-06-2017 01
Uruchomiony przez alfa1 (administrator)  WIN-ALFA-LAP (26-06-2017 12:07:37)
Uruchomiony z C:\Users\alfa1\Downloads
Załadowane profile: alfa1 (Dostępne profile: alfa1 & DefaultAppPool)
Platform: Windows 8.1 (Update) (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe
() C:\TwinCAT\EventLogger\TcEventLogger.exe
(BECKHOFF Automation) C:\TwinCAT\TCATSysSrv.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avpui.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
() C:\Program Files (x86)\Mobilt Bredband\CheckNDISPort_df.exe
() C:\Program Files (x86)\Mobilt Bredband\CancelAutoPlay_df.exe
(BECKHOFF Automation GmbH) C:\TwinCAT\TcSysUI.exe
(ComArch SA) C:\Program Files (x86)\Common Files\NOL3Starter\NOL3Starter.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [3146704 2017-05-09] (Malwarebytes)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2017-06-18] (Synaptics Incorporated)
HKLM-x32\...\Run: [ISUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-08-11] (Macrovision Corporation)
HKLM-x32\...\Run: [CheckNDISPortF0ac64] => C:\Program Files (x86)\Mobilt Bredband\CheckNDISPort_df.exe [418560 2013-04-01] ()
HKLM-x32\...\Run: [CancelAutoPlay_df] => C:\Program Files (x86)\Mobilt Bredband\CancelAutoPlay_df.exe [440648 2013-04-01] ()
HKLM-x32\...\Run: [TcSysUI] => C:\TwinCAT\TcSysUI.exe [349752 2015-12-14] (BECKHOFF Automation GmbH)
HKLM-x32\...\Run: [NOL3Starter] => C:\Program Files (x86)\Common Files\NOL3Starter\NOL3Starter.exe [4300800 2017-03-09] (ComArch SA)
HKLM-x32\...\Run: [InstallValidator.exe.FA87EC44_C38F_4148_93A1_FF4A64A2B707] => C:\Program Files (x86)\National Instruments\Shared\NIUninstaller\InstallValidator.exe [265608 2013-11-21] ()
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [5585136 2015-03-31] (Disc Soft Ltd)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [] => [X]
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1092448 2014-11-19] (Nokia)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9803992 2017-06-13] (Piriform Ltd)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27742168 2017-06-07] (Skype Technologies S.A.)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\Run: [Kaspersky Software Updater] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\...\MountPoints2: {593ac091-e5ed-11e4-8255-001f1693bc22} - "F:\EasyStartup.exe" 
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{2BE951F4-7F25-4C6C-8189-F21240D31ED1}: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{7D0E9F6E-FBBD-4E20-A8F3-F3EDAA8165A9}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-1405297173-1497940689-1013170819-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1405297173-1497940689-1013170819-1001 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-03-29] (AO Kaspersky Lab)
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
BHO: Brak nazwy -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> Brak pliku
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)
BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2017-03-29] (AO Kaspersky Lab)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
BHO-x32: Brak nazwy -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> Brak pliku
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-03-29] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\IEExt\ie_plugin.dll [2017-03-29] (AO Kaspersky Lab)
Handler-x32: amisie - {183A003A-3D01-4E94-A2C5-AD0108C68370} - C:\Program Files (x86)\AMIS\IeDtbPlugin.dll [2011-11-18] (TODO: <Company name>)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF DefaultProfile: 0ihprbz8.default
FF ProfilePath: C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default [2017-06-26]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\0ihprbz8.default -> do-search
FF Homepage: Mozilla\Firefox\Profiles\0ihprbz8.default -> about:home
FF Session Restore: Mozilla\Firefox\Profiles\0ihprbz8.default -> [funkcja włączona]
FF Extension: (anonymoX) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\client@anonymox.net.xpi [2017-06-21]
FF Extension: (Firebug) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\firebug@software.joehewitt.com.xpi [2017-03-05]
FF Extension: (AudioTube) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\firefox@org.audiotube.xpi [2017-04-27]
FF Extension: (Wiktionary and Google Translate) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\googledictionary@toptip.ca.xpi [2016-06-04]
FF Extension: (ImageShack right-click) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\imageshack@unsubstantial.info.xpi [2016-06-04]
FF Extension: (Simple YouTube to MP3/MP4 Converter) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\jid0-SQnwtgW1b8BsMB5PLV5WScEDWOjw@jetpack.xpi [2017-05-22]
