Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:04-03-2016 Uruchomiony przez Mateusz (administrator) MATEUSZ-KOMPUTE (04-03-2016 21:56:01) Uruchomiony z C:\Users\Mateusz\Downloads Załadowane profile: Mateusz & UpdatusUser & Gość (Dostępne profile: Mateusz & UpdatusUser & Gość) Platform: Windows 7 Ultimate (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: "C:\Program Files (x86)\Comodo\Chromodo\chromodo.exe" -- "%1") Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Comodo) C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe (Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (Comodo Security Solutions, Inc.) C:\Program Files\COMODO\GeekBuddy\unit_manager.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe () C:\Program Files (x86)\Stout International\Stout International.exe (Comodo Security Solutions, Inc.) C:\Program Files\COMODO\GeekBuddy\unit.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe (Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-08-05] (COMODO) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [tvncontrol] => C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2486832 2016-02-05] (Comodo Security Solutions, Inc.) AppInit_DLLs: C:\ProgramData\Lightzap\Dan-Air.dll => C:\ProgramData\Lightzap\Dan-Air.dll [805376 2016-01-13] () AppInit_DLLs-x32: C:\ProgramData\Lightzap\Funit.dll => C:\ProgramData\Lightzap\Funit.dll [257536 2016-01-13] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk [2016-02-02] ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files\COMODO\GeekBuddy\launcher.exe (Comodo Security Solutions, Inc.) GroupPolicy: Ograniczenia - Chrome <======= UWAGA CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA CHR HKU\S-1-5-21-2592065745-1446701355-574578764-1000\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA CHR HKU\S-1-5-21-2592065745-1446701355-574578764-1001\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{61C5DECA-82F3-4E9E-BE7A-74C58B48F93A}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{86BAC365-DE56-4161-BE86-02ED6B2E717B}: [NameServer] 82.163.142.6,95.211.158.133 Tcpip\..\Interfaces\{86BAC365-DE56-4161-BE86-02ED6B2E717B}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{90E013BE-B80A-4CE2-9350-5E01F3EE958E}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA HKU\S-1-5-21-2592065745-1446701355-574578764-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1406539535&from=wpc&uid=ST3750640NS_5QD2T1RXXXXX5QD2T1RX&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:Tabs HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1406539535&from=wpc&uid=ST3750640NS_5QD2T1RXXXXX5QD2T1RX&q={searchTerms} HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKU\S-1-5-21-2592065745-1446701355-574578764-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2592065745-1446701355-574578764-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKU\S-1-5-21-2592065745-1446701355-574578764-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.delta-homes.com/web/?type=ds&ts=1434029474&z=62324f6d8e788c7c1d3b78fgez8c1z5e4oat1zcm2e&from=ient06110&uid=ST3750640NS_5QD2T1RXXXXX5QD2T1RX&q={searchTerms} HKU\S-1-5-21-2592065745-1446701355-574578764-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs HKU\S-1-5-21-2592065745-1446701355-574578764-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} HKU\S-1-5-21-2592065745-1446701355-574578764-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} HKU\S-1-5-21-2592065745-1446701355-574578764-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} HKU\S-1-5-21-2592065745-1446701355-574578764-501\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.search.ask.com/?tpid=ORJ-V7C&o=APN11406&pf=V7&trgb=IE&p2=%5EBBE%5EOSJ000%5EYY%5EPL&gct=hp&apn_ptnrs=BBE&apn_dtid=%5EOSJ000%5EYY%5EPL&apn_dbr=ie_8.0.7600.16385&apn_uid=3F6416EA-A8B1-4B84-9276-5C73D9C4F383&itbv=12.12.2.83&doi=2014-07-07&psv=&pt=tb URLSearchHook: HKU\S-1-5-21-2592065745-1446701355-574578764-501 - SearchHook Class - {D8278076-BC68-4484-9233-6E7F1628B56C} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\searchhook.dll" Brak pliku SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1001 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csesjD5u-5A4q5FP8e4pqmivgqMoYY4AOBtHpIt9L0orNW64OcFjzImFtszuwCXAsWI_OahC9-21CZz_Eht3MgwSdUWCyc_lPE46SRACs1s-OPc47wvpLsvrc3vPigwkfml4CA6omUHPvoOo9n8eVL5ueE0L&q={searchTerms} BHO-x32: Issaverr -> {A8D900BA-08F9-4D34-B0DB-A3499E104F5B} -> C:\Program Files (x86)\Issaverr\W7OkBAfWSpvw3i.dll => Brak pliku BHO-x32: AllSaaver -> {BC79D3FD-393A-4B2F-B3FC-70D85BDB9BE8} -> C:\Program Files (x86)\AllSaaver\l9VLIlIoPaPnTH.dll => Brak pliku Toolbar: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> Ask Toolbar - {4F524A2D-5637-4300-76A7-7A786E7484D7} - "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\ORJ-V7C\Passport_x64.dll" Brak pliku Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) FireFox: ======== FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-07] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-07] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2012-12-29] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2012-12-29] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.) FF Plugin HKU\S-1-5-21-2592065745-1446701355-574578764-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Mateusz\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-2592065745-1446701355-574578764-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Mateusz\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-12-17] (Unity Technologies ApS) Chrome: ======= CHR dev: Chrome dev build wykryto! <======= UWAGA Opera: ======= OPR Extension: (Adblock Plus) - C:\Users\Mateusz\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2016-02-14] ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 ChromodoUpdater; C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe [2291192 2016-02-02] (Comodo) R2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [81456 2016-02-08] (Comodo Security Solutions, Inc.) R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5542472 2015-09-03] (COMODO) R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265792 2015-08-05] (COMODO) R2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2486832 2016-02-05] (Comodo Security Solutions, Inc.) R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [146984 2012-07-24] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation) R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [136704 2012-06-29] (MSI) [Brak podpisu cyfrowego] R2 Stout International; C:\Program Files (x86)\Stout International\Stout International.exe [8016081 2015-06-18] () [Brak podpisu cyfrowego] <==== UWAGA R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) S4 248642b4; "C:\Windows\system32\rundll32.exe" "c:\progra~2\pc_boo~1\AssistantSvc.dll",service S4 4d349a54; "C:\Windows\system32\rundll32.exe" "c:\progra~2\gs_boo~1\AssistantSvc.dll",service S2 APNMCP; "C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe" [X] S4 BBSvc; "C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BBSvc.exe" [X] S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X] S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X] S2 Lightzap; C:\ProgramData\\Lightzap\\Lightzap.exe -f "C:\ProgramData\\Lightzap\\Lightzap.dat" -l -a S4 SmdmFService; C:\Program Files (x86)\Assets Manager\smdmf\SmdmFService.exe [X] ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 CFRMD; C:\Windows\System32\DRIVERS\CFRMD.sys [37976 2016-02-02] (Windows (R) Win 7 DDK provider) [Brak podpisu cyfrowego] R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [21184 2015-11-18] (COMODO) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [806032 2015-11-18] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [45856 2015-08-05] (COMODO) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.) R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [20968 