Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:25-11-2015 02 Uruchomiony przez Mateusz (administrator) MATI320 (26-11-2015 15:55:32) Uruchomiony z C:\Users\Mateusz\Desktop Załadowane profile: Mateusz (Dostępne profile: Mateusz) Platform: Windows 7 Home Premium (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKU\S-1-5-21-1289696128-1573057215-2946025546-1001\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{4BDE2593-0527-4990-8F3B-04C9C4FB33E3}: [NameServer] 104.197.191.4 Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 104.197.191.4 Tcpip\..\Interfaces\{B5FACAFE-9539-4E56-9F85-59125C2ED01D}: [NameServer] 104.197.191.4 Tcpip\..\Interfaces\{B5FACAFE-9539-4E56-9F85-59125C2ED01D}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{BA0EBBF6-E1AE-46FE-A421-BDB800F5502A}: [NameServer] 104.197.191.4 Tcpip\..\Interfaces\{BA0EBBF6-E1AE-46FE-A421-BDB800F5502A}: [DhcpNameServer] 192.168.156.1 8.8.8.8 193.242.213.227 Tcpip\..\Interfaces\{DF309FE3-545E-4689-9FCE-90C1C79B7EC4}: [NameServer] 104.197.191.4 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com SearchScopes: HKLM -> DefaultScope - brak wartości SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKLM -> {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKLM -> {4CA7A89B-B509-4CBF-AB97-6307132C0EF3} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKLM -> {AC129BF9-68BF-4bc4-A1DC-ECB62712FF99} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKLM -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKLM -> {D0196D2A-1578-4CC2-8692-9F617C64D184} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {4CA7A89B-B509-4CBF-AB97-6307132C0EF3} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {AC129BF9-68BF-4bc4-A1DC-ECB62712FF99} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} SearchScopes: HKU\S-1-5-21-1289696128-1573057215-2946025546-1001 -> {D0196D2A-1578-4CC2-8692-9F617C64D184} URL = hxxp://www.google.com/cse?cx=partner-pub-9609672093949948%3A2pdkvfm6u5y&ie=ISO-8859-1&q={searchTerms} BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2011-06-06] (Adobe Systems Incorporated) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-26] (Microsoft Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) FireFox: ======== FF ProfilePath: C:\Users\Mateusz\AppData\Roaming\Mozilla\Firefox\Profiles\2lgklpxb.default FF Homepage: www.google.pl FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll [2015-08-06] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2011-06-06] (Adobe Systems Inc.) Chrome: ======= CHR Profile: C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default CHR HKLM\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx CHR HKLM\...\Chrome\Extension: [oggihoncmelambjaefiboekididcaffe] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\oggihoncmelambjaefiboekididcaffe.crx CHR HKLM-x32\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx CHR HKLM-x32\...\Chrome\Extension: [oggihoncmelambjaefiboekididcaffe] - C:\Users\Mateusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\oggihoncmelambjaefiboekididcaffe.crx ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-11-26 15:55 - 2015-11-26 15:55 - 00009160 _____ C:\Users\Mateusz\Desktop\FRST.txt 2015-11-26 15:53 - 2015-11-26 15:53 - 00606643 _____ C:\Users\Mateusz\Desktop\Autoruns.zip 2015-11-26 15:53 - 2015-10-26 15:44 - 00609944 ____N (Sysinternals - www.sysinternals.com) C:\Users\Mateusz\Desktop\autorunsc.exe 2015-11-26 15:53 - 2015-10-26 15:42 - 00696984 ____N (Sysinternals - www.sysinternals.com) C:\Users\Mateusz\Desktop\Autoruns.exe 2015-11-26 15:53 - 2015-10-26 15:39 - 00050512 ____N C:\Users\Mateusz\Desktop\autoruns.chm 2015-11-26 15:53 - 2015-10-26 15:33 - 00007490 ____N C:\Users\Mateusz\Desktop\Eula.txt 2015-11-26 