Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 19-02-2017
Uruchomiony przez Tomasz (administrator)  TOMASZ-KOMP (20-02-2017 14:44:59)
Uruchomiony z C:\Users\Tomasz\Documents\fiz
Załadowane profile: Tomasz (Dostępne profile: Tomasz)
Platform: Windows 10 Pro Wersja 1607 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Edge)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Datpol) C:\Program Files (x86)\SpyShelter Premium\SpyShelterSrv.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
() C:\Program Files (x86)\HDD Health\HDDHealthService.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCuiL.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe
(IDRIX) C:\Program Files\VeraCrypt\VeraCrypt.exe
(PANTERASoft) C:\Program Files (x86)\HDD Health\hddhealth.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(McAfee, Inc.) C:\Program Files\TrueKey\McTkSchedulerService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(OldTimer Tools) C:\Users\Tomasz\Documents\fiz\OTL_www.INSTALKI.pl.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1702.312.0_x64__8wekyb3d8bbwe\Calculator.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\consent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8838400 2016-06-07] (Realtek Semiconductor)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [176440 2016-11-01] (Apple Inc.)
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe [8027016 2016-11-21] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [WindowsDefender] => C:\Program Files\Windows Defender\MSASCuiL.exe [631808 2016-10-08] (Microsoft Corporation)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-02-24] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595992 2016-05-20] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704512 2015-04-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [61896 2016-12-29] (Avira Operations GmbH & Co. KG)
HKLM\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3639280 2016-04-17] (Electronic Arts)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [5583120 2015-02-26] (Disc Soft Ltd)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [GG] => C:\Users\Tomasz\AppData\Local\GG\Application\gghub.exe [4078144 2015-03-24] (GG Network S.A.)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [Spotify Web Helper] => C:\Users\Tomasz\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1529456 2016-10-02] (Spotify Ltd)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [SpyShelter] => C:\Program Files (x86)\SpyShelter Premium\SpyShelter.exe [3436808 2015-08-28] (Datpol)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [Spotify] => C:\Users\Tomasz\AppData\Roaming\Spotify\Spotify.exe [6795376 2016-10-02] (Spotify Ltd)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [vibranceGUI] => "C:\Users\Tomasz\Desktop\xxx\vibranceGUI\vibrance.GUI.exe" -minimized
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [53130368 2016-05-17] (Skype Technologies S.A.)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\OverwolfLauncher.exe [1057840 2017-02-02] ()
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [IPLA!] => C:\Program Files (x86)\ipla\ipla.exe [21407008 2015-12-09] (Cyfrowy Polsat S.A.)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [VeraCrypt] => C:\Program Files\VeraCrypt\VeraCrypt.exe [3122632 2016-03-19] (IDRIX)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8891608 2016-07-13] (Piriform Ltd)
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\Policies\Explorer: [NoCDBurning] 1
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\...\MountPoints2: {c450fee0-04ca-11e6-8349-10c37b93ee5d} - "D:\cda_menu.exe" 
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HDDHealth.lnk [2016-07-30]
ShortcutTarget: HDDHealth.lnk -> C:\Program Files (x86)\HDD Health\hddhealth.exe (PANTERASoft)
Startup: C:\Users\Tomasz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XenoSuite.lnk [2016-07-30]
ShortcutTarget: XenoSuite.lnk -> C:\Program Files (x86)\XenoBot\XenoSuite.exe ()
GroupPolicy: Ograniczenia <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{f8badc96-3c43-4566-aa17-70a909d5ace0}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131204133273455501&GUID=851C1FCA-E252-403C-9AC7-501F71E62C30
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131204133273498192&GUID=851C1FCA-E252-403C-9AC7-501F71E62C30
HKU\S-1-5-21-2831190625-1651721554-443938107-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131204133273488823&GUID=851C1FCA-E252-403C-9AC7-501F71E62C30
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\S-1-5-21-2831190625-1651721554-443938107-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2831190625-1651721554-443938107-1001 -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\S-1-5-21-2831190625-1651721554-443938107-1001 -> {szukaj.gazeta.pl} URL = hxxp://szukaj.gazeta.pl/internet/0,0.html?slowo={searchTerms}
BHO-x32: True Key Helper -> {0F4B8786-5502-4803-8EBC-F652A1153BB6} -> C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-06-28] (Intel Security)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-06-14] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-06-14] (Oracle Corporation)
Toolbar: HKLM-x32 - True Key - {4BAAC1B8-0800-42C9-8FA6-08B211F356B8} - C:\Program Files\Intel Security\True Key\MSIE\truekey_ie.dll [2016-06-28] (Intel Security)

FireFox:
========
FF DefaultProfile: xbw78oyx.default
FF ProfilePath: C:\Users\Tomasz\AppData\Roaming\Mozilla\Firefox\Profiles\xbw78oyx.default [2016-12-14]
FF Homepage: Mozilla\Firefox\Profiles\xbw78oyx.default -> hxxps://www.malwarebytes.org/restorebrowser/
FF Extension: (Firefox Hotfix) - C:\Users\Tomasz\AppData\Roaming\Mozilla\Firefox\Profiles\xbw78oyx.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-11-27]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-06-14] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-06-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-06-14] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-06-14] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-12-17] (Adobe Systems Inc.)
