Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja: 02-07-2016
Uruchomiony przez flower (administrator)  DRZEWO (05-07-2016 19:37:54)
Uruchomiony z C:\Users\flower\AppData\Local\temp\scoped_dir4476_26870
Załadowane profile: flower (Dostępne profile: flower)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: Opera)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE
(Adobe Systems, Incorporated) C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe
(Apple Computer, Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\Novatel Wireless\Novacore\Server\NvtlSrvr.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(QUALCOMM, Inc.) C:\Program Files\QUALCOMM\QDLService2k\QDLService2kDell.exe
(TData.com) C:\Program Files\TData\TData.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
() C:\ProgramData\Birdsarah\Birdsarah.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
() C:\ProgramData\Toolrain\Toolrain.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe
(Opera Software) C:\Program Files\Opera\38.0.2220.31\opera.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6495144 2015-09-16] (Piriform Ltd)
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [3280760 2016-01-15] (Disc Soft Ltd)
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [53130368 2016-05-17] (Skype Technologies S.A.)
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [10240 2009-07-14] (Microsoft Corporation)
Startup: C:\Users\flower\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk [2016-07-05]
ShortcutTarget: Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [94208 2006-02-28] (Apple Computer, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{84047729-E9A8-4828-BC09-0EF3A1002401}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{893A9F89-DB25-444E-90E6-E4EB7FBB731C}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{99A633A1-0BAC-411E-B236-1D384C269AC5}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{BE5DA65A-C8C2-436E-8BB1-0FEC8366F75E}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{DB55B32A-97B4-4C41-AAA6-5551380423B8}: [DhcpNameServer] 192.168.42.129

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
HKU\S-1-5-21-277916205-3838748793-3997461421-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-277916205-3838748793-3997461421-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
SearchScopes: HKU\S-1-5-21-277916205-3838748793-3997461421-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-05] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: ChromeDefaultData -> hxxp://www.yessearches.com/?mode=loadm&ptid=imm&uid=616FBA9126A55FE79631767EB75F0B03&v=20160510&ts=AHEqAXYqBH0oBU..
CHR StartupUrls: ChromeDefaultData -> "hxxp://www.yessearches.com/?mode=loadm&ptid=imm&uid=616FBA9126A55FE79631767EB75F0B03&v=20160510&ts=AHEqAXYqBH0oBU.."
CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.yessearches.com/chrome.php?q={searchTerms}&ts=AHEqAXYqBH0oBU..&v=20160510&uid=616FBA9126A55FE79631767EB75F0B03&ptid=imm&mode=loadm
CHR DefaultSearchKeyword: ChromeDefaultData -> yessearches
CHR Profile: C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData
CHR Extension: (Prezentacje Google) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-21]
CHR Extension: (Dokumenty Google) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-21]
CHR Extension: (Dysk Google) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-21]
CHR Extension: (YouTube) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-21]
CHR Extension: (Google Search) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-21]
CHR Extension: (Arkusze Google) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-21]
CHR Extension: (Dokumenty Google offline) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-10]
CHR Extension: (Gmail) - C:\Users\flower\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-21]

Opera: 
=======
OPR StartupUrls: "hxxp://www.nuesearch.com/?type=hp&ts=1466511083&z=07d791e5dc519fad568d743gfz3q9qcwcgfg6e8b1z&from=wpm0616&uid=TOSHIBAXMK2576GSX_61TKT4X5TXX61TKT4X5T"

