Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 05-03-2017
Uruchomiony przez Mirek (administrator)  MIREK-KOMPUTER (07-03-2017 11:58:29)
Uruchomiony z C:\Users\Mirek\Desktop
Załadowane profile: Mirek (Dostępne profile: Mirek)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: "C:\Program Files\Slimjet\slimjet.exe" -- "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodag.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe
(AO Kaspersky Lab) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksdeui.exe
(FlashPeak Inc.) C:\Program Files\Slimjet\slimjet.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3943535618-2626824538-4139708788-1000\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
HKU\S-1-5-21-3943535618-2626824538-4139708788-1000\...\Run: [Kaspersky Software Updater] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
HKU\S-1-5-21-3943535618-2626824538-4139708788-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11264 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2015-09-23] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 89.231.1.206 217.172.224.160
Tcpip\..\Interfaces\{48188A37-9907-46F0-AF72-9471DF6A6459}: [DhcpNameServer] 89.231.1.206 217.172.224.160

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-3943535618-2626824538-4139708788-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3943535618-2626824538-4139708788-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-21-3943535618-2626824538-4139708788-1000 -> {D995AF07-47AF-444A-AC2D-ECCB6BE12E64} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-03-03] (AO Kaspersky Lab)
BHO-x32: Kaspersky Protection -> {2E38825B-8815-42CF-9126-C58BC28D4591} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\IEExt\ie_plugin.dll [2017-03-03] (AO Kaspersky Lab)
Toolbar: HKLM - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\x64\IEExt\ie_plugin.dll [2017-03-03] (AO Kaspersky Lab)
Toolbar: HKLM-x32 - Kaspersky Protection Toolbar - {093F479D-712E-46CD-9E06-62E734A05F68} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\IEExt\ie_plugin.dll [2017-03-03] (AO Kaspersky Lab)
DPF: HKLM-x32 {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1474070959411

FireFox:
========
FF DefaultProfile: 7y2wdki1.default
FF ProfilePath: C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default [2017-03-02]
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\7y2wdki1.default -> Yahoo!
FF Homepage: Mozilla\Firefox\Profiles\7y2wdki1.default -> hxxps://accounts.google.com/ServiceLogin?service=mail&continue=hxxps://mail.google.com/mail/&hl=pl
FF Extension: (Owl - For comfortable reading) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\@owl-comfortable-reading-addon.xpi [2016-05-27]
FF Extension: (Metal Lion Customise Palette) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\customizepalette@srazzano.com.xpi [2016-12-02]
FF Extension: (cyscon Security Shield) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\cyscon-phishing-protection@patugo.com.xpi [2016-04-22]
FF Extension: (Element Hiding Helper for Adblock Plus) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\elemhidehelper@adblockplus.org.xpi [2016-10-27]
FF Extension: (Ghostery) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\firefox@ghostery.com.xpi [2016-12-02]
FF Extension: (Fox Web Security) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\s3fox@security.xpi [2016-12-19]
FF Extension: (Beyond Australis) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\thefoxonlybetter@quicksaver.xpi [2016-12-02]
FF Extension: (WOT) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-12-11]
FF Extension: (Adblock Plus) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-25]
FF Extension: (Metal Lion Australis Tiger) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\{F3400BAB-1070-4345-99FE-15B150454840}.xpi [2016-12-02] [Brak podpisu cyfrowego]
FF Extension: (Metal Lion Australis Scrollbars II) - C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\Extensions\{FDBAD97E-A258-4fe3-9CF6-60CF386C4422}.xpi [2016-12-02]
FF SearchPlugin: C:\Users\Mirek\AppData\Roaming\Mozilla\Firefox\Profiles\7y2wdki1.default\searchplugins\dobreprogramypl.xml [2015-11-18]
FF HKLM\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Extension: (Kaspersky Protection) - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi [2017-03-03]
FF HKLM-x32\...\Firefox\Extensions: [light_plugin_F6F079488B53499DB99380A7E11A93F6@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\FFExt\light_plugin_firefox\addon.xpi
FF Plugin: @cuminas.jp/DjVuPlugin -> C:\Program Files\Cuminas\Document Express DjVu Plug-in\npdjvu.dll [2015-05-08] (Cuminas Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @cuminas.jp/DjVuPlugin -> C:\Program Files (x86)\Cuminas\Document Express DjVu Plug-in\npdjvu.dll [2015-05-08] (Cuminas Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib
CHR HKLM-x32\...\Chrome\Extension: [fhoibnponjcgjgcnfacekaijdbbplhib] - hxxps://chrome.google.com/webstore/detail/fhoibnponjcgjgcnfacekaijdbbplhib