2012-07-24] () R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [19944 2012-07-24] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [105096 2015-08-05] (COMODO) R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-07-24] () S3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [14136 2010-01-18] (MSI) S4 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [68608 2005-08-10] (Protection Technology) [Brak podpisu cyfrowego] S4 sfhlp02; C:\Windows\System32\drivers\sfhlp02.sys [7168 2005-05-16] (Protection Technology) [Brak podpisu cyfrowego] S4 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [92160 2005-09-29] (Protection Technology) [Brak podpisu cyfrowego] R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2016-03-04] () R1 {148bd8a4-22d4-4044-808c-0b1b85c15929}Gw64; C:\Windows\System32\drivers\{148bd8a4-22d4-4044-808c-0b1b85c15929}Gw64.sys [48824 2014-11-28] (StdLib) R1 {21769883-19ae-4dd9-b522-3613333c3df7}Gw64; C:\Windows\System32\drivers\{21769883-19ae-4dd9-b522-3613333c3df7}Gw64.sys [48824 2014-10-27] (StdLib) R1 {3c433beb-079f-4f3d-a7d8-3be3076f2fbe}Gw64; C:\Windows\System32\drivers\{3c433beb-079f-4f3d-a7d8-3be3076f2fbe}Gw64.sys [48824 2014-11-29] (StdLib) R1 {3c433beb-079f-4f3d-a7d8-3be3076f2fbe}w64; C:\Windows\System32\drivers\{3c433beb-079f-4f3d-a7d8-3be3076f2fbe}w64.sys [48824 2015-01-09] (StdLib) R1 {3f382291-ecca-4a0e-875c-195a3b53133f}Gw64; C:\Windows\System32\drivers\{3f382291-ecca-4a0e-875c-195a3b53133f}Gw64.sys [48824 2014-11-27] (StdLib) R1 {b20d1921-9bc2-4560-913a-b040b4111d1f}Gw64; C:\Windows\System32\drivers\{b20d1921-9bc2-4560-913a-b040b4111d1f}Gw64.sys [48824 2014-10-29] (StdLib) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S1 F06DEFF2-5B9C-490D-910F-35D3A9119622; \??\C:\Program Files (x86)\Assets Manager\smdmf\x64\smdmfmgrc3.cfg [X] S3 MSICDSetup; \??\F:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X] U3 pwniypob; \??\C:\Users\Mateusz\AppData\Local\Temp\pwniypob.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-03-04 21:56 - 2016-03-04 21:56 - 00019802 _____ C:\Users\Mateusz\Downloads\FRST.txt 2016-03-04 21:55 - 2016-03-04 21:56 - 00000000 ____D C:\FRST 2016-03-04 21:54 - 2016-03-04 21:54 - 00609323 _____ C:\Users\Mateusz\Documents\gmer.txt 2016-03-04 21:50 - 2016-03-04 21:50 - 02374144 _____ (Farbar) C:\Users\Mateusz\Downloads\FRST64.exe 2016-03-04 21:48 - 2016-03-04 21:48 - 00380416 _____ C:\Users\Mateusz\Downloads\e8i0piq6.exe 2016-03-04 21:23 - 2016-03-04 21:23 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp 2016-03-04 21:21 - 2016-03-04 21:21 - 00003272 ____N C:\bootsqm.dat 2016-03-03 20:58 - 2016-03-03 20:58 - 00453078 _____ C:\ComboFix.txt 2016-03-03 19:44 - 2016-03-03 19:43 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00256000 _____ C:\Windows\PEV.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00208896 _____ C:\Windows\MBR.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00098816 _____ C:\Windows\sed.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00080412 _____ C:\Windows\grep.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00068096 _____ C:\Windows\zip.exe 2016-03-03 19:44 - 2016-03-03 19:43 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2016-02-24 16:19 - 2016-02-24 16:19 - 00001258 _____ C:\Users\Public\Desktop\Camtasia Studio 8.lnk 2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith 2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith 2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\Program Files (x86)\QuickTime 2016-02-24 16:18 - 2016-02-24 16:18 - 00000000 ____D C:\ProgramData\TechSmith 2016-02-24 16:18 - 2016-02-24 16:18 - 00000000 ____D C:\Program Files (x86)\TechSmith 2016-02-24 16:17 - 2016-02-24 16:17 - 00003460 _____ C:\Windows\System32\Tasks\MateuszDogwoodsAllotrophicV2 2016-02-24 16:16 - 2016-02-24 16:16 - 01100108 _____ ( ) C:\Users\Mateusz\Downloads\Fotor-40637-dp.exe 