Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:12-10-2015
Uruchomiony przez Michal (administrator)  MICHAL-PC (13-10-2015 15:38:46)
Uruchomiony z D:\Instalki\Cryptolocker 12.10.2015
Załadowane profile: Michal (Dostępne profile: Michal)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: IE)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
() C:\Windows\DAODx.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Windows\SysWOW64\HsMgr.exe
() C:\Windows\system\HsMgr64.exe
(CMedia) C:\Program Files\ASUS Xonar DX Audio\Customapp\AsusAudioCenter.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Drakonia Configurator\hid.exe
() C:\Program Files (x86)\Drakonia Configurator\trayicon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Cmaudio8788] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
HKLM\...\Run: [Cmaudio8788GX] => C:\Windows\syswow64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX64] => C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2010-04-27] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [GamingMouse] => C:\Program Files (x86)\Drakonia Configurator\hid.exe [248832 2013-10-29] ()
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-21] (Advanced Micro Devices, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2014-02-07] (Autodesk, Inc.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 89.231.1.206 217.172.224.160
Tcpip\..\Interfaces\{12AE1E79-4B22-4556-99DB-19FBA52AEA09}: [DhcpNameServer] 89.231.1.206 217.172.224.160
Tcpip\..\Interfaces\{378A3555-9711-420A-B14B-A9FBAD6DE053}: [DhcpNameServer] 89.231.1.206 217.172.224.160

Internet Explorer:
==================
HKU\S-1-5-21-1320927441-3038179963-326650102-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.pl/
SearchScopes: HKU\S-1-5-21-1320927441-3038179963-326650102-1000 -> DefaultScope {EE5B2E69-910A-4AA0-981E-7886B174AD53} URL = hxxps://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-1320927441-3038179963-326650102-1000 -> {EE5B2E69-910A-4AA0-981E-7886B174AD53} URL = hxxps://www.google.com/search?q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus64.dll [2015-09-22] (Eyeo GmbH)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll [2015-09-22] (Eyeo GmbH)

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-21] (Advanced Micro Devices, Inc.) [Brak podpisu cyfrowego]
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [31192 2014-02-07] (Autodesk, Inc.)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [Brak podpisu cyfrowego]
S2 MBAMService; D:\Programy\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2734080 2013-04-11] (C-Media Inc)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-10-12 23:23 - 2015-10-13 15:38 - 00000000 ____D C:\FRST
2015-10-12 21:37 - 2002-06-13 14:02 - 00032768 _____ (Sanx Consulting) C:\Windows\SysWOW64\svcmgr.ocx
2015-10-09 18:59 - 2015-10-09 18:59 - 25190400 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 19856896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 14451712 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 12857344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-10-09 18:59 - 2015-10-09 18:59 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-10-09 18:59 - 2015-10-09 18:59 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 02126336 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-10-09 18:59 - 2015-10-09 18:59 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-10-09 18:59 - 2015-10-09 18:59 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-10-09 18:59 - 2015-10-09 18:59 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-10-09 18:59 - 2015-10-09 18:59 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00665600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00585216 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00504832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-10-09 18:59 - 2015-10-09 18:59 - 00393304 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00344168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-10-09 18:59 - 2015-10-09 18:59 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-10-09 18:59 - 2015-10-09 18:59 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-10-09 18:59 - 2015-10-09 18:59 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-10-09 18:59 - 2015-10-09 18:59 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-10-09 18:59 - 2015-10-09 18:59 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-09-27 22:00 - 2015-09-27 22:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Alcatel onetouch Manager
2015-09-22 22:13 - 2015-09-28 11:18 - 00044966 _____ C:\BROM_DLL.log
2015-09-21 23:14 - 2015-09-21 23:14 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2015-09-21 23:14 - 2015-09-21 23:14 - 00000000 _____ C:\Windows\PanelExe.INI
2015-09-21 22:55 - 2015-10-13 15:34 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Mobile Action
2015-09-21 22:53 - 2011-06-22 09:47 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2015-09-21 22:53 - 2011-06-22 09:47 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2015-09-21 22:04 - 2015-10-12 21:16 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-21 22:04 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-21 22:04 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-21 22:04 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-20 23:58 - 2015-10-13 15:34 - 00000000 ____D C:\Users\Public\Nightstud3
2015-09-14 17:55 - 2015-10-13 15:34 - 00000000 ____D C:\Users\Michal\AppData\Roaming\fltk.org
2015-09-14 17:55 - 2015-10-13 15:34 - 00000000 ____D C:\ProgramData\fltk.org

