Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:10-01-2015 01
Uruchomiony przez Kris (administrator)  BOGNA-KOMPUTER (11-01-2016 18:26:49)
Uruchomiony z C:\Users\Kris\Downloads
Załadowane profile: Kris (Dostępne profile: Bogna & Kris)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe
(DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.29.1\GoogleCrashHandler64.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Waves Audio Ltd.) C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_20_0_0_267.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_20_0_0_267.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7575768 2014-05-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1387376 2014-05-13] (Realtek Semiconductor)
HKLM\...\Run: [WavesSvc] => C:\Program Files\Realtek\Audio\HDA\WavesSvc64.exe [562264 2014-04-10] (Waves Audio Ltd.)
HKLM\...\Run: [RtHDVBg_PushButton] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1387376 2014-05-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2810096 2014-02-13] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-05-11] (Avast Software s.r.o.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1622311256-2915342097-2970719552-1001\...\Run: [uTorrent] => C:\Users\Kris\AppData\Roaming\uTorrent\uTorrent.exe [2026520 2015-12-04] (BitTorrent Inc.)
HKU\S-1-5-21-1622311256-2915342097-2970719552-1001\...\MountPoints2: {44713a6b-5142-11e4-951d-ecf4bb8c042a} - G:\setup.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-05-05] (Avast Software s.r.o.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 83.145.129.234 8.8.8.8
Tcpip\..\Interfaces\{1A9C7306-3E95-44FD-B99F-C3B892465650}: [DhcpNameServer] 83.145.129.234 8.8.8.8

Internet Explorer:
==================
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-15] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-23] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-15] (Avast Software s.r.o.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-23] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Kris\AppData\Roaming\Mozilla\Firefox\Profiles\3i0rote5.default-1450565818440
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-23] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-23] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-05] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-10]
FF HKU\S-1-5-21-1622311256-2915342097-2970719552-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi => nie znaleziono