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AGSService; C:\Program Files\Common Files\Adobe\AdobeGCClient\AGSService.exe [2021592 2016-04-05] (Adobe Systems, Incorporated)
R2 BirdsarahP; C:\ProgramData\Birdsarah\Birdsarah.exe [428416 2016-06-23] ()
S2 BirdsarahU; C:\Program Files\Birdsarah\Update\BirdsarahUpdate.exe [591744 2016-06-23] ()
R2 Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [229376 2006-02-28] (Apple Computer, Inc.) [Brak podpisu cyfrowego]
S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2013-03-14] (Intel Corporation)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1082232 2016-01-15] (Disc Soft Ltd)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [654848 2015-11-17] (Macrovision Europe Ltd.) [Brak podpisu cyfrowego]
R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [28552 2016-04-26] (Hewlett-Packard Company)
R3 ICCS; C:\Program Files\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [169752 2012-04-24] (Intel Corporation)
R2 NvtlService; C:\Program Files\Novatel Wireless\Novacore\Server\NvtlSrvr.exe [91984 2010-07-22] ()
R2 PSI_SVC_2; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [277360 2013-09-13] (arvato digital services llc)
R2 QDLService2kDell; C:\Program Files\QUALCOMM\QDLService2k\QDLService2kDell.exe [331512 2010-06-25] (QUALCOMM, Inc.)
S2 SorawardanagckmanagerSrv; C:\Program Files\Sorawardanagck\SorawardanagckmanagerSrv.exe [988280 2016-05-10] ()
R2 TDataSvr; C:\Program Files\TData\TData.exe [135880 2016-06-12] (TData.com)
R2 ToolrainP; C:\ProgramData\Toolrain\Toolrain.exe [424832 2016-06-28] ()
S2 ToolrainU; C:\Program Files\Toolrain\Update\ToolrainUpdate.exe [590208 2016-06-28] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)
R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [5638144 2012-05-24] (Dell Inc.) [Brak podpisu cyfrowego]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [25856 2012-03-07] (Google Inc)
S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag.sys [23040 2012-03-06] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem.sys [27776 2012-03-06] (LG Electronics Inc.)
S3 andnetndis; C:\Windows\System32\DRIVERS\lgandnetndis.sys [73728 2012-03-06] (LG Electronics Inc.)
R3 BCM42RLY; C:\Windows\System32\drivers\BCM42RLY.sys [18496 2012-05-24] (Broadcom Corporation)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [26168 2016-02-13] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [40504 2016-02-13] (Disc Soft Ltd)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-12-25] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [27040 2015-10-26] (LogMeIn, Inc.)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [17160 2015-03-05] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [13064 2015-03-05] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-07-05 19:36 - 2016-07-05 19:36 - 01740288 _____ (Farbar) C:\Users\flower\Desktop\FRST.exe
2016-07-05 19:10 - 2014-05-14 18:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-07-05 19:10 - 2014-05-14 18:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-07-05 19:10 - 2014-05-14 18:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2016-07-05 19:10 - 2014-05-14 18:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2016-07-05 19:10 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2016-07-05 19:10 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2016-07-05 12:41 - 2016-07-05 12:57 - 00000000 ____D C:\Users\flower\Desktop\kolos kebab
2016-07-05 12:37 - 2016-07-05 12:37 - 01260819 _____ C:\Users\flower\Downloads\Bbq-and-grill-background.zip
2016-07-05 12:31 - 2015-02-17 15:01 - 00314043 _____ C:\Users\flower\Desktop\2936_Kolos_Kebab.ai
2016-07-05 11:22 - 2016-07-05 11:22 - 01554087 _____ C:\Users\flower\Downloads\logo gotowe.rar
2016-07-04 21:21 - 2016-07-04 21:30 - 00000000 ____D C:\Users\flower\Desktop\mp3
2016-07-04 17:14 - 2016-07-04 17:14 - 01048504 _____ C:\Users\flower\Downloads\51.pdf
2016-07-04 17:14 - 2016-07-04 17:14 - 01048504 _____ C:\Users\flower\Downloads\51 (1).pdf
2016-07-03 18:01 - 2015-01-19 09:33 - 00000843 ____N C:\Users\flower\Downloads\License.txt
