Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:05-03-2016 01
Uruchomiony przez jan (administrator)  JEBACZ (10-04-2016 09:55:06)
Uruchomiony z C:\Users\jan\Downloads
Załadowane profile: jan (Dostępne profile: jan)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
() C:\Program Files (x86)\158ACBD8-1459263401-1520-0220-181505000000\hnsyDAE0.tmp
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.8.267.0\McCSPServiceHost.exe
() C:\Program Files\ktip\ktip.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\mcods.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCTray.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\platform\McUICnt.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCTray64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Hotkey Utility\HotkeyUtility.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Power Software Ltd) C:\Program Files\PowerISO\PWRISOVM.EXE
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCNews.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\jan\Downloads\FRST64 (2).exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\McVsMap.exe
(McAfee, Inc.) C:\Program Files\mcafee\virusscan\McVsShld.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13650648 2013-08-21] (Realtek Semiconductor)
HKLM\...\Run: [SpaceSoundPro] => C:\Program Files\SpaceSoundPro\SpaceSoundPro.exe [4203520 2015-08-03] (Space Sound Pro)
HKLM\...\Run: [WINCOMCDX] => C:\Program Files (x86)\sunnyday\wincom_CDX.exe [4050432 2016-03-31] ()
HKLM-x32\...\Run: [ic-0.89cd042281bce.exe -start] => C:\Users\jan\AppData\Local\Temp\349010750\ic-0.89cd042281bce.exe [2289664 2016-03-29] () <===== UWAGA
HKLM-x32\...\Run: [comoBoss] => C:\Program Files (x86)\comoBoss\comowin.exe [4050432 2016-03-30] ()
HKLM-x32\...\Run: [KokoMoss] => C:\Program Files (x86)\KokoMoss\comowin.exe [4050432 2016-03-30] ()
HKLM-x32\...\Run: [WizzWifiHotspot] => C:\Program Files (x86)\WizzWifiHotspot\WizzWifiHotspot.exe [2814464 2016-03-31] (Wizzlabs)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595480 2016-03-20] (Oracle Corporation)
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files\PowerISO\PWRISOVM.EXE [465544 2016-02-10] (Power Software Ltd)
HKLM\...\RunOnce: [WINDOWS_SCREEN_MANAGER_UPDATER_1] => C:\Program Files\Windows Screen Manager\Windows screen manage updater.exe [16896 2016-03-31] (Wizzservices)
HKLM\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs,
HKLM-x32\...\Winlogon: [Userinit] wscript C:\WINDOWS\run.vbs, [X]
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3077712 2016-03-31] (Valve Corporation)
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\...\Run: [MyComGames] => C:\Users\jan\AppData\Local\MyComGames\MyComGames.exe [4856688 2016-03-29] (MY.COM B.V.)
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [50599552 2016-02-10] (Skype Technologies S.A.)
AppInit_DLLs: C:\ProgramData\xedmal\Qvoin.dll => C:\ProgramData\xedmal\Qvoin.dll [363520 2016-03-31] ()
AppInit_DLLs-x32: C:\ProgramData\xedmal\Aptax.dll => C:\ProgramData\xedmal\Aptax.dll [257536 2016-03-31] ()
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{851C1639-84A9-464F-A95C-7282616F255D}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3451131124-2045846987-1590504244-1001 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3451131124-2045846987-1590504244-1001 -> {3672D504-4E65-4A9B-8153-E40B027FA20E} URL = 
SearchScopes: HKU\S-1-5-21-3451131124-2045846987-1590504244-1001 -> {B3B3A6AC-74EC-BD56-BCDB-EFA4799FB9DF} URL = hxxps://www.amazon.com/gp/bit/amazonserp/ref=bit_bds-p17_serp_ie_us_display?ie=UTF8&tagbase=bds-p17&tbrId=v1_abb-channel-17_452e4d2b_1201_1403_20160403_PL_ie_ds_&tag=bds-p17-serp-us-ie-20&query={searchTerms}
SearchScopes: HKU\S-1-5-21-3451131124-2045846987-1590504244-1001 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBSiA1rEAocN4PQUDpRKkKqLhA2_PfRuoh-oeV530K_Yv5vrAmct23uAI83ZTrXTTEJ0CnLZduPfTIgHh6vDAiWh-4NpfR3UvTcmozdKqDgwnQ88Xivl2ziZEoUm49AjZJR1c0bOWJAZ1pDPBOJ6E9UudN-pKVPmPedHf2I5AcyhC0vtDE,&q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\ssv.dll [2016-04-03] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\jp2ssv.dll [2016-04-03] (Oracle Corporation)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2016-03-21] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2016-03-21] (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2016-03-21] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2016-03-21] (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2016-03-03] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2016-03-03] (McAfee, Inc.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartpageing.com/?type=sc&ts=1459263684&z=8615b469c448d63d1b3c355g3zdw7tco9q1c1q7b7z&from=cmi&uid=ST1000DX001-1CM162_Z1DDFG7HXXXXZ1DDFG7H

FireFox:
========
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2016-03-03] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-19] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-19] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\dtplugin\npDeployJava1.dll [2016-04-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.77.2 -> C:\Program Files (x86)\Java\jre1.8.0_77\bin\plugin2\npjp2.dll [2016-04-03] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2016-03-03] ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-01-24] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-01-24] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-3451131124-2045846987-1590504244-1001: @my.com/Games -> C:\Users\jan\AppData\Local\MyComGames\NPMyComDetector.dll [2016-02-06] (MY.COM B.V.)
