Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja:09-05-2016
Uruchomiony przez Administrator (administrator)  BAIT (13-05-2016 10:31:43)
Uruchomiony z E:\FF Download
Załadowane profile: Administrator (Dostępne profile: Administrator)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) Język: Polski
Internet Explorer Wersja 8 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
(HP) C:\WINDOWS\system32\HPSIsvc.exe
() C:\WINDOWS\system32\srvany.exe
() C:\WINDOWS\KMService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cistray.exe
() C:\WINDOWS\system32\svhost.exe
(Flux Software LLC) C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\FluxSoftware\Flux\flux.exe
(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cis.exe
() C:\Documents and Settings\Administrator\Pulpit\Ping\2014\Katalog 2-50k 2014\PingMaster.exe
(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cavwp.exe
(AIMP DevTeam) C:\Programy_\AIMP3\AIMP3.exe
(Don HO don.h@free.fr) C:\Programy\notatnik++\notepad++.exe
(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cis.exe
(Microsoft Corporation) C:\Programy_\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
(Sysinternals - www.sysinternals.com) C:\Documents and Settings\Administrator\Pulpit\Programy\procexp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1491128 2016-03-24] (COMODO)
HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [nwiz] => nwiz.exe /install
Winlogon\Notify\WBSrv: C:\Program Files\Stardock\Object Desktop\WindowBlinds\wbsrv.dll [2015-01-31] (Stardock Corporation)
HKLM\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKLM\...\Policies\Explorer: [NoRemoteRecursiveEvents] 1
HKU\S-1-5-19\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-19\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-19\...\Policies\Explorer: [ForceClassicControlPanel] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Run: [svhost] => C:\WINDOWS\System32\svhost.exe [444416 2015-01-26] ()
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Run: [f.lux] => C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\FluxSoftware\Flux\flux.exe [1017224 2015-02-06] (Flux Software LLC)
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Run: [uTorrent] => C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent\uTorrent.exe [1959424 2016-04-10] (BitTorrent Inc.)
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [ForceClassicControlPanel] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\MountPoints2: {4ccff6bb-c75e-11e5-877e-001fd06bb610} - G:\setup.exe
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\MountPoints2: {8a1a2fb6-03a1-11e6-878b-001fd06bb610} - G:\USBNB.exe
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\...\MountPoints2: {9aac5a93-ddf9-11e5-877f-001fd06bb610} - G:\setup.exe
HKU\S-1-5-18\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-18\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-18\...\Policies\Explorer: [ForceClassicControlPanel] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> logon.scr
AppInit_DLLs: wbsys.dll => C:\WINDOWS\system32\wbsys.dll [42672 2015-01-31] (Stardock.Net, Inc)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
Startup: C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart\AutorunsDisabled [2015-01-26] ()
BootExecute: 

