Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 15-02-2017 02
Uruchomiony przez Tuscioch (administrator)  DESKTOP-EL2CSH4 (16-02-2017 13:39:22)
Uruchomiony z C:\Users\Tuscioch\Downloads
Załadowane profile: Tuscioch (Dostępne profile: Tuscioch)
Platform: Windows 10 Home Wersja 1607 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Windows\System32\AdminService.exe
(My Digital Life Forums) C:\Windows\KMSServerService\KMS Server Service.exe
() C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\igfxEM.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.11.105.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Intel Corporation) C:\Windows\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\IntelCpHeciSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [16409496 2015-11-27] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1407744 2015-11-27] (Realtek Semiconductor)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-02] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-05-26] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\...\RunOnce: [Uninstall C:\Users\Tuscioch\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Tuscioch\AppData\Local\Microsoft\OneDrive\17.3.6390.0509_1\amd64"
HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\...\MountPoints2: {c4c6fc6b-963c-11e6-9bdb-02500a503735} - "D:\AutoRun.exe" 
GroupPolicy: Ograniczenia <======= UWAGA
GroupPolicy\User: Ograniczenia <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1
Tcpip\..\Interfaces\{6315f96b-841d-4a40-8b4a-9ce0f1a62644}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{f765e343-d5a2-41af-8028-8cb302d7650b}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{f870cff5-8e9f-4f6a-b019-7a766ca15666}: [DhcpNameServer] 192.168.2.1 192.168.2.1

Internet Explorer:
==================
HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811013
HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.x-kom.pl
SearchScopes: HKLM -> DefaultScope {D01B9FD1-7CDA-4F67-A367-0E9C19DEAFC7} URL = hxxp://www.x-kom.pl
SearchScopes: HKLM -> {D01B9FD1-7CDA-4F67-A367-0E9C19DEAFC7} URL = hxxp://www.x-kom.pl
SearchScopes: HKLM-x32 -> DefaultScope {D01B9FD1-7CDA-4F67-A367-0E9C19DEAFC7} URL = hxxp://www.x-kom.pl
SearchScopes: HKLM-x32 -> {D01B9FD1-7CDA-4F67-A367-0E9C19DEAFC7} URL = hxxp://www.x-kom.pl
SearchScopes: HKU\S-1-5-21-2012787476-2681263979-3076844850-1001 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B728D4C16-1D4E-47B4-B5CB-D889BF19A6A8%7D&gp=811014
SearchScopes: HKU\S-1-5-21-2012787476-2681263979-3076844850-1001 -> {D01B9FD1-7CDA-4F67-A367-0E9C19DEAFC7} URL = 
SearchScopes: HKU\S-1-5-21-2012787476-2681263979-3076844850-1001 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/distib/ep/?q={SearchTerms}&product_id=%7B728D4C16-1D4E-47B4-B5CB-D889BF19A6A8%7D&gp=811014
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2012-10-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-02-10] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-02-10] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation)

Edge: 
======
Edge HomeButtonPage: HKU\S-1-5-21-2012787476-2681263979-3076844850-1001 -> hxxp://www.x-kom.pl/l/dziekujemy-za-zakupy

FireFox:
========
FF DefaultProfile: 8ukyfegx.default
FF ProfilePath: C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default [2017-02-16]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\8ukyfegx.default -> Поиск@Mail.Ru
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\8ukyfegx.default -> Поиск@Mail.Ru
FF Homepage: Mozilla\Firefox\Profiles\8ukyfegx.default -> hxxp://mail.ru/cnt/10445?gp=811013
FF Keyword.URL: Mozilla\Firefox\Profiles\8ukyfegx.default -> hxxp://go.mail.ru/distib/ep/?product_id=%7B030207EF-F661-4C6B-95C0-9D581BEE1219%7D&gp=811014
FF Extension: (Firefox Hotfix) - C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-10-08]
FF Extension: (Домашняя страница Mail.Ru) - C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default\Extensions\homepage@mail.ru [2017-02-16]
FF Extension: (Поиск@Mail.Ru) - C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default\Extensions\search@mail.ru [2017-02-16]
FF Extension: (Визуальные закладки @Mail.Ru) - C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default\Extensions\{a38384b3-2d1d-4f36-bc22-0f7ae402bcd7} [2017-02-16]
FF SearchPlugin: C:\Users\Tuscioch\AppData\Roaming\Mozilla\Firefox\Profiles\8ukyfegx.default\searchplugins\mailru.xml [2017-02-16]
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-02-10] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-02-10] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-19] (Google Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2012-10-01] (Microsoft Corporation)
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\local-settings.js [2016-04-04] <==== UWAGA (Linkuje do pliku *.cfg)
FF ExtraCheck: C:\Program Files\mozilla firefox\mozilla.cfg [2016-05-10] <==== UWAGA