FF Plugin HKU\S-1-5-21-3451131124-2045846987-1590504244-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\jan\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-01-22] (Unity Technologies ApS)
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-12-29]
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2016-02-11] [Brak podpisu cyfrowego]

Chrome: 
=======
CHR HomePage: Default -> amazon.com/websearch/?ie=UTF8__PARAM__
CHR StartupUrls: Default -> "search.mpc.am"
CHR Profile: C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-30]
CHR Extension: (SiteAdvisor) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2016-03-29]
CHR Extension: (AdBlock) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-03-30]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Powiadamiacz Jebacz) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\odnjeeomgmaonkaichjkaglpfopbpdnb [2016-04-05]
CHR Extension: (Amazon Smart Search) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ooebgdicanjhnamfmdlmlbcnkgehkkmf [2016-04-03]
CHR Extension: (Amazon Assistant for Chrome) - C:\Users\jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbjikboenpfhbbejgkoklgkhjpfogcam [2016-04-07]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-03-23]
CHR HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ooebgdicanjhnamfmdlmlbcnkgehkkmf] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-3451131124-2045846987-1590504244-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pbjikboenpfhbbejgkoklgkhjpfogcam] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-03-23]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 Amazon 1Button App Service; C:\Program Files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonService64.Exe [436032 2016-02-17] (Amazon Inc.)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1362464 2016-03-22] ()
S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [245544 2016-02-06] (EasyAntiCheat Ltd)
S2 ggbugreport; C:\Program Files (x86)\SearchesToYesbnd\bugreport.exe [1609280 2016-03-29] ()
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-08-19] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-19] (Intel Corporation)
R2 ktip; C:\Program Files\ktip\ktip.exe [383488 2016-03-31] () [Brak podpisu cyfrowego]
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [163592 2016-03-21] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [863448 2016-03-03] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-25] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.8.267.0\McCSPServiceHost.exe [1696712 2016-02-23] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [681680 2016-02-26] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [234192 2015-11-18] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [380896 2016-01-21] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [275368 2015-11-18] (McAfee, Inc.)
R2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-03-29] (DotC United Inc)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-01-03] (McAfee, Inc.)
S3 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [4278112 2013-08-01] (Symantec Corporation)
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [902112 2015-12-14] (Intel Security, Inc.)
S3 Survarium-Steam Update Service; C:\Program Files (x86)\Steam\steamapps\common\Survarium\game\binaries\x86\survarium_service.exe [96856 2016-03-12] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation)
S2 Winsere; C:\Program Files (x86)\Winsere\Winsere\Winsere.exe [316472 2016-03-29] ()
R2 wucotusy; C:\Program Files (x86)\158ACBD8-1459263401-1520-0220-181505000000\hnsyDAE0.tmp [416256 2016-03-29] () [Brak podpisu cyfrowego]
S2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -a
S2 gerocyni; C:\Program Files (x86)\158ACBD8-1459263401-1520-0220-181505000000\jnsuC468.tmp [X]
S2 Konksolex; C:\ProgramData\\Konksolex\\Konksolex.exe shuz -f "C:\ProgramData\\Konksolex\\Konksolex.dat" -l -a
S2 Update thirteen degrees; "C:\Program Files (x86)\thirteen degrees\updatethirteendegrees.exe" [X]
S2 xedmal; C:\ProgramData\\xedmal\\xedmal.exe -f "C:\ProgramData\\xedmal\\xedmal.dat" -l -a

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 ccSet_NARA; C:\Windows\system32\drivers\NARAx64\0405000.009\ccSetx64.sys [150104 2013-07-30] (Symantec Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [79248 2015-11-25] (McAfee, Inc.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-19] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [419624 2015-11-25] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351144 2015-11-25] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [83096 2015-11-25] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496368 2015-11-25] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [846080 2015-11-25] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [539496 2015-11-20] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2015-11-20] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [36968 2016-01-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [245096 2015-11-25] (McAfee, Inc.)
