Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 22.04.2018 01
Uruchomiony przez User (administrator)  PN (22-04-2018 23:04:40)
Uruchomiony z C:\Users\User\Desktop
Załadowane profile: User (Dostępne profile: User)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 3\creator-ws.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [98024 2018-01-30] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [] => [X]
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [3231232 2016-04-09] (Microsoft Corporation) <==== UWAGA
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [3231232 2016-04-09] (Microsoft Corporation) <==== UWAGA
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3199776 2018-04-03] (Valve Corporation)
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\Run: [uTorrent] => C:\Users\User\AppData\Roaming\uTorrent\uTorrent.exe [1987512 2018-04-22] (BitTorrent Inc.)
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: G - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: {507b2547-30b9-11e7-b77c-6c626d7ddd2d} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: {867e2f87-a420-11e6-8cfc-6c626d7ddd2d} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: {89aa7d02-6264-11e4-aaf5-6c626d7ddd2d} - F:\setup.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: {a7acccb1-b113-11e7-bdf7-6c626d7ddd2d} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\MountPoints2: {a7accd2b-b113-11e7-bdf7-6c626d7ddd2d} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\...\Winlogon: [Shell] C:\Windows\explorer.exe [3231232 2016-04-09] (Microsoft Corporation) <==== UWAGA
HKU\S-1-5-18\...\RunOnce: [SPReview] => "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [3231232 2016-04-09] (Microsoft Corporation) <==== UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 89.231.1.206 192.168.0.1
Tcpip\..\Interfaces\{7ED448E1-7132-40F1-A88A-6AE3CFCF2993}: [DhcpNameServer] 89.231.1.206 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-2592863027-1172541758-1557072248-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO-x32: PDF Architect 3 Helper -> {06E08260-0695-4EC1-A74B-1310D8899D93} -> C:\Program Files (x86)\PDF Architect 3\creator-ie-helper.dll [2015-09-17] (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: AviraBrowserSafety.BrowserSafety -> {c3c77255-42c0-499f-b664-6e981a0b1647} -> C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
Toolbar: HKLM-x32 - PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files (x86)\PDF Architect 3\creator-ie-plugin.dll [2015-09-17] (pdfforge GmbH)
Handler-x32: abs - {E00957BD-D0E1-4eb9-A025-7743FDC8B27B} - C:\Windows\system32\mscoree.dll [2010-11-05] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vc88yy83.default [2018-02-11]
FF Homepage: Mozilla\Firefox\Profiles\vc88yy83.default -> hxxp://google.pl/
FF Extension: (Avira Browser Safety) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vc88yy83.default\Extensions\abs@avira.com [2016-05-11] [Przestarzałe]
FF Extension: (Przelewy24Ext) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vc88yy83.default\Extensions\jid1-AoXeeOB4j7kFdw@jetpack.xpi [2015-07-18] [Przestarzałe] [Brak podpisu cyfrowego]
FF Extension: (Video DownloadHelper) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vc88yy83.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-11-11] [Przestarzałe]
FF Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\vc88yy83.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-15] [Przestarzałe]
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_3_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 3\resources\pdfarchitect3firefoxextension
FF Extension: (PDF Architect 3 Creator) - C:\Program Files (x86)\PDF Architect 3\resources\pdfarchitect3firefoxextension [2015-10-18] [Przestarzałe] [Brak podpisu cyfrowego]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_29_0_0_140.dll [2018-04-19] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-02-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll [Brak pliku]
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-02-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_29_0_0_140.dll [2018-04-19] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.)