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\6288C273836FF6654B9197F31585DE336288 [2016-01-10] <==== UWAGA

Chrome: 
=======
CHR DefaultProfile: ChromeDefaultData
CHR Profile: C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-02-20] <==== UWAGA
CHR Extension: (Prezentacje Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-10-08]
CHR Extension: (Dokumenty Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2016-10-08]
CHR Extension: (Dysk Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-08]
CHR Extension: (YouTube) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-10-08]
CHR Extension: (Adblock Plus) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-10-26]
CHR Extension: (Arkusze Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-10-08]
CHR Extension: (Dokumenty Google offline) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-10-09]
CHR Extension: (Flatbook) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\kadbillinepbjlgenaliokdhejdmmlgp [2017-02-17]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-19]
CHR Extension: (Gmail) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-10-08]
CHR Extension: (Chrome Media Router) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-07]
CHR Profile: C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default [2016-10-08]
CHR Extension: (Prezentacje Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-06-19]
CHR Extension: (Dokumenty Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-06-19]
CHR Extension: (Dysk Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-06-19]
CHR Extension: (YouTube) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-06-19]
CHR Extension: (Adblock Plus) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-01]
CHR Extension: (Arkusze Google) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-06-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-06-19]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-01]
CHR Extension: (Gmail) - C:\Users\Tomasz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-06-19]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-04-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-04-09] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-07-04] ()
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [372272 2016-12-29] (Avira Operations GmbH & Co. KG)
S3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1272592 2015-02-26] (Disc Soft Ltd)
R2 HDDHealth; C:\Program Files (x86)\HDD Health\HDDHealthService.exe [17760 2013-03-08] () [Brak podpisu cyfrowego]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.266\McCHSvc.exe [289256 2015-12-02] (McAfee, Inc.)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2119688 2016-04-17] (Electronic Arts)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1318128 2017-02-02] (Overwolf LTD)
S2 PinnacleUpdateSvc; C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe [430080 2011-05-09] (PowerUp Software, LLC) [Brak podpisu cyfrowego]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
S3 Sense; C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe [2889896 2016-10-08] (Microsoft Corporation)
S2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [954048 2014-08-25] (@ByELDI) [Brak podpisu cyfrowego]
R2 SpyShelterSrv; C:\Program Files (x86)\SpyShelter Premium\SpyShelterSrv.exe [45056 2015-08-28] (Datpol) [Brak podpisu cyfrowego]
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.)
R2 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [905672 2016-06-22] (McAfee, Inc.)
R2 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-06-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-06-22] (McAfee, Inc.)
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87728 2013-10-04] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
S2 AdaptiveSleepService; "C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe" [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S0 amdkmafd; C:\WINDOWS\System32\drivers\amdkmafd.sys [23808 2016-06-02] (Advanced Micro Devices, Inc.)
R3 amdkmdag; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmdag.sys [26568848 2017-01-25] (Advanced Micro Devices, Inc.)
