Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 12.02.2018
Uruchomiony przez pklos (administrator)  DESKTOP-DILHIUC (13-02-2018 19:19:23)
Uruchomiony z C:\Users\pklos\Downloads
Załadowane profile: pklos (Dostępne profile: pklos)
Platform: Windows 10 Home Wersja 1709 16299.125 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Adobe Systems, Incorporated) C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\MsMpEng.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Windows\KMS-R@1n.exe
() C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18011-0\NisSrv.exe
(Akamai Technologies, Inc.) C:\Users\pklos\AppData\Local\Akamai\netsession_win.exe
(Flux Software LLC) C:\Users\pklos\AppData\Local\FluxSoftware\Flux\flux.exe
(© 2015 Microsoft Corporation) C:\Users\pklos\AppData\Local\Microsoft\BingSvc\BingSvc.exe
(Akamai Technologies, Inc.) C:\Users\pklos\AppData\Local\Akamai\netsession_win.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\internet explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Windows\KMS-R@1nHook.exe
(Microsoft Corporation) C:\Windows\System32\SppExtComObj.Exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [SecurityHealth] => C:\Program Files\Windows Defender\MSASCuiL.exe [630168 2017-09-29] (Microsoft Corporation)
HKLM\...\Run: [AdobeGCInvoker-1.0] => C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGCInvokerUtility.exe [315880 2018-01-05] (Adobe Systems, Incorporated)
HKLM\...\Run: [SERVICE] => [X]
HKLM-x32\...\Run: [ADSK DLMSession] => C:\Program Files (x86)\Common Files\Autodesk Shared\Autodesk Download Manager\DLMSession.exe [1627032 2015-01-28] (Autodesk, Inc.)
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [523144 2015-09-07] (Autodesk Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318128 2016-11-16] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-11-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-12-19] (Oracle Corporation)
HKLM\...\RunOnce: [x4zzmy5u5ag] => C:\Program Files (x86)\ccc\ccc.exe [670208 2018-02-11] ()
HKLM\...\RunOnce: [pqgyl4fam1f] => C:\Program Files (x86)\ccc\ccc.exe [670208 2018-02-11] ()
Winlogon\Notify\igfxcui: C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4177784 2016-01-15] (Disc Soft Ltd)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [Akamai NetSession Interface] => C:\Users\pklos\AppData\Local\Akamai\netsession_win.exe [4691384 2015-09-10] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [f.lux] => C:\Users\pklos\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [BingSvc] => C:\Users\pklos\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-04-11] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [ApacheTomcatMonitor8.5_Tomcat8] => C:\Program Files\Apache Software Foundation\Tomcat 8.5\bin\Tomcat8w.exe [110208 2017-03-27] (Apache Software Foundation)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [TIDAL] => C:\Users\pklos\AppData\Local\TIDAL\update.exe [1783520 2017-06-20] (GitHub)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Run: [SmartSwitchPDLR.exe] => C:\Program Files (x86)\Samsung\Smart Switch PC\SmartSwitchPDLR.exe [1184928 2017-09-28] (Samsung)
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\Policies\Explorer: [] 
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\...\MountPoints2: {1b70ea69-d49a-11e5-995f-e8039afc473b} - "G:\Autorun.exe" 
AppInit_DLLs: C:\ProgramData\Quoteex\Dripranfix.dll => Brak pliku
AppInit_DLLs-x32: C:\ProgramData\Quoteex\Driptech.dll => Brak pliku
IFEO\OSppSvc.exe: [Debugger] KMS-R@1nHook.exe
IFEO\SppExtComObj.exe: [Debugger] KMS-R@1nHook.exe
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Ograniczenia - Chrome <==== UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{2269c826-5f35-43d7-a35d-1cb84fe064e3}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{2cc371c0-e1e4-4191-ad71-68a0ab659df2}: [NameServer] 82.163.142.8,95.211.158.136
Tcpip\..\Interfaces\{6997474f-c083-4230-bc4d-cdf004e68961}: [NameServer] 82.163.142.8,95.211.158.136
Tcpip\..\Interfaces\{6997474f-c083-4230-bc4d-cdf004e68961}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <==== UWAGA
