Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 16.05.2018 01
Uruchomiony przez Bartek (administrator)  BARTEK-KOMPUTER (22-05-2018 17:08:26)
Uruchomiony z C:\Users\Bartek\Desktop
Załadowane profile: Bartek (Dostępne profile: Bartek)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe
() C:\Users\Bartek\AppData\Local\Temp\csrss\proxy\Tor\tor.exe
() C:\Windows\windefender.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe
() C:\Windows\rss\csrss.exe
() C:\Users\Bartek\AppData\Local\Temp\csrss\mrt.exe
(EpicNet Inc.) C:\Users\Bartek\AppData\Local\Temp\csrss\cloudnet.exe
() C:\Users\Bartek\AppData\Local\Temp\wup\wup.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TeamSpeak Systems GmbH) E:\Bartek\programy\teamspeak\ts3client_win64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\Run: [DampField] => C:\Windows\rss\csrss.exe [3173376 2018-05-21] () <==== UWAGA
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\Run: [CloudNet] => C:\Users\Bartek\AppData\Roaming\EpicNet Inc\CloudNet\cloudnet.exe [680960 2018-05-22] (EpicNet Inc.)
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: G - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: H - H:\Install.exe
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: {1b076533-6edd-11e6-8a13-90e6ba8602e5} - I:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: {4d9239e9-fc5d-11e7-88d3-90e6ba8602e5} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: {4d9239f4-fc5d-11e7-88d3-90e6ba8602e5} - G:\HiSuiteDownLoader.exe
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: {f65367bc-6bb0-11e6-987e-90e6ba8602e5} - G:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\...\MountPoints2: {f87ad94a-da9b-11e7-84f3-90e6ba8602e5} - G:\HTC_Sync_Manager_PC.exe
AppInit_DLLs: C:\ProgramData\Quoteex\PhysTrax.dll => Brak pliku
AppInit_DLLs-x32: C:\ProgramData\Quoteex\Keytech.dll => Brak pliku

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 31.128.24.2 31.128.0.31
Tcpip\..\Interfaces\{052B51D9-5069-4E2A-9FE4-5C97E012B954}: [NameServer] 8.8.8.8
Tcpip\..\Interfaces\{052B51D9-5069-4E2A-9FE4-5C97E012B954}: [DhcpNameServer] 31.128.24.2 31.128.0.31

Internet Explorer:
==================
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYoyDn3q68ALnTQQwq7elzZwgmnz37qXoKhUCvHsN1GiZZCF3m4prTM0mR0VaGpCldMNZ2yT4d0dQ-2XtvxvzBOfgsX2V7Wo8kvXF6diHO8ce3R6fmB01wcrP3yuOlyBsZrAfH4BM1jAIVRFwUG6cUutR_PWg,,&q={searchTerms}
HKU\S-1-5-21-360975752-3786565279-1083807947-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYoyDn3q68ALnTQQwq7elzZwgmnz37qXoKhUCvHsN1GiZZCF3m4prTM0mR0VaGpCldA6aBH6SIyVUPUh0wIUYP-LrkzKT5owTrePODdncsK8256r86EEWsnA0mQHR4-cGWxQKLkSYc_r8Ka08qQPHOnoG7wNw,,
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYoyDn3q68ALnTQQwq7elzZwgmnz37qXoKhUCvHsN1GiZZCF3m4prTM0mR0VaGpCldMNZ2yT4d0dQ-2XtvxvzBOfgsX2V7Wo8kvXF6diHO8ce3R6fmB01wcrP3yuOlyBsZrAfH4BM1jAIVRFwUG6cUutR_PWg,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-360975752-3786565279-1083807947-1001 -> DefaultScope {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYoyDn3q68ALnTQQwq7elzZwgmnz37qXoKhUCvHsN1GiZZCF3m4prTM0mR0VaGpCldMNZ2yT4d0dQ-2XtvxvzBOfgsX2V7Wo8kvXF6diHO8ce3R6fmB01wcrP3yuOlyBsZrAfH4BM1jAIVRFwUG6cUutR_PWg,,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-360975752-3786565279-1083807947-1001 -> {ielnksrch} URL = hxxps://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBRGNclVS1AC6sNoGk3GzeHhcr-ccYoyDn3q68ALnTQQwq7elzZwgmnz37qXoKhUCvHsN1GiZZCF3m4prTM0mR0VaGpCldMNZ2yT4d0dQ-2XtvxvzBOfgsX2V7Wo8kvXF6diHO8ce3R6fmB01wcrP3yuOlyBsZrAfH4BM1jAIVRFwUG6cUutR_PWg,,&q={searchTerms}
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office16\OCHelper.dll [2016-01-13] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office16\GROOVEEX.DLL [2016-01-13] (Microsoft Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office16\OCHelper.dll [2015-07-31] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2017-06-22] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office16\URLREDIR.DLL [2015-07-31] (Microsoft Corporation)
BHO-x32: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office16\GROOVEEX.DLL [2016-01-13] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2017-06-22] (Oracle Corporation)
Handler: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2016-01-13] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {3459B272-CC19-4448-86C9-DDC3B4B2FAD3} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-01-13] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\Office16\MSOSB.DLL [2016-01-13] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\Office16\MSOSB.DLL [2016-01-13] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: oy1dvr35.default-1506107866360
FF ProfilePath: C:\Users\Bartek\AppData\Roaming\Mozilla\Firefox\Profiles\oy1dvr35.default-1506107866360 [2018-05-21]
FF Homepage: Mozilla\Firefox\Profiles\oy1dvr35.default-1506107866360 -> C:\ProgramData\Quoteexs\ff.HP
FF NewTab: Mozilla\Firefox\Profiles\oy1dvr35.default-1506107866360 -> C:\ProgramData\Quoteexs\ff.NT
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2017-06-22] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2017-06-22] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-01-12] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office16\NPSPWRAP.DLL [2015-07-31] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-09-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-09-12] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [Brak pliku]
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [Brak pliku]