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 AVP17.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\avp.exe [241544 2016-06-28] (AO Kaspersky Lab)
S3 klvssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 17.0.0\x64\vssbridge64.exe [77328 2016-06-28] (AO Kaspersky Lab)
R2 KSDE1.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Secure Connection 1.0\ksde.exe [241544 2016-06-28] (AO Kaspersky Lab)
S2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [1556448 2015-12-15] (AO Kaspersky Lab)
S3 ksu; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Software Updater\kl_platf.exe [1565000 2016-11-26] (AO Kaspersky Lab)
S3 NBService; C:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe [774144 2007-01-15] (Nero AG) [Brak podpisu cyfrowego]
S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [266240 2007-01-15] (Nero AG) [Brak podpisu cyfrowego]
R2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [3636936 2016-02-15] (O&O Software GmbH)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HPSLPSVC; C:\Users\Mirek\AppData\Local\Temp\7zS4644\hpslpsvc64.dll [X] <==== UWAGA

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [238936 2016-06-10] (AO Kaspersky Lab)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [554416 2016-06-02] (AO Kaspersky Lab)
R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [63920 2016-06-07] (AO Kaspersky Lab)
R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [86352 2016-06-15] (AO Kaspersky Lab)
R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [78216 2016-05-31] (AO Kaspersky Lab)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [189264 2016-06-26] (AO Kaspersky Lab)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [305496 2016-09-08] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [1036512 2017-03-03] (AO Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [57936 2017-03-03] (AO Kaspersky Lab)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [52144 2016-05-19] (AO Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [41648 2015-06-07] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [45488 2016-05-31] (AO Kaspersky Lab)
R3 kltap; C:\Windows\System32\DRIVERS\kltap.sys [52152 2016-06-07] (The OpenVPN Project)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [75696 2016-05-17] (AO Kaspersky Lab)
R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [134880 2017-03-03] (AO Kaspersky Lab)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [194480 2016-06-14] (AO Kaspersky Lab)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-03-07 11:58 - 2017-03-07 11:58 - 00012405 _____ C:\Users\Mirek\Desktop\FRST.txt
2017-03-07 11:26 - 2017-03-07 11:26 - 00003803 _____ C:\Users\Mirek\Desktop\3058131.perl
2017-03-07 11:18 - 2017-03-07 11:18 - 00003803 _____ C:\Users\Mirek\Desktop\GMER.txt
2017-03-07 10:30 - 2017-03-07 10:30 - 00380928 _____ C:\Users\Mirek\Desktop\8mytdwsk.exe
2017-03-07 10:23 - 2017-03-07 10:23 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Mirek\Desktop\SPTDinst-v189-x64.exe
2017-03-07 10:12 - 2017-03-07 10:12 - 00000000 ____D C:\Users\Mirek\Desktop\Nowy folder
2017-03-05 20:26 - 2017-03-05 20:26 - 00020670 _____ C:\Users\Mirek\Desktop\272261
2017-03-05 19:42 - 2017-03-07 11:58 - 00000000 ____D C:\FRST
2017-03-05 18:07 - 2017-03-05 18:07 - 02423808 _____ (Farbar) C:\Users\Mirek\Desktop\FRST64.exe
2017-03-05 17:56 - 2017-03-05 17:56 - 01189400 _____ ( ) C:\Users\Mirek\Desktop\RKill-39918-dp.exe
2017-03-05 17:22 - 2017-03-05 17:22 - 00602112 _____ (OldTimer Tools) C:\Users\Mirek\Desktop\OTL.exe
2017-03-05 16:30 - 2017-03-05 16:44 - 00000000 ____D C:\ComboFix
2017-03-05 16:30 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2017-03-05 16:30 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2017-03-05 16:30 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2017-03-05 16:30 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2017-03-05 16:30 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2017-03-05 16:30 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2017-03-05 16:30 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2017-03-05 16:30 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2017-03-05 16:29 - 2017-03-05 16:41 - 00000000 ____D C:\Windows\erdnt
2017-03-05 16:29 - 2017-03-05 16:30 - 00000000 ____D C:\Qoobox
2017-03-05 15:33 - 2017-03-05 15:33 - 00077699 _____ C:\Users\Mirek\Desktop\foo_dsp_multiresampler.fb2k-component
2017-03-05 15:15 - 2017-03-05 15:15 - 00001142 _____ C:\Users\Mirek\Desktop\ASIO4ALL v2 Instruction Manual.lnk
2017-03-05 15:15 - 2017-03-05 15:15 - 00000000 ____D C:\Program Files (x86)\ASIO4ALL v2
2017-03-05 14:58 - 2017-03-05 14:58 - 00186514 _____ C:\Users\Mirek\Desktop\foo_out_asio.fb2k-component
2017-03-05 14:36 - 2017-03-05 14:36 - 18532048 _____ C:\Users\Mirek\Desktop\StealthAudioPlayer_0.2.3.zip
2017-03-05 14:25 - 2017-03-05 14:25 - 03958405 _____ (foobar2000.org) C:\Users\Mirek\Desktop\foobar2000_v1.3.14 (1).exe
2017-03-05 14:21 - 2017-03-05 14:22 - 05660168 ____R (Swearware) C:\Users\Mirek\Desktop\ComboFix.exe
2017-03-05 13:25 - 2017-03-05 13:25 - 00007878 _____ C:\Users\Mirek\Desktop\rebuilt.nauka i hipoteza epub.zip
2017-03-05 13:24 - 2017-03-05 13:25 - 00007876 _____ C:\Users\Mirek\Desktop\nauka i hipoteza epub.zip
2017-03-03 20:53 - 2017-03-03 20:53 - 00000000 ____D C:\Program Files\Common Files\AV
2017-03-03 20:50 - 2017-03-03 20:58 - 00001382 _____ C:\Users\Public\Desktop\Kaspersky Secure Connection.lnk
2017-03-03 20:50 - 2017-03-03 20:50 - 00002169 _____ C:\Users\Public\Desktop\Bezpieczne pieniądze.lnk
2017-03-03 20:50 - 2017-03-03 20:50 - 00002119 _____ C:\Users\Public\Desktop\Kaspersky Total Security.lnk
2017-03-03 20:50 - 2017-03-03 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Total Security
2017-03-03 20:50 - 2017-03-03 20:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Secure Connection
2017-03-03 20:49 - 2017-03-03 20:56 - 01036512 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys
2017-03-03 20:49 - 2017-03-03 20:49 - 00000000 ____D C:\Windows\ELAMBKUP
2017-03-03 20:49 - 2016-09-08 13:18 - 00305496 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys
2017-03-03 20:49 - 2016-06-26 15:10 - 00189264 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klflt.sys
2017-03-03 20:49 - 2013-05-06 08:13 - 00110176 _____ (Kaspersky Lab ZAO) C:\Windows\system32\klfphc.dll
2017-03-03 16:39 - 2017-03-03 16:41 - 180033504 _____ (Kaspersky Lab) C:\Users\Mirek\Desktop\kts17.0.0.611pl-pl_full.exe
2017-02-20 13:15 - 2017-02-20 13:15 - 00001237 _____ C:\Users\Public\Desktop\Kaspersky Software Updater.lnk
2017-02-20 13:15 - 2017-02-20 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Software Updater
2017-02-20 13:15 - 2017-02-20 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2017-02-20 13:15 - 2017-02-20 13:14 - 00001055 ____H C:\Users\Public\Desktop\Kaspersky Security Scan.lnk
2017-02-20 13:14 - 2017-03-07 11:56 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2017-02-20 13:14 - 2017-03-03 20:50 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2017-02-20 13:11 - 2017-03-05 12:12 - 00000000 ____D C:\ProgramData\Kaspersky Lab Setup Files
2017-02-20 13:10 - 2017-02-20 13:11 - 02671128 _____ (Kaspersky Lab) C:\Users\Mirek\Desktop\kss16.0.0.1344en_ru_de_fr_es_it_zh-hans_pl_tr_nl_cs_ko_id_pt_ar_vi_hi_zh-hant_fa_10519.exe
2017-02-11 17:45 - 2017-02-11 17:45 - 50400176 _____ C:\Users\Mirek\Desktop\360TS_Setup_9.0.0.1117.exe