Chrome: 
=======
CHR HomePage: Default -> mail.ru/cnt/11956636?rciguc__PARAM__
CHR StartupUrls: Default -> "hxxp://google.pl/"
CHR Profile: C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default [2017-02-16]
CHR Extension: (Prezentacje Google) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-27]
CHR Extension: (Dokumenty Google) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-27]
CHR Extension: (Dysk Google) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-27]
CHR Extension: (YouTube) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-27]
CHR Extension: (Arkusze Google) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-27]
CHR Extension: (Dokumenty Google offline) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-28]
CHR Extension: (AdBlock) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-02-07]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-25]
CHR Extension: (Gmail) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-27]
CHR Extension: (Chrome Media Router) - C:\Users\Tuscioch\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ccfifbojenkenpkmnbnndeadpfdiffof] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [oelpkepjlgmehajehfeicfbjdiobdkfj] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-2012787476-2681263979-3076844850-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ojlcebdkbpjdpiligkdbbkdkfjmchbfd] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AtherosSvc; C:\WINDOWS\system32\AdminService.exe [355760 2016-09-29] (Windows (R) Win 7 DDK provider)
R3 cphs; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\IntelCpHeciSvc.exe [301528 2016-11-23] (Intel Corporation)
S3 cplspcon; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\IntelCpHDCPSvc.exe [480216 2016-11-23] (Intel Corporation)
R2 DAX2API; C:\Program Files\Dolby\Dolby DAX2\DAX2_API\DolbyDAX2API.exe [176640 2015-09-22] () [Brak podpisu cyfrowego]
R2 igfxCUIService2.0.0.0; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\igfxCUIService.exe [341976 2016-11-23] (Intel Corporation)
R2 KMSServerService; C:\WINDOWS\KMSServerService\KMS Server Service.exe [236032 2017-01-25] (My Digital Life Forums) [Brak podpisu cyfrowego]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
S3 ETDI2C; C:\WINDOWS\system32\DRIVERS\ETDI2C.sys [175152 2015-06-09] (ELAN Microelectronic Corp.)
R3 igfx; C:\WINDOWS\System32\DriverStore\FileRepository\igdlh64.inf_amd64_7ee21f0fcd504371\igdkmd64.sys [11039704 2016-11-23] (Intel Corporation)
S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [251848 2017-02-16] (Malwarebytes)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 Qcamain; C:\WINDOWS\System32\drivers\Qcamainx64.sys [2276352 2015-07-10] (Qualcomm Atheros, Inc.) [Brak podpisu cyfrowego]
R3 Qcamain10x64; C:\WINDOWS\System32\drivers\Qcamain10x64.sys [2336768 2016-07-16] (Qualcomm Atheros, Inc.)
R3 rt640x64; C:\WINDOWS\System32\drivers\rt640x64.sys [889584 2015-09-23] (Realtek                                            )
R3 RTSUER; C:\WINDOWS\system32\Drivers\RtsUer.sys [411712 2015-05-19] (Realsil Semiconductor Corporation)
S3 semav6msr64; C:\Windows\system32\drivers\semav6msr64.sys [21984 2015-06-04] ()
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 SynRMIHID; C:\WINDOWS\system32\DRIVERS\SynRMIHID.sys [66168 2016-09-28] (Synaptics Incorporated)
S3 usbrndis6; C:\WINDOWS\System32\drivers\usb80236.sys [23040 2016-07-16] (Microsoft Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-16 13:39 - 2017-02-16 13:39 - 00017067 _____ C:\Users\Tuscioch\Downloads\FRST.txt
2017-02-16 13:38 - 2017-02-16 13:39 - 00000000 ____D C:\FRST
2017-02-16 13:37 - 2017-02-16 13:37 - 02422272 _____ (Farbar) C:\Users\Tuscioch\Downloads\FRST64.exe
2017-02-16 10:33 - 2017-02-16 12:48 - 00251848 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2017-02-16 10:33 - 2017-02-16 10:33 - 00000000 ____D C:\Program Files\Malwarebytes
2017-02-16 09:49 - 2017-02-16 09:49 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Вoйти в Интeрнет
2017-02-16 09:48 - 2017-02-16 09:48 - 00003494 _____ C:\WINDOWS\System32\Tasks\fupdate
2017-02-16 09:48 - 2017-02-16 09:48 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\fupdate
2017-02-16 09:47 - 2017-02-16 12:46 - 00000000 ____D C:\ProgramData\KMSAutoS
2017-02-16 09:47 - 2017-02-16 09:47 - 00003786 _____ C:\WINDOWS\System32\Tasks\KMSAutoNet
2017-02-16 09:45 - 2017-02-16 09:45 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Поиcк в Интeрнете
2017-02-16 09:44 - 2017-02-16 09:44 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Mail.Ru
2017-02-16 09:44 - 2017-02-16 09:44 - 00000000 ____D C:\ProgramData\Mail.Ru