FF Extension: (NO Google Analytics) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\jid1-JcGokIiQyjoBAQ@jetpack.xpi [2016-10-07]
FF Extension: (Lazarus: Form Recovery) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\lazarus@interclue.com.xpi [2016-06-04]
FF Extension: (Polski słownik poprawnej pisowni) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\pl@dictionaries.addons.mozilla.org [2016-03-07]
FF Extension: (Wappalyzer) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\wappalyzer@crunchlabz.com.xpi [2017-06-12]
FF Extension: (Google Analytics Opt-out Add-on (by Google)) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\{6d96bb5e-1175-4ebf-8ab5-5f56f1c79f65}.xpi [2017-03-31]
FF Extension: (NoScript) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2017-05-31]
FF Extension: (Adblock Plus) - C:\Users\alfa1\AppData\Roaming\Mozilla\Firefox\Profiles\0ihprbz8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-08]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 => nie znaleziono
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 => nie znaleziono
FF HKLM\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2017-03-29]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF48 => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF48 => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_131.dll [2017-06-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-16] ()
FF Plugin-x32: @comarch.com/NOL,version=3.0 -> C:\Program Files (x86)\Common Files\NOL3\npn30plugin.dll [2016-12-17] (COMARCH S.A.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin -> C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll [2014-11-19] ( )
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1405297173-1497940689-1013170819-1001: @citrixonline.com/appdetectorplugin -> C:\Users\alfa1\AppData\Local\Citrix\Plugins\104\npappdetector.dll [2015-04-27] (Citrix Online)

Chrome: 
=======
CHR DefaultProfile: Default
CHR DefaultSearchURL: Default -> hxxp://do-search.com/web/?type=ds&ts=1429412508&from=cor&uid=CrucialXCT256MX100SSD1_15030E6511DC0E6511DC&q={searchTerms}
CHR DefaultSearchKeyword: Default -> do-search
CHR Profile: C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default [2017-06-17]
CHR Extension: (Prezentacje Google) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-13]
CHR Extension: (Dokumenty Google) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-13]
CHR Extension: (Dysk Google) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-07]
CHR Extension: (YouTube) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-07]
CHR Extension: (Google Search) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-03-07]
CHR Extension: (Avast SafePrice) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2017-06-13]
CHR Extension: (Arkusze Google) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-13]
CHR Extension: (Dokumenty Google offline) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (Avast Online Security) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2017-06-13]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-05-01]
CHR Extension: (e-pity - dodatek) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ofoeigeaodhbjogdigckajfhjbonaofg [2017-04-27]
CHR Extension: (Gmail) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-04-18]
CHR Extension: (Chrome Media Router) - C:\Users\alfa1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-06-13]
CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ofoeigeaodhbjogdigckajfhjbonaofg] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1277680 2015-03-31] (Disc Soft Ltd)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation) [Brak podpisu cyfrowego]
R2 KSDE1.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [241544 2016-06-28] (AO Kaspersky Lab)
S2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
R3 ksu; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4470736 2017-05-09] (Malwarebytes)
S3 TcAdsWcfHost; C:\TwinCAT\AdsApi\TcAdsWcf\v3.5\TcAdsWcfHost.exe [6656 2013-09-20] (Beckhoff Automation GmbH) [Brak podpisu cyfrowego]
R2 TcEventLogger; C:\TwinCAT\EventLogger\TcEventLogger.exe [463416 2015-08-10] ()
R2 TcSysSrv; C:\TwinCAT\TCATSysSrv.exe [692280 2015-12-14] (BECKHOFF Automation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [6942480 2016-03-02] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [361824 2017-01-12] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [119872 2017-01-12] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdrivera.sys [307736 2017-03-30] (AVAST Software s.r.o.)