Chrome: 
=======
CHR res: Zainfekowany resources.pak (Adware script). Przeinstaluj Chrome. <==== UWAGA
CHR DefaultSearchURL: Default -> hxxps://feed.bazzsearch.com/?fext=true&publisherid=51206&publisher=defaultbazz&st=ed&q={searchTerms}
CHR DefaultSearchKeyword: Default -> Bazz Search
CHR Profile: C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default [2018-05-22]
CHR Extension: (Prezentacje) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-14]
CHR Extension: (Dokumenty) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-14]
CHR Extension: (Dysk Google) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-09-25]
CHR Extension: (YouTube) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-09-25]
CHR Extension: (Adblock Plus) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-05-17]
CHR Extension: (Arkusze) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-14]
CHR Extension: (Dokumenty Google offline) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-09-25]
CHR Extension: (GeForce Experience Stream Client) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjljknijpnfibppaijefibndmiabonep [2018-05-19]
CHR Extension: (Bazz Search) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmeinlfojlcegblpogpjbhipmonclejh [2018-05-21]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-04]
CHR Extension: (Gmail) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-09-25]
CHR Extension: (Chrome Media Router) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-04-23]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 Disc Soft Lite Bus Service; D:\daemon tools\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1467072 2016-06-22] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [389392 2016-11-02] (EasyAntiCheat Ltd)
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2017-07-26] () [Brak podpisu cyfrowego]
S3 MozillaMaintenance; C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe [172488 2017-04-02] (Mozilla Foundation)
R2 NVIDIA Wireless Controller Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe [1165368 2016-09-30] (NVIDIA Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2016-04-19] (Microsoft Corporation)
R2 WinDefender; C:\Windows\windefender.exe [1377280 2018-05-21] ()
S2 backlh; C:\ProgramData\Logic Cramble\set.exe [X] <==== UWAGA
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
R2 NvContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe" -s NvContainerLocalSystem -a -f "C:\ProgramData\NVIDIA\NvContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem"
S3 NvContainerNetworkService; "C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe" -s NvContainerNetworkService -f "C:\ProgramData\NVIDIA\NvContainerNetworkService.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\NetworkService"
S2 Quoteex; C:\ProgramData\\Quoteex\\Quoteex.exe shuz -f "C:\ProgramData\\Quoteex\\Quoteex.dat" -l -a <==== UWAGA
S2 saiyitechnology; C:\ProgramData\yahoochrome_D\desktop215.exe [X]
R2 TCPSvc; "C:\Users\Bartek\AppData\Local\Temp\csrss\proxy\Tor\tor.exe" --nt-service --SocksPort 7050 --Log "notice file C:\Users\Bartek\AppData\Local\Temp\csrss\proxy\t" <==== UWAGA

