Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:04-03-2016
Uruchomiony przez Mateusz (administrator)  MATEUSZ-KOMPUTE (14-03-2016 13:11:25)
Uruchomiony z C:\Users\Mateusz\Downloads
Załadowane profile: Mateusz & UpdatusUser (Dostępne profile: Mateusz & UpdatusUser & Gość)
Platform: Windows 7 Ultimate (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: "C:\Program Files (x86)\Comodo\Chromodo\chromodo.exe" -- "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe
(Comodo) C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Comodo Security Solutions, Inc.) C:\Program Files\COMODO\GeekBuddy\unit_manager.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Comodo Security Solutions, Inc.) C:\Program Files\COMODO\GeekBuddy\unit.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\35.0.2066.92\opera.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1427648 2015-08-05] (COMODO)
HKLM\...\Run: [MRT] => C:\Windows\system32\MRT.exe [143659408 2016-03-08] (Microsoft Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [tvncontrol] => C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2486832 2016-02-05] (Comodo Security Solutions, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk [2016-03-08]
ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files\COMODO\GeekBuddy\launcher.exe (Comodo Security Solutions, Inc.)
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
CHR HKU\S-1-5-21-2592065745-1446701355-574578764-1000\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA
CHR HKU\S-1-5-21-2592065745-1446701355-574578764-1001\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{61C5DECA-82F3-4E9E-BE7A-74C58B48F93A}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{86BAC365-DE56-4161-BE86-02ED6B2E717B}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{90E013BE-B80A-4CE2-9350-5E01F3EE958E}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-2592065745-1446701355-574578764-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:Tabs
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-2592065745-1446701355-574578764-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-2592065745-1446701355-574578764-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-2592065745-1446701355-574578764-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 
SearchScopes: HKU\S-1-5-21-2592065745-1446701355-574578764-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Issaverr -> {A8D900BA-08F9-4D34-B0DB-A3499E104F5B} -> C:\Program Files (x86)\Issaverr\W7OkBAfWSpvw3i.dll => Brak pliku
BHO-x32: AllSaaver -> {BC79D3FD-393A-4B2F-B3FC-70D85BDB9BE8} -> C:\Program Files (x86)\AllSaaver\l9VLIlIoPaPnTH.dll => Brak pliku
Toolbar: HKU\S-1-5-21-2592065745-1446701355-574578764-1000 -> Brak nazwy - {4F524A2D-5637-4300-76A7-7A786E7484D7} -  Brak pliku
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2012-12-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2012-12-29] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)

Chrome: 
=======
CHR dev: Chrome dev build wykryto! <======= UWAGA

Opera: 
=======
OPR Extension: (Adblock Plus) - C:\Users\Mateusz\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2016-02-14]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 ChromodoUpdater; C:\Program Files (x86)\Comodo\Chromodo\chromodo_updater.exe [2291192 2016-02-02] (Comodo)
R2 CLPSLauncher; C:\Program Files (x86)\Common Files\COMODO\launcher_service.exe [81456 2016-02-08] (Comodo Security Solutions, Inc.)
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5542472 2015-09-03] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2265792 2015-08-05] (COMODO)
R2 GeekBuddyRSP; C:\Program Files (x86)\Common Files\COMODO\GeekBuddyRSP.exe [2486832 2016-02-05] (Comodo Security Solutions, Inc.)