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-03-29] (DotC United Inc)
R2 RtkIOAC60; C:\Windows\system32\DRIVERS\RtkIOAC60.sys [29912 2013-07-19] (Realtek semiconductor corp)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation)
S3 mfeaack01; \Device\mfeaack01.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-04-10 09:12 - 2016-04-10 09:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
2016-04-10 09:10 - 2016-04-10 09:10 - 00003846 _____ C:\WINDOWS\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-04-07 20:00 - 2016-04-07 20:00 - 00000000 ____D C:\Users\jan\AppData\Roaming\Opera Software
2016-04-07 20:00 - 2016-04-07 20:00 - 00000000 ____D C:\Users\jan\AppData\Local\Opera Software
2016-04-07 20:00 - 2016-04-07 20:00 - 00000000 ____D C:\ProgramData\Steam
2016-04-07 19:56 - 2016-04-07 19:56 - 00003870 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1460051785
2016-04-07 19:56 - 2016-04-07 19:56 - 00003246 _____ C:\WINDOWS\System32\Tasks\Opera N Sunday
2016-04-07 19:56 - 2016-04-07 19:56 - 00003246 _____ C:\WINDOWS\System32\Tasks\Opera N Saturday
2016-04-07 19:56 - 2016-04-07 19:56 - 00001890 _____ C:\Users\jan\Desktop\Facebook.lnk
2016-04-07 19:56 - 2016-04-07 19:56 - 00001206 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\A Story About My Uncle.lnk
2016-04-07 19:56 - 2016-04-07 19:56 - 00001194 _____ C:\Users\Public\Desktop\A Story About My Uncle.lnk
2016-04-07 19:56 - 2016-04-07 19:56 - 00001115 _____ C:\Users\Public\Desktop\Opera.lnk
2016-04-07 19:56 - 2016-04-07 19:56 - 00001115 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2016-04-07 19:56 - 2016-04-07 19:56 - 00000000 ____D C:\Users\jan\AppData\Roaming\Shortcut
2016-04-07 19:56 - 2016-04-07 19:56 - 00000000 ____D C:\Program Files (x86)\A Story About My Uncle
2016-04-07 19:55 - 2016-04-07 20:00 - 00000000 ____D C:\Program Files (x86)\Opera
2016-04-07 19:55 - 2016-04-07 19:55 - 00000000 ____D C:\Users\jan\AppData\Roaming\PowerISO
2016-04-07 19:54 - 2016-04-07 19:54 - 03644272 _____ (Power Software Ltd) C:\Users\jan\Downloads\PowerISO6-x64.exe
2016-04-07 19:54 - 2016-04-07 19:54 - 00000828 _____ C:\Users\Public\Desktop\PowerISO.lnk
2016-04-07 19:54 - 2016-04-07 19:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2016-04-07 19:54 - 2016-04-07 19:54 - 00000000 ____D C:\Program Files\PowerISO
2016-04-07 19:54 - 2016-02-10 15:21 - 00137280 _____ (Power Software Ltd) C:\WINDOWS\system32\Drivers\scdemu.sys
2016-04-07 19:20 - 2016-04-07 19:25 - 00000000 ____D C:\Users\jan\Downloads\A.Story.About.My.Uncle-RELOADED
2016-04-07 19:19 - 2016-04-07 19:19 - 00117760 _____ C:\Users\jan\Downloads\[torrenty.pl] A Story About My Uncle-RELOADED.torrent
2016-04-07 19:18 - 2016-04-07 19:18 - 00000000 ____D C:\Users\jan\Downloads\A.Story.About.My.Uncle.RELOADED
2016-04-07 19:17 - 2016-04-07 19:17 - 00015129 _____ C:\Users\jan\Downloads\[torrenty.pl] A Story About My Uncle RELOADED.torrent
2016-04-07 19:15 - 2016-04-07 19:16 - 00000000 ____D C:\Users\jan\AppData\LocalLow\uTorrent
2016-04-04 20:08 - 2016-04-07 20:00 - 00000000 ____D C:\Users\jan\Documents\My Games
2016-04-04 20:07 - 2016-04-04 20:07 - 00002423 _____ C:\Users\jan\Desktop\Play Crysis.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001199 _____ C:\Users\Public\Desktop\Get Random Viral.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001199 _____ C:\Users\jan\Desktop\Get Random Viral.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001199 _____ C:\Users\Default\Desktop\Get Random Viral.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001199 _____ C:\Users\Default User\Desktop\Get Random Viral.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001151 _____ C:\Users\Public\Desktop\Google Search.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001151 _____ C:\Users\jan\Desktop\Google Search.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001151 _____ C:\Users\Default\Desktop\Google Search.lnk