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-08-26] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-08-26] (Disc Soft Ltd)
S3 ew_usbccgpfilter; C:\Windows\System32\DRIVERS\ew_usbccgpfilter.sys [18944 2017-07-26] (Huawei Technologies Co., Ltd.)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2017-07-26] (Huawei Technologies Co., Ltd.)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2017-04-07] (Malwarebytes)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [29240 2016-09-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47672 2016-09-30] (NVIDIA Corporation)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1799680 2009-05-21] ()
R3 VBAudioVACMME; C:\Windows\System32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-05-22 17:08 - 2018-05-22 17:09 - 000016716 _____ C:\Users\Bartek\Desktop\FRST.txt
2018-05-22 17:06 - 2018-05-22 17:07 - 002413056 _____ (Farbar) C:\Users\Bartek\Desktop\FRST64.exe
2018-05-22 16:48 - 2018-05-22 16:56 - 000000000 ____D C:\Users\Bartek\Desktop\Resources
2018-05-22 14:31 - 2018-05-22 16:12 - 000003244 _____ C:\Windows\System32\Tasks\MRT
2018-05-22 11:53 - 2018-05-22 11:53 - 000291664 _____ C:\Windows\Minidump\052218-21746-01.dmp
2018-05-22 00:33 - 2018-05-22 00:36 - 105908315 _____ C:\Users\Bartek\Desktop\M2Bob_Free_Version_File.bob
2018-05-21 14:40 - 2018-05-21 14:40 - 000000000 ____D C:\Program Files (x86)\1lxripqvkmk
2018-05-21 14:18 - 2018-05-21 14:18 - 000003234 _____ C:\Windows\System32\Tasks\{D2DE5D13-9581-4CB6-A3AE-A21E739A4BCA}
2018-05-21 14:18 - 2018-05-21 14:18 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\EpicNet Inc
2018-05-21 14:17 - 2018-05-22 16:12 - 000003514 _____ C:\Windows\System32\Tasks\ScheduledUpdate
2018-05-21 14:17 - 2018-05-22 16:12 - 000003196 _____ C:\Windows\System32\Tasks\csrss
2018-05-21 14:17 - 2018-05-21 14:17 - 001377280 ____H C:\Windows\windefender.exe
2018-05-21 14:17 - 2018-05-21 14:17 - 000000000 ___HD C:\Windows\rss
2018-05-21 14:16 - 2018-05-21 14:17 - 000015606 _____ C:\Windows\SysWOW64\findit.xml
2018-05-21 14:16 - 2018-05-21 14:16 - 007611392 _____ C:\Users\Bartek\AppData\Local\agent.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 001987035 _____ C:\Users\Bartek\AppData\Local\Vaiaquophase.tst
2018-05-21 14:16 - 2018-05-21 14:16 - 001895382 _____ C:\Users\Bartek\AppData\Local\X-find.bin
2018-05-21 14:16 - 2018-05-21 14:16 - 000278508 _____ C:\Users\Bartek\AppData\Local\Toneco.tst
2018-05-21 14:16 - 2018-05-21 14:16 - 000126464 _____ C:\Users\Bartek\AppData\Local\noah.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 000070896 _____ C:\Users\Bartek\AppData\Local\Config.xml
2018-05-21 14:16 - 2018-05-21 14:16 - 000018432 _____ C:\Users\Bartek\AppData\Local\Main.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 000005568 _____ C:\Users\Bartek\AppData\Local\md.xml
2018-05-21 14:16 - 2018-05-21 14:15 - 002136576 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Vaiaquophase.exe
2018-05-21 14:16 - 2018-05-21 14:15 - 002136576 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Toneco.exe
2018-05-21 14:15 - 2018-05-21 14:18 - 000929792 _____ C:\Users\Bartek\AppData\Local\sham.db
2018-05-21 14:15 - 2018-05-21 14:17 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\WidModule
2018-05-21 14:15 - 2018-05-21 14:16 - 000016416 _____ C:\Users\Bartek\AppData\Local\InstallationConfiguration.xml
2018-05-21 14:15 - 2018-05-21 14:15 - 000140800 _____ C:\Users\Bartek\AppData\Local\installer.dat
2018-05-21 14:15 - 2018-05-21 14:15 - 000003238 _____ C:\Windows\System32\Tasks\vgokv
2018-05-21 14:15 - 2018-05-21 14:15 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\zmzol
2018-05-21 14:14 - 2018-05-21 14:14 - 001870764 _____ C:\Users\Bartek\Desktop\fishbot_2_0_nowy_metin2modypl.zip
2018-05-21 14:14 - 2018-05-21 14:14 - 000000000 ____D C:\Users\Bartek\Desktop\fishbot_2_0_nowy_metin2modypl
2018-05-21 14:03 - 2018-05-22 16:48 - 003810304 _____ C:\Users\Bartek\Desktop\M2Bob_Dll.dll
2018-05-21 14:03 - 2018-05-22 16:48 - 000078848 _____ C:\Users\Bartek\Desktop\M2Bob.exe
2018-05-21 14:02 - 2018-05-21 14:02 - 001036304 _____ (M2Bob-Team) C:\Users\Bartek\Desktop\M2Bob - Patcher.exe
2018-05-21 13:21 - 2018-05-21 13:21 - 000000000 ____D C:\Users\Bartek\AppData\Local\OfficeBSCache-MyComputer
2018-05-19 22:01 - 2018-05-19 22:01 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome
2018-05-18 10:21 - 2018-05-18 10:21 - 000217088 ____H C:\Users\Bartek\Desktop\~WRL1986.tmp
2018-05-16 16:30 - 2018-05-16 16:30 - 000000000 ____D C:\Program Files (x86)\GameforgeLive
2018-05-10 13:16 - 2018-05-10 13:19 - 000000000 ____D C:\Users\Bartek\Desktop\zdj babci
2018-05-04 21:53 - 2018-05-05 20:30 - 000000342 _____ C:\Users\Bartek\Desktop\na testy csgo.txt
2018-05-01 11:29 - 2018-05-01 11:29 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\fizzy
2018-04-24 22:07 - 2018-04-24 22:07 - 000262144 ____N C:\Windows\Minidump\042418-22027-01.dmp
2018-04-22 22:37 - 2018-04-22 22:37 - 000000000 ____D C:\Users\Bartek\AppData\LocalLow\The Irregular Corp
2018-04-22 21:10 - 2018-04-22 21:10 - 000023207 _____ C:\Users\Bartek\Desktop\PC.Building.Simulator.v0.7.9.1.torrent