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{3385065D-16DE-4C4F-B28E-356E38F5D022}: [NameServer] 156.154.70.25,156.154.71.25
Tcpip\..\Interfaces\{3385065D-16DE-4C4F-B28E-356E38F5D022}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://yoursites123.com/web?type=ds&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://yoursites123.com/web?type=ds&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = hxxp://www.google.pl/
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Internet Explorer\Main,Local Page = hxxp://www.google.pl/
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://yoursites123.com/web?type=ds&ts=1457941030&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255&q={searchTerms}
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
HKU\S-1-5-21-1491950412-2009852829-4049741679-500\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://yoursites123.com/web?type=ds&ts=1457941030&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKU\S-1-5-21-1491950412-2009852829-4049741679-500 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programy_\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2016-01-10] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Programy_\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2016-01-10] (Oracle Corporation)
Toolbar: HKLM - QT Breadcrumbs Address Bar - {af83e43c-dd2b-4787-826b-31b17dee52ed} - C:\WINDOWS\system32\mscoree.dll [2010-03-18] (Microsoft Corporation)
Toolbar: HKLM - QT TabBar - {d2bf470e-ed1c-487f-a333-2bd8835eb6ce} - C:\WINDOWS\system32\mscoree.dll [2010-03-18] (Microsoft Corporation)
Toolbar: HKLM - QT Tab Standard Buttons - {D2BF470E-ED1C-487F-A666-2BD8835EB6CE} - C:\WINDOWS\system32\mscoree.dll [2010-03-18] (Microsoft Corporation)
Toolbar: HKU\S-1-5-21-1491950412-2009852829-4049741679-500 -> Brak nazwy - {EEF280F3-B6ED-46D8-A8FD-57BD0C4A9ECF} -  Brak pliku
Handler: AutorunsDisabled\ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll [2009-05-23] (Microsoft Corporation)
Filter: AutorunsDisabled\text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL [2010-02-28] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursites123.com/?type=sc&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437
FF NewTab: hxxp://www.yoursites123.com/newtab/?type=nt&ts=1458237279&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=wpm0314&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
FF DefaultSearchEngine: yoursites123
FF Homepage: hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-13] ()
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2016-01-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2016-01-10] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Programy_\VLC\npvlc.dll [2015-04-13] (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1491950412-2009852829-4049741679-500: @tools.google.com/Google Update;version=3 -> C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2015-01-26] (Google Inc.)
FF Plugin HKU\S-1-5-21-1491950412-2009852829-4049741679-500: @tools.google.com/Google Update;version=9 -> C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Update\1.3.25.11\npGoogleUpdate3.dll [2015-01-26] (Google Inc.)
FF Plugin HKU\S-1-5-21-1491950412-2009852829-4049741679-500: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-02-07] ()
FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\searchplugins\yoursites123.xml [2016-03-17]
FF Extension: LastPass - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\support@lastpass.com [2016-03-09]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2016-03-16]
FF Extension: Anti-Porn Pro - The Best Anti-Porn Addon! - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\azhang@cloudacl.com.xpi [2016-04-29]
FF Extension: Greasemonkey - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2016-05-01]
FF Extension: Firebug - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\firebug@software.joehewitt.com.xpi [2016-03-30]
FF Extension: Ghostery - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\firefox@ghostery.com.xpi [2016-05-04]
FF Extension: MEGA - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\firefox@mega.co.nz.xpi [2016-05-05]
FF Extension: Eliminator Slajdów - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\jid0-GaZOxvWNYcafEsmayJDIG3XXVi8@jetpack.xpi [2015-09-17]
FF Extension: Simple-Calculator - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\jid1-hGKEHPUjR8q8Bw@jetpack.xpi [2016-04-08]
FF Extension: Unseen - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\unseen@tangrs.xpi [2016-04-28]
FF Extension: uBlock - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2015-12-05]
FF Extension: SeoQuake - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}.xpi [2016-04-27]
FF Extension: NoScript - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-05-03]
FF Extension: Video DownloadHelper - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-05-09]
FF Extension: Adblock Plus - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2015-01-26] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\fftoolbar2014@etech.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\tmaw22zk.default-1396274136437\extensions\default_newtabff@gmail.com => nie znaleziono

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
CHR StartupUrls: Default -> "hxxp://www.yoursites123.com/?type=hp&ts=1457940567&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=eve0311&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255"
CHR Profile: C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
StartMenuInternet: chrome.exe - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1458237279&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=wpm0314&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
StartMenuInternet: Google Chrome.2FMBYYJ4B447ORG7KFR2LWLLZY - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1458237279&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=wpm0314&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255
StartMenuInternet: Google Chrome.HTNMJTF2D73PCI5HCM3ZEM5NIM - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1458237279&z=21e223b3f0c97db3c281da1g7zccaefozzjcktmlma&from=wpm0314&uid=WDCXWD5003AZEX-00MK2A0_WD-WCC3F223525535255