Chrome: 
=======
CHR Profile: C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-24]
CHR Extension: (Dokumenty Google) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-24]
CHR Extension: (Dysk Google) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-09-03]
CHR Extension: (YouTube) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-24]
CHR Extension: (Google Search) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-24]
CHR Extension: (Arkusze Google) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-24]
CHR Extension: (Dokumenty Google offline) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-03]
CHR Extension: (Avast Online Security) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-06-24]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-03]
CHR Extension: (Gmail) - C:\Users\Kris\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-24]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-15]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-05-05] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4034896 2015-05-05] (Avast Software)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [65640 2015-11-05] (CyberGhost S.R.L)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2015-09-09] () [Brak podpisu cyfrowego]
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1513784 2015-10-05] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2015-01-12] ()
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187072 2015-03-10] ()
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [290520 2014-01-08] (Realtek Semiconductor)
R2 RzKLService; C:\Program Files (x86)\Razer\Razer Cortex\RzKLService.exe [129168 2015-03-12] (Razer Inc.)
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-12-31] (DEVGURU Co., LTD.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-04-10] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-05-05] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-05-05] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-05-05] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-05-05] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-05-05] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-26] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-05-05] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-05-05] ()
R3 cykbfltrService; C:\Windows\System32\DRIVERS\cykbfltr.sys [19968 2013-09-13] (Cypress Semiconductor, Inc.)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-04] (Intel Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
R3 NETwNs64; C:\Windows\System32\DRIVERS\Netwsw02.sys [3438048 2014-05-03] (Intel Corporation)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-03-10] (Razer, Inc.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-02-13] (Synaptics Incorporated)
S3 ss_conn_usb_driver; C:\Windows\System32\Drivers\ss_conn_usb_driver.sys [26392 2014-12-31] (DEVGURU Co., LTD.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-05-05] (Avast Software)
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
U3 fwddrkod; \??\C:\Users\Kris\AppData\Local\Temp\fwddrkod.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-11 18:26 - 2016-01-11 18:27 - 00015471 _____ C:\Users\Kris\Downloads\FRST.txt
2016-01-11 18:26 - 2016-01-11 18:26 - 02370560 _____ (Farbar) C:\Users\Kris\Downloads\FRST64.exe
2016-01-11 18:26 - 2016-01-11 18:26 - 00000000 ____D C:\FRST
2016-01-11 18:17 - 2016-01-11 18:24 - 268349932 _____ C:\Users\Kris\Downloads\[5x03] Lektor PL.rmvb
2016-01-11 18:14 - 2016-01-11 18:18 - 179702077 _____ C:\Users\Kris\Downloads\5x02 [Lektor PL].rmvb
2016-01-11 17:42 - 2016-01-11 17:42 - 00000022 _____ C:\Windows\S.dirmngr
2016-01-11 17:16 - 2016-01-11 17:16 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Kris\Downloads\SPTDinst-v187-x64.exe
2016-01-11 16:56 - 2016-01-11 16:57 - 00380416 _____ C:\Users\Kris\Downloads\x8g0mell.exe
2016-01-11 16:53 - 2016-01-11 16:53 - 00231390 _____ C:\Users\Kris\Downloads\RootkitRevealer(dobreprogramy.pl).zip
2016-01-11 16:53 - 2016-01-11 16:53 - 00000000 ____D C:\Users\Kris\Desktop\rootk
2016-01-11 16:44 - 2016-01-11 16:44 - 00000000 ____D C:\Users\Kris\Desktop\sdf
2016-01-07 21:41 - 2016-01-07 21:41 - 00000000 ____D C:\Users\Bogna\AppData\LocalLow\uTorrent
2016-01-07 12:39 - 2016-01-07 20:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-01-06 20:39 - 2016-01-06 20:39 - 00135749 _____ C:\Users\Bogna\Downloads\99536092_55041511781_16122015_2035329.pdf
2016-01-06 11:55 - 2016-01-06 11:55 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\7CDE451A.sys
2016-01-06 11:55 - 2016-01-06 11:55 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\50D64520.sys
2016-01-04 22:40 - 2015-01-21 16:34 - 05174652 _____ C:\Users\Bogna\Desktop\2015-01-21-3489.mp4
2015-12-31 21:26 - 2015-12-31 21:28 - 00000000 ____D C:\Users\Bogna\Desktop\tel joli
2015-12-30 15:30 - 2015-12-30 15:30 - 00000006 _____ C:\Users\Kris\Desktop\podrozamster.txt
2015-12-29 15:55 - 2015-12-29 15:55 - 00062229 _____ C:\Users\Bogna\Desktop\30368730_F_11079953_12_15_F.pdf
2015-12-29 15:53 - 2015-12-29 15:53 - 00059392 _____ C:\Users\Bogna\Downloads\30368730_F_11079953_12_15_F.pdf
2015-12-25 23:24 - 2015-12-25 23:24 - 00213331 _____ C:\Users\Bogna\Desktop\Izrael przewodnik turystyczny - YouTube.htm
2015-12-20 21:24 - 2015-12-20 21:24 - 00265740 _____ C:\Users\Bogna\Downloads\KSOiW_240_2015 TVP.pdf
2015-12-20 21:01 - 2015-12-20 21:01 - 00000000 ____D C:\Users\Bogna\AppData\LocalLow\Temp
2015-12-20 21:00 - 2015-12-20 21:01 - 00210288 _____ C:\Users\Bogna\Desktop\vcv.xps
2015-12-20 20:59 - 2015-12-20 20:59 - 00011933 _____ C:\Users\Bogna\Desktop\Bilet on-line.htm
2015-12-16 17:44 - 2015-12-16 17:44 - 00022595 _____ C:\Users\Kris\Desktop\I Ching - Księga Przemian - Wróżby i odpowiedzi wyroczni za darmo dla wszytkich poszukujących odpowiedzi !.htm
2015-12-16 17:44 - 2015-12-16 17:44 - 00000000 ____D C:\Users\Kris\Desktop\I Ching - Księga Przemian - Wróżby i odpowiedzi wyroczni za darmo dla wszytkich poszukujących odpowiedzi !_pliki
2015-12-15 12:24 - 2015-12-15 12:24 - 00000000 ____D C:\Users\Kris\AppData\Local\Fallout4
2015-12-15 12:23 - 2015-12-15 12:23 - 00000000 ____D C:\Users\Kris\Desktop\CODEX
2015-12-15 12:19 - 2015-12-15 12:19 - 00000573 _____ C:\Users\Kris\Desktop\Fallout 4.lnk
2015-12-15 12:19 - 2015-12-15 12:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fallout 4
2015-12-12 11:28 - 2015-12-12 11:28 - 00000000 ____D C:\Users\Kris\Desktop\The Witcher 3

