Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:21-02-2016 01
Uruchomiony przez Rob (administrator)  ROB-KOMPUTER (25-02-2016 07:13:01)
Uruchomiony z C:\Users\Rob\Downloads
Załadowane profile: Rob (Dostępne profile: Rob)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files\BitTorrent\BitTorrent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe
() C:\ProgramData\caMyciloP\caMyciloP.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\ProgramData\CloudPrinter\CloudPrinter.exe
() C:\Users\Rob\AppData\Local\Unocare.exe
(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe
(Intel Corporation) C:\Windows\System32\DptfPolicyCriticalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
() C:\ProgramData\serfev\serfev.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Lenovo) C:\Windows\System32\LenovoUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
() C:\ProgramData\caMyciloP\caMyciloP.exe
(Lenovo) C:\Users\Rob\AppData\Local\Apps\2.0\J14EDWB8.KLQ\V67DRPVH.GZ4\lsb...tion_91a10ba61c75c82d_0001.0006_e2bd8e8ce58257d4\LSB.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MpCmdRun.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4367808 2009-12-17] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [6988736 2009-12-17] (Lenovo (Beijing) Limited)
HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\Windows\system32\DptfPolicyLpmServiceHelper.exe [111488 2013-09-17] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [296216 2000-01-01] (Intel Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [gmsd_pl_005010245] => [X]
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2016-01-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2016-01-21]

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{9447638D-7304-4D60-92D5-3994D49E8844}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{EFFDAAEC-D735-43B0-A850-A73512269C71}: [DhcpNameServer] 10.0.17.33

Internet Explorer:
==================
HKU\S-1-5-21-454545797-384275535-3432456732-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
HKU\S-1-5-21-454545797-384275535-3432456732-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JRmAvKTdMatTN9vc2mQeGzomn5x1pLrVtf8EQLn51gDmlleMZfAf9Nuln7QMCq0xwoeX9WnLIk6jP3gRc64wyZ7UPG5ONg,
HKU\S-1-5-21-454545797-384275535-3432456732-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
HKU\S-1-5-21-454545797-384275535-3432456732-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-454545797-384275535-3432456732-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-454545797-384275535-3432456732-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgCD7X73flRI6tqEIMkflfAnctn9Q8s8s8W1MvAZ_hTBd5jZAfI9tX_HX4dJ76rUqf21N2Y0IY7du3ALD49Ykyh_ePEPmc,&q={searchTerms}
BHO: STATISTICA Browser Helper -> {990A8747-93BF-4EF7-B72E-94A6884B98C2} -> C:\Program Files\StatSoft\STATISTICA 12\StaBHO.dll [2014-11-10] (StatSoft, Inc.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: STATISTICA Browser Helper -> {990A8747-93BF-4EF7-B72E-94A6884B98C2} -> C:\Program Files\StatSoft\STATISTICA 12\Support\StaBHO.dll [2014-11-10] (StatSoft, Inc.)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://%66%65%65%64.%73%6E%61%70%64%6F.%63%6F%6D/?p=mKO_AwFzXIpYRYEqQao2TxTGptbOxpBNeoIGShepo8uLJ73GTkshPEmajQEFylJmYlPn2BoG33XbVJ13zSDMfwI7WfIOjwADQbDe_I8N4LQS1JgZrlR0setODzLiXRtdCfS-ndll2C1vtopY-DuDs5LAKloQoNJFIVWC5yzc29AuQXbCjYvpHTBJ-JO3RyUGoWtJVWaP4o8,
CHR StartupUrls: Default -> "hxxps://www.google.pl/"