R3 amdkmdap; C:\WINDOWS\System32\DriverStore\FileRepository\c0309377.inf_amd64_7ab08912e1e1da0a\atikmpag.sys [536600 2017-01-25] (Advanced Micro Devices, Inc.)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-07-04] ()
R3 AtiHDAudioService; C:\WINDOWS\system32\drivers\AtihdWB6.sys [101376 2016-06-02] (Advanced Micro Devices)
R2 avgntflt; C:\WINDOWS\System32\DRIVERS\avgntflt.sys [128536 2015-04-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [132120 2015-04-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\WINDOWS\system32\DRIVERS\avkmgr.sys [28600 2015-04-09] (Avira Operations GmbH & Co. KG)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30352 2015-03-27] (Disc Soft Ltd)
R2 inpoutx64; C:\WINDOWS\System32\Drivers\inpoutx64.sys [15008 2016-04-12] (Highresolution Enterprises [www.highrez.co.uk])
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
S3 NPF; C:\WINDOWS\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R1 PStrip64; C:\WINDOWS\System32\drivers\pstrip64.sys [13008 2006-09-30] ()
R3 SensorsSimulatorDriver; C:\WINDOWS\System32\drivers\WUDFRd.sys [216064 2016-07-16] (Microsoft Corporation)
R1 Spyshelter; C:\Program Files (x86)\SpyShelter Premium\SpyShelter.sys [1147144 2015-08-28] (SpyShelter) [Brak podpisu cyfrowego]
R1 SpyshelterKb; C:\Program Files (x86)\SpyShelter Premium\SpyshelterKb.sys [167344 2015-08-28] (SpyShelter)
R1 veracrypt; C:\WINDOWS\System32\drivers\veracrypt.sys [198248 2016-03-19] (IDRIX)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 kwroipoc; C:\Users\Tomasz\AppData\Local\Temp\kwroipoc.sys [56584 2017-02-20] (GMER) [Brak podpisu cyfrowego] <==== UWAGA

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-20 14:40 - 2017-02-20 14:44 - 00000000 ____D C:\FRST
2017-02-20 13:39 - 2017-02-20 13:39 - 07352138 _____ C:\Users\Tomasz\Desktop\wirus.zip
2017-02-20 13:39 - 2017-02-20 13:39 - 00000000 ____D C:\Users\Tomasz\Desktop\Nowy folder
2017-02-20 13:33 - 2017-02-20 13:33 - 00002165 _____ C:\Users\Tomasz\Desktop\Avira Free Antivirus Profile Local Hard Disks.LNK
2017-02-20 13:30 - 2017-02-20 13:30 - 00001205 _____ C:\Users\Public\Desktop\Avira Connect.lnk
2017-02-20 13:27 - 2017-02-20 13:27 - 00000000 ____D C:\Users\Tomasz\AppData\Roaming\Avira
2017-02-20 13:21 - 2017-02-20 13:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2017-02-20 13:20 - 2017-02-20 13:30 - 00000000 ____D C:\Program Files (x86)\Avira
2017-02-20 13:20 - 2017-02-20 13:29 - 00000000 ____D C:\ProgramData\Avira
2017-02-20 13:20 - 2015-04-09 15:05 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2017-02-20 13:20 - 2015-04-09 15:05 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2017-02-20 13:20 - 2015-04-09 15:05 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2017-02-05 11:25 - 2017-02-05 11:25 - 00001010 _____ C:\Users\Tomasz\Desktop\autoexec.cfg
2017-02-05 11:20 - 2012-09-08 13:42 - 00000044 _____ C:\Users\Tomasz\Desktop\ai.cfg
2017-01-31 18:45 - 2017-02-01 20:07 - 00000000 ____D C:\Users\Tomasz\Desktop\JPG studniowka Justyny
2017-01-31 18:45 - 2017-01-31 18:46 - 1157349051 _____ C:\Users\Tomasz\Desktop\JPG studniowka Justyny.zip
2017-01-31 17:56 - 2017-01-31 18:35 - 00000000 ____D C:\Users\Tomasz\Desktop\zdj
2017-01-27 15:30 - 2017-01-27 15:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Settings
2017-01-27 15:30 - 2017-01-27 15:30 - 00000000 ____D C:\Program Files\ATI Technologies
2017-01-27 15:30 - 2017-01-27 15:30 - 00000000 ____D C:\Program Files (x86)\AMD
2017-01-26 17:34 - 2017-01-29 13:23 - 00000000 ____D C:\KateBot
2017-01-26 17:17 - 2017-01-26 17:17 - 00000000 ____D C:\Users\Tomasz\AppData\Roaming\PolyLoader 3.0
2017-01-26 16:46 - 2017-01-26 16:46 - 00000000 ____D C:\WINDOWS\LastGood.Tmp
2017-01-25 20:36 - 2016-12-21 08:08 - 00142848 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2017-01-25 20:36 - 2016-12-21 05:44 - 00120320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2017-01-25 01:29 - 2017-01-25 01:29 - 01015832 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxx.dll
2017-01-25 01:29 - 2017-01-25 01:29 - 00130584 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2017-01-25 01:29 - 2017-01-25 01:29 - 00121368 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2017-01-25 01:29 - 2017-01-25 01:29 - 00038424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\detoured.dll