2016-04-04 19:02 - 2016-04-09 19:09 - 00001151 _____ C:\Users\Default User\Desktop\Google Search.lnk
2016-04-03 17:37 - 2016-04-10 09:13 - 00004598 _____ C:\WINDOWS\System32\Tasks\DistromaticSearchProtect-hourly
2016-04-03 17:37 - 2016-04-04 20:21 - 00000000 ____D C:\Users\jan\AppData\Roaming\.minecraft
2016-04-03 17:37 - 2016-04-03 17:37 - 00004474 _____ C:\WINDOWS\System32\Tasks\DistromaticUpdater-periodic
2016-04-03 17:37 - 2016-04-03 17:37 - 00004076 _____ C:\WINDOWS\System32\Tasks\DistromaticSearchProtect-logon
2016-04-03 17:37 - 2016-04-03 17:37 - 00003950 _____ C:\WINDOWS\System32\Tasks\DistromaticUpdater-logon
2016-04-03 17:37 - 2016-04-03 17:37 - 00000000 ____D C:\Users\jan\AppData\Local\Amazon Browser Settings
2016-04-03 17:37 - 2016-04-03 17:37 - 00000000 ____D C:\Program Files (x86)\Amazon Browser Settings
2016-04-03 17:37 - 2016-04-03 17:37 - 00000000 ____D C:\Program Files (x86)\Amazon
2016-04-03 17:36 - 2016-04-03 17:36 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\Users\jan\AppData\Roaming\Sun
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\Users\jan\AppData\LocalLow\Sun
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\Users\jan\.oracle_jre_usage
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\ProgramData\Oracle
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-04-03 17:36 - 2016-04-03 17:36 - 00000000 ____D C:\Program Files (x86)\Java
2016-04-03 17:32 - 2016-04-03 17:32 - 00734784 _____ (Oracle Corporation) C:\Users\jan\Downloads\chromeinstall-8u77.exe
2016-04-03 17:32 - 2016-04-03 17:32 - 00000000 ____D C:\Users\jan\AppData\LocalLow\Oracle
2016-04-03 17:31 - 2016-04-03 17:31 - 09337896 _____ C:\Users\jan\Downloads\ShiginimaSE_v3000.zip
2016-04-03 17:31 - 2016-04-03 17:31 - 00000000 ____D C:\Users\jan\Downloads\ShiginimaSE_v3000
2016-04-03 16:17 - 2016-04-03 16:17 - 00042914 _____ C:\Users\jan\Downloads\[torrenty.pl] Crysis 2 [PL] [DVD] [.iso] + Patch 1.9 (1).torrent
2016-04-02 21:47 - 2016-04-04 20:07 - 00000000 ____D C:\Users\jan\Downloads\Crysis multiplayer + singleplayer full game 1.2.1 ^^nosTEAM^^
2016-04-02 21:46 - 2016-04-02 21:46 - 00014389 _____ C:\Users\jan\Downloads\[torrenty.pl] Crysis multiplayer + singleplayer full game 1 2 1 ^^nosTEAM^^.torrent
2016-04-02 21:45 - 2016-04-02 21:45 - 00042914 _____ C:\Users\jan\Downloads\[torrenty.pl] Crysis 2 [PL] [DVD] [.iso] + Patch 1.9.torrent
2016-04-02 21:44 - 2016-04-02 21:44 - 00017523 _____ C:\Users\jan\Downloads\[torrenty.pl] Crysis [PL] 2007 [Razor1911] (+ patch 1 1,1 2,1 2 1) (1).torrent
2016-04-02 21:41 - 2016-04-02 21:41 - 00017511 _____ C:\Users\jan\Downloads\[torrenty.pl] Crysis [PL] 2007 [Razor1911] (+ patch 1 1,1 2,1 2 1).torrent
2016-04-01 20:08 - 2016-04-01 20:08 - 00380699 _____ C:\Users\jan\Downloads\O19_Faktura_indywidualna_000-032-4716-1837_16_03_F003_Z.pdf
2016-03-31 19:04 - 2016-04-10 09:15 - 00000000 ____D C:\Program Files (x86)\SearchesToYesbnd
2016-03-31 19:04 - 2016-04-09 15:50 - 00000000 ____D C:\Program Files (x86)\Hostify
2016-03-31 19:04 - 2016-04-02 14:30 - 00000971 _____ C:\Users\jan\Desktop\Hostify.lnk
2016-03-31 19:04 - 2016-03-31 19:04 - 00001071 _____ C:\Users\jan\Desktop\WizzWifiHotspot.lnk
2016-03-31 19:04 - 2016-03-31 19:04 - 00000000 ____D C:\Users\jan\AppData\Local\csdi_monetize_120160330
2016-03-31 19:04 - 2016-03-31 19:04 - 00000000 ____D C:\Program Files (x86)\WizzWifiHotspot
2016-03-31 19:04 - 2016-03-31 19:04 - 00000000 ____D C:\extensions