HKU\S-1-5-21-1307399746-3321642949-2734818087-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYrAlKCo1kNn6F9vcF55hOQj6P9k6WrOGoLccoB77SOD-E_nl2Ja0e9z4E-Qq7umdnTrL2pKx7ADSs5fDKilpQ7nI8Q25B1bt_NZg30rpdle0ZkmtmGbGvA5MPWKWXvnZmv6g887a8EvGLsc9RoH_gzqAijFw,,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2018-02-04] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_161\bin\ssv.dll [2018-01-18] (Oracle Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2018-02-04] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_161\bin\jp2ssv.dll [2018-01-18] (Oracle Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\Office16\OCHelper.dll [2018-02-04] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\Office16\GROOVEEX.DLL [2018-02-04] (Microsoft Corporation)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-04] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-04] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-04] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2018-02-04] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: 34v2zedf.default
FF ProfilePath: C:\Users\pklos\AppData\Roaming\Mozilla\Firefox\Profiles\34v2zedf.default [2018-02-13]
FF Homepage: Mozilla\Firefox\Profiles\34v2zedf.default -> hxxps://encrypted.google.com
FF NewTab: Mozilla\Firefox\Profiles\34v2zedf.default -> C:\\ProgramData\\Quoteexs\\ff.NT
FF Extension: (NoScript) - C:\Users\pklos\AppData\Roaming\Mozilla\Firefox\Profiles\34v2zedf.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2018-01-30]
FF Extension: (Adblock Plus) - C:\Users\pklos\AppData\Roaming\Mozilla\Firefox\Profiles\34v2zedf.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-12-12]
FF Plugin: @java.com/DTPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\dtplugin\npDeployJava1.dll [2018-01-18] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.161.2 -> C:\Program Files\Java\jre1.8.0_161\bin\plugin2\npjp2.dll [2018-01-18] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-06-29] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-06-29] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-06-29] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2017-06-29] (Foxit Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2018-01-22] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2018-01-22] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-15] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-11-01] (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://google.pl/
CHR StartupUrls: Default -> "hxxps://search.safefinder.com/?st=sc&q="
CHR Profile: C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default [2018-02-13]
CHR Extension: (Prezentacje) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Dokumenty) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Dysk Google) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-16]
CHR Extension: (YouTube) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-16]
CHR Extension: (Google Search) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-16]
CHR Extension: (Arkusze) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Dokumenty Google offline) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-17]
CHR Extension: (AdBlock) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-02-13]
CHR Extension: (F.B.(FluffBusting)Purity) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmkinhboiljjkhaknpaeaicmdjhagpep [2018-02-13]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22]
CHR Extension: (Simple EPUB Reader) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojhbgcchcbdjdenibfmjofobklkkhofc [2017-11-08]
CHR Extension: (Gmail) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-16]
CHR Extension: (Chrome Media Router) - C:\Users\pklos\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-20]

Opera: 
=======
OPR Extension: (F.B.(FluffBusting)Purity) - C:\Users\pklos\AppData\Roaming\Opera Software\Opera Stable\Extensions\ncdlagniojmheiklojdcpdaeepochckl [2018-02-05]
OPR Extension: (Adblock Plus) - C:\Users\pklos\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2018-01-30]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S4 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [1136520 2015-09-07] (Autodesk Inc.)
R2 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2319848 2018-01-05] (Adobe Systems, Incorporated)
S2 Autodesk Content Service; C:\Program Files\Autodesk\Content Service\Connect.Service.ContentService.exe [31160 2015-02-05] (Autodesk, Inc.)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [7968432 2018-01-30] (Microsoft Corporation)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1369464 2016-01-15] (Disc Soft Ltd)
R2 KMS-R@1n; C:\Windows\KMS-R@1n.exe [26112 2016-11-26] () [Brak podpisu cyfrowego]
R2 MySQL57; C:\Program Files\MySQL\MySQL Server 5.7\bin\mysqld.exe [39496704 2017-06-22] () [Brak podpisu cyfrowego]
S3 MySQLRouter; C:\Program Files\MySQL\MySQL Router 2.1\bin\mysqlrouter.exe [326144 2017-04-06] () [Brak podpisu cyfrowego]
S4 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.)