2016-07-03 18:01 - 2014-04-25 16:02 - 04442542 _____ C:\Users\flower\Downloads\22.eps
2016-07-03 18:01 - 2014-04-25 16:02 - 01301593 _____ C:\Users\flower\Downloads\22.ai
2016-07-03 18:00 - 2016-07-03 18:00 - 00109928 _____ C:\Users\flower\AppData\Local\GDIPFONTCACHEV1.DAT
2016-07-03 17:58 - 2016-07-03 17:58 - 02698564 _____ C:\Users\flower\Downloads\Sports-car-and-race-flag-logo.zip
2016-07-03 17:56 - 2016-07-03 17:57 - 01420299 _____ C:\Users\flower\Downloads\checkered-flags-psd-icon.psd
2016-07-03 17:33 - 2016-07-03 17:34 - 01765504 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-01 11:21 - 2016-07-01 11:21 - 00000000 ____D C:\Windows\system32\_TSpm
2016-07-01 10:21 - 2016-07-01 11:21 - 02370200 _____ (Update) C:\Program Files\SSFK.exe
2016-06-30 18:06 - 2016-06-30 18:06 - 00000000 ____D C:\Users\flower\AppData\Local\CPN
2016-06-30 13:54 - 2016-06-30 13:54 - 00000000 ____D C:\ProgramData\W
2016-06-30 12:21 - 2016-06-30 12:21 - 00036566 _____ C:\Users\flower\Downloads\Marta-Kramarz-GMAIL-1-spoko.pdf
2016-06-29 23:17 - 2016-06-29 23:17 - 00002144 _____ C:\Users\flower\Downloads\keyboard-key-enter.svg
2016-06-29 22:49 - 2016-06-29 22:49 - 00007323 _____ C:\Users\flower\Downloads\Anonymous_Sandglass.svg
2016-06-29 21:53 - 2016-06-29 21:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X5
2016-06-29 21:24 - 2016-06-29 21:24 - 00000000 ____D C:\ProgramData\Toolrain
2016-06-29 21:23 - 2016-06-29 21:23 - 00000000 ____D C:\Users\flower\AppData\Local\Toolrain
2016-06-29 21:23 - 2016-06-29 21:23 - 00000000 ____D C:\Program Files\Toolrain
2016-06-23 19:09 - 2016-06-23 19:07 - 00002819 _____ C:\Users\Public\Desktop\Corel PHOTO-PAINT X7.lnk
2016-06-23 19:09 - 2016-06-23 19:07 - 00002816 _____ C:\Users\Public\Desktop\Corel CAPTURE X7.lnk
2016-06-23 19:09 - 2016-06-23 19:07 - 00002309 _____ C:\Users\Public\Desktop\Corel CONNECT X7.lnk
2016-06-23 19:09 - 2016-06-23 19:06 - 00002771 _____ C:\Users\Public\Desktop\CorelDRAW X7.lnk
2016-06-23 19:07 - 2016-06-23 19:07 - 00000000 ____D C:\Users\Public\Documents\Corel
2016-06-23 19:06 - 2016-06-23 19:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CorelDRAW Graphics Suite X7
2016-06-23 14:12 - 2016-06-23 14:12 - 00000000 ____D C:\Users\Public\Documents\chrome
2016-06-23 13:16 - 2016-06-23 13:16 - 00000000 ____D C:\Users\flower\AppData\Roaming\eCyber
2016-06-23 13:12 - 2016-06-30 13:54 - 00000000 ____D C:\Program Files\Birdsarah
2016-06-23 13:12 - 2016-06-23 13:12 - 00000000 ____D C:\Users\flower\AppData\Local\Birdsarah
2016-06-23 13:12 - 2016-06-23 13:12 - 00000000 ____D C:\ProgramData\Birdsarah
2016-06-23 13:07 - 2016-07-05 19:23 - 00000172 _____ C:\Users\Public\Documents\report.dat
2016-06-21 14:15 - 2016-06-21 14:15 - 00000072 _____ C:\Windows\system32\EN_14799456.html
2016-06-21 14:14 - 2016-06-21 14:14 - 00000072 _____ C:\Windows\system32\EN_14711502.html
2016-06-21 14:14 - 2016-06-21 14:14 - 00000072 _____ C:\Windows\system32\EN_14711143.html
2016-06-21 14:12 - 2016-07-01 10:21 - 00000000 ____D C:\Program Files\SFK
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14585797.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14585422.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14580773.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14580493.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14568262.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14567841.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14566936.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000072 _____ C:\Windows\system32\EN_14566530.html
2016-06-21 14:12 - 2016-06-21 14:12 - 00000000 ____D C:\ProgramData\IwinpI
2016-06-21 14:11 - 2016-06-21 14:11 - 00000072 _____ C:\Windows\system32\pl_14520697.html
2016-06-21 14:11 - 2016-06-21 14:11 - 00000072 _____ C:\Windows\system32\EN_14522023.html
2016-06-21 14:11 - 2016-06-21 14:11 - 00000000 ____D C:\Windows\system32\_tWm
2016-06-16 14:11 - 2016-06-16 14:11 - 00000000 ____D C:\Program Files\TData
2016-06-09 17:46 - 2016-07-03 13:09 - 00000324 _____ C:\Windows\Tasks\HPCeeScheduleForflower.job