2016-02-21 14:55 - 2016-02-21 14:57 - 00000000 ____D C:\Users\Mateusz\Desktop\ponczek 2016-02-16 16:22 - 2016-02-16 16:27 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia (1).exe 2016-02-14 19:28 - 2016-02-14 19:37 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia (2).exe 2016-02-14 19:28 - 2016-02-14 19:37 - 259967288 _____ C:\Users\Mateusz\Desktop\camtasia (1).exe 2016-02-14 14:52 - 2016-02-14 14:52 - 259967288 _____ C:\Users\Mateusz\Downloads\Camtasia Studio 8.6.0 [1].exe 2016-02-14 14:48 - 2016-02-14 14:48 - 01004160 _____ (Software Lite ) C:\Users\Mateusz\Downloads\Camtasia Studio 8.6.0.exe 2016-02-14 14:40 - 2016-02-14 14:40 - 00948282 _____ (Application Soft ) C:\Users\Mateusz\Downloads\Camtasia-Studio-12665-dp (4).exe 2016-02-14 14:39 - 2016-02-14 14:39 - 00948282 _____ (Application Soft ) C:\Users\Mateusz\Downloads\Camtasia-Studio-12665-dp (3).exe 2016-02-13 20:11 - 2016-02-13 20:16 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia.exe 2016-02-13 19:56 - 2016-02-13 19:57 - 00948282 _____ (Application Soft ) C:\Users\Mateusz\Downloads\Camtasia-Studio-12665-dp (2).exe 2016-02-13 19:38 - 2016-02-13 19:38 - 00000000 ____D C:\Users\Mateusz\Desktop\film2 2016-02-12 20:47 - 2016-02-13 18:57 - 00000001 _____ C:\Windows\SysWOW64\pl.html 2016-02-12 16:56 - 2016-02-12 17:11 - 387018225 _____ C:\Users\Mateusz\Downloads\SToP_Team_UNPACK.rar 2016-02-09 16:06 - 2016-02-09 16:15 - 276368470 _____ C:\Users\Mateusz\Downloads\TypowaPolskaWies_v3_MafiaSolec__1_.rar 2016-02-09 10:24 - 2016-02-09 10:24 - 00074800 _____ (Microsoft Corporation) C:\Windows\system32\offreg.dll 2016-02-07 17:14 - 2016-02-07 17:21 - 220863749 _____ C:\Users\Mateusz\Downloads\Farming_Symulator_2015___Patch_1.1.0.1_PL (1).rar 2016-02-05 19:41 - 2016-03-03 20:58 - 00000000 ____D C:\Qoobox 2016-02-05 19:40 - 2016-03-03 20:55 - 00000000 ____D C:\Windows\erdnt ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-03-04 21:54 - 2016-02-02 20:08 - 00228196 _____ C:\Windows\system32\Drivers\fvstore.dat 2016-03-04 21:51 - 2013-06-12 21:00 - 00638289 _____ C:\Windows\system32\Drivers\sfi.dat 2016-03-04 21:44 - 2013-06-11 19:53 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Google 2016-03-04 21:44 - 2013-06-11 19:53 - 00000000 ____D C:\Program Files (x86)\Google 2016-03-04 21:35 - 2015-08-25 19:00 - 00000000 ____D C:\Program Files (x86)\DNS Unlocker 2016-03-04 21:23 - 2014-06-22 11:40 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys 2016-03-04 21:22 - 2013-06-11 20:22 - 00000000 ____D C:\ProgramData\NVIDIA 2016-03-04 21:22 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-03-04 21:17 - 2016-01-13 17:37 - 00000000 ____D C:\ProgramData\Lightzap 2016-03-04 21:17 - 2015-07-31 09:08 - 00000000 ____D C:\ProgramData\ppgmibjmfhppdcaejhbocegpmkapgaji 2016-03-04 21:17 - 2015-06-11 14:32 - 00000000 ____D C:\Users\Mateusz\AppData\Everything 2016-03-04 21:17 - 2015-06-11 14:31 - 00000000 ____D C:\Program Files (x86)\MiuiTab 2016-03-04 21:17 - 2015-05-23 15:02 - 00000000 ____D C:\Program Files (x86)\BrowserTexting 2016-03-04 21:17 - 2015-05-23 15:01 - 00000000 ____D C:\Program Files (x86)\DiscountExTTensii 2016-03-04 21:17 - 2015-04-02 15:45 - 00000000 ____D C:\Program Files (x86)\ExsuTraSSaavings 2016-03-04 21:17 - 2015-03-17 18:05 - 00000000 ____D C:\Program Files (x86)\SaveNeWAAppz 2016-03-04 21:17 - 2015-03-05 19:55 - 00000000 ____D C:\Program Files (x86)\TakeTheCouupon 2016-03-04 21:17 - 2015-03-05 19:55 - 00000000 ____D C:\Program Files (x86)\Cookie Clicker Extended 2016-03-04 21:17 - 2015-03-05 19:39 - 00000000 ____D C:\Program Files (x86)\ExsstRiaSaviangs 2016-03-04 21:17 - 2015-02-27 12:29 - 00000000 ____D C:\Program Files (x86)\Redirect Path 2016-03-04 21:17 - 2015-02-27 12:29 - 00000000 ____D C:\Program Files (x86)\Iron Man Lego Adventures 2016-03-04 21:17 - 2015-02-27 12:28 - 00000000 ____D C:\Program Files (x86)\shhopepi 2016-03-04 21:17 - 