S3 Te.Service; C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\Wex.Services.exe [137216 2015-11-19] (Microsoft Corporation) [Brak podpisu cyfrowego]
S4 Tomcat8; C:\Program Files\Apache Software Foundation\Tomcat 8.5\bin\Tomcat8.exe [109696 2017-03-27] (Apache Software Foundation)
S3 VSStandardCollectorService150; C:\Program Files (x86)\Microsoft Visual Studio\Shared\Common\DiagnosticsHub.Collection.Service\StandardCollector.Service.exe [129144 2017-08-23] (Microsoft Corporation)
R3 WdNisSvc; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\NisSrv.exe [356168 2018-01-19] (Microsoft Corporation)
R2 WinDefend; C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18011-0\MsMpEng.exe [105792 2018-01-19] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [82664 2015-12-16] (Advanced Micro Devices, Inc.)
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-02-16] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-02-16] (Disc Soft Ltd)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [27552 2016-02-16] (REALiX(tm))
R1 MpKsla5c6f4fa; C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{364D1096-E4BF-474F-ABEE-9ADBA7B1FF4A}\MpKsla5c6f4fa.sys [58120 2018-02-13] (Microsoft Corporation)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [604160 2017-09-29] (Realtek )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [410880 2016-01-27] (Realsil Semiconductor Corporation)
R3 ScpVBus; C:\WINDOWS\System32\drivers\ScpVBus.sys [39168 2016-04-14] (Scarlet.Crush Productions)
S2 Sentinel64; C:\WINDOWS\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.)
R3 VBoxNetAdp; C:\WINDOWS\System32\drivers\VBoxNetAdp6.sys [200832 2018-01-15] (Oracle Corporation)
R1 VBoxNetLwf; C:\WINDOWS\system32\DRIVERS\VBoxNetLwf.sys [211704 2018-01-15] (Oracle Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\wd\WdBoot.sys [46072 2018-01-19] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\wd\WdFilter.sys [288848 2018-01-19] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\drivers\wd\WdNisDrv.sys [129616 2018-01-19] (Microsoft Corporation)
S1 elauxnoe; \??\C:\WINDOWS\system32\drivers\elauxnoe.sys [X]
S1 fndzutse; \??\C:\WINDOWS\system32\drivers\fndzutse.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-02-13 18:51 - 2018-02-13 18:53 - 000061367 _____ C:\Users\pklos\Downloads\Addition.txt
2018-02-13 18:50 - 2018-02-13 19:19 - 000020256 _____ C:\Users\pklos\Downloads\FRST.txt
2018-02-13 18:48 - 2018-02-13 19:19 - 000000000 ____D C:\FRST
2018-02-13 18:48 - 2018-02-13 18:48 - 002405376 _____ (Farbar) C:\Users\pklos\Downloads\FRST64.exe
2018-02-13 18:38 - 2018-02-13 18:38 - 000000000 ____D C:\WINDOWS\system32\Drivers\wd
2018-02-13 18:33 - 2018-02-13 18:34 - 008222496 _____ (Malwarebytes) C:\Users\pklos\Downloads\adwcleaner_7.0.8.0.exe
2018-02-13 00:04 - 2018-02-13 00:04 - 000000085 _____ C:\WINDOWS\wininit.ini
2018-02-13 00:04 - 2018-02-13 00:04 - 000000000 ____D C:\WINDOWS\System32\Tasks\Safer-Networking
2018-02-12 23:15 - 2018-02-13 00:05 - 000000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2018-02-12 23:15 - 2018-02-13 00:04 - 000000000 ____D C:\ProgramData\Spybot - Search & Destroy
