Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 22-01-2017
Uruchomiony przez Pyko (administrator)  PYKO-KOMPUTER (24-01-2017 16:08:12)
Uruchomiony z C:\Users\Pyko\Downloads
Załadowane profile: Pyko (Dostępne profile: Pyko)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ABBYY Production LLC) C:\Program Files (x86)\ABBYY PDF Transformer+\NetworkLicenseServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Alexandr Irza) C:\Program Files (x86)\Volume2\Volume2.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(HP) C:\Windows\System32\HPSIsvc.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
(Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8447192 2015-04-23] (Realtek Semiconductor)
HKLM\...\Run: [GrooveMonitor] => c:\program files (x86)\microsoft office\office12\groovemonitor.exe [33648 2007-08-24] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] => c:\program files (x86)\common files\adobe\arm\1.0\adobearm.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM\...\Run: [Malwarebytes TrayApp] => C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\mbamtray.exe [2776528 2016-12-14] (Malwarebytes)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292088 2000-01-01] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-22] (AVAST Software)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1160408 2016-12-17] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM-x32\...\Run: [Volume2] => C:\Program Files (x86)\Volume2\Volume2.exe [4781056 2015-08-10] (Alexandr Irza)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\...\MountPoints2: E - E:\autorun.exe
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\...\MountPoints2: {5e67e146-a210-11e4-b5a4-10bf48722ea6} - G:\DPFMate.exe
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\...\MountPoints2: {71ae7ece-ba2b-11e6-a1aa-806e6f6e6963} - F:\HiSuiteDownLoader.exe
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\...\MountPoints2: {c04ca00b-d453-11e6-8c1b-10bf48722ea6} - F:\DPFMate.exe
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\...\MountPoints2: {d0154799-77ec-11e4-aa0f-10bf48722ea6} - H:\START.EXE
HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-09] (AVAST Software)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{9E808DA9-1B53-4CEC-8EED-63B36F8589F4}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{9E808DA9-1B53-4CEC-8EED-63B36F8589F4}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{D8B185CA-0BEC-4C9E-9B7C-D404E9F45E74}: [NameServer] 77.234.40.79

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2811792325-3593454412-1631040856-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2811792325-3593454412-1631040856-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-01-20] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-10-24] (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-20] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2007-08-24] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-01-20] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-24] (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-20] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Pyko\AppData\Roaming\Mozilla\Firefox\Profiles\pnqdnu4r.default-1485173287884 [2017-01-24]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-11-29]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-11-29]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: (SmartPrintButton) - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2011-01-26] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Firefox\Extensions: [ffsearch_toolbar] - C:\Users\Pyko\AppData\Roaming\Mozilla\Firefox\Profiles\yv7ukisc.default-1437668322638\extensions\ffsearch_toolbar => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_194.dll [2017-01-10] ()