R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [146984 2012-07-24] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-17] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2016-03-08] (Malwarebytes)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 CFRMD; C:\Windows\System32\DRIVERS\CFRMD.sys [37976 2016-02-02] (Windows (R) Win 7 DDK provider) [Brak podpisu cyfrowego]
R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [21184 2015-11-18] (COMODO)
R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [806032 2015-11-18] (COMODO)
R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [45856 2015-08-05] (COMODO)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [20968 2012-07-24] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [19944 2012-07-24] ()
R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [105096 2015-08-05] (COMODO)
R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46016 2012-07-24] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2016-03-08] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2016-03-08] (Malwarebytes Corporation)
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2016-03-14] ()
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MSICDSetup; \??\F:\CDriver64.sys [X]
S3 NTIOLib_1_0_3; \??\C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [X]
S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-14 13:01 - 2016-03-14 13:01 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2016-03-08 23:06 - 2016-03-08 23:06 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2016-03-08 22:49 - 2016-03-08 22:49 - 143659408 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-08 22:49 - 2016-03-08 22:49 - 00000000 ____D C:\Windows\system32\MRT
2016-03-08 22:47 - 2016-03-08 22:47 - 05509504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-08 22:47 - 2016-03-08 22:47 - 03957632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2016-03-08 22:47 - 2016-03-08 22:47 - 03901824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2016-03-08 22:47 - 2016-03-08 22:47 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2016-03-08 22:47 - 2016-03-08 22:47 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2016-03-08 22:37 - 2016-03-08 22:37 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-03-08 22:37 - 2016-03-08 22:37 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2016-03-08 22:37 - 2016-03-08 22:37 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-03-08 22:28 - 2016-03-08 22:28 - 00003414 _____ C:\malware.txt
2016-03-08 21:17 - 2016-03-08 21:17 - 00003310 _____ C:\Windows\System32\Tasks\{7DD2C9EC-CBBC-4BDF-9318-F6C7D8248884}
2016-03-08 21:15 - 2016-03-08 21:15 - 00000080 _____ C:\Users\Mateusz\Desktop\Dysk lokalny (E) - skrót.lnk
2016-03-08 21:11 - 2016-03-08 21:11 - 00001113 _____ C:\malwarebytes.txt
2016-03-08 20:14 - 2016-03-10 19:36 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-08 20:14 - 2016-03-08 21:16 - 00001096 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-03-08 20:14 - 2016-03-08 20:14 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-03-08 20:14 - 2016-03-08 20:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-03-08 20:14 - 2016-03-08 20:14 - 00025816 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-03-08 20:14 - 2016-03-08 20:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-03-08 20:14 - 2016-03-08 20:14 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-03-08 20:14 - 2016-03-08 20:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-03-08 20:13 - 2016-03-08 20:14 - 22908888 _____ (Malwarebytes ) C:\Users\Mateusz\Downloads\mbam-setup-2.2.0.1024.exe
2016-03-04 21:57 - 2016-03-04 21:57 - 00077116 _____ C:\Users\Mateusz\Downloads\Shortcut.txt
2016-03-04 21:56 - 2016-03-14 13:11 - 00012960 _____ C:\Users\Mateusz\Downloads\FRST.txt
2016-03-04 21:56 - 2016-03-04 21:57 - 00043583 _____ C:\Users\Mateusz\Downloads\Addition.txt
2016-03-04 21:55 - 2016-03-14 13:11 - 00000000 ____D C:\FRST
2016-03-04 21:54 - 2016-03-04 21:54 - 00609323 _____ C:\Users\Mateusz\Documents\gmer.txt
2016-03-04 21:50 - 2016-03-04 21:50 - 02374144 _____ (Farbar) C:\Users\Mateusz\Downloads\FRST64.exe
2016-03-04 21:48 - 2016-03-04 21:48 - 00380416 _____ C:\Users\Mateusz\Downloads\e8i0piq6.exe
2016-03-03 20:58 - 2016-03-03 20:58 - 00453078 _____ C:\ComboFix.txt