2017-01-25 01:29 - 2017-01-25 01:29 - 00038416 _____ (Microsoft Corporation) C:\WINDOWS\system32\detoured.dll

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-20 14:42 - 2017-01-15 11:25 - 00000000 ____D C:\Users\Tomasz\Documents\fiz
2017-02-20 14:07 - 2016-10-08 13:32 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-02-20 13:30 - 2016-10-08 13:37 - 00000000 ____D C:\ProgramData\Package Cache
2017-02-20 13:25 - 2016-10-08 14:01 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-02-20 13:25 - 2016-10-08 13:42 - 00000000 ____D C:\Users\Tomasz
2017-02-20 13:25 - 2015-01-21 11:12 - 00119296 _____ C:\WINDOWS\SysWOW64\zlib.dll
2017-02-19 21:30 - 2014-12-09 02:15 - 00000000 ____D C:\Program Files (x86)\Steam
2017-02-19 16:19 - 2016-07-16 12:47 - 00000000 ____D C:\WINDOWS\AppReadiness
2017-02-18 12:44 - 2016-07-16 12:47 - 00000000 ___HD C:\Program Files\WindowsApps
2017-02-10 21:50 - 2016-01-05 21:50 - 00000000 ____D C:\Program Files (x86)\Overwolf
2017-02-07 21:21 - 2016-10-08 13:37 - 00065536 _____ C:\WINDOWS\system32\spu_storage.bin
2017-02-07 21:21 - 2016-07-16 07:04 - 00262144 _____ C:\WINDOWS\system32\config\BBI
2017-02-06 20:10 - 2015-03-27 19:23 - 00002280 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-02-04 16:47 - 2014-12-09 02:17 - 00000000 ____D C:\ProgramData\AMD
2017-01-31 18:45 - 2015-04-19 20:39 - 00000000 ____D C:\Users\Tomasz\AppData\Roaming\MPC-HC
2017-01-27 15:29 - 2016-10-08 13:37 - 00000000 ____D C:\Program Files\AMD
2017-01-26 21:49 - 2014-12-28 17:47 - 00000000 ____D C:\Users\Tomasz\AppData\Roaming\AMD
2017-01-26 16:47 - 2014-12-09 02:15 - 00000000 ____D C:\AMD
2017-01-26 16:46 - 2016-07-16 12:45 - 00000000 ____D C:\WINDOWS\INF
2017-01-26 16:45 - 2016-07-16 12:36 - 00000000 ____D C:\WINDOWS\CbsTemp
2017-01-25 01:29 - 2016-10-26 00:04 - 09405464 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdvlk64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 07589400 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdvlk32.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 02463256 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amfrt64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 02150928 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amfrt32.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00909336 _____ (AMD) C:\WINDOWS\system32\coinst_16.40.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00768024 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdlvr64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00643096 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdlvr32.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00476696 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00420376 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe
2017-01-25 01:29 - 2016-10-26 00:04 - 00310808 _____ C:\WINDOWS\system32\dgtrayicon.exe
2017-01-25 01:29 - 2016-10-26 00:04 - 00293400 _____ C:\WINDOWS\system32\GameManager64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00287248 _____ C:\WINDOWS\system32\clinfo.exe
2017-01-25 01:29 - 2016-10-26 00:04 - 00285720 _____ C:\WINDOWS\system32\hsa-thunk64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00266256 _____ C:\WINDOWS\system32\amdgfxinfo64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00248344 _____ C:\WINDOWS\system32\atieah64.exe
2017-01-25 01:29 - 2016-10-26 00:04 - 00239128 _____ C:\WINDOWS\SysWOW64\amdgfxinfo32.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00219672 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00178200 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantle64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00154648 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00147480 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\mantleaxl64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00128536 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00100888 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdmcl64.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00084504 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdmcl32.dll