2016-03-31 11:38 - 2016-03-31 11:38 - 00000000 ____D C:\ProgramData\xedmals
2016-03-31 11:37 - 2016-04-02 11:03 - 00000000 ____D C:\ProgramData\xedmal
2016-03-31 08:38 - 2016-03-31 11:38 - 00002389 _____ C:\WINDOWS\SysWOW64\findit.xml
2016-03-31 08:38 - 2016-03-31 08:38 - 00000000 ____D C:\Users\jan\AppData\Roaming\Mozilla
2016-03-31 08:38 - 2016-03-31 08:38 - 00000000 ____D C:\ProgramData\Konksolexs
2016-03-31 08:37 - 2016-04-06 16:37 - 00000000 ____D C:\ProgramData\Konksolex
2016-03-31 08:37 - 2016-04-06 16:37 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-03-31 08:37 - 2016-04-06 16:07 - 00000000 ____D C:\Program Files\ktip
2016-03-31 08:37 - 2016-03-31 08:37 - 06504960 _____ C:\Users\jan\AppData\Roaming\agent.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 01626416 _____ C:\Users\jan\AppData\Roaming\Vaiais.tst
2016-03-31 08:37 - 2016-03-31 08:37 - 00188621 _____ () C:\Users\jan\AppData\Roaming\Rankix.bin
2016-03-31 08:37 - 2016-03-31 08:37 - 00126464 _____ C:\Users\jan\AppData\Roaming\noah.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 00126464 _____ C:\Users\jan\AppData\Roaming\lobby.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 00072699 _____ C:\Users\jan\AppData\Roaming\GoodLux.tst
2016-03-31 08:37 - 2016-03-31 08:37 - 00065424 _____ C:\Users\jan\AppData\Roaming\Config.xml
2016-03-31 08:37 - 2016-03-31 08:37 - 00054272 _____ C:\Users\jan\AppData\Roaming\ApplicationHosting.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 00018432 _____ C:\Users\jan\AppData\Roaming\Main.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 00005568 _____ C:\Users\jan\AppData\Roaming\md.xml
2016-03-31 08:36 - 2016-04-10 09:12 - 00000000 ____D C:\Program Files (x86)\sunnyday
2016-03-31 08:36 - 2016-04-02 14:31 - 00000000 ____D C:\Program Files (x86)\comoBoss
2016-03-31 08:36 - 2016-04-02 14:30 - 00000000 ____D C:\Program Files (x86)\KokoMoss
2016-03-31 08:36 - 2016-03-31 08:36 - 00160875 _____ C:\Users\jan\AppData\Roaming\inst.lat
2016-03-31 08:36 - 2016-03-31 08:36 - 00127488 _____ C:\Users\jan\AppData\Roaming\Installer.dat
2016-03-31 08:36 - 2016-03-31 08:36 - 00017760 _____ C:\Users\jan\AppData\Roaming\InstallationConfiguration.xml
2016-03-31 08:36 - 2016-03-31 08:36 - 00000000 ____D C:\Users\jan\AppData\Local\tuto_monetize_220160330
2016-03-31 08:36 - 2016-03-31 08:36 - 00000000 ____D C:\Users\jan\AppData\Local\tuto_monetize_120160330
2016-03-31 08:36 - 2016-03-31 08:36 - 00000000 ____D C:\Users\jan\AppData\Local\csdi_monetize_220160330
2016-03-31 08:36 - 2016-03-31 08:36 - 00000000 ____D C:\Program Files\Windows Screen Manager
2016-03-30 16:48 - 2016-03-30 16:48 - 00000000 ____D C:\Users\jan\AppData\Roaming\MCorp
2016-03-29 17:15 - 2016-04-10 09:14 - 00000000 ____D C:\Users\jan\AppData\Local\app
2016-03-29 17:11 - 2016-04-10 09:12 - 00001705 _____ C:\Users\Public\Desktop\MPC Cleaner.lnk
2016-03-29 17:11 - 2016-03-29 17:15 - 00000000 ____D C:\Program Files (x86)\CleanBrowser
2016-03-29 17:03 - 2016-03-29 17:03 - 00380928 _____ C:\Users\jan\Downloads\kbirh3qo.exe
2016-03-29 17:02 - 2016-03-29 17:02 - 02374144 _____ (Farbar) C:\Users\jan\Downloads\FRST64 (2).exe
2016-03-29 17:02 - 2016-03-29 17:02 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2016-03-29 17:01 - 2016-03-29 17:12 - 00000000 ____D C:\Users\jan\AppData\Roaming\istartpageing
2016-03-29 17:01 - 2016-03-29 17:01 - 00000000 ____D C:\Program Files (x86)\mpck_en_005030282
2016-03-29 17:00 - 2016-04-09 15:44 - 00000000 ____D C:\Program Files\SpaceSoundPro
2016-03-29 17:00 - 2016-03-29 17:11 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-03-29 17:00 - 2016-03-29 17:00 - 00060136 _____ (DotC United Inc) C:\WINDOWS\system32\Drivers\MPCKpt.sys