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-20] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_194.dll [2017-01-10] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2000-01-01] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2000-01-01] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-20] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR HomePage: Profile 1 -> hxxp://google.pl/
CHR StartupUrls: Profile 1 -> "hxxp://google.pl/"
CHR Profile: C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-01-24]
CHR Extension: (Avast Passwords) - C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\emhginjpijfggbofeediiojmdlmlkoik [2017-01-23]
CHR Extension: (Avast SafePrice) - C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-11-14]
CHR Extension: (Avast Online Security) - C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-12-16]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (Chrome Media Router) - C:\Users\Pyko\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-16]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 ABBYY.Licensing.PDFTransformer.Classic.4.0; C:\Program Files (x86)\ABBYY PDF Transformer+\NetworkLicenseServer.exe [822072 2013-11-22] (ABBYY Production LLC)
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [Brak podpisu cyfrowego]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-09] (AVAST Software)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2012-10-26] (Brother Industries, Ltd.) [Brak podpisu cyfrowego]
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2000-01-01] (Intel Corporation)
S4 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2909472 2015-07-31] (IObit)
R2 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4317648 2016-12-14] (Malwarebytes)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-01-28] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-09-09] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-09-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-09-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-09-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-09] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-14] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513632 2016-09-22] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-09-09] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2014-11-29] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-10-13] (AVAST Software)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-11-29] (Disc Soft Ltd)
R1 ESProtectionDriver; C:\Windows\system32\drivers\mbae64.sys [77416 2016-12-14] ()
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [27552 2015-07-23] (REALiX(tm))
S2 Kmm4xNT; C:\Windows\SysWow64\Drivers\Kmm4xNT.sys [95484 2002-04-26] (DATOM Dariusz Cielebąk) [Brak podpisu cyfrowego]
R2 MBAMChameleon; C:\Windows\system32\drivers\MBAMChameleon.sys [176064 2017-01-24] (Malwarebytes)
R3 MBAMFarflt; C:\Windows\system32\drivers\farflt.sys [102856 2017-01-24] (Malwarebytes)
R3 MBAMProtection; C:\Windows\system32\drivers\mbam.sys [43968 2017-01-24] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [250816 2017-01-24] (Malwarebytes)
R3 MBAMWebProtection; C:\Windows\system32\drivers\mwac.sys [81696 2017-01-24] (Malwarebytes)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2015-04-23] (Intel Corporation)
S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-08-21] (Marvell Semiconductor, Inc.)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-01-24 16:08 - 2017-01-24 16:08 - 00016859 _____ C:\Users\Pyko\Downloads\FRST.txt
2017-01-24 16:07 - 2017-01-24 16:07 - 00003830 _____ C:\Users\Pyko\Desktop\Malwarebytes AntiMalware.txt
2017-01-24 16:07 - 2017-01-24 15:36 - 00006637 _____ C:\Users\Pyko\Desktop\Fixlog.txt
2017-01-24 15:56 - 2017-01-24 15:56 - 00176064 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMChameleon.sys
2017-01-24 15:55 - 2017-01-24 16:00 - 00081696 _____ (Malwarebytes) C:\Windows\system32\Drivers\mwac.sys