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4542840 2016-03-24] (COMODO)
S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1670840 2016-03-24] (COMODO)
R2 KMService; C:\WINDOWS\system32\srvany.exe [8192 2015-01-26] () [Brak podpisu cyfrowego]
S4 Microsoft SharePoint Workspace Audit Service; C:\Programy_\Microsoft Office\Office14\GROOVE.EXE [30969208 2015-06-29] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2015-01-26] (NVIDIA Corporation)
R2 stisvc; C:\WINDOWS\system32\wiaservc.dll [350720 2009-02-28] (Microsoft Corporation) [Brak podpisu cyfrowego]
S2 UTSCSI; C:\WINDOWS\system32\UTSCSI.EXE [0 2016-05-12] () <==== UWAGA (zerobajtowy plik/folder)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
S3 androidusb; C:\WINDOWS\System32\Drivers\androidusb.sys [25728 2016-02-16] (Google Inc)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [17416 2016-03-21] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [637352 2016-03-21] (COMODO)
R1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [31704 2016-03-21] (COMODO)
R0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [107688 2016-03-21] (COMODO)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R0 mv61xxmm; C:\WINDOWS\system32\Drivers\mv61xxmm.sys [14184 2014-05-17] (Marvell Semiconductor Inc.)
R0 mv64xxmm; C:\WINDOWS\system32\Drivers\mv64xxmm.sys [5632 2014-05-17] (Marvell Semiconductor Inc.) [Brak podpisu cyfrowego]
R0 mvxxmm; C:\WINDOWS\system32\Drivers\mvxxmm.sys [14184 2014-05-17] (Marvell Semiconductor Inc.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S3 paeusbaudio; C:\WINDOWS\System32\DRIVERS\paeusbaudio.sys [195448 2012-05-24] ()
S3 paeusbaudiodsp; C:\WINDOWS\System32\DRIVERS\paeusbaudiodsp.sys [60280 2012-05-24] ()
S3 paeusbaudioks; C:\WINDOWS\System32\DRIVERS\paeusbaudioks.sys [42872 2012-05-24] ()
S3 qcusbnet; C:\WINDOWS\System32\DRIVERS\innosusbnet.sys [425984 2016-02-16] (QUALCOMM Incorporated)
S3 qcusbser; C:\WINDOWS\System32\DRIVERS\innosusbser.sys [311936 2016-02-16] (QUALCOMM Incorporated)
R0 SscRdBus; C:\WINDOWS\System32\DRIVERS\SscRdBus.sys [129096 2013-08-01] (SuperSpeed LLC)
R1 Tcpip; C:\WINDOWS\System32\DRIVERS\tcpip.sys [361600 2014-05-17] (Microsoft Corporation) [Brak podpisu cyfrowego]
S4 IntelIde; Brak ImagePath
U4 WinRM; Brak ImagePath
U1 WS2IFSL; Brak ImagePath
U3 pgtdqpow; \??\C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\pgtdqpow.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-05-13 10:31 - 2016-05-13 10:31 - 00000000 ____D C:\FRST
2016-05-13 10:28 - 2016-05-13 10:28 - 00090112 _____ C:\Documents and Settings\Administrator\Pulpit\Mini051116-01.dmp
2016-05-13 07:13 - 2016-05-13 10:31 - 00010889 _____ C:\WINDOWS\system322016-05-13.cfg
2016-05-12 19:43 - 2016-05-12 19:43 - 00013332 _____ C:\Documents and Settings\Administrator\Pulpit\minidump.txt
2016-05-12 19:41 - 2016-05-12 19:42 - 00000000 ____D C:\Program Files\Debugging Tools for Windows (x86)
2016-05-12 19:41 - 2016-05-12 19:41 - 00000000 ____D C:\Documents and Settings\All Users\Menu Start\Programy\Debugging Tools for Windows (x86)
2016-05-12 19:32 - 2016-05-13 10:28 - 00090112 _____ C:\Documents and Settings\Administrator\Pulpit\Mini051216-01.dmp
2016-05-12 19:16 - 2016-05-12 19:16 - 00090112 _____ C:\WINDOWS\Minidump\Mini051216-01.dmp
2016-05-12 07:31 - 2016-05-12 21:21 - 00005574 _____ C:\WINDOWS\system322016-05-12.cfg
2016-05-11 07:23 - 2016-05-11 23:46 - 00061753 _____ C:\WINDOWS\system322016-05-11.cfg
2016-05-11 07:11 - 2016-05-11 07:11 - 00090112 _____ C:\WINDOWS\Minidump\Mini051116-01.dmp
2016-05-10 06:48 - 2016-05-10 23:56 - 00052748 _____ C:\WINDOWS\system322016-05-10.cfg
2016-05-10 06:45 - 2016-05-10 06:45 - 00090112 _____ C:\WINDOWS\Minidump\Mini051016-01.dmp
2016-05-09 17:15 - 2016-05-09 17:15 - 00000000 ____D C:\masaz