CHR Profile: C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-22]
CHR Extension: (Dokumenty Google) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-22]
CHR Extension: (Dysk Google) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-22]
CHR Extension: (YouTube) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-22]
CHR Extension: (Google Search) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-22]
CHR Extension: (Arkusze Google) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-22]
CHR Extension: (Dokumenty Google offline) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-22]
CHR Extension: (AdBlock) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-02-22]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-22]
CHR Extension: (Gmail) - C:\Users\Rob\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-22]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 BitTorrent; C:\Program Files\BitTorrent\BitTorrent.exe [383488 2016-02-22] () [Brak podpisu cyfrowego]
R2 caMyciloP; C:\ProgramData\\caMyciloP\\caMyciloP.exe [528384 2016-02-23] () [Brak podpisu cyfrowego]
R2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe [667136 2016-02-22] () [Brak podpisu cyfrowego]
R2 dowoloadad; C:\Users\Rob\AppData\Local\Unocare.exe [28160 2016-02-22] () [Brak podpisu cyfrowego]
R2 DptfParticipantAcpiProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [117704 2013-09-17] (Intel Corporation)
R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [118728 2013-09-17] (Intel Corporation)
R2 DptfPolicyCriticalService; C:\Windows\system32\DptfPolicyCriticalService.exe [150760 2013-09-17] (Intel Corporation)
S2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [124904 2013-09-17] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [330144 2015-09-09] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\TXE Components\TCS\HeciServer.exe [733696 2013-07-01] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\TXE Components\TCS\SocketHeciServer.exe [822232 2013-07-01] (Intel(R) Corporation)
R3 LenovoUpdate; C:\Windows\System32\LenovoUpdate.exe [26608 2016-02-25] (Lenovo)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [1863680 2012-07-06] (Ralink) [Brak podpisu cyfrowego]
R2 serfev; C:\ProgramData\\serfev\\serfev.exe [528384 2016-02-24] () [Brak podpisu cyfrowego]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 DptfDevAcpiProc; C:\Windows\System32\DRIVERS\DptfDevAcpiProc.sys [198808 2013-09-17] (Intel Corporation)
R3 DptfDevGen; C:\Windows\System32\DRIVERS\DptfDevGen.sys [78504 2013-09-17] (Intel Corporation)
R3 DptfManager; C:\Windows\System32\DRIVERS\DptfManager.sys [493240 2013-09-17] (Intel Corporation)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [294104 2014-12-10] (Realtek Semiconductor Corp.)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [3059928 2015-06-23] (Realtek Semiconductor Corp.)
R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3513048 2015-03-23] (Realtek Semiconductor Corporation                           )
R3 TXEIx64; C:\Windows\System32\DRIVERS\TXEIx64.sys [88592 2014-01-15] (Intel Corporation)
R1 {b62cb561-fced-4cde-aa45-8be9df6fa758}Gw64; C:\Windows\System32\drivers\{b62cb561-fced-4cde-aa45-8be9df6fa758}Gw64.sys [48752 2016-02-22] (StdLib)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-02-25 07:00 - 2016-02-25 07:00 - 00003272 _____ C:\Windows\System32\Tasks\psv_GoldenRonsing
2016-02-25 07:00 - 2016-02-25 07:00 - 00003262 _____ C:\Windows\System32\Tasks\psv_Kanlab