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-10-13 15:36 - 2015-03-11 11:50 - 00212538 _____ C:\Windows\AutoKMS.log
2015-10-13 15:36 - 2015-03-11 02:30 - 00002740 _____ C:\Windows\System32\Tasks\AutoKMSDaily
2015-10-13 15:36 - 2015-03-11 02:30 - 00000202 _____ C:\Windows\Tasks\AutoKMSDaily.job
2015-10-13 15:36 - 2015-03-11 02:30 - 00000202 _____ C:\Windows\Tasks\AutoKMS.job
2015-10-13 15:36 - 2015-03-11 02:19 - 00078848 _____ C:\Windows\KMSEmulator.exe
2015-10-13 15:36 - 2014-07-23 14:32 - 01985840 _____ C:\Windows\WindowsUpdate.log
2015-10-13 15:36 - 2010-11-21 05:47 - 00230438 _____ C:\Windows\PFRO.log
2015-10-13 15:36 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-13 15:36 - 2009-07-14 06:51 - 00046083 _____ C:\Windows\setupact.log
2015-10-13 15:36 - 2009-07-14 06:45 - 00021904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-10-13 15:36 - 2009-07-14 06:45 - 00021904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-10-13 15:34 - 2015-09-07 01:05 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OCCT
2015-10-13 15:34 - 2015-09-06 21:13 - 00000000 ____D C:\Users\Michal\AppData\Roaming\ATI
2015-10-13 15:34 - 2015-09-06 21:13 - 00000000 ____D C:\ProgramData\ATI
2015-10-13 15:34 - 2015-09-06 21:12 - 00000000 ____D C:\ProgramData\AMD
2015-10-13 15:34 - 2015-09-06 13:56 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Trine3
2015-10-13 15:34 - 2015-08-03 15:01 - 00000000 ____D C:\ProgramData\Socialclub
2015-10-13 15:34 - 2015-06-23 00:15 - 00000000 ____D C:\Users\Michal\AppData\Roaming\uplay
2015-10-13 15:34 - 2015-06-22 23:21 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2015-10-13 15:34 - 2015-03-14 12:31 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Atod
2015-10-13 15:34 - 2015-03-11 17:11 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\Oracle
2015-10-13 15:34 - 2015-03-11 17:11 - 00000000 ____D C:\ProgramData\Sun
2015-10-13 15:34 - 2015-03-11 17:06 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\Sun
2015-10-13 15:34 - 2015-03-05 00:47 - 00000000 ____D C:\Users\Michal\AppData\Roaming\MathWorks
2015-10-13 15:34 - 2015-02-24 18:52 - 00000000 ____D C:\Saves
2015-10-13 15:34 - 2015-02-20 15:12 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\Krillbite Studio
2015-10-13 15:34 - 2015-02-17 20:25 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Petroglyph
2015-10-13 15:34 - 2015-01-25 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-10-13 15:34 - 2015-01-23 22:15 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Day 1 Studios
2015-10-13 15:34 - 2015-01-23 18:41 - 00000000 ____D C:\Users\Michal\AppData\Roaming\AMD
2015-10-13 15:34 - 2015-01-19 00:07 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Wise Registry Cleaner
2015-10-13 15:34 - 2015-01-03 22:34 - 00000000 ____D C:\Users\Michal\AppData\Roaming\NapiProjekt
2015-10-13 15:34 - 2014-12-10 03:15 - 00000000 ____D C:\Users\Michal\.thumbnails
2015-10-13 15:34 - 2014-12-10 03:03 - 00000000 ____D C:\Users\Michal\.gimp-2.8
2015-10-13 15:34 - 2014-11-22 22:46 - 00000000 ____D C:\Users\Michal\AppData\Roaming\11bitstudios
2015-10-13 15:34 - 2014-11-20 17:28 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\E_Line Media
2015-10-13 15:34 - 2014-11-20 17:23 - 00000000 __SHD C:\Users\Michal\AppData\LocalLow\EmieBrowserModeList
2015-10-13 15:34 - 2014-11-01 16:03 - 00000000 ____D C:\ProgramData\Solidshield
2015-10-13 15:34 - 2014-10-20 10:49 - 00000000 ____D C:\Users\Michal\AppData\Roaming\2K Sports
2015-10-13 15:34 - 2014-09-28 13:36 - 00000000 ___RD C:\Users\Michal\AppData\Roaming\Brother
2015-10-13 15:34 - 2014-09-28 13:36 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\Brother
2015-10-13 15:34 - 2014-09-28 13:28 - 00000000 ____D C:\Brother
2015-10-13 15:34 - 2014-09-28 13:23 - 00000000 ____D C:\ProgramData\Brother
2015-10-13 15:34 - 2014-09-24 13:50 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Steam
2015-10-13 15:34 - 2014-09-24 13:50 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Arrowhead
2015-10-13 15:34 - 2014-09-22 16:30 - 00000000 ____D C:\ProgramData\FLEXnet