2018-02-12 23:13 - 2018-02-12 23:14 - 051725936 _____ (Safer-Networking Ltd. ) C:\Users\pklos\Downloads\spybotsd-2.6.46.exe
2018-02-12 22:05 - 2018-02-12 22:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js
2018-02-12 22:05 - 2018-02-12 22:05 - 000000000 ____D C:\Users\pklos\AppData\Roaming\npm
2018-02-12 22:05 - 2018-02-12 22:05 - 000000000 ____D C:\Program Files\nodejs
2018-02-12 22:02 - 2018-02-12 22:04 - 016748544 _____ C:\Users\pklos\Downloads\node-v8.9.4-x64.msi
2018-02-12 21:54 - 2018-02-13 18:37 - 155189248 _____ C:\WINDOWS\system32\config\SOFTWARE
2018-02-12 21:41 - 2018-02-12 21:54 - 000000000 ____D C:\WINDOWS\Microsoft Antimalware
2018-02-11 23:27 - 2018-02-11 23:27 - 000000266 __RSH C:\Users\pklos\ntuser.pol
2018-02-11 22:55 - 2018-02-11 22:55 - 007576064 _____ C:\Users\pklos\AppData\Local\agent.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 001983026 _____ C:\Users\pklos\AppData\Local\Subhome.tst
2018-02-11 22:55 - 2018-02-11 22:55 - 000278509 _____ C:\Users\pklos\AppData\Local\Rankronstring.tst
2018-02-11 22:55 - 2018-02-11 22:55 - 000140800 _____ C:\Users\pklos\AppData\Local\installer.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 000126464 _____ C:\Users\pklos\AppData\Local\noah.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 000070896 _____ C:\Users\pklos\AppData\Local\Config.xml
2018-02-11 22:55 - 2018-02-11 22:55 - 000005568 _____ C:\Users\pklos\AppData\Local\md.xml
2018-02-11 22:55 - 2018-02-11 22:55 - 000000000 ____D C:\Program Files (x86)\ccc
2018-02-11 22:54 - 2018-02-12 20:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Toolkit Final
2018-02-11 22:10 - 2018-02-11 22:10 - 000001149 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2018-02-11 22:10 - 2018-02-11 22:10 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2018-02-11 22:10 - 2018-02-11 22:10 - 000000000 ____D C:\Program Files\Oracle
2018-02-11 22:09 - 2018-02-11 22:09 - 113828696 _____ (Oracle Corporation) C:\Users\pklos\Downloads\VirtualBox-5.2.6-120293-Win.exe
2018-02-05 21:58 - 2018-02-05 21:58 - 000002200 _____ C:\Users\Public\Desktop\Smart Switch.lnk
2018-02-01 22:09 - 2018-02-01 22:09 - 000003588 _____ C:\WINDOWS\System32\Tasks\AdobeGCInvoker-1.0-DESKTOP-DILHIUC-pklos
2018-01-26 19:27 - 2018-01-26 19:27 - 003811578 _____ C:\Users\pklos\Downloads\Smilgin.Radoslaw.Zawod.Tester.Od.Decyzji.Do.Pierwszych.Krokow.W.Pracy.2016.POLiSH.eBook-Olbrzym.pdf
2018-01-23 23:02 - 2018-01-23 23:02 - 000000000 ____D C:\Users\pklos\Downloads\Dow__d_Rzeczowy_nr_3__2013_
2018-01-23 22:42 - 2018-01-23 22:42 - 000000000 ____D C:\Users\pklos\Downloads\Xxanaxx - FWRD
2018-01-23 22:41 - 2018-01-23 23:02 - 127376890 _____ C:\Users\pklos\Downloads\Dow__d_Rzeczowy_nr_3__2013_.rar
2018-01-23 22:35 - 2018-01-23 22:41 - 097778172 _____ C:\Users\pklos\Downloads\Xxanaxx - FWRD.rar
2018-01-19 19:59 - 2018-01-19 20:00 - 007394201 _____ C:\Users\pklos\Downloads\s55.pdf
2018-01-15 15:59 - 2018-01-15 15:59 - 000211704 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxNetLwf.sys
2018-01-15 15:59 - 2018-01-15 15:59 - 000200832 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxNetAdp6.sys
2018-01-14 15:35 - 2018-01-14 15:36 - 023323855 _____ C:\Users\pklos\Downloads\Jak przestać się martwić i zacząć żyć.pdf