2016-02-24 09:02 - 2016-02-24 09:02 - 00003390 _____ C:\Users\Rob\Desktop\GMER.txt
2016-02-24 08:41 - 2016-02-24 08:41 - 00380416 _____ C:\Users\Rob\Downloads\dqyh9y45.exe
2016-02-24 08:37 - 2016-02-25 07:00 - 00000000 ____D C:\ProgramData\serfev
2016-02-24 08:37 - 2016-02-24 08:37 - 00003298 _____ C:\Windows\System32\Tasks\psv_Gravefresh
2016-02-24 08:37 - 2016-02-24 08:37 - 00003272 _____ C:\Windows\System32\Tasks\psv_Pluslattech
2016-02-24 08:37 - 2016-02-24 08:37 - 00003266 _____ C:\Windows\System32\Tasks\psv_StrongAnin
2016-02-24 08:37 - 2016-02-24 08:37 - 00003264 _____ C:\Windows\System32\Tasks\psv_Triotam
2016-02-24 08:37 - 2016-02-24 08:37 - 00000000 ____D C:\ProgramData\serfevs
2016-02-23 16:13 - 2016-02-24 08:37 - 00003624 _____ C:\Windows\System32\Tasks\snp
2016-02-23 16:13 - 2016-02-24 08:37 - 00003226 _____ C:\Windows\System32\Tasks\snf
2016-02-23 16:13 - 2016-02-24 08:37 - 00002397 _____ C:\Windows\SysWOW64\findit.xml
2016-02-23 16:13 - 2016-02-23 16:13 - 00003286 _____ C:\Windows\System32\Tasks\psv_Homesolfan
2016-02-23 16:13 - 2016-02-23 16:13 - 00003278 _____ C:\Windows\System32\Tasks\psv_Stat-Tough
2016-02-23 16:13 - 2016-02-23 16:13 - 00003266 _____ C:\Windows\System32\Tasks\psv_Zamtom
2016-02-23 16:11 - 2016-02-25 07:00 - 00000000 ____D C:\ProgramData\caMyciloP
2016-02-23 15:54 - 2016-02-23 15:54 - 00024130 _____ C:\Users\Rob\Downloads\Addition.txt
2016-02-23 15:53 - 2016-02-25 07:13 - 00015544 _____ C:\Users\Rob\Downloads\FRST.txt
2016-02-23 15:52 - 2016-02-25 07:13 - 00000000 ____D C:\FRST
2016-02-23 15:52 - 2016-02-23 15:52 - 02371072 _____ (Farbar) C:\Users\Rob\Downloads\FRST64.exe
2016-02-23 15:52 - 2016-02-23 15:52 - 01722368 _____ (Farbar) C:\Users\Rob\Downloads\FRST.exe
2016-02-23 14:51 - 2016-02-23 16:11 - 00000000 ____D C:\AdwCleaner
2016-02-23 14:51 - 2016-02-23 14:51 - 01511936 _____ C:\Users\Rob\Downloads\adwcleaner_5.036.exe
2016-02-23 06:15 - 2016-02-23 06:15 - 00003234 _____ C:\Windows\System32\Tasks\webdpwneob
2016-02-22 16:27 - 2016-02-22 16:27 - 00003332 _____ C:\Windows\System32\Tasks\Mojkussa
2016-02-22 16:27 - 2016-02-22 16:27 - 00000000 ____D C:\Windows\system32\geku
2016-02-22 16:27 - 2016-02-22 16:27 - 00000000 ____D C:\Users\Rob\AppData\Roaming\GousFoavfu
2016-02-22 15:50 - 2016-02-22 15:50 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-02-22 15:43 - 2016-02-22 15:43 - 00003572 _____ C:\Windows\System32\Tasks\{FAA1C03F-2A8D-491D-8EEB-8CA2AE02C736}
2016-02-22 15:39 - 2016-02-23 06:15 - 00000000 ____D C:\Program Files\BitTorrent
2016-02-22 15:39 - 2016-02-22 15:39 - 00222699 _____ C:\Users\Rob\AppData\Roaming\Unolam.bin
2016-02-22 15:39 - 2016-02-22 15:39 - 00041472 _____ C:\Users\Rob\AppData\Local\Unocare.dat
2016-02-22 15:39 - 2016-02-22 15:39 - 00028160 _____ C:\Users\Rob\AppData\Local\Unocare.exe
2016-02-22 15:39 - 2016-02-22 15:39 - 00000187 _____ C:\Users\Rob\AppData\Local\Unocare.exe.config
2016-02-22 15:39 - 2016-02-22 15:39 - 00000000 ____D C:\Users\Rob\AppData\Roaming\Mozilla
2016-02-22 15:38 - 2016-02-22 15:38 - 07951360 _____ C:\Users\Rob\AppData\Roaming\agent.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 01881610 _____ C:\Users\Rob\AppData\Roaming\Lotdom.tst
2016-02-22 15:38 - 2016-02-22 15:38 - 00848437 _____ C:\Users\Rob\AppData\Roaming\EcoPhase.bin
2016-02-22 15:38 - 2016-02-22 15:38 - 00667136 _____ C:\Users\Rob\AppData\Roaming\Villadex.exe
2016-02-22 15:38 - 2016-02-22 15:38 - 00667136 _____ C:\Users\Rob\AppData\Roaming\Lotdom.exe