2016-03-03 19:44 - 2016-03-03 19:43 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00256000 _____ C:\Windows\PEV.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00208896 _____ C:\Windows\MBR.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00098816 _____ C:\Windows\sed.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00080412 _____ C:\Windows\grep.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00068096 _____ C:\Windows\zip.exe
2016-03-03 19:44 - 2016-03-03 19:43 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-02-24 16:19 - 2016-03-08 21:16 - 00001252 _____ C:\Users\Public\Desktop\Camtasia Studio 8.lnk
2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith
2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
2016-02-24 16:19 - 2016-02-24 16:19 - 00000000 ____D C:\Program Files (x86)\QuickTime
2016-02-24 16:18 - 2016-02-24 16:18 - 00000000 ____D C:\ProgramData\TechSmith
2016-02-24 16:18 - 2016-02-24 16:18 - 00000000 ____D C:\Program Files (x86)\TechSmith
2016-02-21 14:55 - 2016-02-21 14:57 - 00000000 ____D C:\Users\Mateusz\Desktop\ponczek
2016-02-16 16:22 - 2016-02-16 16:27 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia (1).exe
2016-02-14 19:28 - 2016-02-14 19:37 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia (2).exe
2016-02-14 19:28 - 2016-02-14 19:37 - 259967288 _____ C:\Users\Mateusz\Desktop\camtasia (1).exe
2016-02-14 14:52 - 2016-02-14 14:52 - 259967288 _____ C:\Users\Mateusz\Downloads\Camtasia Studio 8.6.0 [1].exe
2016-02-13 20:11 - 2016-02-13 20:16 - 259967288 _____ C:\Users\Mateusz\Downloads\camtasia.exe
2016-02-13 19:38 - 2016-02-13 19:38 - 00000000 ____D C:\Users\Mateusz\Desktop\film2

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-14 13:10 - 2013-06-12 21:00 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat
2016-03-14 13:04 - 2016-02-02 20:08 - 00232538 _____ C:\Windows\system32\Drivers\fvstore.dat
2016-03-14 13:01 - 2014-06-22 11:40 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2016-03-14 13:00 - 2013-06-11 20:22 - 00000000 ____D C:\ProgramData\NVIDIA
2016-03-14 13:00 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\Downloaded Program Files
2016-03-14 13:00 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-10 19:16 - 2016-01-15 20:30 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-08 23:40 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2016-03-08 23:15 - 2014-07-02 16:09 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Facebook
2016-03-08 23:11 - 2013-06-11 19:56 - 00065480 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2016-03-08 23:11 - 2009-07-14 18:55 - 00057632 _____ C:\Windows\system32\perfh015.dat
2016-03-08 23:11 - 2009-07-14 18:55 - 00027110 _____ C:\Windows\system32\perfc015.dat
2016-03-08 23:11 - 2009-07-14 06:13 - 00065480 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-08 23:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-03-08 22:29 - 2015-06-18 13:29 - 00000000 ____D C:\Program Files (x86)\Stout International
2016-03-08 21:38 - 2013-10-17 17:31 - 00000000 ____D C:\Users\Mateusz\Documents\My Games
2016-03-08 21:38 - 2013-06-14 09:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Conflict Desert Storm PL
2016-03-08 21:38 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-03-08 21:37 - 2014-01-20 17:04 - 00000000 ____D C:\ProgramData\Codemasters
2016-03-08 21:37 - 2014-01-05 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Purplehills
2016-03-08 21:37 - 2013-06-11 19:51 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-08 21:36 - 2013-06-14 08:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hard Truck 18 Wheels of Steel
2016-03-08 21:35 - 2013-06-16 19:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PLAY
2016-03-08 21:35 - 2013-06-16 19:47 - 00000000 ____D C:\Program Files (x86)\PLAY
2016-03-08 21:35 - 2013-06-16 10:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\City Interactive
2016-03-08 21:35 - 2013-06-16 10:37 - 00000000 ____D C:\Program Files (x86)\City Interactive
2016-03-08 21:21 - 2013-06-26 13:18 - 00000000 ____D C:\Program Files (x86)\Trucker2
2016-03-08 21:20 - 2016-01-13 17:36 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\WarThunder
2016-03-08 21:20 - 2014-01-25 11:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skoki narciarskie 2004
