Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 18-02-2017 01 Uruchomiony przez Anna (administrator) ANIA_PC (20-02-2017 00:44:06) Uruchomiony z C:\Users\Anna\Desktop Załadowane profile: Anna (Dostępne profile: Anna) Platform: Windows 8.1 (Update) (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe (Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\avp.exe () C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\ProgramData\OnlineUpdate\ouc.exe (Microsoft) C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe (AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\avpui.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe () C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\BrccMCtl.exe (Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcMon.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Google Inc.) C:\Users\Anna\AppData\Local\Google\Update\GoogleUpdate.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [] => [X] HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-08-18] (TOSHIBA Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2778864 2014-08-06] (Synaptics Incorporated) HKLM-x32\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [383768 2002-04-12] (Alcor Micro Corp.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation) HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2012-09-25] () HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\chomikbox.exe HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\Run: [ALLUpdate] => "C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe" "sleep" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\Run: [Napisy24Update] => "C:\Program Files (x86)\Napisy24\Napisy24Update.exe" "sleep" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\Run: [Google Update] => C:\Users\Anna\AppData\Local\Google\Update\1.3.32.7\GoogleUpdateCore.exe [601752 2016-12-17] (Google Inc.) HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {3c81cfec-c4a9-11e6-828d-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {3c81d129-c4a9-11e6-828d-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {3c81d251-c4a9-11e6-828d-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {4d6a4a5d-0d32-11e6-8267-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {6db91e04-ef36-11e6-8292-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {7f789076-9ad9-11e6-8287-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {7f78962d-9ad9-11e6-8287-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {d3cca15d-5515-11e3-8251-806e6f6e6963} - "D:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {f7f2f9de-eb54-11e5-8265-645a04b54569} - "E:\AutoRun.exe" HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\...\MountPoints2: {f7f2fa48-eb54-11e5-8265-645a04b54569} - "E:\AutoRun.exe" Startup: C:\Users\Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk [2016-11-22] ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 62.179.1.61 62.179.1.63 Tcpip\..\Interfaces\{CC857AC7-AD6A-451D-82C1-B149BF797F3D}: [DhcpNameServer] 192.168.1.254 Tcpip\..\Interfaces\{D3DCC4BB-4181-4F46-947F-D0533C9DDEBA}: [DhcpNameServer] 62.179.1.61 62.179.1.63 Internet Explorer: ================== HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gazeta.pl/0,0.html?p=189 HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com/?pc=TEJB HKU\S-1-5-21-2762488165-1568373490-1817202181-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://toshiba.eu/symbaloo_c SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2762488165-1568373490-1817202181-1001 -> DefaultScope {9C9067F7-D336-4C66-895D-8DA1AA36F00B} URL = BHO: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab) BHO: STATISTICA Browser Helper -> {990A8747-93BF-4EF7-B72E-94A6884B98C2} -> C:\Program Files (x86)\StatSoft\STATISTICA 12 Trial\Support\StaBHO.dll => Brak pliku BHO-x32: Kaspersky Protection -> {03993315-5CE9-4F00-8790-D14A94F1D91A} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation) Toolbar: HKLM - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\x64\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab) Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {001032CB-B0AC-4F2C-A650-AD4B2B26E5DA} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\IEExt\ie_plugin.dll [2016-12-02] (AO Kaspersky Lab) FireFox: ======== FF ProfilePath: C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Profiles\qeub0qb4.default-1478815154687 [2017-02-20] FF Extension: (uBlock Origin) - C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Profiles\qeub0qb4.default-1478815154687\Extensions\uBlock0@raymondhill.net.xpi [2017-01-25] FF Extension: (BetterPrivacy) - C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Profiles\qeub0qb4.default-1478815154687\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2016-11-10] FF Extension: (SHA-1 deprecation staged rollout) - C:\Users\Anna\AppData\Roaming\Mozilla\Firefox\Profiles\qeub0qb4.default-1478815154687\features\{0ada93a2-3bfa-4c7b-875c-57f25b4135a1}\disableSHA1rollout@mozilla.org.xpi [2017-02-17] FF HKLM-x32\...