R0 aswbidsh; C:\Windows\system32\drivers\aswbidsha.sys [189768 2017-03-30] (AVAST Software s.r.o.)
R0 aswblog; C:\Windows\system32\drivers\aswbloga.sys [334088 2017-03-30] (AVAST Software s.r.o.)
R0 aswbuniv; C:\Windows\system32\drivers\aswbuniva.sys [48528 2017-03-30] (AVAST Software s.r.o.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [38296 2017-03-30] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [164064 2017-03-30] (AVAST Software)
S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [59904 2015-02-06] (www.winchiphead.com)
R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab)
R3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30352 2015-04-18] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77376 2017-05-25] ()
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-07] (AO Kaspersky Lab)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab)
R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [78216 2016-05-31] (AO Kaspersky Lab)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [28792 2016-03-31] (AO Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [197336 2017-06-16] (AO Kaspersky Lab)
R1 klhk; C:\Windows\System32\drivers\klhk.sys [520176 2017-06-16] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [1018592 2017-06-16] (AO Kaspersky Lab)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [57424 2017-03-29] (AO Kaspersky Lab)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [52136 2016-05-19] (AO Kaspersky Lab)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R3 kltap; C:\Windows\system32\DRIVERS\kltap.sys [52152 2016-06-07] (The OpenVPN Project)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [85320 2016-06-18] (AO Kaspersky Lab)
R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [136416 2017-03-29] (AO Kaspersky Lab)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [199392 2017-06-16] (AO Kaspersky Lab)
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [188312 2017-06-17] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [113592 2017-06-26] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [44960 2017-06-26] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [252832 2017-06-26] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [93600 2017-06-26] (Malwarebytes)
R2 TcIo; C:\TwinCAT\Driver\TcIo.sys [868512 2013-09-02] (Beckhoff Automation GmbH)
R2 TcRouter; C:\TwinCAT\Driver\TcRouter.sys [652448 2013-09-02] (Beckhoff Automation GmbH)
R2 TcRTime; C:\TwinCAT\Driver\TcRTime.sys [432800 2013-09-02] (Beckhoff Automation GmbH)
S3 usbser; C:\Windows\SysWOW64\drivers\usbser.sys [25600 2008-12-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [71680 2016-08-13] (Microsoft Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [46600 2017-02-10] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [274776 2017-01-12] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [117592 2017-01-12] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-26 11:44 - 2017-06-26 12:07 - 00024852 _____ C:\Users\alfa1\Downloads\FRST.txt
2017-06-26 11:41 - 2017-06-26 11:42 - 00380928 _____ C:\Users\alfa1\Downloads\ex5xoikj.exe
2017-06-26 11:24 - 2017-06-26 11:25 - 00240671 _____ C:\Users\alfa1\Downloads\rttj7spj.exe.part
2017-06-26 11:17 - 2017-06-26 11:19 - 02441216 _____ (Farbar) C:\Users\alfa1\Downloads\FRST64.exe
2017-06-22 13:27 - 2017-06-22 13:32 - 00000000 ____D C:\Users\alfa1\Desktop\xxx
2017-06-18 12:49 - 2017-06-18 12:49 - 00000000 ____D C:\Program Files\Synaptics
2017-06-18 12:46 - 2017-06-18 12:46 - 00000000 ____D C:\Users\alfa1\Downloads\TouchPad_Synaptics_14.0.6.0_W7x64W7x86_A
2017-06-18 06:01 - 2017-06-18 06:01 - 00091624 _____ C:\Users\alfa1\Documents\gmer-full.txt
2017-06-18 05:12 - 2017-06-18 05:12 - 00000499 _____ C:\Users\alfa1\Documents\gmer-skrócony.txt
2017-06-18 04:50 - 2017-06-26 12:07 - 00000000 ____D C:\FRST
2017-06-17 21:19 - 2017-06-17 21:19 - 00000834 _____ C:\Users\Public\Desktop\CCleaner.lnk
2017-06-17 21:16 - 2017-06-17 21:16 - 00049836 _____ C:\Users\alfa1\Documents\cc_20170617_211558.reg
2017-06-17 06:26 - 2017-06-17 06:26 - 00000000 ____D C:\Windows\pss