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-03-07 11:54 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-03-07 11:54 - 2009-07-14 05:45 - 00009936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-03-07 11:54 - 2009-07-14 05:45 - 00009936 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-03-07 11:20 - 2015-09-23 12:51 - 00000000 ____D C:\Users\Mirek\AppData\Local\ElevatedDiagnostics
2017-03-07 11:20 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2017-03-07 10:19 - 2016-05-14 17:52 - 00000000 ____D C:\Program Files (x86)\Elaborate Bytes
2017-03-05 16:41 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2017-03-05 16:27 - 2015-09-22 21:09 - 00000000 ____D C:\Users\Mirek\AppData\Roaming\foobar2000
2017-03-05 15:15 - 2016-02-10 20:15 - 00000000 ____D C:\Users\Mirek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASIO4ALL v2
2017-03-03 20:55 - 2016-09-08 13:18 - 00134880 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klwtp.sys
2017-03-03 20:55 - 2016-09-08 13:18 - 00057936 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klim6.sys
2017-03-03 20:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-03-03 16:23 - 2016-04-04 14:30 - 00000000 ____D C:\Program Files\Slimjet
2017-03-01 16:22 - 2016-01-14 12:53 - 00000000 ___RD C:\Users\Mirek\Documents\Scanned Documents
2017-02-25 21:52 - 2015-09-26 14:23 - 00000000 ____D C:\Program Files (x86)\360
2017-02-25 11:10 - 2015-10-08 10:37 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-02-11 17:00 - 2015-09-26 14:30 - 00000000 ____D C:\$360Section
2017-02-11 17:00 - 2015-09-26 14:27 - 00000000 ____D C:\ProgramData\360Quarant
2017-02-11 13:12 - 2016-04-26 12:52 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

==================== Pliki w katalogu głównym wybranych folderów =======

2015-09-22 21:06 - 2015-09-22 21:06 - 0007604 _____ () C:\Users\Mirek\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe
[2015-09-24 22:42] - [2011-01-16 01:01] - 0389632 ____A (Microsoft Corporation) 81257415084B84F3C0D95C381A8D4C8F

C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll
[2015-12-11 12:01] - [2011-01-16 01:01] - 1008640 ____A (Microsoft Corporation) 0B864E15A0BADFF0E7BB8B59009FDDCF

C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-03-02 17:20

==================== Koniec  FRST.txt ============================