\Firefox\Extensions: [light_plugin_ACF0E80077C511E59DED005056C00008@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\FFExt\light_plugin_firefox\addon.xpi FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\FFExt\light_plugin_firefox\addon.xpi [2016-12-02] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-15] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-15] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2762488165-1568373490-1817202181-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Anna\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google) FF Plugin HKU\S-1-5-21-2762488165-1568373490-1817202181-1001: @talk.google.com/O1DPlugin -> C:\Users\Anna\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google) FF Plugin HKU\S-1-5-21-2762488165-1568373490-1817202181-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Anna\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin HKU\S-1-5-21-2762488165-1568373490-1817202181-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Anna\AppData\Local\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin HKU\S-1-5-21-2762488165-1568373490-1817202181-1001: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [Brak pliku] FF Plugin ProgramFiles/Appdata: C:\Users\Anna\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google) FF Plugin ProgramFiles/Appdata: C:\Users\Anna\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google) Chrome: ======= CHR HomePage: Default -> hxxp://www.gazeta.pl/0,0.html?p=189 CHR StartupUrls: Default -> "hxxp://www.gazeta.pl/0,0.html?p=189" CHR Profile: C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default [2016-03-07] CHR Extension: (Prezentacje Google) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-26] CHR Extension: (Dokumenty Google) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-26] CHR Extension: (Dysk Google) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-26] CHR Extension: (YouTube) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-26] CHR Extension: (Adblock Plus) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-02] CHR Extension: (Google Search) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-26] CHR Extension: (Kaspersky Protection) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\eahebamiopdhefndnmappcihfajigkka [2016-03-07] CHR Extension: (Arkusze Google) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-26] CHR Extension: (Dokumenty Google offline) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-02-26] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-02-26] CHR Extension: (Gmail) - C:\Users\Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-26] CHR HKLM\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lpeeaghdjmhlakojjcgfdhgcejdaefmi] - hxxps://chrome.google.com/webstore/detail/lpeeaghdjmhlakojjcgfdhgcejdaefmi ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [312448 2013-08-22] (Windows (R) Win 7 DDK provider) [Brak podpisu cyfrowego] R2 AVP16.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\avp.exe [236928 2015-12-22] (AO Kaspersky Lab) R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [19792 2013-09-10] () R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-04-10] () R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [Brak podpisu cyfrowego] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-04] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation) S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 16.0.1\x64\vssbridge64.exe [152488 2015-12-22] (AO Kaspersky Lab) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.) S2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.) S2 Mobile Partner. RunOuc; C:\Program Files (x86)\Mobile Partner\UpdateDog\ouc.exe [656976 2013-05-21] () R2 NovaPdfServer; C:\Program Files\Softland\novaPDF 8\Server\novapdfs.exe [50600 2016-03-03] (Microsoft) R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [339456 2013-08-16] (IDT, Inc.) [Brak podpisu cyfrowego] S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [346872 2013-08-22] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23840 2013-08-22] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-16] (Qualcomm Atheros Communications, Inc.) S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.) R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-05] (Kaspersky Lab ZAO) S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) S3 hwusb_cdcacm; C:\Windows\system32\DRIVERS\ew_cdcacm.sys [121728 2013-08-22] (Huawei Technologies Co., Ltd.) S3 hwusb_wwanecm; C:\Windows\system32\DRIVERS\ew_wwanecm.sys [375040 2013-08-22] (Huawei Technologies Co., Ltd.) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-09-11] (Kaspersky Lab ZAO) R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO) R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [79752 2015-12-01] (AO Kaspersky Lab) R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [78200 2015-12-01] (AO Kaspersky Lab) S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [30328 2015-06-24] (Kaspersky Lab) R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [182664 2015-12-11] (AO Kaspersky Lab) R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [237912 2016-12-02] (AO Kaspersky Lab) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [992600 2016-08-28] (AO Kaspersky Lab) R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [51288 2016-05-05] (AO Kaspersky Lab) R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [52608 2015-11-11] (AO Kaspersky Lab) R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [45960 2015-12-07] (AO Kaspersky Lab) R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [87984 2016-08-28] (AO Kaspersky Lab) R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [110424 2016-08-28] (AO Kaspersky Lab) R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [194440 2015-12-02] (AO Kaspersky Lab) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-04] (Intel Corporation) S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.) S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [69264 2013-08-07] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.) S3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1936088 