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-11 18:26 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2016-01-11 18:08 - 2014-10-10 12:05 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-11 18:06 - 2014-10-10 12:03 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-01-11 17:50 - 2015-09-18 12:43 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-01-11 17:50 - 2009-07-14 05:45 - 00031280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-11 17:50 - 2009-07-14 05:45 - 00031280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-11 17:46 - 2014-10-21 19:12 - 00000000 ____D C:\Users\Kris\AppData\Roaming\uTorrent
2016-01-11 17:43 - 2014-10-10 12:05 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-11 17:42 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-11 17:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-01-11 16:20 - 2015-04-23 11:13 - 00000080 _____ C:\Users\Kris\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦
2016-01-10 22:29 - 2011-04-12 14:21 - 04810696 _____ C:\Windows\system32\perfh015.dat
2016-01-10 22:29 - 2011-04-12 14:21 - 01576822 _____ C:\Windows\system32\perfc015.dat
2016-01-10 22:29 - 2009-07-14 06:13 - 00006208 _____ C:\Windows\system32\PerfStringBackup.INI
2016-01-10 16:52 - 2014-10-10 12:19 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-01-08 00:24 - 2014-10-11 13:48 - 00000000 ____D C:\Users\Bogna\AppData\Roaming\uTorrent
2016-01-08 00:13 - 2014-10-10 12:01 - 00000000 ____D C:\Users\Bogna\AppData\Roaming\vlc
2016-01-07 20:11 - 2014-10-10 12:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-01-02 21:06 - 2014-10-10 12:03 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-01-02 21:06 - 2014-10-10 12:03 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-01-02 21:06 - 2014-10-10 12:03 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-30 14:52 - 2015-09-18 12:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-12-30 14:52 - 2015-09-18 12:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-12-24 16:25 - 2015-08-31 22:30 - 00000000 ____D C:\Users\Kris\Documents\The Witcher 3
2015-12-19 23:41 - 2015-09-19 12:49 - 00000000 ____D C:\Users\Kris\.gimp-2.8
2015-12-15 16:06 - 2015-04-23 05:15 - 00000000 ____D C:\Program Files (x86)\Rockstar Games
2015-12-15 16:06 - 2015-04-23 05:14 - 00000000 ____D C:\Program Files\Rockstar Games
2015-12-15 12:24 - 2014-10-22 17:03 - 00000000 ____D C:\Users\Kris\Documents\My Games
2015-12-14 10:54 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2015-12-13 10:26 - 2014-10-10 12:02 - 00000000 ____D C:\Program Files (x86)\Opera

==================== Pliki w katalogu głównym wybranych folderów =======

2015-10-20 12:31 - 2015-10-20 12:31 - 0006893 _____ () C:\Users\Kris\AppData\Local\recently-used.xbel
2014-10-29 23:51 - 2015-04-30 20:34 - 0007655 _____ () C:\Users\Kris\AppData\Local\Resmon.ResmonCfg
2015-09-20 17:19 - 2015-09-20 17:19 - 0055808 _____ (src) C:\Users\Kris\AppData\Local\Tempsrc.exe
2014-10-10 10:03 - 2014-10-10 10:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Niektóre pliki w TEMP:
====================
C:\Users\Bogna\AppData\Local\Temp\jre-8u25-windows-au.exe
C:\Users\Bogna\AppData\Local\Temp\uttBC86.tmp.exe
C:\Users\Kris\AppData\Local\Temp\amd-catalyst-omega-14.12-without-dotnet45-win7-64bit.exe
C:\Users\Kris\AppData\Local\Temp\AutoDetectUtilApp.exe
C:\Users\Kris\AppData\Local\Temp\BKKLMV.exe
C:\Users\Kris\AppData\Local\Temp\mediaenchx32.dll
C:\Users\Kris\AppData\Local\Temp\mediaenchx321.dll
C:\Users\Kris\AppData\Local\Temp\mediaenchx322.dll
C:\Users\Kris\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Kris\AppData\Local\Temp\php.exe
C:\Users\Kris\AppData\Local\Temp\procexp64.exe
C:\Users\Kris\AppData\Local\Temp\Quarantine.exe
C:\Users\Kris\AppData\Local\Temp\raptrpatch.exe
C:\Users\Kris\AppData\Local\Temp\raptr_stub.exe
C:\Users\Kris\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Kris\AppData\Local\Temp\sfamcc00002.dll
C:\Users\Kris\AppData\Local\Temp\sfextra.dll
C:\Users\Kris\AppData\Local\Temp\sq.exe
C:\Users\Kris\AppData\Local\Temp\sql.exe
C:\Users\Kris\AppData\Local\Temp\sqlite3.dll
C:\Users\Kris\AppData\Local\Temp\sqll.exe
C:\Users\Kris\AppData\Local\Temp\tray.exe
C:\Users\Kris\AppData\Local\Temp\uttC33E.tmp.exe
C:\Users\Kris\AppData\Local\Temp\WPNEDP.exe
C:\Users\Kris\AppData\Local\Temp\XKMPFSL.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-01-09 21:52

==================== Koniec  FRST.txt ============================