2017-02-16 09:36 - 2017-02-16 09:37 - 06727901 _____ C:\Users\Tuscioch\Downloads\oferta.pdf
2017-02-16 09:07 - 2017-02-16 09:08 - 07381763 _____ C:\Users\Tuscioch\Downloads\SKMBT_C28017021609020.pdf
2017-02-15 12:45 - 2017-02-15 12:46 - 00000000 ____D C:\ProgramData\Lexmark Universal v2 XL
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\WINDOWS\PCHEALTH
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-02-15 12:45 - 2017-02-15 12:45 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2017-02-15 12:44 - 2017-02-15 12:45 - 00000000 ____D C:\WINDOWS\SHELLNEW
2017-02-15 12:44 - 2017-02-15 12:45 - 00000000 ____D C:\Program Files\Microsoft Office
2017-02-15 12:44 - 2017-02-15 12:44 - 00000000 __RHD C:\MSOCache
2017-02-15 12:44 - 2017-02-15 12:44 - 00000000 ____D C:\Program Files\Microsoft Analysis Services
2017-02-15 12:44 - 2017-02-15 12:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-02-15 12:44 - 2017-02-15 12:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Analysis Services
2017-02-15 12:15 - 2017-02-15 12:15 - 00000000 ____D C:\WINDOWS\System32\Tasks\OfficeSoftwareProtectionPlatform
2017-02-15 12:14 - 2017-02-15 12:14 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Microsoft Help
2017-02-15 12:09 - 2017-02-16 09:48 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\MSfree Inc
2017-02-15 12:05 - 2017-02-16 12:43 - 00000000 ____D C:\Users\Tuscioch\Desktop\KMSAuto Net 2015 v1.3.8 Portable
2017-02-15 08:30 - 2017-02-15 08:30 - 00979476 _____ C:\Users\Tuscioch\Downloads\Oferta mailowa - Idea Płynności.pdf
2017-02-15 08:30 - 2017-02-15 08:30 - 00490781 _____ C:\Users\Tuscioch\Downloads\Jak dodać pierwszą fakturę do systemu Idea Faktor 24 - Dla Pana.pdf
2017-02-10 23:10 - 2017-02-10 23:10 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\java
2017-02-10 23:08 - 2017-02-10 23:09 - 00000000 ____D C:\ProgramData\Oracle
2017-02-10 23:08 - 2017-02-10 23:08 - 00097856 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2017-02-10 23:08 - 2017-02-10 23:08 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Sun
2017-02-10 23:08 - 2017-02-10 23:08 - 00000000 ____D C:\Users\Tuscioch\AppData\LocalLow\Sun
2017-02-10 23:08 - 2017-02-10 23:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2017-02-10 23:08 - 2017-02-10 23:08 - 00000000 ____D C:\Program Files (x86)\Java
2017-02-10 23:05 - 2017-02-10 23:41 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\.minecraft
2017-02-10 23:05 - 2017-02-10 23:05 - 00002195 _____ C:\Users\Tuscioch\Desktop\Minecraft.lnk
2017-02-10 23:05 - 2017-02-10 23:05 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Minecraft
2017-02-10 22:43 - 2017-02-15 12:54 - 00000000 ____D C:\Users\Tuscioch\AppData\LocalLow\BitTorrent
2017-01-27 08:13 - 2017-01-27 08:14 - 00000000 ____D C:\ProgramData\kingsoft
2017-01-27 08:13 - 2017-01-27 08:13 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\kingsoft
2017-01-26 12:34 - 2017-02-16 12:41 - 00000000 ____D C:\Users\Tuscioch\Documents\Umowy RDB
2017-01-25 19:05 - 2017-01-25 19:07 - 00000000 ____D C:\Users\Tuscioch\Desktop\karta pamieci
2017-01-25 11:41 - 2017-01-25 11:41 - 00000000 ____D C:\WINDOWS\KMSServerService
2017-01-25 11:36 - 2017-02-16 12:50 - 00003656 _____ C:\WINDOWS\System32\Tasks\AutoKMS
2017-01-25 11:36 - 2017-01-26 11:36 - 00000000 ____D C:\WINDOWS\AutoKMS
2017-01-25 11:34 - 2017-01-25 11:34 - 00000000 ____D C:\ProgramData\Microsoft Toolkit
2017-01-25 11:25 - 2017-01-25 11:25 - 00000000 ____D C:\Users\Tuscioch\Documents\Niestandardowe szablony pakietu Office
2017-01-25 10:08 - 2016-12-21 08:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-25 10:08 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-25 08:10 - 2017-01-25 08:10 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\WinRAR
2017-01-25 08:09 - 2017-01-25 08:09 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-01-25 08:09 - 2017-01-25 08:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2017-01-25 08:08 - 2017-01-25 08:09 - 00000000 ____D C:\Program Files\WinRAR
2017-01-24 14:50 - 2017-01-24 14:50 - 06791548 _____ C:\Users\Tuscioch\Desktop\Bez nazwy-1.psd
2017-01-17 09:15 - 2017-02-15 12:00 - 859354497 _____ C:\Users\Tuscioch\Desktop\qwerty.psd
2017-01-17 07:50 - 2017-01-17 07:50 - 00000000 ____D C:\Users\Tuscioch\AppData\LocalLow\Adobe
2017-01-17 06:40 - 2017-01-17 06:40 - 00003646 _____ C:\WINDOWS\System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-EL2CSH4-Tuscioch
2017-01-17 06:39 - 2017-01-17 06:39 - 00001092 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015.lnk
2017-01-17 06:38 - 2017-01-17 06:39 - 00000000 ____D C:\Program Files\Common Files\Adobe