2017-06-17 06:06 - 2017-06-17 06:06 - 00188312 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-06-17 06:04 - 2017-06-26 11:23 - 00093600 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-06-17 06:04 - 2017-06-26 10:58 - 00113592 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-06-17 06:04 - 2017-06-26 10:58 - 00044960 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-06-17 06:03 - 2017-06-17 06:03 - 00001883 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-06-17 06:03 - 2017-06-17 06:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-06-17 06:03 - 2017-06-17 06:03 - 00000000 ____D C:\Program Files\Malwarebytes
2017-06-17 06:03 - 2017-05-25 11:58 - 00077376 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-06-16 19:05 - 2017-06-16 19:05 - 00001492 _____ C:\Users\Public\Desktop\LibreOffice 5.3.lnk
2017-06-16 19:05 - 2017-06-16 19:05 - 00000000 ___SD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LibreOffice 5.3
2017-06-16 19:04 - 2017-06-16 19:05 - 00000000 ____D C:\Program Files (x86)\LibreOffice 5
2017-06-16 15:20 - 2017-06-16 15:20 - 00002200 _____ C:\Users\Public\Desktop\Bezpieczne pieniądze.lnk
2017-06-16 15:20 - 2017-06-16 15:20 - 00002156 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk
2017-06-16 15:20 - 2017-06-16 15:20 - 00001398 _____ C:\Users\Public\Desktop\Kaspersky Secure Connection.lnk
2017-06-16 15:20 - 2017-06-16 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Secure Connection
2017-06-16 15:20 - 2017-06-16 15:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security
2017-06-16 15:20 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2017-06-16 15:19 - 2017-06-16 15:34 - 01018592 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys
2017-06-16 15:19 - 2017-06-16 15:34 - 00197336 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klflt.sys
2017-06-16 15:18 - 2017-06-16 15:18 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2017-06-16 14:45 - 2017-06-26 11:15 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-06-16 14:45 - 2017-06-16 15:20 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2017-06-16 14:45 - 2017-06-16 14:45 - 00001253 _____ C:\Users\Public\Desktop\Kaspersky Software Updater.lnk
2017-06-16 14:45 - 2017-06-16 14:45 - 00001071 ____H C:\Users\Public\Desktop\Kaspersky Security Scan.lnk
2017-06-16 14:45 - 2017-06-16 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Software Updater
2017-06-16 14:45 - 2017-06-16 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2017-06-16 14:43 - 2017-06-16 15:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2017-06-16 11:42 - 2017-06-16 11:44 - 00000000 ____D C:\Users\alfa1\Documents\Visual Studio 2010
2017-06-16 11:37 - 2017-06-16 11:47 - 00000000 ____D C:\Users\alfa1\Downloads\bank
2017-06-14 06:57 - 2017-06-02 14:15 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2017-06-14 06:57 - 2017-06-02 14:12 - 00468992 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2017-06-14 06:57 - 2017-06-02 14:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2017-06-14 06:57 - 2017-06-02 14:06 - 01001984 _____ (Microsoft Corporation) C:\Windows\HelpPane.exe
2017-06-14 06:57 - 2017-06-02 14:01 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2017-06-14 06:57 - 2017-06-02 13:30 - 03635200 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2017-06-14 06:57 - 2017-06-02 13:03 - 00903168 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2017-06-14 06:57 - 2017-06-02 12:58 - 02551808 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2017-06-14 06:57 - 2017-06-02 12:25 - 00272896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2017-06-14 06:57 - 2017-06-02 12:24 - 00391680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2017-06-14 06:57 - 2017-06-02 12:17 - 00699392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2017-06-14 06:57 - 2017-06-02 12:02 - 02751488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2017-06-14 06:57 - 2017-06-02 11:43 - 01920000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2017-06-14 06:57 - 2017-06-02 11:43 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2017-06-14 06:57 - 2017-05-15 21:58 - 00121184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tm.sys