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-02-13 18:47 - 2016-09-25 23:53 - 000000000 ____D C:\AdwCleaner
2018-02-13 18:46 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\DeliveryOptimization
2018-02-13 18:38 - 2017-12-19 21:27 - 000000006 ____H C:\WINDOWS\Tasks\SA.DAT
2018-02-13 18:37 - 2017-09-29 09:45 - 000524288 _____ C:\WINDOWS\system32\config\BBI
2018-02-13 18:36 - 2016-02-16 02:03 - 000002254 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2018-02-13 18:36 - 2016-02-16 02:03 - 000002254 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-02-13 18:30 - 2017-09-29 14:46 - 000000000 ___HD C:\Program Files\WindowsApps
2018-02-13 18:30 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\AppReadiness
2018-02-13 18:24 - 2016-02-16 13:01 - 000000000 ____D C:\Users\pklos\AppData\Local\Akamai
2018-02-13 06:06 - 2017-12-19 20:58 - 000000000 ____D C:\WINDOWS\system32\SleepStudy
2018-02-12 23:14 - 2016-12-27 21:17 - 000000000 ____D C:\Users\pklos\AppData\LocalLow\Mozilla
2018-02-12 22:54 - 2017-12-23 18:00 - 000000000 ____D C:\Program Files\Opera
2018-02-11 23:27 - 2017-12-19 21:04 - 000000000 ____D C:\Users\pklos
2018-02-11 23:24 - 2017-09-29 14:37 - 000000000 ____D C:\WINDOWS\CbsTemp
2018-02-11 22:56 - 2016-07-29 11:36 - 000000266 __RSH C:\ProgramData\ntuser.pol
2018-02-11 22:56 - 2015-10-30 08:24 - 000000000 ___HD C:\WINDOWS\system32\GroupPolicy
2018-02-11 22:18 - 2016-02-17 17:01 - 000000000 ____D C:\Users\pklos\.VirtualBox
2018-02-11 22:10 - 2017-09-29 14:44 - 000000000 ____D C:\WINDOWS\INF
2018-02-07 22:54 - 2017-12-04 10:13 - 000000000 ____D C:\Users\pklos\Documents\Visual Studio 2017
2018-02-06 03:49 - 2017-09-29 14:49 - 000835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2018-02-06 03:49 - 2017-09-29 14:49 - 000177648 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2018-02-04 21:47 - 2016-12-27 21:16 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-04 21:47 - 2016-12-27 21:16 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-02-04 19:49 - 2016-02-16 11:54 - 000000000 ____D C:\Users\pklos\AppData\Roaming\foobar2000
2018-02-04 15:52 - 2016-04-30 12:14 - 000000000 ____D C:\Users\pklos\.p2
2018-02-04 15:51 - 2016-04-30 12:22 - 000000000 ____D C:\Users\pklos\AppData\Local\Eclipse
2018-02-04 14:23 - 2017-09-29 14:46 - 000000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2018-02-04 14:21 - 2016-11-26 01:11 - 000000000 ____D C:\Program Files (x86)\Microsoft Office
2018-02-01 22:06 - 2016-12-27 21:16 - 000001232 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk
2018-01-31 22:12 - 2017-12-19 21:38 - 000003378 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task-S-1-5-21-1307399746-3321642949-2734818087-1001
2018-01-31 22:12 - 2016-02-16 01:51 - 000002411 _____ C:\Users\pklos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2018-01-31 22:12 - 2016-02-16 01:51 - 000000000 ___RD C:\Users\pklos\OneDrive
2018-01-28 14:02 - 2017-12-18 21:27 - 000000000 ___DC C:\WINDOWS\Panther
2018-01-28 14:02 - 2017-10-13 07:31 - 000000000 ____D C:\Users\pklos\AppData\Local\CrashDumps