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-02-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll [Brak pliku]
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [Brak pliku]
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-17] (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-02-17] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: PDF Architect 3 -> C:\Program Files (x86)\PDF Architect 3\np-previewer.dll [2015-09-17] (pdfforge GmbH)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default [2018-04-22]
CHR Extension: (Prezentacje) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13]
CHR Extension: (Dokumenty) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13]
CHR Extension: (Dysk Google) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-29]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-29]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-29]
CHR Extension: (Star Wars VII: The Force Awakens - Rey & BB-8) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhomklfjbgfjndojomfhmoghhngdnfnc [2016-03-28]
CHR Extension: (Arkusze) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13]
CHR Extension: (Avira Browser Safety) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2017-06-09]
CHR Extension: (Dokumenty Google offline) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2018-04-22]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-19]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-29]
CHR Extension: (Chrome Media Router) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-19]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ofoeigeaodhbjogdigckajfhjbonaofg] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1136744 2018-02-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [492560 2018-02-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [492560 2018-02-15] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1533608 2018-02-15] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [445112 2018-01-30] (Avira Operations GmbH & Co. KG)
S3 cfbackd; C:\Program Files (x86)\CleverFiles\Disk Drill\cfbackd.w32.exe [211520 2015-09-25] (CleverFiles)
S3 PDF Architect 3; C:\Program Files (x86)\PDF Architect 3\ws.exe [2244832 2015-09-17] (pdfforge GmbH)
S3 PDF Architect 3 CrashHandler; C:\Program Files (x86)\PDF Architect 3\crash-handler-ws.exe [964832 2015-09-17] (pdfforge GmbH)
R2 PDF Architect 3 Creator; C:\Program Files (x86)\PDF Architect 3\creator-ws.exe [767712 2015-09-17] (pdfforge GmbH)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-06-30] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5702416 2015-09-11] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 avdevprot; C:\Windows\System32\DRIVERS\avdevprot.sys [64504 2017-06-15] (Avira Operations GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [196344 2017-12-14] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [153552 2018-02-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [35328 2017-03-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [78600 2017-03-23] (Avira Operations GmbH & Co. KG)
R2 NPF; C:\Windows\SysWOW64\drivers\npf64.sys [36600 2015-12-16] (Riverbed Technology, Inc.)
S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]
S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]
S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]
S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]
S3 AndnetBus; system32\DRIVERS\lgandnetbus64.sys [X]
S3 AndNetDiag; system32\DRIVERS\lgandnetdiag64.sys [X]
S3 ANDNetModem; system32\DRIVERS\lgandnetmodem64.sys [X]
S3 LgBttPort; system32\DRIVERS\lgbtpt64.sys [X]
S3 lgbusenum; system32\DRIVERS\lgbtbs64.sys [X]
S3 LGVMODEM; system32\DRIVERS\lgvmdm64.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-04-22 23:04 - 2018-04-22 23:05 - 000017575 _____ C:\Users\User\Desktop\FRST.txt
2018-04-22 23:03 - 2018-04-22 23:04 - 000000000 ____D C:\FRST
2018-04-22 23:03 - 2018-04-22 23:03 - 002404864 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2018-04-22 22:48 - 2018-04-22 22:48 - 000000000 ____D C:\Users\User\AppData\Local\CrashRpt
2018-04-22 22:47 - 2018-04-22 23:00 - 000000000 ____D C:\Users\User\AppData\Local\DiskDrill
2018-04-22 22:47 - 2018-04-22 22:47 - 000003049 _____ C:\Users\User\Desktop\Disk Drill.lnk