2017-06-14 06:57 - 2017-05-14 22:44 - 04170240 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2017-06-14 06:57 - 2017-05-14 22:42 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2017-06-14 06:57 - 2017-05-14 22:26 - 00576512 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2017-06-14 06:57 - 2017-05-14 22:19 - 25738752 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2017-06-14 06:57 - 2017-05-14 22:19 - 01364040 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2017-06-14 06:57 - 2017-05-14 22:10 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2017-06-14 06:57 - 2017-05-14 21:55 - 05975040 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2017-06-14 06:57 - 2017-05-14 21:32 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2017-06-14 06:57 - 2017-05-14 21:31 - 01033216 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2017-06-14 06:57 - 2017-05-14 21:22 - 00499200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2017-06-14 06:57 - 2017-05-14 21:19 - 00806912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2017-06-14 06:57 - 2017-05-14 21:11 - 20274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2017-06-14 06:57 - 2017-05-14 21:10 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2017-06-14 06:57 - 2017-05-14 21:04 - 00315224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2017-06-14 06:57 - 2017-05-14 21:03 - 00373080 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2017-06-14 06:57 - 2017-05-14 20:54 - 15252992 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2017-06-14 06:57 - 2017-05-14 20:52 - 03240960 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2017-06-14 06:57 - 2017-05-14 20:48 - 05274112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2017-06-14 06:57 - 2017-05-14 20:46 - 00880640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2017-06-14 06:57 - 2017-05-14 20:44 - 04549120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2017-06-14 06:57 - 2017-05-14 20:40 - 00693248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2017-06-14 06:57 - 2017-05-14 20:38 - 07796736 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2017-06-14 06:57 - 2017-05-14 20:37 - 01544704 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2017-06-14 06:57 - 2017-05-14 20:30 - 13664768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2017-06-14 06:57 - 2017-05-14 20:27 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2017-06-14 06:57 - 2017-05-14 20:16 - 05268992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2017-06-14 06:57 - 2017-05-14 20:15 - 02767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2017-06-14 06:57 - 2017-05-14 20:13 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2017-06-14 06:57 - 2017-05-14 20:11 - 01314816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2017-06-14 06:57 - 2017-05-14 20:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2017-06-14 06:57 - 2017-05-14 20:06 - 07441240 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2017-06-14 06:57 - 2017-05-14 20:06 - 01737600 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2017-06-14 06:57 - 2017-05-14 20:06 - 01502000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2017-06-14 06:57 - 2017-05-12 19:05 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2017-06-14 06:57 - 2017-05-12 18:16 - 01084928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2017-06-14 06:57 - 2017-05-12 18:13 - 01559552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2017-06-14 06:57 - 2017-05-12 17:51 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2017-06-14 06:57 - 2017-05-12 17:50 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2017-06-14 06:57 - 2017-05-12 17:48 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2017-06-14 06:57 - 2017-05-12 17:47 - 00726528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2017-06-14 06:57 - 2017-05-12 06:10 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2017-06-14 06:57 - 2017-05-12 04:58 - 01985536 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2017-06-14 06:57 - 2017-05-12 04:48 - 01377792 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2017-06-14 06:57 - 2017-05-12 04:18 - 03714560 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2017-06-14 06:57 - 2017-05-12 04:11 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2017-06-14 06:57 - 2017-05-12 04:10 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2017-06-14 