2017-01-25 01:29 - 2016-10-26 00:04 - 00077848 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\ati2erec.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 01351192 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 01015832 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00541208 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe
2017-01-25 01:29 - 2016-09-13 21:08 - 00305176 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe
2017-01-25 01:29 - 2016-09-13 21:08 - 00258072 _____ C:\WINDOWS\SysWOW64\GameManager32.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00251416 _____ C:\WINDOWS\SysWOW64\hsa-thunk.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00226328 _____ C:\WINDOWS\SysWOW64\atieah32.exe
2017-01-25 01:29 - 2016-09-13 21:08 - 00193560 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00158336 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\aticfx64.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00153112 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantle32.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00145952 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\aticfx32.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00135704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00126488 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\mantleaxl32.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00118800 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atidxx64.dll
2017-01-25 01:29 - 2016-09-13 21:08 - 00107544 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atidxx32.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00488496 _____ C:\WINDOWS\system32\amdmiracast.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00166408 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00162216 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00145872 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00145360 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00130224 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00130216 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll
2017-01-25 01:28 - 2016-10-26 00:05 - 00112328 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll
2017-01-25 01:28 - 2016-09-13 21:08 - 00112336 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll
2017-01-21 11:09 - 2016-12-16 16:33 - 00003284 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-01-21 11:09 - 2016-10-08 14:18 - 00002410 _____ C:\Users\Tomasz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-01-21 11:09 - 2016-10-08 14:18 - 00000000 ___RD C:\Users\Tomasz\OneDrive

==================== Pliki w katalogu głównym wybranych folderów =======

2016-02-01 16:53 - 2016-02-01 16:53 - 0001248 _____ () C:\Program Files (x86)\unins000.dat
2016-02-01 16:53 - 2016-02-01 16:53 - 0685338 _____ () C:\Program Files (x86)\unins000.exe
2016-06-19 16:22 - 2016-06-19 16:22 - 6867968 _____ () C:\Users\Tomasz\AppData\Roaming\agent.dat
2016-06-19 16:22 - 2016-06-19 16:22 - 0128512 _____ () C:\Users\Tomasz\AppData\Roaming\Installer.dat
2016-06-19 16:22 - 2016-06-19 16:22 - 0018432 _____ () C:\Users\Tomasz\AppData\Roaming\Main.dat
2015-10-28 14:40 - 2016-01-11 14:22 - 0006315 _____ () C:\Users\Tomasz\AppData\Roaming\PStrip.bak
2015-10-29 16:51 - 2015-12-30 14:06 - 0007348 _____ () C:\Users\Tomasz\AppData\Roaming\PStrip.bk!
2015-10-29 16:51 - 2016-01-10 15:56 - 0006315 _____ () C:\Users\Tomasz\AppData\Roaming\PStrip.bko
2015-10-28 14:35 - 2016-01-12 15:27 - 0006315 _____ () C:\Users\Tomasz\AppData\Roaming\PStrip.ini
2016-06-19 16:22 - 2016-06-19 16:22 - 1106432 _____ () C:\Users\Tomasz\AppData\Roaming\Tamptax.exe
2016-06-19 16:22 - 2016-06-19 16:22 - 1106432 _____ () C:\Users\Tomasz\AppData\Roaming\Xxx-ozeair.exe
2016-06-19 16:28 - 2016-06-19 16:28 - 0347956 _____ (YellowSend.com) C:\Users\Tomasz\AppData\Local\nsl21E3.tmp
2015-06-14 19:03 - 2015-06-14 19:03 - 0000742 _____ () C:\Users\Tomasz\AppData\Local\recently-used.xbel
2016-10-08 14:22 - 2016-10-08 14:22 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\Tomasz\handling.dat


Niektóre pliki w TEMP:
====================
2017-02-20 13:27 - 2017-02-20 13:28 - 0000000 ____D () C:\Users\Tomasz\AppData\Local\Temp\avgnt.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-02-13 17:03

==================== Koniec  FRST.txt ============================