2013-07-31] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-22] (Synaptics Incorporated) S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider) S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [34760 2013-08-22] (Microsoft Corporation) S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [265056 2013-08-22] (Microsoft Corporation) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124256 2013-08-22] (Microsoft Corporation) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-20 00:44 - 2017-02-20 00:45 - 00020520 _____ C:\Users\Anna\Desktop\FRST.txt 2017-02-20 00:43 - 2017-02-20 00:44 - 00000000 ____D C:\FRST 2017-02-20 00:42 - 2017-02-20 00:42 - 00380928 _____ C:\Users\Anna\Desktop\e195320j.exe 2017-02-20 00:41 - 2017-02-20 00:41 - 02422784 _____ (Farbar) C:\Users\Anna\Desktop\FRST64.exe 2017-02-20 00:33 - 2017-02-20 00:43 - 00000038 _____ C:\Users\Anna\Desktop\fixitpc.txt 2017-02-08 10:41 - 2017-02-08 10:41 - 00476400 _____ C:\Users\Anna\Desktop\deklaracja_PIT-11_3640.pdf 2017-02-08 10:36 - 2017-02-08 10:36 - 00360335 _____ C:\Users\Anna\Downloads\deklaracja_PIT-11_3640.pdf 2017-01-29 12:41 - 2017-02-03 20:10 - 00000000 ____D C:\ProgramData\OnlineUpdate 2017-01-29 12:41 - 2017-01-30 21:20 - 00000000 ____D C:\ProgramData\log ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-20 00:45 - 2016-03-07 09:58 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2017-02-20 00:43 - 2016-11-17 16:21 - 00000000 ____D C:\Users\Anna\AppData\LocalLow\Mozilla 2017-02-20 00:34 - 2016-02-26 02:41 - 00003976 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{04B6CE94-3A52-4C90-8018-C4F75F7EF05F} 2017-02-19 11:24 - 2016-03-07 02:38 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2017-02-19 02:21 - 2016-11-02 10:39 - 00000000 ____D C:\Users\Anna\OneDrive 2017-02-16 15:32 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf 2017-02-16 11:25 - 2013-09-19 18:02 - 02226306 _____ C:\Windows\system32\PerfStringBackup.INI 2017-02-16 11:25 - 2013-08-28 15:28 - 00816386 _____ C:\Windows\system32\perfh015.dat 2017-02-16 11:25 - 2013-08-28 15:28 - 00168634 _____ C:\Windows\system32\perfc015.dat 2017-02-16 11:25 - 2013-08-28 15:19 - 00314438 _____ C:\Windows\system32\perfh00E.dat 2017-02-16 11:25 - 2013-08-28 15:19 - 00064710 _____ C:\Windows\system32\perfc00E.dat 2017-02-15 11:45 - 2016-03-07 09:58 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-02-15 11:45 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-02-15 11:45 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\Macromed 2017-02-09 23:05 - 2016-03-08 18:33 - 00000000 ____D C:\Users\Anna\AppData\Roaming\Skype 2017-02-09 16:09 - 2016-03-07 03:08 - 01249280 ___SH C:\Users\Anna\Desktop\Thumbs.db 2017-02-06 00:50 - 2016-02-26 00:52 - 00000000 ____D C:\Users\Anna 2017-02-03 20:10 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-02-03 10:38 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp 2017-02-01 11:55 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\LiveKernelReports 2017-01-29 12:41 - 2016-11-10 22:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-01-29 11:47 - 2016-11-10 22:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-01-27 15:16 - 2016-03-07 07:31 - 00294912 ___SH C:\Users\Anna\Downloads\Thumbs.db 2017-01-23 17:15 - 2016-02-26 00:58 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2762488165-1568373490-1817202181-1001 ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-05-20 22:14 - 2016-05-20 22:14 - 0000092 _____ () C:\Users\Anna\AppData\Local\fusioncache.dat Niektóre pliki w TEMP: ==================== 2016-04-04 13:05 - 2016-04-12 09:07 - 2152872 _____ (ALLPlayer ) C:\Users\Anna\AppData\Local\Temp\ALLRemote.exe 2016-12-14 19:16 - 2017-01-07 16:14 - 0046592 _____ (Sony DADC Austria AG) C:\Users\Anna\AppData\Local\Temp\drm_dialogs.dll 2007-09-18 13:58 - 2007-09-18 13:58 - 0077160 _____ (Microsoft Corporation) C:\Users\Anna\AppData\Local\Temp\DSETUP.dll 2007-09-18 13:58 - 2007-09-18 13:58 - 1673576 _____ (Microsoft Corporation) C:\Users\Anna\AppData\Local\Temp\dsetup32.dll 2007-09-18 13:58 - 2007-09-18 13:58 - 0503144 _____ (Microsoft Corporation) C:\Users\Anna\AppData\Local\Temp\DXSETUP.exe 2016-07-15 18:16 - 2016-09-09 12:17 - 0185768 _____ (RealNetworks, Inc.) C:\Users\Anna\AppData\Local\Temp\lowproc.exe 2016-04-04 21:52 - 2016-06-04 21:57 - 3821523 _____ (Napisy24.pl ) C:\Users\Anna\AppData\Local\Temp\Napisy24.exe 2016-05-18 11:56 - 2016-05-18 11:56 - 45196928 _____ (Skype Technologies S.A.) C:\Users\Anna\AppData\Local\Temp\SkypeSetup.exe 2016-07-15 18:16 - 2016-09-09 12:18 - 0096496 _____ (RealNetworks, Inc.) C:\Users\Anna\AppData\Local\Temp\stubhelper.dll 2016-05-20 22:50 - 2016-05-20 22:50 - 0015872 _____ ( ) C:\Users\Anna\AppData\Local\Temp\x0vcbqcu.dll 2016-05-20 22:15 - 2016-05-20 22:15 - 0005120 _____ ( ) C:\Users\Anna\AppData\Local\Temp\zyzc7d35.dll 2016-05-20 21:41 - 2007-02-27 22:08 - 0456416 ____R (Macrovision Corporation) C:\Users\Anna\AppData\Local\Temp\_is4357.exe 2016-10-09 13:02 - 2007-02-27 22:08 - 0456416 _____ (Macrovision Corporation) C:\Users\Anna\AppData\Local\Temp\_is457C.exe 2016-07-23 13:29 - 2008-10-24 08:54 - 0455952 ____R (Macrovision Corporation) C:\Users\Anna\AppData\Local\Temp\_is761F.exe 2016-10-25 18:34 - 2006-05-24 18:10 - 0455600 _____ (Macrovision Corporation) C:\Users\Anna\AppData\Local\Temp\_isC47E.exe 2016-07-23 13:10 - 2008-10-29 09:36 - 0455952 ____R (Macrovision Corporation) C:\Users\Anna\AppData\Local\Temp\_isF1BF.exe ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-02-16 23:13 ==================== Koniec FRST.txt ============================