Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:27-02-2016 Uruchomiony przez Tays (administrator) TAYS-KOMPUTER (01-03-2016 20:20:45) Uruchomiony z C:\Users\Tays\Desktop Załadowane profile: Tays & UpdatusUser (Dostępne profile: Tays & UpdatusUser) Platform: Windows 7 Ultimate (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe () C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagent.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (BitTorrent Inc.) C:\Users\Tays\AppData\Roaming\uTorrent\uTorrent.exe (FastStone Soft) C:\Program Files (x86)\FastStone Capture\FSCapture.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (BitTorrent Inc.) C:\Users\Tays\AppData\Roaming\uTorrent\updates\3.4.5_41712\utorrentie.exe (BitTorrent Inc.) C:\Users\Tays\AppData\Roaming\uTorrent\updates\3.4.5_41712\utorrentie.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe (C. Ghisler & Co.) C:\Program Files (x86)\TC PowerPack 2\TOTALCMD.EXE (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11780712 2011-03-04] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-13] (ELAN Microelectronics Corp.) HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [3873704 2016-02-01] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [TC PowerPack 2] => C:\Program Files (x86)\TC PowerPack 2\TCPowerPack.exe [56832 2009-05-24] (BuKoX) HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe [179624 2016-02-18] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [594992 2016-01-29] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23499656 2016-01-15] (Google) HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\...\Run: [uTorrent] => C:\Users\Tays\AppData\Roaming\uTorrent\uTorrent.exe [2065944 2016-02-10] (BitTorrent Inc.) HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\...\Policies\Explorer: [] HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\...\MountPoints2: {6a223669-9e53-11e3-a506-806e6f6e6963} - E:\InstAll.exe HKU\S-1-5-21-3919403963-3147837309-3499571233-1001\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun HKU\S-1-5-21-3919403963-3147837309-3499571233-1001\...\MountPoints2: {6a223669-9e53-11e3-a506-806e6f6e6963} - E:\InstAll.exe AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-02-08] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2011-02-08] (NVIDIA Corporation) ShellIconOverlayIdentifiers: [ GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-01-15] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-01-15] (Google) ShellIconOverlayIdentifiers: [ GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-01-15] (Google) Startup: C:\Users\Tays\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FastStone Capture.lnk [2014-07-20] ShortcutTarget: FastStone Capture.lnk -> C:\Program Files (x86)\FastStone Capture\FSCapture.exe (FastStone Soft) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.5.1 8.8.8.8 Tcpip\..\Interfaces\{AEF2D5CD-B28B-407E-BC3A-8999426CE1D7}: [DhcpNameServer] 192.168.5.1 8.8.8.8 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKU\S-1-5-21-3919403963-3147837309-3499571233-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={SearchTerms}&fr=ntg BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\ssv.dll [2016-02-08] (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\jp2ssv.dll [2016-02-08] (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-09-08] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-09-08] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-09-08] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-09-08] (Microsoft Corporation) FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_306.dll [2016-02-10] () FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_306.dll [2016-02-10] () FF Plugin-x32: @java.com/DTPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\dtplugin\npDeployJava1.dll [2016-02-08] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.73.2 -> C:\Program Files (x86)\Java\jre1.8.0_73\bin\plugin2\npjp2.dll [2016-02-08] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-02-09] (Adobe Systems Inc.) Chrome: ======= CHR HomePage: Default -> hxxps://www.google.pl/ CHR StartupUrls: Default -> "hxxps://www.google.pl/","hxxp://www.delta-homes.com/?type=hp&ts=1432123317&z=281102cd6445afa98837607gaz9c9o7g6oacdc8gfc&from=wpm05203&uid=ST3500418AS_Z2A410Y5XXXXZ2A410Y5","hxxp://www.istartsurf.com/?type=hp&ts=1435159825&z=1d00d7122d33d3c70a2509dg4zbc5w8gfw2tcb4o4g&from=cor&uid=ST3500418AS_Z2A410Y5XXXXZ2A410Y5","hxxp://www.mystartsearch.com/?type=hp&ts=1435297137&z=e464845d738508094240d07gdzdc7weo9tfm9g1o3w&from=cornl&uid=ST3500418AS_Z2A410Y5XXXXZ2A410Y5","hxxp://www.istartsurf.com/?type=hp&ts=1448280821&z=4a9ef563b9b85d681ffb215g4z9z2bbodbee3wdeaw&from=cor&uid=SPCCXSolidXStateXDisk_E7CB0759080B00255289" CHR DefaultSearchURL: Default -> hxxps://mail.google.com/mail/u/0/#inbox CHR Session Restore: Default -> [funkcja włączona] CHR Profile: C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Tłumacz