2015-10-13 15:34 - 2014-09-22 16:09 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Autodesk
2015-10-13 15:34 - 2014-09-22 16:09 - 00000000 ____D C:\ProgramData\Autodesk
2015-10-13 15:34 - 2014-09-10 19:41 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Doublefine
2015-10-13 15:34 - 2014-09-05 19:55 - 00000000 ____D C:\ProgramData\Electronic Arts
2015-10-13 15:34 - 2014-08-31 16:01 - 00000000 ____D C:\Users\Michal\Graphisoft
2015-10-13 15:34 - 2014-08-31 16:01 - 00000000 ____D C:\Users\Michal\AppData\Roaming\MAXON
2015-10-13 15:34 - 2014-08-31 16:01 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Graphisoft
2015-10-13 15:34 - 2014-08-31 13:16 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Install.GS
2015-10-13 15:34 - 2014-08-24 17:28 - 00000000 ____D C:\Users\Michal\AppData\Roaming\pdfforge
2015-10-13 15:34 - 2014-08-23 09:46 - 00000000 __SHD C:\ProgramData\DSS
2015-10-13 15:34 - 2014-08-23 09:46 - 00000000 ____D C:\ProgramData\Codemasters
2015-10-13 15:34 - 2014-07-27 15:47 - 00000000 ____D C:\Users\Michal\AppData\Roaming\MPC-HC
2015-10-13 15:34 - 2014-07-27 03:00 - 00000000 ____D C:\ProgramData\Steam
2015-10-13 15:34 - 2014-07-26 21:09 - 00000000 ____D C:\ProgramData\Applications
2015-10-13 15:34 - 2014-07-26 01:04 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Macromedia
2015-10-13 15:34 - 2014-07-26 00:40 - 00000000 ____D C:\Users\Michal\AppData\Roaming\qBittorrent
2015-10-13 15:34 - 2014-07-25 18:53 - 00000000 ____D C:\Users\Michal\AppData\LocalLow\Adblock Plus for IE
2015-10-13 15:34 - 2014-07-25 16:49 - 00000000 ____D C:\Users\Michal\AppData\Roaming\MingGuan
2015-10-13 15:34 - 2014-07-25 15:25 - 00000000 ____D C:\Users\Michal\AppData\Roaming\ASUS
2015-10-13 15:34 - 2014-07-24 19:10 - 00000000 __SHD C:\Users\Michal\AppData\LocalLow\EmieUserList
2015-10-13 15:34 - 2014-07-24 19:07 - 00000000 __SHD C:\Users\Michal\AppData\LocalLow\EmieSiteList
2015-10-13 15:34 - 2014-07-24 19:06 - 00000000 ____D C:\Users\Michal\AppData\Roaming\Adobe
2015-10-13 15:34 - 2014-07-24 00:59 - 00000000 ____D C:\Intel
2015-10-13 15:34 - 2014-07-23 14:42 - 00000000 ____D C:\Users\Michal\AppData\Roaming\InstallShield
2015-10-13 15:34 - 2014-07-23 14:32 - 00000000 ___RD C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2015-10-13 15:34 - 2014-07-23 14:32 - 00000000 ___RD C:\Users\Michal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2015-10-13 15:34 - 2014-07-23 14:32 - 00000000 ____D C:\Users\Michal
2015-10-13 15:34 - 2011-04-12 15:32 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-10-13 15:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2015-10-13 15:27 - 2011-04-12 15:21 - 00740098 _____ C:\Windows\system32\perfh015.dat
2015-10-13 15:27 - 2011-04-12 15:21 - 00155672 _____ C:\Windows\system32\perfc015.dat
2015-10-13 15:27 - 2009-07-14 07:13 - 01669190 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-12 20:48 - 2014-09-10 19:41 - 00000000 ____D C:\ProgramData\RELOADED
2015-10-12 20:47 - 2014-07-23 14:42 - 00000000 ____D C:\ProgramData\Ralink Driver
2015-10-12 20:34 - 2015-03-11 17:09 - 00000000 ____D C:\ProgramData\Oracle
2015-10-10 23:27 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-10-09 19:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-10-06 12:05 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-09-23 03:28 - 2015-03-10 23:24 - 00000000 ____D C:\Program Files\Adblock Plus for IE
2015-09-19 23:52 - 2014-07-25 14:35 - 00000000 ____D C:\ProgramData\Package Cache
2015-09-19 21:46 - 2014-07-27 02:58 - 00201932 _____ C:\Windows\DirectX.log
2015-09-19 16:02 - 2014-07-27 02:53 - 00000000 ____D C:\Windows\SysWOW64\directx
2015-09-13 16:58 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games

==================== Pliki w katalogu głównym wybranych folderów =======

2015-10-12 22:59 - 2015-10-12 22:59 - 0001707 _____ () C:\Users\Michal\AppData\Local\recently-used.xbel
2014-07-25 00:11 - 2015-10-12 21:26 - 0007583 _____ () C:\Users\Michal\AppData\Local\resmon.resmoncfg
2015-03-10 21:26 - 2015-03-10 21:26 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-10-11 00:45

==================== Koniec  FRST.txt ============================