2016-05-09 11:36 - 2016-05-09 11:39 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\Nowy folder
2016-05-09 08:31 - 2016-05-09 23:52 - 00044204 _____ C:\WINDOWS\system322016-05-09.cfg
2016-05-08 10:13 - 2016-05-08 20:35 - 00007614 _____ C:\WINDOWS\system322016-05-08.cfg
2016-05-07 08:14 - 2016-05-07 12:03 - 00004189 _____ C:\WINDOWS\system322016-05-07.cfg
2016-05-06 20:01 - 2016-05-06 20:00 - 00090112 _____ C:\WINDOWS\Minidump\Mini050616-01.dmp
2016-05-06 06:03 - 2016-05-06 20:24 - 00000546 _____ C:\WINDOWS\system322016-05-06.cfg
2016-05-05 22:07 - 2016-05-06 20:01 - 00000000 ____D C:\Program Files\Mozilla Firefox
2016-05-05 04:10 - 2016-05-05 22:43 - 00006009 _____ C:\WINDOWS\system322016-05-05.cfg
2016-05-05 04:06 - 2016-05-05 04:06 - 00090112 _____ C:\WINDOWS\Minidump\Mini050516-01.dmp
2016-05-04 07:15 - 2016-05-12 09:38 - 00060732 _____ C:\Documents and Settings\Administrator\Pulpit\23629544_F_11176276_05_16_F.pdf
2016-05-04 07:09 - 2016-05-04 21:21 - 00118808 _____ C:\WINDOWS\system322016-05-04.cfg
2016-05-03 10:26 - 2016-05-03 22:38 - 00111691 _____ C:\WINDOWS\system322016-05-03.cfg
2016-05-02 12:59 - 2016-05-02 13:00 - 00014083 _____ C:\Documents and Settings\Administrator\Pulpit\btc.xlsx
2016-05-02 09:32 - 2016-05-02 09:32 - 00090112 _____ C:\WINDOWS\Minidump\Mini050216-01.dmp
2016-05-02 07:24 - 2016-05-02 17:39 - 00103869 _____ C:\WINDOWS\system322016-05-02.cfg
2016-05-01 07:57 - 2016-05-01 20:46 - 00092161 _____ C:\WINDOWS\system322016-05-01.cfg
2016-04-30 08:56 - 2016-04-30 21:40 - 00084027 _____ C:\WINDOWS\system322016-04-30.cfg
2016-04-29 06:50 - 2016-04-29 23:12 - 00078289 _____ C:\WINDOWS\system322016-04-29.cfg
2016-04-28 06:06 - 2016-04-28 23:03 - 00071342 _____ C:\WINDOWS\system322016-04-28.cfg
2016-04-27 00:10 - 2016-04-27 23:19 - 00064864 _____ C:\WINDOWS\system322016-04-27.cfg
2016-04-26 00:00 - 2016-04-26 23:29 - 00061585 _____ C:\WINDOWS\system322016-04-26.cfg
2016-04-25 23:19 - 2016-04-25 23:19 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\zdjecia rocznica
2016-04-25 00:02 - 2016-04-25 23:59 - 00053154 _____ C:\WINDOWS\system322016-04-25.cfg
2016-04-24 09:04 - 2016-04-24 23:55 - 00040243 _____ C:\WINDOWS\system322016-04-24.cfg
2016-04-23 07:42 - 2016-04-23 16:16 - 00029240 _____ C:\WINDOWS\system322016-04-23.cfg
2016-04-22 07:21 - 2016-04-22 20:01 - 00026362 _____ C:\WINDOWS\system322016-04-22.cfg
2016-04-21 07:25 - 2016-04-21 23:42 - 00023724 _____ C:\WINDOWS\system322016-04-21.cfg
2016-04-20 07:56 - 2016-04-20 07:56 - 00051472 _____ C:\Documents and Settings\Administrator\Pulpit\O mnie..pdf
2016-04-20 07:53 - 2016-04-20 23:15 - 00018492 _____ C:\WINDOWS\system322016-04-20.cfg
2016-04-19 18:48 - 2016-04-19 18:48 - 00090112 _____ C:\WINDOWS\Minidump\Mini041916-01.dmp
2016-04-19 07:55 - 2016-04-19 23:31 - 00008307 _____ C:\WINDOWS\system322016-04-19.cfg
2016-04-18 07:41 - 2016-04-18 23:11 - 00050644 _____ C:\WINDOWS\system322016-04-18.cfg
2016-04-17 11:32 - 2016-04-17 11:32 - 00000053 _____ C:\google98b8be7cbb405262.html
2016-04-17 09:51 - 2016-04-17 09:52 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\Ping
2016-04-17 09:12 - 2016-04-17 23:45 - 00031923 _____ C:\WINDOWS\system322016-04-17.cfg
2016-04-16 16:57 - 2016-05-12 20:49 - 00000000 _____ C:\WINDOWS\system32\UTSCSI.EXE
2016-04-16 16:56 - 2016-05-12 20:47 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\PLAux
2016-04-16 16:56 - 2016-04-16 16:56 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\OTi
2016-04-16 00:20 - 2016-04-16 18:33 - 00019197 _____ C:\WINDOWS\system322016-04-16.cfg
2016-04-15 07:46 - 2016-04-15 20:50 - 00002599 _____ C:\WINDOWS\system322016-04-15.cfg
2016-04-14 22:14 - 2016-04-14 22:14 - 00000000 ____D C:\Comodo
2016-04-14 05:57 - 2016-04-14 23:06 - 00321977 _____ C:\WINDOWS\system322016-04-14.cfg
2016-04-13 07:21 - 2016-04-13 23:02 - 00312848 _____ C:\WINDOWS\system322016-04-13.cfg