06:57 - 2017-05-12 04:07 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2017-06-14 06:57 - 2017-05-12 04:06 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2017-06-14 06:57 - 2017-05-12 04:04 - 00897024 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2017-06-14 06:57 - 2017-05-12 04:00 - 02240512 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2017-06-14 06:57 - 2017-05-12 01:36 - 22361848 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2017-06-14 06:57 - 2017-05-12 01:32 - 19788672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2017-06-14 06:57 - 2017-05-10 20:19 - 00101720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2017-06-14 06:57 - 2017-05-06 18:05 - 01094656 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2017-06-14 06:57 - 2017-05-06 18:04 - 00865792 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2017-06-14 06:57 - 2017-04-06 19:37 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2017-06-14 06:57 - 2017-04-06 19:16 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\wpd_ci.dll
2017-06-14 06:57 - 2017-04-06 18:50 - 01436672 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2017-06-14 06:57 - 2017-04-06 18:46 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2017-06-14 06:57 - 2017-04-06 18:46 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2017-06-14 06:57 - 2017-04-06 18:35 - 01362432 _____ (Microsoft Corporation) C:\Windows\system32\gpsvc.dll
2017-06-14 06:57 - 2017-04-06 18:15 - 00358912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2017-06-14 06:57 - 2017-04-06 17:44 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\wpdbusenum.dll
2017-06-14 06:57 - 2017-04-02 16:49 - 00186880 _____ (Microsoft Corporation) C:\Windows\system32\dpapisrv.dll
2017-06-14 06:57 - 2017-04-02 15:40 - 02013016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2017-06-14 06:53 - 2017-02-01 21:44 - 00201728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2017-06-13 16:36 - 2017-06-13 16:39 - 53207206 _____ C:\Users\alfa1\Downloads\Sowa & purpurowi przyjaciele. Koneksje kapelana TVN z kard. Dziwiszem (97).flv

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-26 12:01 - 2015-03-13 19:12 - 00000000 ____D C:\Users\alfa1\AppData\Roaming\Skype
2017-06-26 11:10 - 2015-04-27 19:00 - 00000588 _____ C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-1405297173-1497940689-1013170819-1001.job
2017-06-26 11:06 - 2015-04-25 06:18 - 00004000 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{252C2E59-6140-4289-9A9A-43BC23E7EF73}
2017-06-26 11:05 - 2015-03-13 19:54 - 00000000 ____D C:\Users\alfa1\AppData\Roaming\ClassicShell
2017-06-26 11:05 - 2015-03-13 15:19 - 02105512 _____ C:\Windows\system32\PerfStringBackup.INI
2017-06-26 11:05 - 2013-08-23 01:12 - 00910772 _____ C:\Windows\system32\perfh015.dat
2017-06-26 11:05 - 2013-08-23 01:12 - 00209028 _____ C:\Windows\system32\perfc015.dat
2017-06-26 11:05 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\Inf
2017-06-26 11:03 - 2017-02-21 14:23 - 00000000 ____D C:\Users\alfa1\AppData\LocalLow\Mozilla
2017-06-26 11:00 - 2017-03-19 11:55 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-06-26 11:00 - 2015-03-13 17:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-06-26 10:58 - 2016-01-24 13:45 - 00000000 ____D C:\TwinCAT
2017-06-26 10:58 - 2015-03-13 19:47 - 00252832 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-06-26 10:57 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-21 11:14 - 2017-05-01 17:00 - 00000000 ____D C:\Users\alfa1\AppData\Local\Arduino15
2017-06-21 10:35 - 2015-08-12 05:06 - 00000684 _____ C:\Windows\Tasks\G2MUploadTask-S-1-5-21-1405297173-1497940689-1013170819-1001.job
2017-06-18 12:46 - 2009-09-17 20:12 - 00292912 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2017-06-18 12:46 - 2009-09-17 20:09 - 00396072 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00263464 _____ (Synaptics Incorporated) C:\Windows\system32\SynCtrl.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00206120 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCtrl.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00205608 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00169256 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00147752 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo4.dll