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-05-22 17:08 - 2017-09-22 18:16 - 000000000 ____D C:\FRST
2018-05-22 16:58 - 2016-08-26 20:26 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\TS3Client
2018-05-22 16:19 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-05-22 16:19 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-05-22 16:12 - 2016-08-27 11:57 - 000000000 ____D C:\ProgramData\NVIDIA
2018-05-22 16:11 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-05-22 15:06 - 2017-10-12 20:16 - 000000000 ____D C:\Windows\AutoKMS
2018-05-22 11:55 - 2017-10-12 20:16 - 000003758 _____ C:\Windows\System32\Tasks\AutoKMS
2018-05-22 11:53 - 2017-03-27 09:33 - 000000000 ____D C:\Windows\Minidump
2018-05-21 14:17 - 2017-09-25 18:28 - 000002236 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-05-21 14:17 - 2016-11-22 22:31 - 000001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2018-05-21 14:17 - 2016-08-25 22:33 - 000001303 _____ C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2018-05-21 14:15 - 2017-01-22 22:21 - 000000000 ____D C:\Program Files (x86)\Google
2018-05-21 13:54 - 2016-11-05 22:30 - 000000000 ____D C:\Users\Bartek\Downloads\Gameforge Live
2018-05-19 17:20 - 2011-02-04 19:55 - 000155474 _____ C:\Windows\system32\perfc015.dat
2018-05-19 17:20 - 2011-02-04 19:55 - 000012470 _____ C:\Windows\system32\perfh015.dat
2018-05-19 17:20 - 2009-07-14 07:13 - 000936636 _____ C:\Windows\system32\PerfStringBackup.INI
2018-05-19 17:20 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-05-17 20:00 - 2016-11-05 22:29 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
2018-05-17 19:51 - 2017-09-25 18:25 - 000003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2018-05-17 19:51 - 2017-09-25 18:25 - 000003354 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2018-05-16 16:30 - 2016-11-05 22:30 - 000001138 _____ C:\Users\Public\Desktop\Metin2.lnk
2018-05-11 00:05 - 2016-08-29 23:03 - 000000000 ____D C:\Users\Bartek\AppData\Local\CrashDumps
2018-05-10 20:14 - 2017-06-19 23:04 - 000000000 ____D C:\Users\Bartek\AppData\Local\Microsoft Games
2018-05-01 11:29 - 2016-08-25 22:32 - 000000000 ____D C:\Users\Bartek\AppData\Local\VirtualStore
2018-04-30 13:56 - 2009-07-14 07:08 - 000032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-04-24 23:38 - 2016-11-11 19:56 - 000007605 _____ C:\Users\Bartek\AppData\Local\Resmon.ResmonCfg
2018-04-22 22:20 - 2016-08-26 00:54 - 000000000 ____D C:\Users\Bartek\AppData\Roaming\uTorrent

