Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:29-10-2015
Uruchomiony przez Ewela22 (administrator)  EWELA (30-10-2015 20:23:02)
Uruchomiony z C:\Users\Ewela22\Desktop
Załadowane profile: Ewela22 (Dostępne profile: Ewela22)
Platform: Windows 8.1 Connected (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe
(Refactoria Paweł Urbanek) C:\Program Files (x86)\Draco Software\Draco Organizer 3\Organizer.exe
(Spotify Ltd) C:\Users\Ewela22\AppData\Roaming\Spotify\SpotifyWebHelper.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Qihu 360 Software Co., Ltd.) C:\Users\Ewela22\AppData\Local\360Browser\Browser\Application\360browser.exe
(Farbar) C:\Users\Ewela22\Desktop\FRST64 (1).exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Classic Start Menu] => C:\Program Files\Classic Shell\ClassicStartMenu.exe [161984 2014-04-20] (IvoSoft)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [1080992 2014-04-23] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe [63296 2014-02-25] ()
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [134784 2014-02-25] (Atheros Communications)
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\Run: [Google Update] => C:\Users\Ewela22\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-08-29] (Google Inc.)
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31280256 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\Run: [Draco Organizer] => C:\Program Files (x86)\Draco Software\Draco Organizer 3\Organizer.exe [11222528 2011-01-18] (Refactoria Paweł Urbanek)
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\Run: [Spotify Web Helper] => C:\Users\Ewela22\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2021944 2015-06-14] (Spotify Ltd)
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\Run: [download.ninja] => C:\Program Files\Ninja Download Manager\download.ninja.exe [5240240 2015-06-19] ()
HKU\S-1-5-21-1587283898-3112464119-1393011846-1001\...\MountPoints2: {8a162feb-4f67-11e4-825c-dc85ded503aa} - "F:\AutoRun.exe" 
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
ShellIconOverlayIdentifiers: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
ShellIconOverlayIdentifiers-x32: [ShareOverlay] -> {594D4122-1F87-41E2-96C7-825FB4796516} => C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
Startup: C:\Users\Ewela22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk [2015-09-26]
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

ProxyEnable: [S-1-5-21-1587283898-3112464119-1393011846-1001] => Proxy [funkcja włączona]
Tcpip\Parameters: [DhcpNameServer] 194.204.152.34 208.67.222.222
Tcpip\..\Interfaces\{867DA877-F1E3-43BA-864C-A5ABB3C3F60C}: [DhcpNameServer] 194.204.152.34 208.67.222.222
Tcpip\..\Interfaces\{EC268CD1-2D4A-4B16-87FC-6B1C3FC8F44C}: [DhcpNameServer] 40.54.1.17

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
SearchScopes: HKU\S-1-5-21-1587283898-3112464119-1393011846-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1587283898-3112464119-1393011846-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?PC=WCUG&FORM=WCUGDF&q={searchTerms}
BHO: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_64.dll [2014-04-20] (IvoSoft)
BHO-x32: ExplorerBHO Class -> {449D0D6E-2412-4E61-B68F-1CB625CD9E52} -> C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Download Ninja IE -> {C935DDA0-269E-11E4-9235-78C81D5D46B0} -> C:\Program Files\Ninja Download Manager\DownloadNinjaIE.dll [2015-06-19] ()
BHO-x32: ClassicIEBHO Class -> {EA801577-E6AD-4BD5-8F71-4BE0154331A4} -> C:\Program Files\Classic Shell\ClassicIEDLL_32.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll [2014-04-20] (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll [2014-04-20] (IvoSoft)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin HKU\S-1-5-21-1587283898-3112464119-1393011846-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Ewela22\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-20] (Google Inc.)
FF Plugin HKU\S-1-5-21-1587283898-3112464119-1393011846-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Ewela22\AppData\Local\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-20] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Ewela22\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Dokumenty Google) - C:\Users\Ewela22\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-04]
CHR Extension: (AdBlock) - C:\Users\Ewela22\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-09-05]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Ewela22\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-01]

Opera: 
=======
OPR Extension: (Magic Actions for YouTube™) - C:\Users\Ewela22\AppData\Roaming\Opera Software\Opera Stable\Extensions\nlffnljnicbkfhnlomjhjlebndachaka [2015-09-07]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS Cloud Corporation) [Brak podpisu cyfrowego]
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [319104 2014-02-25] (Windows (R) Win 7 DDK provider) [Brak podpisu cyfrowego]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2014-04-23] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-04-23] (Microsoft Corporation)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2014-02-25] (Atheros) [Brak podpisu cyfrowego]
S2 51cdb72; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro 3.11\OptProCrash.dll",ENT