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-05-13 10:32 - 2015-01-26 21:10 - 00010889 _____ C:\WINDOWS\system32\svchost.html
2016-05-13 10:32 - 2015-01-26 16:01 - 00000000 ____D C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp
2016-05-13 10:31 - 2015-01-26 20:34 - 00007902 _____ C:\WINDOWS\system32\nvAppTimestamps
2016-05-13 10:31 - 2015-01-26 16:25 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\NetSpeedMonitor
2016-05-13 10:29 - 2015-01-26 20:08 - 01448672 _____ C:\WINDOWS\system32\Drivers\sfi.dat
2016-05-13 10:28 - 2015-01-26 15:56 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit
2016-05-13 10:22 - 2015-01-26 17:05 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\AIMP3
2016-05-13 10:13 - 2016-01-30 13:47 - 00000000 ____D C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\LastPass
2016-05-13 10:13 - 2016-01-10 21:58 - 00000523 _____ C:\Documents and Settings\Administrator\Pulpit\change.txt
2016-05-13 10:03 - 2015-02-06 22:28 - 00000930 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2016-05-13 09:56 - 2015-01-26 20:08 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
2016-05-13 08:27 - 2016-01-10 21:58 - 00023668 _____ C:\Documents and Settings\Administrator\Pulpit\poker.xlsx
2016-05-13 07:49 - 2016-01-30 13:46 - 00000000 ____D C:\Documents and Settings\Administrator\Moje dokumenty\fullrecalldb
2016-05-13 07:18 - 2016-01-30 13:46 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent
2016-05-12 21:14 - 2015-01-26 20:30 - 01438744 _____ C:\WINDOWS\system32\nvdrsdb0.bin
2016-05-12 21:14 - 2015-01-26 20:30 - 00000001 _____ C:\WINDOWS\system32\nvdrssel.bin
2016-05-12 21:13 - 2015-01-26 17:10 - 00052224 _____ C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-05-12 21:01 - 2015-01-26 20:08 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
2016-05-12 21:01 - 2015-01-26 20:08 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
2016-05-12 21:01 - 2015-01-26 20:08 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
2016-05-12 19:41 - 2015-01-26 16:34 - 00000000 ____D C:\Documents and Settings\All Users\Menu Start\Programy
2016-05-12 19:16 - 2016-01-30 14:19 - 00000000 ____D C:\WINDOWS\Minidump
2016-05-12 19:16 - 2015-01-26 15:56 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-05-12 19:16 - 2015-01-26 15:56 - 00000000 __SHD C:\WINDOWS\CSC
2016-05-12 19:16 - 2008-04-15 22:00 - 00002184 _____ C:\WINDOWS\system32\wpa.dbl
2016-05-12 11:13 - 2016-01-10 21:28 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\Dabest
2016-05-11 23:03 - 2015-01-26 15:56 - 00032208 _____ C:\WINDOWS\SchedLgU.Txt
2016-05-11 09:30 - 2016-01-30 16:44 - 00000000 ____D C:\Documents and Settings\Administrator\.matplotlib
2016-05-11 08:27 - 2015-01-26 20:30 - 01438744 _____ C:\WINDOWS\system32\nvdrsdb1.bin
2016-05-10 21:54 - 2016-01-10 21:58 - 00000943 _____ C:\Documents and Settings\Administrator\Pulpit\video.txt
2016-05-10 07:27 - 2015-01-26 17:00 - 00002547 _____ C:\WINDOWS\WINCMD.INI
2016-05-10 07:27 - 2015-01-26 17:00 - 00001447 _____ C:\WINDOWS\wcx_ftp.ini
2016-05-10 06:45 - 2015-01-26 16:56 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2016-05-09 23:51 - 2016-02-25 22:21 - 00000236 _____ C:\m.txt
2016-05-09 21:45 - 2015-01-26 16:34 - 00000000 ____D C:\Documents and Settings\All Users\Pulpit
2016-05-09 16:42 - 2016-03-04 17:38 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\masaz
2016-05-09 11:07 - 2016-01-10 21:58 - 00004722 _____ C:\Documents and Settings\Administrator\Pulpit\MM.txt
2016-05-08 20:28 - 2016-01-10 21:58 - 00038912 ____H C:\Documents and Settings\Administrator\Pulpit\~WRL0001.tmp
2016-05-05 22:43 - 2015-01-26 18:43 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\vlc
2016-05-03 20:20 - 2008-04-15 22:00 - 00335440 _____ C:\WINDOWS\system32\Drivers\etc\1hosts
2016-05-03 12:55 - 2016-01-10 21:58 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\UO
2016-05-01 08:01 - 2015-01-26 17:29 - 00065536 _____ C:\WINDOWS\system32\config\OAlerts.evt
2016-05-01 08:01 - 2015-01-26 15:56 - 00000188 ___SH C:\Documents and Settings\Administrator\ntuser.ini
2016-05-01 08:01 - 2015-01-26 15:56 - 00000000 ____D C:\Documents and Settings\Administrator
2016-04-28 19:35 - 2016-01-10 21:58 - 00000000 ____D C:\Documents and Settings\Administrator\Pulpit\TXT
2016-04-26 21:38 - 2016-01-10 21:58 - 00002036 _____ C:\Documents and Settings\Administrator\Pulpit\books.txt
2016-04-26 07:54 - 2016-01-30 13:45 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\Skype
2016-04-16 16:56 - 2015-01-26 15:56 - 00000000 __RHD C:\Documents and Settings\Administrator\Dane aplikacji
2016-04-16 15:12 - 2016-02-07 15:41 - 00000000 ____D C:\Documents and Settings\Administrator\Dane aplikacji\Might & Magic Heroes VI
2016-04-15 18:09 - 2015-01-26 15:56 - 00000188 ___SH C:\Documents and Settings\LocalService\ntuser.ini
2016-04-14 22:16 - 2015-01-26 16:35 - 01280414 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2016-04-14 22:16 - 2008-04-15 22:00 - 00565384 _____ C:\WINDOWS\system32\perfh015.dat
2016-04-14 22:16 - 2008-04-15 22:00 - 00108756 _____ C:\WINDOWS\system32\perfc015.dat
2016-04-13 20:06 - 2015-01-26 20:03 - 00797376 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2016-04-13 20:06 - 2015-01-26 20:03 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2016-04-13 20:06 - 2015-01-26 17:13 - 00000000 ____D C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Adobe