==================== Pliki w katalogu głównym wybranych folderów =======

2017-04-23 17:00 - 2017-05-05 00:12 - 000000600 _____ () C:\Users\Bartek\AppData\Roaming\winscp.rnd
2018-05-21 14:16 - 2018-05-21 14:16 - 007611392 _____ () C:\Users\Bartek\AppData\Local\agent.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 000070896 _____ () C:\Users\Bartek\AppData\Local\Config.xml
2018-05-21 14:15 - 2018-05-21 14:16 - 000016416 _____ () C:\Users\Bartek\AppData\Local\InstallationConfiguration.xml
2018-05-21 14:15 - 2018-05-21 14:15 - 000140800 _____ () C:\Users\Bartek\AppData\Local\installer.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 000018432 _____ () C:\Users\Bartek\AppData\Local\Main.dat
2018-05-21 14:16 - 2018-05-21 14:16 - 000005568 _____ () C:\Users\Bartek\AppData\Local\md.xml
2018-05-21 14:16 - 2018-05-21 14:16 - 000126464 _____ () C:\Users\Bartek\AppData\Local\noah.dat
2018-04-17 19:47 - 2018-04-17 19:47 - 000005661 _____ () C:\Users\Bartek\AppData\Local\recently-used.xbel
2016-11-11 19:56 - 2018-04-24 23:38 - 000007605 _____ () C:\Users\Bartek\AppData\Local\Resmon.ResmonCfg
2018-05-21 14:15 - 2018-05-21 14:18 - 000929792 _____ () C:\Users\Bartek\AppData\Local\sham.db
2018-05-21 14:16 - 2018-05-21 14:15 - 002136576 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Toneco.exe
2018-05-21 14:16 - 2018-05-21 14:16 - 000278508 _____ () C:\Users\Bartek\AppData\Local\Toneco.tst
2017-03-24 22:40 - 2017-03-24 22:40 - 000000552 _____ () C:\Users\Bartek\AppData\Local\TroubleshooterConfig.json
2018-05-21 14:16 - 2018-05-21 14:16 - 000032038 _____ () C:\Users\Bartek\AppData\Local\uninstall_temp.ico
2018-05-21 14:16 - 2018-05-21 14:15 - 002136576 _____ (TODO: <Company name>) C:\Users\Bartek\AppData\Local\Vaiaquophase.exe
2018-05-21 14:16 - 2018-05-21 14:16 - 001987035 _____ () C:\Users\Bartek\AppData\Local\Vaiaquophase.tst
2018-05-21 14:16 - 2018-05-21 14:16 - 001895382 _____ () C:\Users\Bartek\AppData\Local\X-find.bin

Pliki do przeniesienia lub usunięcia:
====================
C:\Windows\rss\csrss.exe


Niektóre pliki w TEMP:
====================
2018-05-21 14:17 - 2016-04-19 23:49 - 005551336 _____ (Microsoft Corporation) C:\Users\Bartek\AppData\Local\Temp\ntkrnlmp.exe
2018-05-21 14:17 - 2016-04-19 23:40 - 000634432 _____ (Microsoft Corporation) C:\Users\Bartek\AppData\Local\Temp\osloader.exe
2018-03-06 18:38 - 2018-03-09 00:27 - 015301888 _____ (Microsoft Corporation) C:\Users\Bartek\AppData\Local\Temp\vcredist_x64.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-05-18 12:20

==================== Koniec  FRST.txt ============================