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3892224 2014-03-06] (Qualcomm Atheros Communications, Inc.)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [71952 2014-03-31] (ASUS Corporation)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-02-25] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-04-16] (Malwarebytes Corporation)
R0 MBI; C:\Windows\System32\drivers\MBI.sys [29464 2013-10-28] (Intel Corporation)
R3 TXEIx64; C:\Windows\System32\drivers\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35856 2014-04-23] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [237400 2014-04-23] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2014-04-23] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-10-30 20:23 - 2015-10-30 20:23 - 00015613 _____ C:\Users\Ewela22\Desktop\FRST.txt
2015-10-30 20:22 - 2015-10-30 20:23 - 00000000 ____D C:\FRST
2015-10-30 20:22 - 2015-10-30 20:22 - 02198016 _____ (Farbar) C:\Users\Ewela22\Desktop\FRST64.exe
2015-10-30 20:22 - 2015-10-30 20:22 - 02198016 _____ (Farbar) C:\Users\Ewela22\Desktop\FRST64 (1).exe
2015-10-19 18:16 - 2015-10-19 18:16 - 01374489 _____ C:\Users\Ewela22\Desktop\Introduction-to-Natural-Hazards-Modeling example.pptx
2015-10-16 22:25 - 2015-10-16 22:25 - 00009337 _____ C:\Users\Ewela22\Desktop\life.xlsx
2015-10-13 16:17 - 2015-10-13 16:17 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-10-12 17:32 - 2015-10-12 17:39 - 00000000 ____D C:\Users\Ewela22\Desktop\semestr IV
2015-10-07 19:08 - 2015-10-07 19:08 - 00030720 _____ C:\Users\Ewela22\Desktop\ARIMA Kato-schedule Oct_ 2015_ver 1. poprawna xls.xls

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-10-30 20:18 - 2014-10-16 20:21 - 00000000 ____D C:\Users\Ewela22\AppData\Roaming\ClassicShell
2015-10-30 20:17 - 2014-04-23 07:52 - 00367798 _____ C:\Windows\system32\perfh015.dat
2015-10-30 20:17 - 2014-04-23 07:52 - 00051138 _____ C:\Windows\system32\perfc015.dat
2015-10-30 20:17 - 2014-03-18 16:25 - 00753500 _____ C:\Windows\system32\PerfStringBackup.INI
2015-10-30 20:12 - 2014-10-09 04:55 - 00000093 _____ C:\Users\Ewela22\AppData\Roaming\sp_data.sys
2015-10-30 20:12 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-10-30 20:09 - 2015-04-02 18:33 - 01360499 _____ C:\Windows\WindowsUpdate.log
2015-10-30 20:09 - 2015-04-02 15:14 - 00000000 ____D C:\Users\Ewela22\AppData\Roaming\Draco Organizer
2015-10-30 20:09 - 2014-10-12 21:43 - 00003980 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{855033C1-B961-4033-84BE-7B351B846831}
2015-10-30 20:09 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-10-30 20:03 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\sru
2015-10-28 21:00 - 2014-10-14 02:02 - 00001078 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1587283898-3112464119-1393011846-1001UA.job
2015-10-27 14:14 - 2014-11-11 22:00 - 00003244 _____ C:\Windows\System32\Tasks\IORRT
2015-10-26 14:02 - 2015-05-25 19:37 - 00000000 ____D C:\Users\Ewela22\Desktop\Memories
2015-10-24 12:51 - 2014-10-10 00:40 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1587283898-3112464119-1393011846-1001
2015-10-24 11:36 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2015-10-22 16:09 - 2015-09-25 16:11 - 00000000 ____D C:\Users\Ewela22\Desktop\Prerow time
2015-10-21 22:06 - 2015-04-07 11:52 - 00009296 _____ C:\Windows\setupact.log
2015-10-20 18:00 - 2014-10-14 02:01 - 00001026 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1587283898-3112464119-1393011846-1001Core.job
2015-10-17 15:31 - 2014-10-17 23:20 - 00000000 ____D C:\Users\Ewela22\AppData\Local\CrashDumps
2015-10-12 17:37 - 2015-09-26 16:03 - 00000000 ____D C:\Users\Ewela22\Desktop\prerow
2015-10-02 11:17 - 2014-10-15 14:29 - 00003866 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1413379757
2015-10-02 11:17 - 2014-10-15 14:29 - 00001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-10-02 11:17 - 2014-10-15 14:29 - 00000000 ____D C:\Program Files (x86)\Opera

==================== Pliki w katalogu głównym wybranych folderów =======

2015-03-28 16:10 - 2015-03-28 16:10 - 0009662 _____ () C:\Users\Ewela22\AppData\Roaming\em_64x64.ico
2014-11-10 19:34 - 2014-11-10 19:34 - 0000021 _____ () C:\Users\Ewela22\AppData\Roaming\my_intel.sys
2014-10-09 04:55 - 2015-10-30 20:12 - 0000093 _____ () C:\Users\Ewela22\AppData\Roaming\sp_data.sys
2015-08-01 10:14 - 2015-08-01 10:14 - 0000017 _____ () C:\Users\Ewela22\AppData\Local\resmon.resmoncfg
2014-07-25 06:51 - 2014-07-25 06:51 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-04-23 09:53 - 2012-09-07 12:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-04-23 09:53 - 2009-07-22 11:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-04-23 09:53 - 2012-09-07 12:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS

Niektóre pliki w TEMP:
====================
C:\Users\Ewela22\AppData\Local\Temp\iTunesSetup.exe
C:\Users\Ewela22\AppData\Local\Temp\ninja.download.manager_build33.exe
C:\Users\Ewela22\AppData\Local\Temp\Rainmeter-3.3-r2461-beta.exe
C:\Users\Ewela22\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Ewela22\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-10-24 12:51

==================== Koniec  FRST.txt ============================