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-07-05 19:37 - 2015-12-30 12:33 - 00000000 ____D C:\FRST
2016-07-05 19:37 - 2015-12-26 18:16 - 00001036 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-07-05 19:27 - 2016-03-18 17:15 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-05 19:16 - 2009-07-14 06:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-05 19:16 - 2009-07-14 06:34 - 00021664 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-05 19:02 - 2016-05-11 14:11 - 00000000 ____D C:\Users\flower\AppData\Roaming\Skype
2016-07-05 19:01 - 2015-12-26 18:16 - 00001032 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-05 19:00 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-05 12:38 - 2016-05-31 09:42 - 00297620 _____ C:\Users\flower\Desktop\55077-O816QE.ai
2016-07-03 17:37 - 2016-01-06 12:56 - 00000000 ___RD C:\Users\flower\Desktop\grafika
2016-07-03 14:44 - 2016-05-08 22:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCSOFT
2016-07-03 14:44 - 2015-11-14 23:22 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2016-07-03 14:42 - 2015-11-14 23:22 - 00000000 ____D C:\Program Files\Common Files\InstallShield
2016-07-03 14:41 - 2015-11-14 23:22 - 00000000 ____D C:\Program Files\Valve
2016-07-02 23:24 - 2015-10-10 02:31 - 00000992 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-06-29 21:53 - 2015-10-09 17:38 - 00000000 ____D C:\Program Files\Corel
2016-06-29 21:23 - 2015-10-18 20:45 - 00002165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-29 21:23 - 2015-10-07 19:13 - 00000000 ____D C:\Program Files\Opera
2016-06-23 19:14 - 2015-10-09 16:41 - 00000000 ____D C:\ProgramData\Corel
2016-06-23 19:10 - 2015-10-09 16:27 - 00000000 ____D C:\ProgramData\CorelDRAW Graphics Suite X7
2016-06-23 13:16 - 2016-06-01 10:59 - 00000000 ____D C:\Program Files\WinZipper
2016-06-23 13:06 - 2016-06-01 10:59 - 00000000 ____D C:\Users\flower\AppData\Roaming\WinZiper
2016-06-22 17:55 - 2015-10-07 18:58 - 00000000 ____D C:\Users\flower
2016-06-21 14:12 - 2016-06-01 10:58 - 00000000 ____D C:\Users\flower\AppData\Roaming\TSv
2016-06-21 10:29 - 2015-10-10 02:31 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-06-21 10:29 - 2015-10-10 02:31 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-06-16 14:35 - 2016-05-11 13:10 - 00000000 ____D C:\Program Files\yesbnd
2016-06-13 19:31 - 2015-10-07 19:16 - 00400040 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2016-06-13 12:37 - 2016-05-11 14:11 - 00000000 ____D C:\ProgramData\Skype
2016-06-11 19:39 - 2011-04-12 07:08 - 00739932 _____ C:\Windows\system32\perfh015.dat
2016-06-11 19:39 - 2011-04-12 07:08 - 00155474 _____ C:\Windows\system32\perfc015.dat
2016-06-11 19:39 - 2010-11-20 23:01 - 01668226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-11 19:39 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2016-06-11 08:28 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-06-09 18:14 - 2016-01-20 21:49 - 00000000 ____D C:\Users\flower\Desktop\dokumenty
2016-06-08 10:56 - 2015-11-18 00:18 - 00027040 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys

==================== Pliki w katalogu głównym wybranych folderów =======

2016-07-01 10:21 - 2016-07-01 11:21 - 2370200 _____ (Update) C:\Program Files\SSFK.exe
2015-11-19 11:52 - 2015-11-19 11:52 - 0002289 _____ () C:\Users\flower\AppData\Local\recently-used.xbel
2016-03-08 15:11 - 2016-03-08 15:11 - 0000057 _____ () C:\ProgramData\Ament.ini

Niektóre pliki w TEMP:
====================
C:\Users\flower\AppData\Local\temp\4d1331dc00f370726aa0971ed793cca2.dll
C:\Users\flower\AppData\Local\temp\ab5e31d07b6ea746979d10d903f463d5.dll
C:\Users\flower\AppData\Local\temp\sdf58F8.exe
C:\Users\flower\AppData\Local\temp\sdfF91D.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-07-02 20:23

==================== Koniec  FRST.txt ============================