Google) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2016-02-29] CHR Extension: (Prezentacje Google) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-29] CHR Extension: (Dokumenty Google) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-29] CHR Extension: (Dysk Google) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-29] CHR Extension: (YouTube) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-29] CHR Extension: (Google Search) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-29] CHR Extension: (Infinity Nowa karta) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbfmnekepjoapopniengjbcpnbljalfg [2016-02-29] CHR Extension: (Szybkie wyszukiwanie) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\eipoppoadgjpjilajgmlkceakffokhkd [2016-02-29] CHR Extension: (Arkusze Google) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-29] CHR Extension: (Dokumenty Google offline) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-29] CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2016-02-29] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-29] CHR Extension: (Gmail) - C:\Users\Tays\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-29] CHR HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\Tays\AppData\Local\Google\Drive\user_default\apdfllckaahabafndbhieahigkjlhalf_live.crx [2015-03-30] CHR HKU\S-1-5-21-3919403963-3147837309-3499571233-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx Opera: ======= StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.) S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [604144 2016-02-01] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagent.exe [3881184 2016-02-01] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1045928 2016-02-18] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe [561104 2016-02-01] (AVG Technologies CZ, s.r.o.) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1215560 2016-02-22] () ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [184240 2015-11-06] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [315312 2016-01-05] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [272304 2016-01-08] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [284080 2015-10-21] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [398256 2015-08-14] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [260528 2016-01-22] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [42416 2015-12-04] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [302000 2015-10-08] (AVG Technologies CZ, s.r.o.) R0 Avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [23472 2016-01-08] (AVG Technologies CZ, s.r.o.) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-02-29] () R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-02-29 23:07 - 2016-02-29 23:07 - 00093433 _____ C:\Users\Tays\Desktop\GMER.txt 2016-02-29 22:33 - 2016-02-29 22:33 - 00380416 _____ C:\Users\Tays\Desktop\7j3wx5pl.exe 2016-02-29 18:58 - 2016-02-29 18:59 - 18587648 _____ (Malwarebytes ) C:\Users\Tays\Desktop\Niepotwierdzony 161549.crdownload 2016-02-29 17:59 - 2016-02-29 17:59 - 00031348 _____ C:\Users\Tays\Desktop\Addition.txt 2016-02-29 17:51 - 2016-02-29 17:51 - 00000000 ____D C:\Users\Tays\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome 2016-02-29 17:50 - 2016-02-29 17:50 - 00002260 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-02-29 17:50 - 2016-02-29 17:50 - 00002231 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2016-02-29 17:44 - 2016-02-29 17:45 - 00987728 _____ (Google Inc.) C:\Users\Tays\Downloads\ChromeSetup.exe 2016-02-29 17:41 - 2016-02-29 17:41 - 00000844 _____ C:\Users\Public\Desktop\Light.lnk 2016-02-29 17:36 - 2016-03-01 20:20 - 00017545 _____ C:\Users\Tays\Desktop\FRST.txt 2016-02-29 17:36 - 2016-03-01 20:20 - 00000000 ____D C:\FRST 2016-02-29 17:36 - 2016-02-29 17:36 - 02371072 _____ (Farbar) C:\Users\Tays\Desktop\FRST64.exe 2016-02-29 16:57 - 2016-02-29 18:59 - 00000000 ____D C:\AdwCleaner 2016-02-29 16:56 - 2016-02-29 16:56 - 01518592 _____ C:\Users\Tays\Desktop\AdwCleaner.exe 2016-02-29 16:52 - 2016-03-01 11:55 - 00000000 ____D C:\Users\Tays\AppData\LocalLow\uTorrent 2016-02-29 16:45 - 2016-02-29 16:45 - 00000000 _____ C:\autoexec.bat 2016-02-29 16:42 - 2016-02-29 16:42 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys 2016-02-28 21:44 - 2016-02-28 21:44 - 43821333 _____ C:\Users\Tays\Desktop\com.facebook.katana_65.0.0.42.81-23239543_minAPI21(armeabi-v7a)(280,360,400,420,480,560,640dpi).apk 2016-02-24 22:13 - 2016-02-24 22:58 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2016-02-24 22:12 - 2016-02-24 22:57 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2016-02-22 20:58 - 2016-02-22 21:25 - 00000000 ____D C:\Users\Tays\Downloads\Poklosie 480p ac3 pl 2012 2016-02-21 22:33 - 2016-02-21 22:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Abyssmedia 2016-02-21 22:33 - 2016-02-21 22:33 - 00000000 ____D C:\Program Files (x86)\Abyssmedia 2016-02-21 22:32 - 2016-02-21 22:32 - 01159023 _____ (AbyssMedia.com ) C:\Users\Tays\Downloads\waveditor.exe 2016-02-21 22:19 - 2012-12-04 23:06 - 00011750 _____ C:\Users\Tays\Desktop\dom - wydane.xlsx 2016-02-19 20:26 - 2016-02-19 20:28 - 00000000 ____D C:\Users\Tays\Downloads\Michael W. Smith - Decades of Worship (2012) 2016-02-19 20:22 - 2016-02-19 20:28 - 00000000 ____D C:\Users\Tays\Downloads\MWS Concert videos 2016-02-08 22:08 - 2016-02-08 22:08 - 00000000 ____D C:\Program Files (x86)\e-Deklaracje 2016-02-08 22:03 - 2016-02-08 22:03 - 00000000 ____D C:\Users\Tays\AppData\Local\CEF ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-03-01 20:21 - 2015-04-04 20:19 - 00000000 ____D C:\Users\Tays\Documents\Pliki programu Outlook 2016-03-01 20:20 - 2015-02-22 21:29 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-03-01 20:20 - 2014-03-02 22:18 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-03-01 20:19 - 2014-07-20 13:10 - 00000000 ____D C:\Users\Tays\AppData\Roaming\uTorrent 2016-03-01 14:19 - 2009-07-14 05:45 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-03-01 14:19 - 2009-07-14 05:45 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-03-01 11:54 - 2014-03-02 22:18 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-03-01 11:54 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-03-01 11:26 - 2014-02-25 22:11 - 00000000 ____D C:\ProgramData\MFAData 2016-02-29 17:50 - 2014-03-02 22:18 - 00000000 ____D C:\Users\Tays\AppData\Local\Google 2016-02-29 17:49 - 2014-03-02 22:18 - 00000000 ____D C:\Program Files (x86)\Google 2016-02-29 16:45 - 2014-02-25 20:38 - 00000000 ____D C:\Users\Tays 2016-02-28 22:07 - 2014-03-02 21:28 - 00000000 ____D C:\Users\Tays\AppData\Roaming\AIMP3 2016-02-28 18:01 - 2009-07-14 18:55 - 00737980 _____ C:\Windows\system32\perfh015.dat 2016-02-28 18:01 - 2009-07-14 18:55 - 00154636 _____ C:\Windows\system32\perfc015.dat 2016-02-28 18:01 - 2009-07-14 06:13 - 01662556 _____ C:\Windows\system32\PerfStringBackup.INI 2016-02-28 18:01 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2016-02-26 21:24 - 2014-03-31 16:09 - 00000000 ____D C:\Users\Tays\AppData\Roaming\vlc 2016-02-25 19:22 - 2009-07-14 06:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2016-02-24 22:14 - 2014-03-02 19:59 - 00000000 ____D C:\Users\Tays\AppData\Local\Adobe 2016-02-24 22:12 - 2014-03-02 22:11 - 00000000 ____D C:\Program Files (x86)\Adobe 2016-02-22 19:21 - 2015-05-22 19:56 - 00019270 _____ C:\Users\Tays\Desktop\Kredyt lista.xlsx 2016-02-22 19:05 - 2014-11-06 20:14 - 00000000 ____D C:\ProgramData\AVG Web TuneUp 2016-02-22 19:05 - 2014-11-06 20:14 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp 2016-02-21 22:17 - 2014-03-02 18:31 - 00000000 ____D C:\Users\Tays\AppData\Roaming\Skype 2016-02-21 16:10 - 2014-03-02 18:31 - 00000000 ____D C:\ProgramData\Skype 2016-02-12 19:43 - 2014-03-31 17:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2016-02-10 20:21 - 2015-02-22 21:29 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2016-02-10 20:21 - 2014-02-25 21:31 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-02-10 20:21 - 2014-02-25 21:31 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-02-08 23:50 - 2015-08-06 21:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2016-02-08 23:50 - 2015-08-06 21:49 - 00000000 ____D C:\Program Files (x86)\Java 2016-02-08 23:50 - 2015-08-01 22:43 - 00000000 ____D C:\ProgramData\Oracle 2016-02-08 23:49 - 2015-09-01 22:56 - 00000000 ____D C:\Users\Tays\.oracle_jre_usage 2016-02-08 23:49 - 2015-08-06 21:49 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2016-02-08 22:08 - 2014-03-27 20:14 - 00000889 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\e-Deklaracje.lnk 2016-02-03 20:37 - 2015-03-30 17:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2016-02-03 20:28 - 2014-03-02 22:18 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2016-02-03 20:28 - 2014-03-02 22:18 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2016-01-31 20:17 - 2014-03-02 22:11 - 00000000 ____D C:\ProgramData\Adobe ==================== Pliki w katalogu głównym wybranych folderów ======= 2014-12-16 15:02 - 2014-12-16 15:02 - 0312594 _____ ( ) C:\Program Files (x86)\baidus.exe Niektóre pliki w TEMP: ==================== C:\Users\Tays\AppData\Local\Temp\AcDeltree.exe C:\Users\Tays\AppData\Local\Temp\avg-6a2e2d1b-6932-4b0e-9a18-6a259f479046.exe C:\Users\Tays\AppData\Local\Temp\avguirn_081378161880.exe C:\Users\Tays\AppData\Local\Temp\avguirn_081418028867.exe C:\Users\Tays\AppData\Local\Temp\avguirn_08354282172.exe C:\Users\Tays\AppData\Local\Temp\avguirn_08748343581.exe C:\Users\Tays\AppData\Local\Temp\FNP_ACT_InstallerCA.dll C:\Users\Tays\AppData\Local\Temp\jre-8u60-windows-au.exe C:\Users\Tays\AppData\Local\Temp\jre-8u65-windows-au.exe C:\Users\Tays\AppData\Local\Temp\jre-8u71-windows-au.exe C:\Users\Tays\AppData\Local\Temp\jre-8u73-windows-au.exe C:\Users\Tays\AppData\Local\Temp\SkypeSetup.exe C:\Users\Tays\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-02-28 16:00 ==================== Koniec FRST.txt ============================