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-16 12:56 - 2016-11-23 19:19 - 00000000 ____D C:\Program Files (x86)\Steam
2017-02-16 12:52 - 2016-07-16 23:05 - 01840750 _____ C:\WINDOWS\system32\perfh015.dat
2017-02-16 12:52 - 2016-07-16 23:05 - 00485594 _____ C:\WINDOWS\system32\perfc015.dat
2017-02-16 12:52 - 2016-04-12 00:55 - 04098676 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-02-16 12:48 - 2016-10-02 02:47 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-16 12:48 - 2016-09-27 17:43 - 00000000 __SHD C:\Users\Tuscioch\IntelGraphicsProfiles
2017-02-16 12:48 - 2016-07-16 07:04 - 00524288 _____ C:\WINDOWS\system32\config\BBI
2017-02-16 12:34 - 2016-10-31 00:00 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Adobe
2017-02-16 11:46 - 2016-10-02 02:43 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-16 09:55 - 2016-10-02 02:43 - 00355360 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2017-02-16 09:44 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\SysWOW64\GroupPolicy
2017-02-16 09:44 - 2015-07-10 12:04 - 00000000 ___HD C:\WINDOWS\system32\GroupPolicy
2017-02-16 08:39 - 2016-09-27 17:43 - 00000000 ____D C:\Users\Tuscioch\AppData\Local\Packages
2017-02-16 08:37 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-16 07:34 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-15 12:54 - 2016-10-28 09:53 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\BitTorrent
2017-02-15 12:45 - 2016-07-16 12:47 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2017-02-15 12:45 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2017-02-15 12:45 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-02-15 12:44 - 2016-07-16 12:47 - 00000000 ____D C:\Program Files\Common Files\System
2017-02-15 12:44 - 2015-07-10 12:04 - 00000167 _____ C:\WINDOWS\win.ini
2017-02-15 12:43 - 2016-11-08 16:49 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-02-15 11:59 - 2014-06-09 08:48 - 150587126 _____ C:\Users\Tuscioch\Desktop\drukomat_banner_jednostronny_3000x1500_poziom_205.psd
2017-02-07 10:03 - 2016-10-08 11:52 - 00002285 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-01-27 08:13 - 2016-10-01 10:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2017-01-27 08:12 - 2016-10-01 10:55 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Origin
2017-01-27 08:12 - 2016-10-01 10:50 - 00000000 ____D C:\ProgramData\Origin
2017-01-27 08:11 - 2016-10-03 18:57 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Skype
2017-01-25 10:19 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-25 08:03 - 2016-10-03 18:57 - 00000000 ____D C:\ProgramData\Skype
2017-01-24 14:50 - 2016-10-02 02:44 - 00000000 ____D C:\Users\Tuscioch
2017-01-24 07:53 - 2016-12-20 22:08 - 00003296 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-24 07:53 - 2016-09-27 17:44 - 00002427 _____ C:\Users\Tuscioch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-01-24 07:53 - 2016-09-27 17:44 - 00000000 ___RD C:\Users\Tuscioch\OneDrive
2017-01-19 08:05 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\rescache
2017-01-18 10:16 - 2016-10-08 14:46 - 00000000 _____ C:\WINDOWS\system32\GfxValDisplayLog.bin
2017-01-18 10:16 - 2016-04-12 01:39 - 00000000 ____D C:\Intel
2017-01-18 07:36 - 2016-10-31 00:00 - 00000000 ____D C:\ProgramData\Adobe
2017-01-17 06:40 - 2016-09-27 17:43 - 00000000 ____D C:\Users\Tuscioch\AppData\Roaming\Adobe
2017-01-17 06:39 - 2016-11-02 12:45 - 00000000 ____D C:\Users\Tuscioch\Documents\Adobe
2017-01-17 06:39 - 2016-10-31 00:02 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2017-01-17 06:38 - 2016-10-31 00:01 - 00001626 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
2017-01-17 06:38 - 2016-10-31 00:01 - 00000000 ____D C:\Program Files\Adobe
2017-01-17 06:19 - 2016-10-03 18:57 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-01-17 06:18 - 2016-04-12 00:50 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-01-17 06:17 - 2016-07-16 12:47 - 00000000 ___RD C:\WINDOWS\ImmersiveControlPanel
2017-01-17 06:17 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\WinBioPlugIns
2017-01-17 06:17 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\system32\oobe
2017-01-17 06:17 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\ShellExperiences
2017-01-17 06:17 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\Provisioning