2018-01-28 14:02 - 2017-10-12 15:08 - 000000000 ____D C:\Users\pklos\AppData\Roaming\FileZilla
2018-01-28 14:02 - 2017-09-29 14:46 - 000000000 ____D C:\WINDOWS\LiveKernelReports
2018-01-28 14:02 - 2017-07-26 23:23 - 000000000 ____D C:\Users\pklos\AppData\Roaming\inkscape
2018-01-28 14:02 - 2016-09-02 17:00 - 000000000 ____D C:\Users\pklos\AppData\Roaming\MPC-HC
2018-01-28 14:02 - 2016-03-28 12:55 - 000000000 ____D C:\Users\pklos\AppData\Roaming\uTorrent
2018-01-28 14:02 - 2016-02-16 11:26 - 000000000 ____D C:\Users\pklos\AppData\Roaming\DAEMON Tools Lite
2018-01-27 20:00 - 2017-04-22 15:54 - 000000000 ____D C:\Python34
2018-01-27 19:53 - 2018-01-06 11:29 - 000000000 ____D C:\ProgramData\Anaconda2
2018-01-25 22:12 - 2016-02-16 11:23 - 000548000 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2018-01-21 12:15 - 2017-11-26 20:08 - 000000000 ____D C:\Users\pklos\PycharmProjects
2018-01-19 20:24 - 2017-12-19 21:05 - 000000000 ____D C:\Users\pklos\AppData\Local\Packages
2018-01-18 19:28 - 2017-04-12 12:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2018-01-18 19:28 - 2017-04-12 12:45 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2018-01-18 19:28 - 2016-04-30 12:13 - 000000000 ____D C:\ProgramData\Oracle
2018-01-18 19:28 - 2016-04-30 12:13 - 000000000 ____D C:\Program Files\Java
2018-01-18 19:27 - 2017-04-12 12:46 - 000110144 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2018-01-15 15:59 - 2016-02-17 17:00 - 000972192 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxDrv.sys
2018-01-15 15:59 - 2016-02-17 17:00 - 000157672 _____ (Oracle Corporation) C:\WINDOWS\system32\Drivers\VBoxUSBMon.sys

==================== Pliki w katalogu głównym wybranych folderów =======

2017-07-12 10:07 - 2002-12-11 22:11 - 004085904 _____ (Microsoft Corporation) C:\Program Files (x86)\wmfdist.exe
2017-07-12 10:07 - 2003-04-15 19:27 - 000793536 _____ (Microsoft Corporation) C:\Program Files (x86)\wmpcdcs8.exe
2017-12-29 23:27 - 2017-12-31 00:36 - 000001752 _____ () C:\Users\pklos\AppData\Roaming\HP10bII+State.bin
2018-02-11 22:55 - 2018-02-11 22:55 - 007576064 _____ () C:\Users\pklos\AppData\Local\agent.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 000070896 _____ () C:\Users\pklos\AppData\Local\Config.xml
2018-02-11 22:55 - 2018-02-11 22:55 - 000140800 _____ () C:\Users\pklos\AppData\Local\installer.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 000005568 _____ () C:\Users\pklos\AppData\Local\md.xml
2018-02-11 22:55 - 2018-02-11 22:55 - 000126464 _____ () C:\Users\pklos\AppData\Local\noah.dat
2018-02-11 22:55 - 2018-02-11 22:55 - 000278509 _____ () C:\Users\pklos\AppData\Local\Rankronstring.tst
2017-12-09 11:37 - 2017-12-09 11:37 - 000002567 _____ () C:\Users\pklos\AppData\Local\recently-used.xbel
2016-04-28 19:59 - 2017-01-12 11:46 - 000007589 _____ () C:\Users\pklos\AppData\Local\Resmon.ResmonCfg
2018-02-11 22:55 - 2018-02-11 22:55 - 001983026 _____ () C:\Users\pklos\AppData\Local\Subhome.tst
2018-02-11 22:55 - 2018-02-11 22:55 - 000032038 _____ () C:\Users\pklos\AppData\Local\uninstall_temp.ico

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-02-09 20:25

==================== Koniec  FRST.txt ============================