2016-03-29 17:00 - 2016-03-29 17:00 - 00000888 _____ C:\Users\jan\Desktop\SpaceSoundPro.lnk
2016-03-29 17:00 - 2016-03-29 17:00 - 00000000 ____D C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpaceSoundPro 1.0
2016-03-29 16:59 - 2016-03-29 16:59 - 00000266 __RSH C:\ProgramData\ntuser.pol
2016-03-29 16:58 - 2016-03-29 16:58 - 00000000 ____D C:\ProgramData\Tencent
2016-03-29 16:57 - 2016-03-29 16:56 - 00001340 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak
2016-03-29 16:56 - 2016-04-10 09:52 - 00000000 ____D C:\Users\jan\AppData\Roaming\YSPackage
2016-03-29 16:56 - 2016-04-08 18:02 - 00000000 ____D C:\Program Files (x86)\158ACBD8-1459263401-1520-0220-181505000000
2016-03-29 16:56 - 2016-03-29 16:57 - 00000000 ____D C:\Users\Public\Thunder Network
2016-03-29 16:56 - 2016-03-29 16:56 - 00000000 ____D C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\YSPackage
2016-03-29 16:56 - 2016-03-29 16:56 - 00000000 ____D C:\ProgramData\Thunder Network
2016-03-27 08:28 - 2016-03-29 16:41 - 00025600 ___SH C:\Users\jan\Desktop\Thumbs.db
2016-03-26 20:49 - 2016-03-29 17:06 - 00032759 _____ C:\Users\jan\Downloads\Shortcut.txt
2016-03-26 13:04 - 2016-04-10 09:53 - 00043945 _____ C:\Users\jan\Desktop\Addition.txt
2016-03-26 13:02 - 2016-04-10 09:53 - 00043945 _____ C:\Users\jan\Downloads\Addition.txt
2016-03-26 13:01 - 2016-04-10 09:55 - 00023349 _____ C:\Users\jan\Downloads\FRST.txt
2016-03-26 12:34 - 2016-03-26 12:34 - 00380928 _____ C:\Users\jan\Downloads\zsvprdjy.exe
2016-03-26 12:34 - 2016-03-26 12:34 - 00380928 _____ C:\Users\jan\Downloads\uk50tbun.exe
2016-03-26 12:34 - 2016-03-26 12:34 - 00380928 _____ C:\Users\jan\Downloads\no0pol8z.exe
2016-03-26 12:33 - 2016-03-26 12:33 - 02374144 _____ (Farbar) C:\Users\jan\Downloads\FRST64 (1).exe
2016-03-26 12:33 - 2016-03-26 12:33 - 00380928 _____ C:\Users\jan\Downloads\42wd5w3s.exe
2016-03-25 16:37 - 2016-04-01 18:30 - 00000000 ____D C:\Users\jan\AppData\Local\3810282D-6C19-47B0-8283-5C6C29A7E108
2016-03-25 16:37 - 2016-03-31 19:04 - 00015136 _____ C:\WINDOWS\System32\Tasks\WinTaske
2016-03-25 16:37 - 2016-03-29 16:59 - 00000000 ____D C:\Program Files (x86)\thirteen degrees
2016-03-25 16:37 - 2016-03-25 16:37 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-03-25 16:37 - 2016-03-25 16:37 - 00000000 ____D C:\Program Files (x86)\WinTaske
2016-03-25 16:37 - 2016-03-25 16:37 - 00000000 ____D C:\Program Files (x86)\Winsere
2016-03-25 16:36 - 2016-03-25 16:36 - 00526336 _____ C:\Users\jan\Downloads\Bloody2-Ultra Core 3 Activation Code.exe.iso
2016-03-25 13:26 - 2016-03-25 13:26 - 02362120 _____ C:\Users\jan\Downloads\Bloody-HeadShot-V131113-EN-doc.zip
2016-03-24 20:57 - 2016-03-24 20:57 - 00002005 _____ C:\Users\Public\Desktop\Bloody5.lnk
2016-03-24 20:57 - 2016-03-24 20:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bloody
2016-03-24 20:54 - 2016-03-24 20:55 - 26950764 _____ C:\Users\jan\Downloads\Bloody5 (1).zip
2016-03-24 20:53 - 2016-03-24 20:53 - 00000000 ____D C:\Users\jan\Downloads\KeyResponsePK V2.0_20150707_B1
2016-03-24 20:51 - 2016-03-24 20:52 - 10486312 _____ C:\Users\jan\Downloads\KeyResponsePK V2.0_20150707_B1.zip
2016-03-24 17:50 - 2016-03-24 20:57 - 00000000 ____D C:\Program Files (x86)\Bloody5
2016-03-24 17:47 - 2016-03-24 17:48 - 26950764 _____ C:\Users\jan\Downloads\Bloody5.zip
2016-03-24 17:43 - 2016-03-24 17:43 - 00000000 ____D C:\Users\jan\AppData\Local\CyberLink
2016-03-23 22:56 - 2016-03-23 22:56 - 00000000 ____D C:\Users\jan\AppData\Roaming\com.geetagames.LillyLookingThrough
2016-03-23 21:50 - 2016-03-24 08:56 - 00000000 ____D C:\Users\jan\Desktop\lindsey starling