2018-04-22 22:47 - 2018-04-22 22:47 - 000000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Cleverfiles Disk Drill
2018-04-22 22:47 - 2018-04-22 22:47 - 000000000 ____D C:\Program Files (x86)\CleverFiles
2018-04-22 22:45 - 2018-04-22 22:46 - 007766016 _____ C:\Users\User\Downloads\disk-drill-win.msi
2018-04-22 20:02 - 2018-04-22 22:47 - 000001899 _____ C:\Users\User\Desktop\UsbFix Anti-Malware.lnk
2018-04-22 20:02 - 2018-04-22 20:31 - 000000000 ____D C:\Program Files (x86)\UsbFix
2018-04-22 20:02 - 2018-04-22 20:02 - 007092424 _____ (SOSVirus) C:\Users\User\Downloads\UsbFix_10.020.exe
2018-04-22 10:48 - 2018-04-22 10:48 - 000019357 _____ C:\Users\User\Downloads\Renault Reprog [2018. 25.01].rar
2018-04-22 10:47 - 2018-04-22 10:47 - 000015924 _____ C:\Users\User\Downloads\calfiles.rar
2018-04-22 10:33 - 2018-04-22 10:33 - 000000000 ____D C:\Users\User\Desktop\SKODA 4.0 03.2012 (1)
2018-04-22 10:32 - 2018-04-22 10:32 - 000000000 ____D C:\Users\User\Desktop\VW 5.3 01.2016 (1)
2018-04-22 10:32 - 2018-04-22 10:32 - 000000000 ____D C:\Users\User\Desktop\SEAT 5.2 01.2015 (1)
2018-04-22 10:32 - 2018-04-22 10:32 - 000000000 ____D C:\Users\User\Desktop\AUDI 5.3 02.2016
2018-04-22 10:24 - 2018-04-22 10:24 - 000000000 ____D C:\Users\User\Desktop\Mercedes-Benz WIS ASRA 09.2017 Full [09.2017] [rutracker-5467854]
2018-04-22 10:21 - 2018-04-22 10:21 - 000000852 _____ C:\Users\User\Desktop\µTorrent.lnk
2018-04-19 14:53 - 2018-04-19 14:53 - 000062509 _____ C:\Users\User\Downloads\ipko_acc_data_20180419_145304.pdf
2018-03-23 13:33 - 2018-04-19 14:32 - 000004548 _____ C:\Windows\System32\Tasks\Adobe Flash Player NPAPI Notifier

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-04-22 22:46 - 2014-04-21 10:19 - 000000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2018-04-22 22:36 - 2014-05-14 14:04 - 000000386 _____ C:\Windows\Tasks\update-S-1-5-21-2592863027-1172541758-1557072248-1001.job
2018-04-22 22:06 - 2017-09-18 13:24 - 000003292 _____ C:\Windows\System32\Tasks\Avira_Antivirus_Systray
2018-04-22 21:38 - 2009-07-14 06:45 - 000026544 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-04-22 21:38 - 2009-07-14 06:45 - 000026544 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-04-22 20:53 - 2014-05-14 14:04 - 000000386 _____ C:\Windows\Tasks\update-sys.job
2018-04-22 10:21 - 2015-09-26 17:10 - 000000000 ____D C:\Program Files (x86)\Steam
2018-04-22 10:17 - 2014-12-20 00:14 - 000000000 ____D C:\Program Files (x86)\DVDVideoSoft
2018-04-22 10:17 - 2014-12-20 00:13 - 000000000 ____D C:\Users\User\AppData\Roaming\DVDVideoSoft
2018-04-22 10:06 - 2009-07-14 19:55 - 000740098 _____ C:\Windows\system32\perfh015.dat
2018-04-22 10:06 - 2009-07-14 19:55 - 000155672 _____ C:\Windows\system32\perfc015.dat
2018-04-22 10:06 - 2009-07-14 07:13 - 001669190 _____ C:\Windows\system32\PerfStringBackup.INI
2018-04-22 10:06 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-04-22 09:54 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-04-19 14:32 - 2015-02-21 19:52 - 000004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-04-19 14:32 - 2014-04-14 21:26 - 000804864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-04-19 14:32 - 2014-04-14 21:26 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-04-19 14:32 - 2014-04-14 21:26 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-04-19 14:32 - 2014-04-14 21:26 - 000000000 ____D C:\Windows\system32\Macromed
2018-04-19 14:06 - 2015-01-25 17:03 - 000000000 ____D C:\Users\User\Documents\efile-backup
2018-03-23 13:33 - 2015-02-21 19:59 - 000002236 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-03-23 13:33 - 2015-02-21 19:59 - 000002195 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Pliki w katalogu głównym wybranych folderów =======

2015-11-01 22:41 - 2015-11-01 22:42 - 000000132 _____ () C:\Users\User\AppData\Roaming\Preferencje Adobe CS5 dla formatu GIF
2014-05-14 13:17 - 2015-11-02 21:02 - 000000132 _____ () C:\Users\User\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG
2014-05-14 14:04 - 2014-05-14 14:04 - 000000003 _____ () C:\Users\User\AppData\Local\updater.log
2014-05-14 14:04 - 2014-06-02 14:19 - 000000434 _____ () C:\Users\User\AppData\Local\UserProducts.xml

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2016-07-04 22:07

==================== Koniec  FRST.txt ============================