2016-03-08 21:20 - 2014-01-25 11:29 - 00000000 ____D C:\Program Files (x86)\Skoki narciarskie 2004
2016-03-08 21:20 - 2013-06-11 19:42 - 00000000 ____D C:\Users\Mateusz
2016-03-08 21:18 - 2015-12-31 23:22 - 00000000 ____D C:\Users\Mateusz\AppData\LocalLow\Unity
2016-03-08 21:18 - 2015-12-31 23:22 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Unity
2016-03-08 21:17 - 2015-07-09 17:15 - 00001111 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-03-08 21:17 - 2013-06-11 19:39 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-03-08 21:17 - 2013-06-11 19:39 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-03-08 21:17 - 2009-07-14 05:57 - 00001535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-03-08 21:17 - 2009-07-14 05:57 - 00001318 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-03-08 21:17 - 2009-07-14 05:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-03-08 21:17 - 2009-07-14 05:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-03-08 21:16 - 2016-02-02 19:32 - 00001882 _____ C:\Users\Public\Desktop\COMODO Internet Security.lnk
2016-03-08 21:16 - 2016-02-02 19:30 - 00002007 _____ C:\Users\Public\Desktop\GeekBuddy.lnk
2016-03-08 21:16 - 2016-02-02 19:30 - 00001116 _____ C:\Users\Public\Desktop\Internet (Chromodo).lnk
2016-03-08 21:16 - 2015-07-09 17:15 - 00001105 _____ C:\Users\Public\Desktop\Opera.lnk
2016-03-08 21:16 - 2015-05-18 17:08 - 00002012 _____ C:\Users\Public\Desktop\Niezbędnik rowerzysty.lnk
2016-03-08 21:16 - 2013-06-14 20:58 - 00001985 _____ C:\Users\Public\Desktop\HP Photo Creations.lnk
2016-03-08 21:16 - 2013-06-14 20:40 - 00002206 _____ C:\Users\Public\Desktop\HP Deskjet 2510 series.lnk
2016-03-08 21:16 - 2013-06-14 20:40 - 00001153 _____ C:\Users\Public\Desktop\Zakup materiałów eksploatacyjnych - HP Deskjet 2510 series.lnk
2016-03-08 21:15 - 2016-01-13 17:36 - 00002246 _____ C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk
2016-03-08 21:15 - 2015-05-24 18:36 - 00000988 _____ C:\Users\Mateusz\Desktop\Bandicam.lnk
2016-03-08 21:15 - 2013-06-14 21:33 - 00002673 _____ C:\Users\Mateusz\Desktop\Microsoft Office Word 2007.lnk
2016-03-08 21:15 - 2013-06-14 21:32 - 00001196 _____ C:\Users\Mateusz\Desktop\HP Scan.lnk
2016-03-08 21:15 - 2013-06-14 08:20 - 00000000 ____D C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-03-08 21:15 - 2013-06-11 19:43 - 00001451 _____ C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-08 21:15 - 2013-06-11 19:43 - 00001417 _____ C:\Users\Mateusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-03-08 21:15 - 2009-07-14 06:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-03-08 21:15 - 2009-07-14 05:54 - 00001224 _____ C:\Users\Mateusz\Desktop\Paint.lnk
2016-03-08 21:15 - 2009-07-14 05:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-03-08 21:14 - 2016-01-21 12:33 - 00000000 ____D C:\Program Files (x86)\Picexa
2016-03-08 21:14 - 2015-05-28 17:52 - 00000000 ____D C:\Users\Gość\AppData\Roaming\Elex-tech
2016-03-08 21:14 - 2014-09-10 13:29 - 00000000 ____D C:\ProgramData\GoSavee
2016-03-08 21:14 - 2014-08-04 18:19 - 00000000 ____D C:\ProgramData\FreshApp installer
2016-03-08 21:14 - 2014-07-28 10:24 - 00000000 ____D C:\ProgramData\Trusted Publisher
2016-03-08 21:14 - 2014-07-07 18:17 - 00000000 ____D C:\ProgramData\APN
2016-03-08 21:14 - 2014-06-21 10:28 - 00000000 ____D C:\ProgramData\AppSnow
2016-03-08 21:14 - 2014-04-11 19:33 - 00000000 ____D C:\Program Files (x86)\Settings Manager
2016-03-08 21:13 - 2013-06-14 21:13 - 00000000 ____D C:\Windows\system32\appmgmt
2016-03-04 22:46 - 2009-07-14 05:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-04 22:46 - 2009-07-14 05:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-04 21:44 - 2013-06-11 19:53 - 00000000 ____D C:\Users\Mateusz\AppData\Local\Google
2016-03-04 21:44 - 2013-06-11 19:53 - 00000000 ____D C:\Program Files (x86)\Google
2016-03-04 21:17 - 2015-07-31 09:08 - 00000000 ____D C:\ProgramData\ppgmibjmfhppdcaejhbocegpmkapgaji
2016-03-04 21:17 - 2015-05-23 15:02 - 00000000 ____D C:\Program Files (x86)\BrowserTexting
2016-03-04 21:17 - 2015-04-02 15:45 - 00000000 ____D C:\Program Files (x86)\ExsuTraSSaavings
2016-03-04 21:17 - 2015-03-17 18:05 - 00000000 ____D C:\Program Files (x86)\SaveNeWAAppz
2016-03-04 21:17 - 2015-03-05 19:55 - 00000000 ____D C:\Program Files (x86)\TakeTheCouupon
2016-03-04 21:17 - 2015-03-05 19:55 - 00000000 ____D C:\Program Files (x86)\Cookie Clicker Extended