15:48 - 2015-11-26 15:55 - 00000000 ____D C:\FRST 2015-11-26 15:27 - 2015-11-26 15:27 - 719608048 _____ C:\Windows\MEMORY.DMP 2015-11-26 15:27 - 2015-11-26 15:27 - 00276168 _____ C:\Windows\Minidump\112615-25942-01.dmp 2015-11-26 15:27 - 2015-11-26 15:27 - 00000000 ____D C:\Windows\Minidump 2015-11-26 15:20 - 2015-11-26 15:20 - 02348544 _____ (Farbar) C:\Users\Mateusz\Desktop\FRST64.exe 2015-11-26 15:15 - 2015-11-26 15:15 - 00016506 _____ C:\Users\Mateusz\Desktop\gmer.txt 2015-11-26 11:37 - 2015-11-26 12:32 - 00001100 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2015-11-26 11:37 - 2015-11-26 11:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2015-11-26 11:37 - 2015-11-26 11:37 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware 2015-11-26 11:37 - 2015-10-05 09:50 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-11-26 11:37 - 2015-10-05 09:50 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys 2015-11-26 10:38 - 2015-11-26 12:32 - 00001455 _____ C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-11-26 09:56 - 2015-11-26 10:37 - 00004696 _____ C:\Windows\SysWOW64\Yvuumb.ini 2015-11-26 09:56 - 2015-11-26 10:37 - 00002416 _____ C:\Windows\SysWOW64\YvuumbOff.ini 2015-11-26 09:56 - 2015-11-26 10:37 - 00002416 _____ C:\Windows\system32\YvuumbOff.ini 2015-11-26 09:55 - 2015-11-26 12:27 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\DiqkiFitlef 2015-11-26 09:55 - 2015-11-26 09:55 - 00000000 ____D C:\Windows\system32\wocf 2015-11-26 09:54 - 2015-11-26 09:54 - 00003340 _____ C:\Windows\System32\Tasks\Nefcum 2015-11-26 09:53 - 2015-11-26 09:53 - 00000000 _____ C:\Windows\SysWOW64\Number of results 2015-11-25 16:46 - 2015-11-25 16:46 - 00000013 _____ C:\Users\Mateusz\.pluto.tv 2015-11-25 16:18 - 2015-11-26 09:17 - 00000000 ____D C:\Program Files (x86)\Pluto TV 2015-11-25 13:35 - 2015-11-25 15:21 - 00000000 ____D C:\Users\Mateusz\Doctor Web 2015-11-25 13:20 - 2015-11-25 13:22 - 177567560 _____ C:\Users\Mateusz\Desktop\launch.exe 2015-11-25 13:16 - 2015-11-25 13:16 - 00380416 _____ C:\Users\Mateusz\Desktop\114zfoph.exe 2015-11-25 12:33 - 2015-11-26 11:37 - 00000000 ____D C:\ProgramData\Malwarebytes 2015-11-25 12:32 - 2015-11-26 12:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2015-11-25 12:32 - 2015-11-26 11:39 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-11-25 12:32 - 2015-10-05 09:50 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-11-25 12:24 - 2015-11-26 11:18 - 00000000 ____D C:\Users\Mateusz\Desktop\mbar 2015-11-21 17:37 - 2015-11-26 12:32 - 00000803 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-11-21 17:37 - 2015-11-26 10:07 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Mozilla 2015-11-21 17:37 - 2015-11-21 17:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-11-21 17:37 - 2015-11-21 17:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-11-19 20:31 - 2015-11-19 20:31 - 00000000 _____ C:\Users\Mateusz\AppData\Local\{730D0059-BD87-4023-826E-85B38312B9C8} 2015-11-13 19:11 - 2015-11-13 19:12 - 06420480 _____ C:\Program Files (x86)\GUT9EFE.tmp 2015-11-13 19:11 - 2015-11-13 19:11 - 00000000 ____D C:\Program Files (x86)\GUM9EFD.tmp 2015-11-13 19:10 - 2015-11-13 19:12 - 06420480 _____ C:\Program Files (x86)\GUT956C.tmp 2015-11-13 19:10 - 2015-11-13 19:10 - 00000000 ____D C:\Program Files (x86)\GUM956B.tmp 2015-11-13 11:34 - 2015-11-13 11:34 - 00000000 ____D C:\Program Files (x86)\directx 2015-11-12 18:31 - 1998-10-02 18:00 - 00327168 _____ (InstallShield Software Corporation) C:\Windows\IsUninst.exe 2015-11-11 16:46 - 2015-11-25 14:21 - 00000000 _____ C:\Windows\upd_version.ini 2015-11-11 13:27 - 2015-11-11 16:51 - 00000000 ____D C:\Users\Mateusz\Documents\JoWooD 2015-11-11 13:12 - 2015-11-15 19:02 