2017-01-24 15:55 - 2017-01-24 15:55 - 00250816 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-01-24 15:55 - 2017-01-24 15:55 - 00102856 _____ (Malwarebytes) C:\Windows\system32\Drivers\farflt.sys
2017-01-24 15:55 - 2017-01-24 15:55 - 00043968 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2017-01-24 15:55 - 2017-01-24 15:55 - 00001908 _____ C:\Users\Public\Desktop\Malwarebytes.lnk
2017-01-24 15:55 - 2017-01-24 15:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes
2017-01-24 15:55 - 2017-01-24 15:55 - 00000000 ____D C:\ProgramData\Malwarebytes
2017-01-24 15:55 - 2017-01-24 15:55 - 00000000 ____D C:\Program Files\Malwarebytes
2017-01-24 15:55 - 2016-12-14 12:55 - 00077416 _____ C:\Windows\system32\Drivers\mbae64.sys
2017-01-24 15:46 - 2017-01-24 15:46 - 00001997 _____ C:\Users\Pyko\Desktop\AdwCleaner[C3].txt
2017-01-24 15:32 - 2017-01-24 15:36 - 00006637 _____ C:\Users\Pyko\Downloads\Fixlog.txt
2017-01-24 15:27 - 2017-01-24 15:54 - 54199488 _____ (Malwarebytes ) C:\Users\Pyko\Downloads\mb3-setup-consumer-3.0.5.1299.exe
2017-01-24 14:41 - 2017-01-24 14:41 - 1322175746 ____N C:\Windows\MEMORY.DMP
2017-01-24 14:41 - 2017-01-24 14:41 - 00720344 _____ C:\Windows\Minidump\012417-67002-01.dmp
2017-01-24 13:24 - 2017-01-24 13:25 - 00183407 _____ C:\Users\Pyko\Desktop\GMER.txt
2017-01-24 12:49 - 2017-01-24 12:49 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Pyko\Downloads\SPTDinst-v189-x64.exe
2017-01-24 12:42 - 2017-01-24 12:42 - 00380928 _____ C:\Users\Pyko\Downloads\yivntzdb.exe
2017-01-24 12:36 - 2017-01-24 12:36 - 00091349 _____ C:\Users\Pyko\Desktop\Shortcut.txt
2017-01-24 12:30 - 2017-01-24 12:36 - 00045869 _____ C:\Users\Pyko\Desktop\Addition.txt
2017-01-24 12:30 - 2017-01-24 12:36 - 00029553 _____ C:\Users\Pyko\Desktop\FRST.txt
2017-01-24 12:27 - 2017-01-24 16:08 - 00000000 ____D C:\FRST
2017-01-24 12:27 - 2017-01-24 12:27 - 02420736 _____ (Farbar) C:\Users\Pyko\Downloads\FRST64.exe
2017-01-24 12:20 - 2017-01-24 12:20 - 00006535 _____ C:\Users\Pyko\Desktop\AdwCleaner[C0].txt
2017-01-24 12:20 - 2017-01-24 12:20 - 00001785 _____ C:\Users\Pyko\Desktop\AdwCleaner[C2].txt
2017-01-24 12:19 - 2017-01-24 12:19 - 00005448 _____ C:\Users\Pyko\Desktop\AdwCleaner[S2].txt
2017-01-24 12:18 - 2017-01-24 12:18 - 00013655 _____ C:\Users\Pyko\Desktop\AdwCleaner[S0].txt
2017-01-24 12:18 - 2017-01-24 12:18 - 00004838 _____ C:\Users\Pyko\Desktop\AdwCleaner[S1].txt
2017-01-23 21:38 - 2017-01-23 21:38 - 03988944 _____ C:\Users\Pyko\Downloads\adwcleaner_6.042(1).exe
2017-01-23 21:37 - 2017-01-23 21:37 - 03988944 _____ C:\Users\Pyko\Downloads\adwcleaner_6.042.exe
2017-01-23 17:42 - 2017-01-24 10:16 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\Volume2
2017-01-23 17:42 - 2017-01-23 17:42 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Volume2
2017-01-23 17:42 - 2017-01-23 17:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Volume2
2017-01-23 17:42 - 2017-01-23 17:42 - 00000000 ____D C:\Program Files (x86)\Volume2
2017-01-23 13:07 - 2017-01-24 15:46 - 00000000 ____D C:\Users\Pyko\AppData\LocalLow\Mozilla
2017-01-23 13:07 - 2017-01-23 13:07 - 00001204 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-01-23 13:07 - 2017-01-23 13:07 - 00001192 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-01-23 13:07 - 2017-01-23 13:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-23 11:27 - 2017-01-23 11:27 - 00000000 ____D C:\Users\Pyko\AppData\Local\AVAST Software
2017-01-22 14:12 - 2017-01-22 14:12 - 01477060 _____ C:\Users\Pyko\Desktop\TD-W8951ND_V5_160113.zip
2017-01-20 15:11 - 2017-01-20 15:16 - 00000000 ___HD C:\Users\Pyko\AppData\Local\SysHashTable
2017-01-20 15:03 - 2017-01-20 15:03 - 00000000 ____D C:\Program Files (x86)\Firebird
2017-01-20 15:02 - 2017-01-20 18:02 - 00000000 ____D C:\Planista BD 2008 edukacyjny
2017-01-16 13:55 - 2017-01-16 13:55 - 00000000 ____D C:\Users\Pyko\Desktop\KONIE PZU