2016-02-22 15:38 - 2016-02-22 15:38 - 00189671 _____ () C:\Users\Rob\AppData\Roaming\New-Tone.bin
2016-02-22 15:38 - 2016-02-22 15:38 - 00126976 _____ C:\Users\Rob\AppData\Roaming\Installer.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 00126464 _____ C:\Users\Rob\AppData\Roaming\noah.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 00126464 _____ C:\Users\Rob\AppData\Roaming\lobby.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 00072711 _____ C:\Users\Rob\AppData\Roaming\Villadex.tst
2016-02-22 15:38 - 2016-02-22 15:38 - 00063696 _____ C:\Users\Rob\AppData\Roaming\Config.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 00054272 _____ C:\Users\Rob\AppData\Roaming\ApplicationHosting.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 00018672 _____ C:\Users\Rob\AppData\Roaming\InstallationConfiguration.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 00018432 _____ C:\Users\Rob\AppData\Roaming\Main.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 00005568 _____ C:\Users\Rob\AppData\Roaming\md.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-02-22 15:35 - 2016-02-22 15:35 - 00000000 ____D C:\Users\Rob\AppData\Roaming\gplyra
2016-02-22 15:34 - 2016-02-22 16:28 - 00000000 ____D C:\Users\Rob\AppData\Local\Tempfolder
2016-02-22 15:34 - 2016-02-22 15:34 - 00003338 _____ C:\Windows\System32\Tasks\Mirfeodl
2016-02-22 15:34 - 2016-02-22 15:34 - 00000000 ____D C:\Windows\system32\siur
2016-02-22 15:34 - 2016-02-22 15:34 - 00000000 ____D C:\Users\Rob\AppData\Roaming\FatceqCedeti
2016-02-22 15:34 - 2016-02-22 15:34 - 00000000 ____D C:\Users\Rob\AppData\LocalLow\Company
2016-02-22 15:34 - 2016-02-22 15:34 - 00000000 ____D C:\uninst
2016-02-22 15:33 - 2016-02-22 15:33 - 00000000 _____ C:\Windows\SysWOW64\Number of results
2016-02-22 15:30 - 2016-02-22 15:30 - 00000000 ____D C:\d51fce47ba11f6f774e6b096f999
2016-02-22 15:29 - 2016-02-22 15:27 - 00001110 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-02-22 15:26 - 2016-02-22 01:36 - 00048752 _____ (StdLib) C:\Windows\system32\Drivers\{b62cb561-fced-4cde-aa45-8be9df6fa758}Gw64.sys
2016-02-22 15:20 - 2016-02-22 16:45 - 00000000 ____D C:\programy
2016-02-22 15:20 - 2016-02-22 15:21 - 00000000 ____D C:\Program Files (x86)\Windows Loader
2016-02-10 10:19 - 2016-02-22 15:20 - 00000000 ____D C:\Users\Rob\Downloads\z neta
2016-02-10 10:19 - 2016-02-10 10:19 - 01185793 _____ C:\Users\Rob\Downloads\Marcinski_A_2005_Dziecko_maltretowane_urazy_nieprzypadkowe.pdf
2016-02-07 11:21 - 2016-02-07 11:21 - 00440160 _____ C:\Users\Rob\Downloads\Wzgledna_trafnosc_samooceny_sylwetki_i_wskaznika_BMI_(Body_Mass_Index).pdf
2016-02-05 13:20 - 2016-02-05 13:20 - 00507348 _____ C:\Users\Rob\Downloads\Kluz.pdf
2016-02-05 13:19 - 2016-02-05 13:19 - 00854501 _____ C:\Users\Rob\Downloads\04_Profilaktyka_Zdrowotna_Interpretacje.pdf
2016-02-04 21:32 - 2016-02-04 21:32 - 00956444 _____ C:\Users\Rob\Downloads\NA0614046PLC_002.pdf
2016-02-03 14:18 - 2016-02-03 14:18 - 00079231 _____ C:\Users\Rob\Downloads\2632-6231-1-PB.pdf
2016-02-01 14:50 - 2016-02-01 14:50 - 02300609 _____ C:\Users\Rob\Downloads\PGIS_4_Zdrowie.pdf
2016-02-01 12:24 - 2016-02-01 12:24 - 00418911 _____ C:\Users\Rob\Downloads\D19940083Lj.pdf
2016-01-31 11:22 - 2016-01-31 11:22 - 00819709 _____ C:\Users\Rob\Downloads\podstawydietetyki.pdf
2016-01-30 20:40 - 2016-02-22 16:43 - 00350597 _____ C:\Users\Rob\Desktop\PLAN ZAJĘĆ - semestr letni 2016.pdf