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-11-11 13:12 - 2015-11-11 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JoWood 2015-11-10 18:00 - 2015-11-10 18:00 - 06420480 _____ C:\Program Files (x86)\GUTF019.tmp 2015-11-10 18:00 - 2015-11-10 18:00 - 00000000 ____D C:\Program Files (x86)\GUMF018.tmp 2015-11-10 17:59 - 2015-11-10 18:00 - 06420480 _____ C:\Program Files (x86)\GUT6B02.tmp 2015-11-10 17:59 - 2015-11-10 17:59 - 00000316 ____H C:\Windows\Tasks\User_Feed_Synchronization-{6A4D1574-5570-4048-B688-2132A6EB8831}.job 2015-11-10 17:59 - 2015-11-10 17:59 - 00000000 ____D C:\Program Files (x86)\GUM6B01.tmp 2015-11-10 16:01 - 2015-11-10 16:02 - 00000000 _____ C:\Users\Mateusz\AppData\Local\{CD71F914-0CCB-44B3-9846-92DAB34BA761} 2015-11-09 22:21 - 2015-11-09 22:21 - 00000136 _____ C:\Windows\version.ini 2015-11-09 21:23 - 2015-11-21 18:38 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Mozilla 2015-11-09 21:21 - 2015-11-26 12:27 - 00000000 ____D C:\Program Files\Common Files\rw5e0ly0 2015-11-09 20:58 - 2015-11-21 17:10 - 00004736 _____ C:\Windows\SysWOW64\Dorkiczam.ini 2015-11-09 20:58 - 2015-11-21 17:10 - 00002448 _____ C:\Windows\SysWOW64\DorkiczamOff.ini 2015-11-09 20:58 - 2015-11-21 17:10 - 00002448 _____ C:\Windows\system32\DorkiczamOff.ini 2015-11-09 20:57 - 2015-11-09 20:57 - 00003342 _____ C:\Windows\System32\Tasks\Ulopum 2015-11-09 20:57 - 2015-11-09 20:57 - 00000000 ____D C:\Windows\system32\fin 2015-11-09 20:28 - 2015-11-09 20:28 - 00004046 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-11-09 20:28 - 2015-11-09 20:28 - 00003794 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-11-09 19:57 - 2015-11-09 19:57 - 00000187 _____ C:\Users\Mateusz\AppData\Local\Movefan.exe.config 2015-11-05 22:49 - 2015-11-05 22:49 - 00003070 _____ C:\Windows\System32\Tasks\Car Form 2015-11-04 19:21 - 2015-11-04 19:21 - 00000000 ____D C:\Windows\System32\Tasks\Games 2015-11-04 18:19 - 2015-11-26 09:56 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Tempfolder 2015-11-04 18:19 - 2015-11-04 18:19 - 00000000 ____D C:\Windows\system32\bar 2015-11-04 18:18 - 2015-11-26 12:27 - 00000000 ____D C:\Users\Mateusz\AppData\LocalLow\Company 2015-11-04 18:18 - 2015-11-26 09:54 - 00000098 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat 2015-11-04 18:18 - 2015-11-04 18:18 - 00000000 ____D C:\uninst 2015-11-04 15:21 - 2015-11-26 10:29 - 00000000 ____D C:\Program Files (x86)\04a5883b-115e-448f-9032-232def82982a 2015-11-04 15:20 - 2009-06-10 22:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak 2015-11-04 15:18 - 2015-11-21 17:23 - 00000000 ____D C:\Program Files (x86)\3ab95b34-6f9f-4cff-8ed3-cceb7837dc65 2015-11-04 15:18 - 2015-11-09 20:14 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7 2015-11-04 15:18 - 2015-11-09 19:58 - 00000000 ____D C:\Program Files (x86)\Bin 2015-11-04 15:18 - 2015-11-04 15:18 - 00000000 ____D C:\Program Files (x86)\TempInstaller 2015-11-04 15:17 - 2015-11-26 10:30 - 00000000 ____D C:\Windows\Provider32 2015-11-02 13:03 - 2015-11-26 12:32 - 00000266 __RSH C:\ProgramData\ntuser.pol ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-11-26 15:51 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-11-26 15:50 - 2009-07-14 05:45 - 00013584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-11-26 15:50 - 2009-07-14 05:45 - 00013584 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-11-26 15:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows 2015-11-26 15:45 - 2015-08-06 08:51 - 00000000 ____D C:\Users\Mateusz 2015-11-26 14:27 - 2009-07-14 03:34 - 00000219 _____ C:\Windows\system.ini 2015-11-26 12:32 - 2015-08-06 10:09 - 00000427 _____ C:\Users\Mateusz\Desktop\TC Login.lnk 2015-11-26 12:32 - 2015-08-06 09:29 