2017-01-08 23:51 - 2017-01-08 23:51 - 00002016 _____ C:\Users\Public\Desktop\Revit 2014 - Polski (Polish).lnk
2017-01-02 19:34 - 2017-01-02 19:34 - 00000000 ____D C:\Users\Pyko\.inet
2017-01-02 19:30 - 2017-01-20 19:59 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2017-01-02 19:26 - 2017-01-20 20:01 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2017-01-02 19:26 - 2017-01-20 20:01 - 00000000 ____D C:\Program Files\Java
2017-01-02 08:30 - 2017-01-08 17:45 - 00000002 _____ C:\Users\Pyko\AppData\Local\SendToWorkFiles.txt
2017-01-02 08:27 - 2017-01-02 08:27 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\ABBYY
2017-01-02 08:27 - 2017-01-02 08:27 - 00000000 ____D C:\Users\Pyko\AppData\Local\ABBYY
2017-01-02 08:26 - 2017-01-02 08:26 - 00002299 _____ C:\Users\Public\Desktop\ABBYY PDF Transformer+.lnk
2017-01-02 08:26 - 2017-01-02 08:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ABBYY PDF Transformer+
2017-01-02 08:26 - 2013-11-18 09:47 - 00057888 _____ (Tracker Software Products (Canada) Ltd.) C:\Windows\system32\pxc50pma.dll
2017-01-02 08:22 - 2017-01-02 08:26 - 00000000 ____D C:\Program Files (x86)\ABBYY PDF Transformer+
2017-01-02 08:22 - 2017-01-02 08:22 - 00000000 ____D C:\ProgramData\ABBYY
2016-12-29 12:00 - 2016-12-29 16:02 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\MotionDSP
2016-12-29 12:00 - 2016-12-29 16:02 - 00000000 ____D C:\Users\Pyko\AppData\Local\MotionDSP
2016-12-28 13:26 - 2016-12-28 13:26 - 00284525 _____ C:\Users\Pyko\Documents\PROJEKT-DOMINIKA.docx
2016-12-28 11:32 - 2016-12-28 11:40 - 00000000 ____D C:\Users\Pyko\AppData\Local\Deshaker

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-01-24 16:01 - 2014-12-01 20:44 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-01-24 15:53 - 2009-07-14 05:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-24 15:53 - 2009-07-14 05:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-24 15:45 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-24 15:43 - 2015-08-07 12:04 - 00000000 ____D C:\AdwCleaner
2017-01-24 15:38 - 2015-07-23 18:05 - 00000008 __RSH C:\ProgramData\ntuser.pol
2017-01-24 15:36 - 2015-02-13 16:20 - 00000000 ____D C:\Users\Pyko\AppData\LocalLow\Temp
2017-01-24 15:33 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2017-01-24 14:41 - 2009-02-19 19:28 - 00000000 ____D C:\Windows\Minidump
2017-01-24 12:48 - 2015-11-28 09:11 - 00000000 ____D C:\Program Files (x86)\UltraISO
2017-01-24 10:32 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-01-24 10:32 - 2009-02-19 22:04 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-01-24 10:28 - 2015-07-28 21:51 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2017-01-24 10:27 - 2015-07-28 22:41 - 00000384 _____ C:\Windows\wininit.ini
2017-01-24 10:27 - 2015-07-28 21:51 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2017-01-23 21:21 - 2016-01-20 11:36 - 01003520 ___SH C:\Users\Pyko\Desktop\Thumbs.db
2017-01-23 14:21 - 2016-02-04 16:24 - 02357760 ___SH C:\Users\Pyko\Downloads\Thumbs.db
2017-01-23 13:07 - 2015-07-23 20:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-01-23 13:04 - 2014-11-29 19:31 - 00000000 ____D C:\Program Files (x86)\Google
2017-01-23 13:04 - 2009-01-10 16:59 - 00001466 _____ C:\Users\Pyko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-01-22 17:51 - 2015-07-28 12:29 - 00000000 ____D C:\Program Files (x86)\fc1c26fc-322a-43ac-850d-24444a45516b
2017-01-22 17:51 - 2014-11-29 19:33 - 00000000 ____D C:\Program Files (x86)\Adobe
2017-01-22 12:01 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-01-21 15:50 - 2015-02-11 09:57 - 00000000 ____D C:\Users\Pyko\AppData\Local\cache
2017-01-21 15:45 - 2009-02-22 01:43 - 00000000 ____D C:\ProgramData\ProductData
2017-01-20 20:01 - 2014-12-04 13:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-01-20 19:59 - 2014-12-04 13:05 - 00000000 ____D C:\Program Files (x86)\Java