==================== Pliki w katalogu głównym wybranych folderów =======

2015-01-26 17:10 - 2016-05-12 21:13 - 0052224 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-02-10 10:41 - 2016-02-20 11:46 - 0000169 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\MagicHoldem_SettingsPath.txt
2016-02-09 11:55 - 2016-02-09 11:55 - 0000218 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\recently-used.xbel
2016-03-14 09:29 - 2016-03-17 19:58 - 0000146 _____ () C:\Documents and Settings\All Users\Dane aplikacji\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\Documents and Settings\Administrator\Del1281.bat
C:\Documents and Settings\Default User\Del1281.bat


Niektóre pliki w TEMP:
====================
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\bandoffer.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\bandoffer[1].exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\ICReinstall_NapiProjekt(19170)-dp.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\KMP_3.2.0.0.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\KMP_4.0.5.3.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\siinst.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\SkypeSetup.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\SoftonicAssistant_v0-1-6.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\strings.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\utt19A.tmp.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\utt1A2.tmp.exe


Niektóre zerobajtowe pliki/foldery:
==========================
C:\Windows\System32\UTSCSI.EXE

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\explorer.exe
[2011-08-01 03:09] - [2011-08-01 03:09] - 2549760 ____A (Microsoft Corporation) DCA5A6EF20D7AC2B0214C1D7FD4AAE5F

C:\WINDOWS\system32\winlogon.exe
[2009-02-27 20:15] - [2009-02-27 20:15] - 0559616 ____A (Microsoft Corporation) CEF41B7F252C18D841769D72EA33D086

C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll
[2009-05-21 00:25] - [2009-05-21 00:25] - 0631296 ____A (Microsoft Corporation) EFF0EB33111C9CB9EE5244A6B270F856

C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

==================== Koniec  FRST.txt ============================