2017-06-18 12:46 - 2009-09-17 20:09 - 00107816 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2017-06-18 12:46 - 2009-08-07 09:49 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2017-06-18 06:05 - 2015-03-13 16:41 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1405297173-1497940689-1013170819-1001
2017-06-17 06:03 - 2015-03-13 19:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-06-17 06:03 - 2015-03-13 19:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2017-06-17 05:13 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2017-06-17 04:48 - 2013-08-22 16:44 - 00414056 _____ C:\Windows\system32\FNTCACHE.DAT
2017-06-16 18:35 - 2015-04-18 18:18 - 00000000 ____D C:\ProgramData\YTAHelper
2017-06-16 18:35 - 2015-04-18 18:18 - 00000000 ____D C:\Program Files (x86)\YTAHelper
2017-06-16 15:34 - 2016-06-14 17:47 - 00199392 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\kneps.sys
2017-06-16 15:33 - 2017-03-29 04:05 - 00520176 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys
2017-06-16 15:25 - 2016-02-05 19:15 - 00000000 ____D C:\Program Files\CCleaner
2017-06-16 15:21 - 2015-12-08 11:55 - 00000000 ____D C:\Program Files\Common Files\AV
2017-06-16 15:20 - 2013-08-22 17:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2017-06-16 15:20 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2017-06-16 15:18 - 2015-03-13 17:01 - 00000000 ____D C:\Program Files\AVAST Software
2017-06-16 15:18 - 2015-03-13 16:59 - 00000000 ____D C:\ProgramData\AVAST Software
2017-06-16 12:29 - 2015-03-13 15:37 - 00000000 ____D C:\Users\alfa1\AppData\Local\Packages
2017-06-16 12:29 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2017-06-16 12:29 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2017-06-16 11:41 - 2015-06-17 18:30 - 00004388 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-06-16 11:41 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-06-16 11:41 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\Macromed
2017-06-14 07:53 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ToastData
2017-06-14 07:37 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2017-06-14 07:33 - 2015-03-13 17:47 - 133627792 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2017-06-14 07:33 - 2015-03-13 17:47 - 00000000 ____D C:\Windows\system32\MRT
2017-06-14 06:49 - 2017-04-19 08:06 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2017-06-14 06:48 - 2017-04-19 08:06 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2017-06-13 19:58 - 2015-03-13 20:02 - 00000000 ____D C:\Users\alfa1\AppData\Roaming\vlc
2017-06-13 16:33 - 2015-08-12 05:06 - 00003692 _____ C:\Windows\System32\Tasks\G2MUploadTask-S-1-5-21-1405297173-1497940689-1013170819-1001
2017-06-13 16:33 - 2015-04-27 19:00 - 00003596 _____ C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-1405297173-1497940689-1013170819-1001
2017-06-12 11:31 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2017-06-12 09:19 - 2017-03-19 11:53 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-06-03 04:31 - 2016-10-30 17:19 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-06-03 04:31 - 2016-10-30 17:19 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-06-02 11:15 - 2016-10-30 17:18 - 00003968 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1477840722
2017-06-02 11:15 - 2016-10-30 17:18 - 00001059 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk
2017-05-29 10:41 - 2017-03-30 10:41 - 00004172 _____ C:\Windows\System32\Tasks\Avast Emergency Update

==================== Pliki w katalogu głównym wybranych folderów =======

2016-01-24 14:38 - 2016-01-24 14:38 - 0000730 _____ () C:\Users\alfa1\AppData\Roaming\APStartupCulture
2015-03-14 08:26 - 2015-03-14 08:26 - 0007650 _____ () C:\Users\alfa1\AppData\Local\Resmon.ResmonCfg
2016-01-24 14:38 - 2016-01-24 14:38 - 0000730 _____ () C:\ProgramData\APStartupCulture

Niektóre pliki w TEMP:
====================
2017-06-18 04:26 - 2017-06-18 04:26 - 0001536 _____ () C:\Users\alfa1\AppData\Local\Temp\NOSEventMessages.dll

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-06-17 05:14

==================== Koniec  FRST.txt ============================