2014-12-08 19:53 - 00000000 ____D C:\ProgramData\clickit 2016-03-04 21:17 - 2014-09-26 19:36 - 00000000 ____D C:\Program Files (x86)\GaoSavEo 2016-03-04 21:17 - 2014-09-26 19:33 - 00000000 ____D C:\Program Files (x86)\GuOSavoe 2016-03-04 21:17 - 2014-09-26 11:48 - 00000000 ____D C:\Program Files (x86)\GoSSave 2016-03-04 21:17 - 2014-09-18 17:05 - 00000000 ____D C:\Program Files (x86)\GoSAuveE 2016-03-04 21:17 - 2014-09-18 13:12 - 00000000 ____D C:\Program Files (x86)\GOSaVe 2016-03-04 21:17 - 2014-09-10 13:29 - 00000000 ____D C:\Program Files (x86)\GoSavee 2016-03-04 21:17 - 2014-08-17 11:48 - 00000000 ____D C:\ProgramData\pRicechaop 2016-03-04 21:17 - 2014-08-14 13:26 - 00000000 ____D C:\ProgramData\ppriceechoP 2016-03-04 21:17 - 2014-08-11 13:22 - 00000000 ____D C:\ProgramData\prricechOpp 2016-03-04 21:17 - 2014-08-11 13:22 - 00000000 ____D C:\ProgramData\priccechop 2016-03-04 21:17 - 2014-08-04 18:19 - 00000000 ____D C:\ProgramData\priceucchoopu 2016-03-04 21:17 - 2014-07-28 20:01 - 00000000 ____D C:\ProgramData\priiCecchop 2016-03-04 21:17 - 2014-07-28 11:09 - 00000000 ____D C:\ProgramData\priecechoP 2016-03-04 21:17 - 2014-07-28 11:09 - 00000000 ____D C:\Program Files (x86)\priecechoP 2016-03-04 21:17 - 2014-07-28 10:24 - 00000000 ____D C:\ProgramData\prIceccHHop 2016-03-04 21:17 - 2009-07-14 05:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-03-04 21:17 - 2009-07-14 05:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-03-04 21:16 - 2016-01-15 20:30 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-03-04 21:16 - 2015-03-05 19:40 - 00000000 ____D C:\Program Files (x86)\CalendarWeek 2016-03-04 21:16 - 2015-02-27 12:28 - 00000000 ____D C:\Program Files (x86)\Coinsave 2016-03-04 21:16 - 2014-10-29 19:47 - 00000000 ____D C:\Program Files (x86)\YourFileDownloader 2016-03-04 21:16 - 2014-09-30 16:17 - 00000000 ____D C:\Program Files (x86)\GoSaaVe 2016-03-04 21:16 - 2014-08-17 11:48 - 00000000 ____D C:\Program Files (x86)\pRicechaop 2016-03-04 21:16 - 2014-08-14 13:26 - 00000000 ____D C:\Program Files (x86)\ppriceechoP 2016-03-04 21:16 - 2014-08-11 13:22 - 00000000 ____D C:\Program Files (x86)\prricechOpp 2016-03-04 21:16 - 2014-08-11 13:22 - 00000000 ____D C:\Program Files (x86)\priccechop 2016-03-04 21:16 - 2014-08-04 18:19 - 00000000 ____D C:\Program Files (x86)\priceucchoopu 2016-03-04 21:16 - 2014-07-28 20:01 - 00000000 ____D C:\Program Files (x86)\priiCecchop 2016-03-04 21:16 - 2014-07-28 10:25 - 00000000 ____D C:\Program Files (x86)\SupTab 2016-03-04 21:16 - 2014-07-28 10:25 - 00000000 ____D C:\Program Files (x86)\Optimizer Pro 2016-03-04 21:16 - 2014-07-28 10:24 - 00000000 ____D C:\Program Files (x86)\prIceccHHop 2016-03-04 21:16 - 2014-07-28 10:24 - 00000000 ____D C:\Program Files (x86)\PC_Booster 2016-03-04 20:38 - 2015-07-09 17:15 - 00003902 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1436458504 2016-03-04 20:38 - 2015-07-09 17:14 - 00000000 ____D C:\Program Files (x86)\Opera 2016-03-04 20:15 - 2014-07-02 16:09 - 00000936 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2592065745-1446701355-574578764-1000UA.job 2016-03-04 19:52 - 2014-07-02 16:09 - 00000914 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2592065745-1446701355-574578764-1000Core.job 2016-03-03 21:00 - 2009-07-14 18:55 - 00013936 _____ C:\Windows\system32\perfh015.dat 2016-03-03 21:00 - 2009-07-14 18:55 - 00005260 _____ C:\Windows\system32\perfc015.dat 2016-03-03 21:00 - 2009-07-14 06:13 - 00009086 _____ C:\Windows\system32\PerfStringBackup.INI 2016-03-03 21:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2016-03-03 20:53 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini 2016-03-03 20:49 - 2009-07-14 03:34 - 59244544 _____ C:\Windows\system32\config\SOFTWARE.bak 2016-03-03 20:49 - 2009-07-14 03:34 - 22806528 _____ C:\Windows\system32\config\SYSTEM.bak 2016-03-03 20:49 - 2009-07-14 03:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT.bak 