2016-01-26 17:02 - 2016-01-26 17:02 - 00000000 ____D C:\Users\Rob\AppData\Local\StatSoft
2016-01-26 16:13 - 2016-01-26 16:13 - 00000000 ____D C:\Users\Rob\AppData\Roaming\StatSoft
2016-01-26 16:12 - 2016-01-26 16:12 - 00000000 ____D C:\Users\Rob\AppData\Roaming\Softland
2016-01-26 16:12 - 2016-01-26 16:12 - 00000000 ____D C:\ProgramData\StatSoft
2016-01-26 16:12 - 2016-01-26 16:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\STATISTICA 12 64-bit
2016-01-26 16:12 - 2016-01-26 16:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\novaPDF 7
2016-01-26 16:12 - 2016-01-26 16:12 - 00000000 ____D C:\Program Files\Common Files\StatSoft
2016-01-26 16:12 - 2016-01-26 16:11 - 00001663 _____ C:\Users\Public\Desktop\STATISTICA.lnk
2016-01-26 16:12 - 2013-02-13 14:20 - 00029504 _____ (Softland) C:\Windows\system32\novamnk7.dll
2016-01-26 16:12 - 2013-02-13 14:20 - 00022336 _____ (Softland) C:\Windows\system32\novamik7.dll
2016-01-26 16:12 - 2011-11-22 17:06 - 00007549 _____ C:\Windows\system32\novak7.ctm
2016-01-26 16:12 - 2010-02-05 14:00 - 01700352 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2016-01-26 16:11 - 2016-01-26 16:11 - 00000000 ____D C:\Program Files\StatSoft
2016-01-26 14:59 - 2016-01-26 14:59 - 00000000 ____D C:\4e80e94bd00bc52a24b9c896e26460
2016-01-26 14:59 - 2016-01-26 14:59 - 00000000 ____D C:\3da5429275c980508d2b12018e94

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-02-25 07:07 - 2009-07-14 05:45 - 00022576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-02-25 07:07 - 2009-07-14 05:45 - 00022576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-02-25 07:04 - 2009-07-14 18:55 - 00699460 _____ C:\Windows\system32\perfh015.dat
2016-02-25 07:04 - 2009-07-14 18:55 - 00135840 _____ C:\Windows\system32\perfc015.dat
2016-02-25 07:04 - 2009-07-14 06:13 - 01549696 _____ C:\Windows\system32\PerfStringBackup.INI
2016-02-25 07:04 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-02-25 07:00 - 2016-01-21 11:36 - 00000000 __SHD C:\Users\Rob\IntelGraphicsProfiles
2016-02-25 07:00 - 2016-01-21 11:16 - 00000000 ____D C:\Users\Rob\AppData\Local\Deployment
2016-02-25 06:59 - 2016-01-21 11:16 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-02-25 06:59 - 2016-01-21 11:01 - 00097264 _____ (Lenovo (Beijing) Limited) C:\Windows\system32\LenovoCheck.exe
2016-02-25 06:59 - 2016-01-21 11:01 - 00026608 _____ (Lenovo) C:\Windows\system32\LenovoUpdate.exe
2016-02-25 06:59 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-02-24 08:37 - 2016-01-21 11:18 - 00001310 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-02-24 08:37 - 2016-01-21 11:18 - 00001304 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-02-24 08:37 - 2016-01-21 11:05 - 00001188 _____ C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-02-22 16:27 - 2016-01-21 15:41 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2016-02-22 16:27 - 2016-01-21 15:41 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2016-02-22 15:56 - 2016-01-21 11:05 - 00001417 _____ C:\Users\Rob\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-02-22 15:26 - 2009-07-14 03:34 - 00000580 _____ C:\Windows\win.ini
2016-02-19 16:40 - 2016-01-21 12:26 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-02-03 10:12 - 2016-01-21 11:16 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-02-03 10:12 - 2016-01-21 11:16 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-02-03 10:12 - 2016-01-21 11:16 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