2016-03-04 21:17 - 2015-03-05 19:39 - 00000000 ____D C:\Program Files (x86)\ExsstRiaSaviangs
2016-03-04 21:17 - 2015-02-27 12:29 - 00000000 ____D C:\Program Files (x86)\Redirect Path
2016-03-04 21:17 - 2015-02-27 12:29 - 00000000 ____D C:\Program Files (x86)\Iron Man Lego Adventures
2016-03-04 21:17 - 2015-02-27 12:28 - 00000000 ____D C:\Program Files (x86)\shhopepi
2016-03-04 21:17 - 2014-08-17 11:48 - 00000000 ____D C:\ProgramData\pRicechaop
2016-03-04 21:17 - 2014-08-14 13:26 - 00000000 ____D C:\ProgramData\ppriceechoP
2016-03-04 21:17 - 2014-08-11 13:22 - 00000000 ____D C:\ProgramData\prricechOpp
2016-03-04 21:17 - 2014-08-04 18:19 - 00000000 ____D C:\ProgramData\priceucchoopu
2016-03-04 21:17 - 2014-07-28 20:01 - 00000000 ____D C:\ProgramData\priiCecchop
2016-03-04 21:17 - 2014-07-28 11:09 - 00000000 ____D C:\ProgramData\priecechoP
2016-03-04 21:17 - 2014-07-28 10:24 - 00000000 ____D C:\ProgramData\prIceccHHop
2016-03-04 21:16 - 2015-03-05 19:40 - 00000000 ____D C:\Program Files (x86)\CalendarWeek
2016-03-04 21:16 - 2015-02-27 12:28 - 00000000 ____D C:\Program Files (x86)\Coinsave
2016-03-04 21:16 - 2014-08-04 18:19 - 00000000 ____D C:\Program Files (x86)\priceucchoopu
2016-03-04 20:38 - 2015-07-09 17:15 - 00003902 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1436458504
2016-03-04 20:38 - 2015-07-09 17:14 - 00000000 ____D C:\Program Files (x86)\Opera
2016-03-03 20:58 - 2016-02-05 19:41 - 00000000 ____D C:\Qoobox
2016-03-03 20:55 - 2016-02-05 19:40 - 00000000 ____D C:\Windows\erdnt
2016-03-03 20:53 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2016-03-03 20:49 - 2009-07-14 03:34 - 59244544 _____ C:\Windows\system32\config\SOFTWARE.bak
2016-03-03 20:49 - 2009-07-14 03:34 - 22806528 _____ C:\Windows\system32\config\SYSTEM.bak
2016-03-03 20:49 - 2009-07-14 03:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT.bak
2016-03-03 20:49 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.bak
2016-03-03 20:49 - 2009-07-14 03:34 - 00262144 _____ C:\Windows\system32\config\SAM.bak
2016-03-03 19:44 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2016-02-24 16:01 - 2013-10-17 17:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Techland
2016-02-24 16:00 - 2013-06-16 20:26 - 00000000 ____D C:\Program Files (x86)\Black Sheep Studio
2016-02-24 16:00 - 2013-06-14 08:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crazy Taxi
2016-02-24 16:00 - 2013-06-14 08:44 - 00000000 ____D C:\Program Files (x86)\Crazy Taxi
2016-02-24 15:59 - 2015-08-21 13:32 - 00000000 ____D C:\Program Files (x86)\MTA San Andreas 1.4
2016-02-24 15:58 - 2015-08-21 12:22 - 00000000 ____D C:\ProgramData\MTA San Andreas All
2016-02-24 15:58 - 2015-08-21 12:22 - 00000000 ____D C:\Program Files (x86)\MTA San Andreas 1.5
2016-02-24 15:57 - 2013-10-17 17:34 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin
2016-02-21 17:47 - 2015-11-19 14:37 - 00000000 ____D C:\Users\Mateusz\Desktop\orka
2016-02-17 16:50 - 2013-06-11 20:21 - 00000000 ____D C:\Users\UpdatusUser
2016-02-16 16:37 - 2015-05-23 14:48 - 00000000 ____D C:\Windows\pss
2016-02-13 18:57 - 2016-02-12 20:47 - 00000001 _____ C:\Windows\SysWOW64\pl.html

==================== Pliki w katalogu głównym wybranych folderów =======

2015-05-13 16:51 - 2016-02-02 19:19 - 0000024 _____ () C:\Users\Mateusz\AppData\Roaming\appdataFr25.bin
2015-01-15 16:58 - 2015-05-13 16:23 - 0000020 _____ () C:\Users\Mateusz\AppData\Roaming\appdataFr3.bin
2016-01-13 18:37 - 2016-02-02 19:17 - 0000089 _____ () C:\Users\Mateusz\AppData\Roaming\WB.CFG
2015-11-14 16:04 - 2015-11-14 16:04 - 0003584 _____ () C:\Users\Mateusz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-06-14 17:50 - 2013-06-14 17:50 - 0000017 _____ () C:\Users\Mateusz\AppData\Local\resmon.resmoncfg
2016-02-02 19:22 - 2016-02-02 19:22 - 0000796 _____ () C:\Users\Mateusz\AppData\Local\Temp-log.txt
2013-06-14 20:37 - 2013-06-14 20:37 - 0000057 _____ () C:\ProgramData\Ament.ini
2015-12-24 11:38 - 2016-01-12 15:59 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll
[2009-07-14 00:38] - [2013-06-11 21:17] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2009-07-14 00:24] - [2013-06-11 21:17] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-03-09 00:57

==================== Koniec  FRST.txt ============================