Rezultaty skanowania Farbar KamilRecovery Scan Tool (FRST) (x64) Wersja: 04-12-2016
Uruchomiony przez Kamil (administrator)  KAMIL-KOMPUTER (05-12-2016 13:23:12)
Uruchomiony z G:\programy\skanowanie\nowe
Załadowane profile: Kamil & UpdatusUser (Dostępne profile: Kamil & UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Opera)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Datpol) C:\Program Files (x86)\SpyShelter Premium\SpyShelterSrv.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Datpol) C:\Program Files (x86)\SpyShelter Premium\SpyShelter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe
(QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Max Diesel) C:\Program Files\Unreal Commander\Uncom.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [6325936 2012-11-26] (ESET)
HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6340312 2013-09-03] (Realtek semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-04-30] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2771184 2013-07-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [509216 2015-10-12] (QFX Software Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2139634509-321378673-1434440363-1000\...\Run: [SpyShelter] => C:\Program Files (x86)\SpyShelter Premium\SpyShelter.exe [3741736 2016-08-05] (Datpol)
HKU\S-1-5-21-2139634509-321378673-1434440363-1000\...\MountPoints2: {57811ffb-40cf-11e5-9906-142d27ef0e50} - E:\LaunchU3.exe -a
HKU\S-1-5-21-2139634509-321378673-1434440363-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\PhotoScreensaver.scr [477696 2010-11-21] (Microsoft Corporation)
HKU\S-1-5-21-2139634509-321378673-1434440363-1001\...\MountPoints2: {ccfaa1cf-4582-11e4-9622-806e6f6e6963} - D:\Autorun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [184048 2013-11-01] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156256 2013-11-01] (NVIDIA Corporation)
BootExecute: 

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 62.179.1.60 62.179.1.61
Tcpip\..\Interfaces\{6FE0B6E7-FA56-4EBF-BA30-3CCF285FD041}: [DhcpNameServer] 62.179.1.60 62.179.1.61
Tcpip\..\Interfaces\{CEA13913-1426-41C6-B6BC-91EEAF5E326B}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKU\S-1-5-21-2139634509-321378673-1434440363-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.wp.pl/
HKU\S-1-5-21-2139634509-321378673-1434440363-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.wp.pl/
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default [2016-12-05]
FF Homepage: Mozilla\Firefox\Profiles\rjxy8nua.default -> www.google.pl
FF Session Restore: Mozilla\Firefox\Profiles\rjxy8nua.default -> [funkcja włączona]
FF Extension: (Flash Video Downloader - YouTube HD Download [4K]) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\artur.dubovoy@gmail.com [2016-11-14]
FF Extension: (Blur) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\donottrackplus@abine.com.xpi [2016-11-30]
FF Extension: (FireGloves) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\firegloves@fingerprint.pet-portal.eu.xpi [2014-09-27] [Brak podpisu cyfrowego]
FF Extension: (HTTPS Everywhere) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\https-everywhere@eff.org.xpi [2016-12-03]
FF Extension: (resolveip2) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\jid0-1BAVg428rfAD8xc1aqX0BQWyojc@jetpack.xpi [2016-04-27]
FF Extension: (IP Address and Domain Information) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\jid0-jJRRRBMgoShUhb07IvnxTBAl29w@jetpack.xpi [2016-01-11]
FF Extension: (ip-check) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\jid1-qDZOmCLBeE4b2A@jetpack.xpi [2016-07-02]
FF Extension: (Polski Language Pack) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\langpack-pl@firefox.mozilla.org.xpi [2016-11-29]
FF Extension: (Polski słownik poprawnej pisowni) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\pl@dictionaries.addons.mozilla.org [2016-02-29]
FF Extension: (TrackMeNot) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\trackmenot@mrl.nyu.edu.xpi [2016-04-07]
FF Extension: (Remove Cookies for Site) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{06997db0-c027-4d5f-bd37-b0d9230226ea}.xpi [2016-10-23]
FF Extension: (Session Manager) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2016-03-18]
FF Extension: (ShowIP) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{3e9bb2a7-62ca-4efa-a4e6-f6f6168a652d}.xpi [2016-04-27]
FF Extension: (NoScript) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-11-30]
FF Extension: (Video DownloadHelper) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2016-10-11]
FF Extension: (Flash and Video Download) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a} [2016-11-02]
FF Extension: (Adblock Plus) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF Extension: (BetterPrivacy) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2016-11-01]
FF Extension: (Disable Anti-Adblock) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{d49a148e-817e-4025-bee3-5d541376de3b}.xpi [2016-04-28]
FF Extension: (User Agent Switcher) - C:\Users\Kamil\AppData\Roaming\Mozilla\Firefox\Profiles\rjxy8nua.default\Extensions\{e968fc70-8f95-4ab9-9e79-304de2a71ee1}.xpi [2016-04-28]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: (ESET Smart Security Extension) - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-09-26] [Brak podpisu cyfrowego]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-25] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-25] ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll [2014-09-26] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll [2014-09-26] (Google Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR Profile: C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default [2016-12-01]
CHR Extension: (Prezentacje Google) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-11-02]
CHR Extension: (Dokumenty Google) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-11-02]
CHR Extension: (Dysk Google) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-11-02]
CHR Extension: (YouTube) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-11-02]
CHR Extension: (Google Search) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-11-02]
CHR Extension: (Arkusze Google) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-11-02]
CHR Extension: (Cookie Injector) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\mflfghebbbnmdnkhbnmhajalhbgalklk [2016-11-30]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-11-30]
CHR Extension: (Gmail) - C:\Users\Kamil\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-11-02]