==================== Pliki w katalogu głównym wybranych folderów =======

2016-02-22 15:38 - 2016-02-22 15:38 - 7951360 _____ () C:\Users\Rob\AppData\Roaming\agent.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 0054272 _____ () C:\Users\Rob\AppData\Roaming\ApplicationHosting.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 0063696 _____ () C:\Users\Rob\AppData\Roaming\Config.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 0848437 _____ () C:\Users\Rob\AppData\Roaming\EcoPhase.bin
2016-02-22 15:38 - 2016-02-22 15:38 - 0018672 _____ () C:\Users\Rob\AppData\Roaming\InstallationConfiguration.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 0126976 _____ () C:\Users\Rob\AppData\Roaming\Installer.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 0126464 _____ () C:\Users\Rob\AppData\Roaming\lobby.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 0667136 _____ () C:\Users\Rob\AppData\Roaming\Lotdom.exe
2016-02-22 15:38 - 2016-02-22 15:38 - 1881610 _____ () C:\Users\Rob\AppData\Roaming\Lotdom.tst
2016-02-22 15:38 - 2016-02-22 15:38 - 0018432 _____ () C:\Users\Rob\AppData\Roaming\Main.dat
2016-02-22 15:38 - 2016-02-22 15:38 - 0005568 _____ () C:\Users\Rob\AppData\Roaming\md.xml
2016-02-22 15:38 - 2016-02-22 15:38 - 0189671 _____ () C:\Users\Rob\AppData\Roaming\New-Tone.bin
2016-02-22 15:38 - 2016-02-22 15:38 - 0126464 _____ () C:\Users\Rob\AppData\Roaming\noah.dat
2016-02-22 15:39 - 2016-02-22 15:39 - 0001150 _____ () C:\Users\Rob\AppData\Roaming\uninstall_temp.ico
2016-02-22 15:39 - 2016-02-22 15:39 - 0222699 _____ () C:\Users\Rob\AppData\Roaming\Unolam.bin
2016-02-22 15:38 - 2016-02-22 15:38 - 0667136 _____ () C:\Users\Rob\AppData\Roaming\Villadex.exe
2016-02-22 15:38 - 2016-02-22 15:38 - 0072711 _____ () C:\Users\Rob\AppData\Roaming\Villadex.tst
2016-02-22 15:39 - 2016-02-22 15:39 - 0041472 _____ () C:\Users\Rob\AppData\Local\Unocare.dat
2016-02-22 15:39 - 2016-02-22 15:39 - 0028160 _____ () C:\Users\Rob\AppData\Local\Unocare.exe
2016-02-22 15:39 - 2016-02-22 15:39 - 0000187 _____ () C:\Users\Rob\AppData\Local\Unocare.exe.config

Niektóre pliki w TEMP:
====================
C:\Users\Rob\AppData\Local\Temp\3948.tmp.exe
C:\Users\Rob\AppData\Local\Temp\5C17.tmp.exe
C:\Users\Rob\AppData\Local\Temp\6D15.tmp.exe
C:\Users\Rob\AppData\Local\Temp\6FA6.tmp.exe
C:\Users\Rob\AppData\Local\Temp\7F1F.tmp.exe
C:\Users\Rob\AppData\Local\Temp\9A3D.tmp.exe
C:\Users\Rob\AppData\Local\Temp\amisetup8289__18454.exe
C:\Users\Rob\AppData\Local\Temp\amisetup8309__18454.exe
C:\Users\Rob\AppData\Local\Temp\amisetup8420__18454.exe
C:\Users\Rob\AppData\Local\Temp\DD27.tmp.exe
C:\Users\Rob\AppData\Local\Temp\E8F7.tmp.exe
C:\Users\Rob\AppData\Local\Temp\fsdD0E5.exe
C:\Users\Rob\AppData\Local\Temp\hib230A.exe
C:\Users\Rob\AppData\Local\Temp\hib2828.exe
C:\Users\Rob\AppData\Local\Temp\hib8CD3.exe
C:\Users\Rob\AppData\Local\Temp\MQCNL14S1F.exe
C:\Users\Rob\AppData\Local\Temp\nss4D55.exe
C:\Users\Rob\AppData\Local\Temp\O2E8VOYC9W.exe
C:\Users\Rob\AppData\Local\Temp\SAXTMP42RG.exe
C:\Users\Rob\AppData\Local\Temp\SCVGUXF96W.exe
C:\Users\Rob\AppData\Local\Temp\setup_758.exe
C:\Users\Rob\AppData\Local\Temp\setup_ra.exe
C:\Users\Rob\AppData\Local\Temp\sqlite3.dll
C:\Users\Rob\AppData\Local\Temp\WindowsLoader2.4__8172_il38660.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-01-21 15:00

==================== Koniec  FRST.txt ============================