2016-03-23 21:11 - 2016-03-23 21:51 - 00000000 ____D C:\Users\jan\Downloads\Lindsey Stirling - Discography (2010-2015) Mp3 - 320 kbps
2016-03-23 20:24 - 2016-03-23 20:24 - 00000222 _____ C:\Users\jan\Desktop\Lilly Looking Through.url
2016-03-22 21:41 - 2016-03-22 21:41 - 00000222 _____ C:\Users\jan\Desktop\Serious Sam 2.url
2016-03-22 17:55 - 2016-03-22 17:56 - 00000000 ____D C:\ProgramData\Package Cache
2016-03-21 20:52 - 2016-03-21 20:52 - 00000222 _____ C:\Users\jan\Desktop\ARK Survival Of The Fittest.url
2016-03-14 10:20 - 2016-03-29 17:01 - 00001196 _____ C:\Users\Public\Desktop\Assassin's Creed IV - Black Flag.lnk
2016-03-14 10:20 - 2016-03-14 10:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Assassin's Creed IV - Black Flag
2016-03-13 23:03 - 2016-03-13 23:03 - 00000000 ____D C:\Users\jan\AppData\Local\Setup Integrity Check
2016-03-13 22:59 - 2016-03-13 22:59 - 00000000 ____D C:\Users\jan\Downloads\-Oceanofgames.com-Assassins_Creed_Black_Flag
2016-03-13 17:30 - 2016-03-13 21:57 - 1401363099 _____ C:\Users\jan\Downloads\-Oceanofgames.com-Assassins_Creed_Black_Flag.zip
2016-03-12 16:34 - 2016-03-12 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Survarium-Steam
2016-03-12 16:28 - 2016-03-12 17:54 - 00000000 ____D C:\Users\jan\Documents\Survarium-Steam
2016-03-12 11:39 - 2016-03-12 11:39 - 00000222 _____ C:\Users\jan\Desktop\Survarium.url

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-04-10 09:55 - 2016-02-06 16:13 - 00000000 ____D C:\FRST
2016-04-10 09:48 - 2016-02-10 21:44 - 00000000 ____D C:\Users\jan\AppData\Roaming\Skype
2016-04-10 09:42 - 2016-02-06 15:37 - 00001056 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-10 09:40 - 2016-02-06 15:36 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3451131124-2045846987-1590504244-1001
2016-04-10 09:15 - 2016-02-06 15:38 - 00002056 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-04-10 09:15 - 2016-02-06 15:38 - 00002044 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-04-10 09:14 - 2016-02-06 15:36 - 00003968 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{D1F115F8-5716-4E54-8679-6E1786F8ABC9}
2016-04-10 09:12 - 2016-02-06 21:14 - 00000000 ____D C:\Users\jan\AppData\Local\MyComGames
2016-04-10 09:12 - 2016-02-06 15:56 - 00000000 ____D C:\Program Files (x86)\Steam
2016-04-10 09:12 - 2016-02-06 15:37 - 00001052 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-10 09:12 - 2016-02-06 15:35 - 00000000 ___DO C:\Users\jan\SkyDrive
2016-04-09 13:38 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2016-04-09 10:09 - 2013-08-22 15:36 - 00000000 ____D C:\WINDOWS\Inf
2016-04-08 18:05 - 2015-02-18 05:29 - 00805918 _____ C:\WINDOWS\system32\perfh015.dat
2016-04-08 18:05 - 2015-02-18 05:29 - 00163272 _____ C:\WINDOWS\system32\perfc015.dat
2016-04-08 18:05 - 2013-10-04 09:58 - 01825074 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-08 17:59 - 2016-02-06 15:30 - 00000000 ____D C:\Users\jan
2016-04-08 17:59 - 2015-02-20 20:49 - 00000000 ____D C:\ProgramData\NVIDIA
2016-04-08 17:59 - 2013-08-22 16:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-04-07 21:15 - 2016-02-21 18:17 - 00000000 ____D C:\Users\jan\AppData\Roaming\uTorrent
2016-04-05 17:16 - 2016-02-06 21:55 - 00000000 ____D C:\WINDOWS\System32\Tasks\McAfee
2016-04-05 17:15 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2016-03-31 11:38 - 2016-02-06 15:30 - 00001470 _____ C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-29 17:10 - 2013-08-22 15:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2016-03-26 17:14 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\system32\GroupPolicy
2016-03-25 14:28 - 2013-08-22 17:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2016-03-25 14:26 - 2016-02-23 20:32 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX
2016-03-25 14:26 - 2016-02-23 20:32 - 00000000 ___SD C:\WINDOWS\system32\GWX
2016-03-24 20:53 - 2016-02-15 20:56 - 00000000 __SHD C:\Users\jan\AppData\LocalLow\EmieUserList
2016-03-24 20:53 - 2016-02-15 20:56 - 00000000 __SHD C:\Users\jan\AppData\LocalLow\EmieSiteList
2016-03-23 20:24 - 2016-02-06 16:20 - 00000000 ____D C:\Users\jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-03-17 22:29 - 2016-02-07 09:56 - 00000000 ____D C:\Fraps
2016-03-17 12:44 - 2013-08-22 17:36 - 00000000 ____D C:\WINDOWS\rescache
2016-03-14 10:11 - 2016-02-11 10:08 - 00000000 ____D C:\Games
2016-03-12 11:18 - 2016-02-10 21:44 - 00000000 ____D C:\ProgramData\Skype

==================== Pliki w katalogu głównym wybranych folderów =======

2016-03-31 08:37 - 2016-03-31 08:37 - 6504960 _____ () C:\Users\jan\AppData\Roaming\agent.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0054272 _____ () C:\Users\jan\AppData\Roaming\ApplicationHosting.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0065424 _____ () C:\Users\jan\AppData\Roaming\Config.xml
2016-03-31 08:37 - 2016-03-31 08:37 - 0072699 _____ () C:\Users\jan\AppData\Roaming\GoodLux.tst
2016-03-31 08:36 - 2016-03-31 08:36 - 0160875 _____ () C:\Users\jan\AppData\Roaming\inst.lat
2016-03-31 08:36 - 2016-03-31 08:36 - 0017760 _____ () C:\Users\jan\AppData\Roaming\InstallationConfiguration.xml
2016-03-31 08:36 - 2016-03-31 08:36 - 0127488 _____ () C:\Users\jan\AppData\Roaming\Installer.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0126464 _____ () C:\Users\jan\AppData\Roaming\lobby.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0018432 _____ () C:\Users\jan\AppData\Roaming\Main.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0005568 _____ () C:\Users\jan\AppData\Roaming\md.xml
2016-03-31 08:37 - 2016-03-31 08:37 - 0126464 _____ () C:\Users\jan\AppData\Roaming\noah.dat
2016-03-31 08:37 - 2016-03-31 08:37 - 0188621 _____ () C:\Users\jan\AppData\Roaming\Rankix.bin
2016-03-31 08:38 - 2016-03-31 08:38 - 0032038 _____ () C:\Users\jan\AppData\Roaming\uninstall_temp.ico
2016-03-31 08:37 - 2016-03-31 08:37 - 1626416 _____ () C:\Users\jan\AppData\Roaming\Vaiais.tst
2016-02-10 21:54 - 2016-02-10 21:54 - 0007599 _____ () C:\Users\jan\AppData\Local\Resmon.ResmonCfg
2015-02-20 20:52 - 2015-02-20 20:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-03-29 17:02 - 2016-03-29 17:02 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\jan\AppData\Local\Temp\349010750\ic-0.89cd042281bce.exe
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Niektóre pliki w TEMP:
====================
C:\Users\jan\AppData\Local\Temp\6F9EPVV1BB.exe
C:\Users\jan\AppData\Local\Temp\8JMIU80J4W.exe
C:\Users\jan\AppData\Local\Temp\AcerDocsSetup.exe
C:\Users\jan\AppData\Local\Temp\AcerPortalSetup.exe
C:\Users\jan\AppData\Local\Temp\B5F7.tmp.exe
C:\Users\jan\AppData\Local\Temp\CE6RP17YF5.exe
C:\Users\jan\AppData\Local\Temp\CUS533NIKO.exe
C:\Users\jan\AppData\Local\Temp\GC9HF17S75.exe
C:\Users\jan\AppData\Local\Temp\I5B8S5NBX6.exe
C:\Users\jan\AppData\Local\Temp\KZXE1A16L0.exe
C:\Users\jan\AppData\Local\Temp\nsz621E.exe
C:\Users\jan\AppData\Local\Temp\qqpcmgr_v11.4.17347.218_45297_Silence.exe
C:\Users\jan\AppData\Local\Temp\QVLET5DPTP.exe
C:\Users\jan\AppData\Local\Temp\S8B4UZ3PBM.exe
C:\Users\jan\AppData\Local\Temp\Setup__2140_il503577.exe
C:\Users\jan\AppData\Local\Temp\SYXR59YU58.exe
C:\Users\jan\AppData\Local\Temp\XEFK3CJJ59.exe
C:\Users\jan\AppData\Local\Temp\XHCORGM4BY.exe
C:\Users\jan\AppData\Local\Temp\XKAOA2P0NX.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-04-08 19:47

==================== Koniec  FRST.txt ============================