Opera: 
=======
StartMenuInternet: (HKLM) Operadeveloper - C:\Program Files (x86)\Opera developer\Launcher.exe

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-08] (Broadcom Corporation.)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1329304 2012-11-26] (ESET)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-04-30] (Intel Corporation)
R2 SpyShelterSrv; C:\Program Files (x86)\SpyShelter Premium\SpyShelterSrv.exe [60968 2016-08-05] (Datpol)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]
S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 ampa; C:\Windows\system32\ampa.sys [17008 2013-12-18] () [Brak podpisu cyfrowego]
S3 ampa; C:\Windows\SysWOW64\ampa.sys [17008 2013-12-18] () [Brak podpisu cyfrowego]
R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-08] (Broadcom Corporation.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [211344 2012-10-08] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [149592 2012-10-08] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [189208 2012-10-08] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [59440 2012-10-08] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [57904 2012-11-28] (ESET)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [Brak podpisu cyfrowego]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2013-03-07] () [Brak podpisu cyfrowego]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [Brak podpisu cyfrowego]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [Brak podpisu cyfrowego]
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-04-30] (Intel Corporation)
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [224720 2015-08-18] (QFX Software Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [128200 2013-04-03] (Qualcomm Atheros Co., Ltd.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8874712 2013-09-03] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2013-07-24] (Synaptics Incorporated)
R1 Spyshelter; C:\Program Files (x86)\SpyShelter Premium\SpyShelter.sys [1828392 2016-08-05] (SpyShelter)
R1 SpyshelterKb; C:\Program Files (x86)\SpyShelter Premium\SpyshelterKb.sys [886824 2016-08-05] (SpyShelter)
R1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [117768 2015-11-10] (Oracle Corporation)
R1 VBoxNetLwf; C:\Windows\System32\DRIVERS\VBoxNetLwf.sys [194976 2015-11-10] (Oracle Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-12-05 01:46 - 2016-12-05 01:46 - 00001334 _____ C:\Users\Kamil\Desktop\The World's Legends - Kashchey the Immortal.lnk
2016-12-05 01:46 - 2016-12-05 01:46 - 00001091 _____ C:\Users\Kamil\AppData\Roaming\Microsoft\Windows\Start Menu\MyPlayCity Games.lnk
2016-12-05 01:46 - 2016-12-05 01:46 - 00000518 _____ C:\Users\Kamil\Desktop\Goodgame Empire Online.lnk
2016-11-30 20:12 - 2016-11-30 20:12 - 00053722 _____ C:\Users\Kamil\Downloads\Cookieinjection31 (1).crx
2016-11-30 20:07 - 2016-11-30 20:08 - 00053722 _____ C:\Users\Kamil\Downloads\Cookieinjection31.crx
2016-11-29 12:04 - 2016-12-05 13:19 - 00000000 ____D C:\Users\Kamil\AppData\LocalLow\Mozilla
2016-11-24 10:44 - 2016-11-24 10:49 - 00000000 ____D C:\Program Files (x86)\CodeBlocks
2016-11-24 10:44 - 2016-11-24 10:44 - 00001091 _____ C:\Users\Kamil\Desktop\CodeBlocks.lnk
2016-11-24 10:44 - 2016-11-24 10:44 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2016-11-24 10:44 - 2016-11-24 10:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CodeBlocks
2016-11-24 00:35 - 2016-12-02 16:06 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\CodeBlocks
2016-11-16 12:31 - 2016-11-16 12:31 - 00001244 _____ C:\Users\Kamil\AppData\Local\recently-used.xbel
2016-11-13 12:50 - 2016-11-13 12:50 - 00001831 _____ C:\Users\Kamil\Desktop\Yeti Legend - Mystery of the forest — skrót.lnk
2016-11-13 12:50 - 2016-11-13 12:50 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\DikobrazGames
2016-11-09 07:07 - 2016-11-09 07:25 - 00000000 ____D C:\Program Files (x86)\Bolide Movie Creator
2016-11-09 07:07 - 2016-11-09 07:07 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\Obsidium
2016-11-09 07:07 - 2016-11-09 07:07 - 00000000 ____D C:\Users\Kamil\AppData\Local\BolideSoftware
2016-11-09 07:07 - 2016-11-09 07:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bolide Movie Creator
2016-11-09 07:07 - 2016-11-09 07:07 - 00000000 ____D C:\ProgramData\BolideSoftware