2017-01-20 18:03 - 2015-02-05 18:05 - 00000000 ____D C:\ProgramData\chandney
2017-01-20 18:03 - 2015-02-05 18:05 - 00000000 ____D C:\Program Files (x86)\WINBUD
2017-01-20 18:02 - 2015-05-15 09:20 - 00000000 ____D C:\Windows\system32\appmgmt
2017-01-20 18:00 - 2009-02-19 19:10 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-20 17:52 - 2014-12-01 19:33 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\uTorrent
2017-01-20 15:14 - 2014-11-29 19:33 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2017-01-17 17:49 - 2015-02-10 15:19 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\Autodesk
2017-01-17 17:49 - 2015-02-10 15:19 - 00000000 ____D C:\ProgramData\Autodesk
2017-01-13 16:39 - 2016-02-12 09:31 - 00000000 ___RD C:\Users\Pyko\Virtual Machines
2017-01-12 17:58 - 2009-07-14 18:55 - 04853804 _____ C:\Windows\system32\perfh015.dat
2017-01-12 17:58 - 2009-07-14 18:55 - 01559064 _____ C:\Windows\system32\perfc015.dat
2017-01-12 17:58 - 2009-07-14 06:13 - 00006208 _____ C:\Windows\system32\PerfStringBackup.INI
2017-01-10 19:01 - 2014-12-01 20:44 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-01-10 19:01 - 2014-12-01 20:44 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-01-10 19:01 - 2014-12-01 20:44 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-01-10 19:01 - 2014-12-01 20:44 - 00000000 ____D C:\Windows\system32\Macromed
2017-01-10 19:01 - 2014-11-29 16:48 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-01-09 11:13 - 2014-12-11 19:30 - 00000000 ____D C:\Users\Pyko\AppData\Local\Autodesk
2017-01-09 11:01 - 2009-02-19 19:18 - 00143376 _____ C:\Users\Pyko\AppData\Local\GDIPFONTCACHEV1.DAT
2017-01-09 10:59 - 2009-07-14 05:45 - 05055064 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-08 23:54 - 2015-02-10 15:35 - 00000000 ____D C:\Program Files\Autodesk
2017-01-08 23:54 - 2015-02-10 15:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2017-01-08 23:39 - 2015-02-10 15:35 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared
2017-01-08 22:46 - 2013-07-02 20:34 - 00000000 ____D C:\Autodesk
2017-01-04 15:24 - 2014-12-11 12:15 - 00000000 ____D C:\Users\Pyko\Desktop\studia
2017-01-02 19:34 - 2009-01-10 16:59 - 00000000 ____D C:\Users\Pyko
2017-01-02 19:30 - 2016-03-21 18:42 - 00000000 ____D C:\ProgramData\Oracle
2017-01-02 14:24 - 2014-12-02 10:31 - 00000000 ____D C:\ProgramData\CanonIJPLM
2016-12-29 12:43 - 2015-07-23 19:53 - 00000000 ____D C:\ProgramData\TEMP
2016-12-29 12:00 - 2009-02-22 01:48 - 00000000 ___RD C:\Users\Pyko\Desktop\Programy
2016-12-28 13:23 - 2016-12-05 07:52 - 00000000 ____D C:\Users\Pyko\AppData\Roaming\SolidDocuments
2016-12-27 18:29 - 2009-01-10 16:59 - 00000000 ___RD C:\Users\Pyko\Pictures
2016-12-27 18:28 - 2009-01-10 16:59 - 00000000 ____D C:\Users\Pyko\AppData\Local\Microsoft

==================== Pliki w katalogu głównym wybranych folderów =======

2014-11-29 19:31 - 2014-11-29 19:50 - 50053120 _____ () C:\Program Files (x86)\GUTEABD.tmp
2016-04-04 11:15 - 2016-04-04 11:15 - 0000132 _____ () C:\Users\Pyko\AppData\Roaming\Adobe IllExport Filter CS5 Prefs
2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () C:\Users\Pyko\AppData\Roaming\HBbRNMacN17uyL5
2016-04-04 19:11 - 2016-11-21 19:45 - 0006144 _____ () C:\Users\Pyko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-02-22 02:26 - 2009-02-22 02:27 - 1065984 _____ () C:\Users\Pyko\AppData\Local\file__0.localstorage
2014-12-02 09:38 - 2015-01-28 17:09 - 0007599 _____ () C:\Users\Pyko\AppData\Local\Resmon.ResmonCfg
2017-01-02 08:30 - 2017-01-08 17:45 - 0000002 _____ () C:\Users\Pyko\AppData\Local\SendToWorkFiles.txt
2009-02-22 14:43 - 2009-02-22 14:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-02-10 15:36 - 2015-02-10 15:36 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2016-10-25 10:57

==================== Koniec  FRST.txt ============================