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk 2015-11-26 12:32 - 2015-08-06 09:22 - 00002164 _____ C:\Users\Public\Desktop\HP Deskjet 3520 series.lnk 2015-11-26 12:32 - 2015-08-06 08:51 - 00001421 _____ C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-11-26 12:32 - 2015-08-06 08:43 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk 2015-11-26 12:32 - 2015-08-06 08:43 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk 2015-11-26 12:32 - 2009-07-14 06:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk 2015-11-26 12:32 - 2009-07-14 05:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-11-26 12:32 - 2009-07-14 05:57 - 00001340 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk 2015-11-26 12:32 - 2009-07-14 05:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk 2015-11-26 12:32 - 2009-07-14 05:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk 2015-11-26 12:32 - 2009-07-14 05:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk 2015-11-26 12:32 - 2009-07-14 05:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk 2015-11-26 12:27 - 2015-08-07 14:47 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2015-11-26 11:19 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help 2015-11-26 10:38 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD 2015-11-25 12:23 - 2015-08-06 18:37 - 00687828 _____ C:\Windows\system32\perfh015.dat 2015-11-25 12:23 - 2015-08-06 18:37 - 00131382 _____ C:\Windows\system32\perfc015.dat 2015-11-25 12:23 - 2009-07-14 06:13 - 01523412 _____ C:\Windows\system32\PerfStringBackup.INI 2015-11-25 12:23 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2015-11-25 11:03 - 2015-08-06 09:06 - 00000000 ____D C:\Program Files (x86)\Google 2015-11-25 10:56 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-11-22 09:19 - 2015-08-06 09:06 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Google 2015-11-18 16:56 - 2015-08-23 13:05 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Microsoft Games 2015-11-17 19:21 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF 2015-11-13 13:19 - 2009-07-14 05:45 - 00418416 _____ C:\Windows\system32\FNTCACHE.DAT 2015-11-13 11:56 - 2015-08-06 09:05 - 00109232 _____ C:\Users\Mateusz\AppData\Local\GDIPFONTCACHEV1.DAT 2015-11-12 19:01 - 2015-08-17 10:05 - 00000000 ____D C:\Users\Mateusz\Desktop\MUZA 2015-11-10 17:56 - 2015-08-06 09:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2015-11-09 20:28 - 2015-08-06 09:05 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Deployment 2015-11-02 13:03 - 2009-07-14 04:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy 2015-11-02 13:03 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-11-10 17:59 - 2015-11-10 18:00 - 6420480 _____ () C:\Program Files (x86)\GUT6B02.tmp 2015-11-13 19:10 - 2015-11-13 19:12 - 6420480 _____ () C:\Program Files (x86)\GUT956C.tmp 2015-11-13 19:11 - 2015-11-13 19:12 - 6420480 _____ () C:\Program Files (x86)\GUT9EFE.tmp 2015-11-10 18:00 - 2015-11-10 18:00 - 6420480 _____ () C:\Program Files (x86)\GUTF019.tmp 2015-11-09 19:57 - 2015-11-09 19:57 - 0000187 _____ () C:\Users\Mateusz\AppData\Local\Movefan.exe.config 2015-11-19 20:31 - 2015-11-19 20:31 - 0000000 _____ () C:\Users\Mateusz\AppData\Local\{730D0059-BD87-4023-826E-85B38312B9C8} 2015-11-10 16:01 - 2015-11-10 16:02 - 0000000 _____ () C:\Users\Mateusz\AppData\Local\{CD71F914-0CCB-44B3-9846-92DAB34BA761} 2015-08-06 09:20 - 2015-08-06 09:20 - 0000057 _____ () C:\ProgramData\Ament.ini 2015-11-04 18:18 - 2015-11-26 09:54 - 0000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat Pliki do przeniesienia lub usunięcia: ==================== C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2015-10-24 08:47 ==================== Koniec FRST.txt ============================