2016-03-03 20:49 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak 2016-03-03 20:49 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak 2016-03-03 19:44 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe 2016-02-24 16:20 - 2013-06-11 19:42 - 00000000 ____D C:\Users\Mateusz 2016-02-24 16:01 - 2013-10-17 17:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Techland 2016-02-24 16:01 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2016-02-24 16:00 - 2013-06-16 20:26 - 00000000 ____D C:\Program Files (x86)\Black Sheep Studio 2016-02-24 16:00 - 2013-06-14 08:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Taxi 2016-02-24 16:00 - 2013-06-14 08:44 - 00000000 ____D C:\Program Files (x86)\Crazy Taxi 2016-02-24 15:59 - 2015-08-21 13:32 - 00000000 ____D C:\Program Files (x86)\MTA San Andreas 1.4 2016-02-24 15:58 - 2015-08-21 12:22 - 00000000 ____D C:\ProgramData\MTA San Andreas All 2016-02-24 15:58 - 2015-08-21 12:22 - 00000000 ____D C:\Program Files (x86)\MTA San Andreas 1.5 2016-02-24 15:57 - 2013-10-17 17:34 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin 2016-02-21 17:47 - 2015-11-19 14:37 - 00000000 ____D C:\Users\Mateusz\Desktop\orka 2016-02-17 16:50 - 2013-06-11 20:21 - 00000000 ____D C:\Users\UpdatusUser 2016-02-16 16:37 - 2015-05-23 14:48 - 00000000 ____D C:\Windows\pss 2016-02-16 16:06 - 2016-01-13 17:37 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Gameo 2016-02-15 17:01 - 2015-12-08 16:58 - 00000000 ____D C:\Program Files (x86)\Steam 2016-02-14 13:42 - 2015-07-21 10:44 - 00000000 ____D C:\Program Files (x86)\SFK 2016-02-13 19:58 - 2014-10-27 15:18 - 00000000 ____D C:\Program Files (x86)\LuckyTab 2016-02-13 14:55 - 2016-01-13 17:37 - 00002389 _____ C:\Windows\SysWOW64\findit.xml 2016-02-12 19:39 - 2014-07-28 10:40 - 00000000 ____D C:\ProgramData\TEMP 2016-02-12 19:38 - 2014-07-28 10:40 - 00003266 _____ C:\Windows\System32\Tasks\Optimizer Pro Schedule 2016-02-12 17:15 - 2014-08-15 12:04 - 00000000 ____D C:\Users\Mateusz\Desktop\MODY 2016-02-11 14:30 - 2016-01-15 20:30 - 00004004 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier 2016-02-10 15:16 - 2016-01-20 13:16 - 19613888 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe 2016-02-10 15:16 - 2016-01-15 20:30 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-02-10 15:16 - 2016-01-15 20:30 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-02-10 15:16 - 2016-01-15 20:30 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2016-02-09 17:28 - 2015-12-24 11:38 - 00000000 ____D C:\Program Files (x86)\WinZipper ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-08-21 09:54 - 2015-12-24 11:37 - 2770377 _____ (iBank) C:\Program Files (x86)\SSFK.exe 2015-05-13 16:51 - 2016-02-02 19:19 - 0000024 _____ () C:\Users\Mateusz\AppData\Roaming\appdataFr25.bin 2015-01-15 16:58 - 2015-05-13 16:23 - 0000020 _____ () C:\Users\Mateusz\AppData\Roaming\appdataFr3.bin 2016-01-13 18:37 - 2016-02-02 19:17 - 0000089 _____ () C:\Users\Mateusz\AppData\Roaming\WB.CFG 2015-11-14 16:04 - 2015-11-14 16:04 - 0003584 _____ () C:\Users\Mateusz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-06-14 17:50 - 2013-06-14 17:50 - 0000017 _____ () C:\Users\Mateusz\AppData\Local\resmon.resmoncfg 2016-02-02 19:22 - 2016-02-02 19:22 - 0000796 _____ () C:\Users\Mateusz\AppData\Local\Temp-log.txt 2013-06-14 20:37 - 2013-06-14 20:37 - 0000057 _____ () C:\ProgramData\Ament.ini 2015-12-24 11:38 - 2016-01-12 15:59 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat Pliki do przeniesienia lub usunięcia: ==================== C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll [2009-07-14 00:38] - [2013-06-11 21:17] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79 C:\Windows\SysWOW64\User32.dll [2009-07-14 00:24] - [2013-06-11 21:17] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-03-03 21:17 ==================== Koniec FRST.txt ============================