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-12-05 13:23 - 2015-01-17 16:11 - 00000000 ____D C:\FRST
2016-12-05 13:11 - 2015-11-12 12:18 - 00000000 ____D C:\Users\Kamil\.VirtualBox
2016-12-05 12:48 - 2014-09-26 13:43 - 00001046 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-12-05 11:39 - 2009-07-14 05:45 - 00031280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-12-05 11:39 - 2009-07-14 05:45 - 00031280 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-12-05 11:37 - 2011-02-04 18:38 - 18786590 _____ C:\Windows\system32\perfh015.dat
2016-12-05 11:37 - 2011-02-04 18:38 - 06567238 _____ C:\Windows\system32\perfc015.dat
2016-12-05 11:37 - 2009-07-14 06:13 - 00006422 _____ C:\Windows\system32\PerfStringBackup.INI
2016-12-05 11:33 - 2014-09-26 13:43 - 00001042 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-12-05 11:33 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-12-05 01:50 - 2014-09-27 11:50 - 00000000 ____D C:\Program Files\Waterfox
2016-12-05 01:46 - 2016-04-24 11:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MyPlayCity.com
2016-12-04 22:34 - 2016-02-10 23:21 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\X-Chat 2
2016-12-04 17:27 - 2015-10-06 11:23 - 00000000 ____D C:\film
2016-12-04 14:46 - 2015-08-26 17:49 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-12-02 12:10 - 2015-08-04 14:25 - 00003348 _____ C:\Windows\System32\Tasks\ESET Windows 10 upgrade – Refresh settings
2016-11-28 12:52 - 2015-09-30 13:14 - 00000000 ____D C:\Users\Kamil\AppData\Local\CrashDumps
2016-11-23 12:44 - 2014-10-08 15:18 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\Unreal Commander
2016-11-17 18:21 - 2016-01-17 10:00 - 101308891 _____ C:\Users\Kamil\Desktop\Meble.xlsx
2016-11-17 13:48 - 2014-09-27 16:53 - 00000000 ____D C:\Users\UpdatusUser
2016-11-16 12:38 - 2016-08-22 11:15 - 00000000 ____D C:\Users\Kamil\AppData\Roaming\Sylpheed
2016-11-16 12:31 - 2016-01-31 02:13 - 00000000 ____D C:\Users\Kamil\AppData\Local\gtk-2.0
2016-11-14 21:57 - 2015-11-12 12:19 - 00000000 ____D C:\Users\Kamil\VirtualBox VMs
2016-11-12 16:49 - 2016-05-20 14:09 - 00003912 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1463749790
2016-11-12 16:49 - 2016-05-20 14:09 - 00000000 ____D C:\Program Files (x86)\Opera developer
2016-11-10 09:54 - 2014-09-27 20:16 - 00000000 ____D C:\Users\Kamil\AppData\Local\Adobe
2016-11-10 09:53 - 2014-09-27 20:18 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-11-10 09:53 - 2014-09-27 20:18 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-11-10 09:53 - 2014-09-27 20:18 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-11-10 09:53 - 2014-09-27 20:18 - 00000000 ____D C:\Windows\system32\Macromed

==================== Pliki w katalogu głównym wybranych folderów =======

2014-09-26 17:13 - 2015-03-20 13:25 - 0006144 _____ () C:\Users\Kamil\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-11-16 12:31 - 2016-11-16 12:31 - 0001244 _____ () C:\Users\Kamil\AppData\Local\recently-used.xbel
2014-11-04 17:15 - 2015-09-08 14:51 - 0007620 _____ () C:\Users\Kamil\AppData\Local\resmon.resmoncfg

Niektóre pliki w TEMP:
====================
C:\Users\Kamil\AppData\Local\Temp\GOTD_mydll_1.dll
C:\Users\Kamil\AppData\Local\Temp\GOTD_mydll_3.dll


==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2016-11-24 19:28

==================== Koniec  FRST.txt ============================