==================== Pliki w katalogu głównym wybranych folderów =======

2016-10-01 19:33 - 2016-10-01 19:33 - 0000017 _____ () C:\Users\Tuscioch\AppData\Local\resmon.resmoncfg
2016-10-02 02:43 - 2016-10-02 02:43 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2016-10-02 02:43 - 2016-10-02 02:43 - 0000102 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc

Niektóre pliki w TEMP:
====================
2017-02-16 09:45 - 2017-02-16 09:45 - 1205240 ____N () C:\Users\Tuscioch\AppData\Local\Temp\aCyiaVLVcV7K.exe
2017-02-16 09:49 - 2017-02-16 09:49 - 1205240 ____N () C:\Users\Tuscioch\AppData\Local\Temp\HQbnFd192ABK.exe
2017-02-16 09:51 - 2017-02-16 09:51 - 1205240 ____N () C:\Users\Tuscioch\AppData\Local\Temp\je4Y02XrdfDE.exe
2017-02-16 09:50 - 2017-02-16 09:50 - 1205240 _____ () C:\Users\Tuscioch\AppData\Local\Temp\n5yoPHf3o9Jw.exe
2017-02-16 09:49 - 2017-02-16 09:49 - 64938720 ____N (Kometa LCC) C:\Users\Tuscioch\AppData\Local\Temp\X674ceIPyrOx.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-02-13 12:11

==================== Koniec  FRST.txt ============================