Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 15-03-2017 Uruchomiony przez Kacper (administrator) KACPER-KOMPUTER (08-04-2017 16:22:37) Uruchomiony z C:\Users\Kacper\Desktop Załadowane profile: Kacper (Dostępne profile: Kacper & Administrator) Platform: Windows 7 Ultimate (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: "C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe" -- "%1") Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\WTabletServiceCon.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe () C:\ProgramData\Logic Handler\set.exe () C:\FRST\Quarantine\C\ProgramData\service.exe.xBAD (Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe () C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe () C:\Program Files (x86)\UCBrowser\Application\UCService.exe (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.3.1.1\WsAppService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe (Wacom Technology) C:\Program Files\Tablet\Pen\WacomHost.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe (Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe () C:\Users\Kacper\AppData\Roaming\Browser-Security\s768.exe (PC Remote) C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe (Flux Software LLC) C:\Users\Kacper\AppData\Local\FluxSoftware\Flux\flux.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe () C:\Users\Kacper\AppData\Local\Temp\00008959\msiql.exe (Nero AG) C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe () C:\Program Files (x86)\Bamboo Dock\BambooCore.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (Disc Soft Ltd) D:\DAEMON Tools Lite\DiscSoftBusService.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe () C:\Program Files (x86)\UCBrowser\Application\6.0.1471.913\UCAgent.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [NvMediaCenter] => RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation) HKLM-x32\...\Run: [BambooCore] => C:\Program Files (x86)\Bamboo Dock\BambooCore.exe [646744 2012-10-16] () HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1273448 2012-04-03] (CANON INC.) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [Steam] => D:\Steam\steam.exe [3019552 2017-03-23] (Valve Corporation) HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [DAEMON Tools Lite Automount] => D:\DAEMON Tools Lite\DTAgent.exe [4289728 2016-04-12] (Disc Soft Ltd) HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] => C:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe [143360 2006-12-23] (Nero AG) HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [safe_urls768] => C:\Users\Kacper\AppData\Roaming\Browser-Security\s768.exe [2548944 2016-06-20] () HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [Wondershare Helper Compact.exe] => "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelperSetup.exe" HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [PC Remote Server] => C:\Program Files (x86)\PC Remote\PC Remote\PCRemote.exe [1190648 2014-10-12] (PC Remote) HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [f.lux] => C:\Users\Kacper\AppData\Local\FluxSoftware\Flux\flux.exe [1024240 2016-12-06] (Flux Software LLC) HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [msiql] => C:\Users\Kacper\AppData\Local\Temp\00008959\msiql.exe [2072064 2017-04-08] () <===== UWAGA HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [svchost0] => "C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe"\UUC0789.exe HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [osmsg] => C:\ProgramData\WindowsMsg\chrome.exe /AUTORUN HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\Run: [apphide] => C:\Program Files (x86)\ttt\uc.exe [139350 2017-04-05] () HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\MountPoints2: G - G:\autorun.exe HKU\S-1-5-21-730243133-2252115748-3518476468-1000\...\MountPoints2: {a706f2be-51a9-11e6-8932-c053b03e57f7} - F:\Startme.exe HKLM\...\Providers\zy7w25lt: C:\Program Files (x86)\Coasuent Monitor\local64spl.dll [307200 2017-04-08] () AppInit_DLLs: C:\ProgramData\Quotenamron\Vilala.dll => Brak pliku AppInit_DLLs-x32: C:\ProgramData\Quotenamron\Zimlax.dll => Brak pliku ShellExecuteHooks: Brak nazwy - {2D5D8F5C-1485-11E7-A215-64006A5CFC23} - C:\Users\Kacper\AppData\Roaming\Coehaplahaph\Ganagfory.dll -> Brak pliku ShellExecuteHooks: Brak nazwy - {5F51FFFE-7463-4220-B711-E5B9ACB8EDFE} - C:\ProgramData\igfxDH.dll [1062400 2017-04-06] () ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} => C:\Program Files\żěŃą\X64\KZipShell.dll [2017-04-08] () Startup: C:\Users\Kacper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xfire.lnk [2016-12-23] ShortcutTarget: Xfire.lnk -> C:\Program Files (x86)\Xfire\Xfire.exe (Xfire Inc.) GroupPolicyScripts: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{93854431-57D1-47E4-8E67-F0A94C40002A}: [NameServer] 82.163.142.8,95.211.158.136 Tcpip\..\Interfaces\{93854431-57D1-47E4-8E67-F0A94C40002A}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKU\S-1-5-21-730243133-2252115748-3518476468-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms} HKU\S-1-5-21-730243133-2252115748-3518476468-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.wp.pl/?dp2=20161108 HKU\S-1-5-21-730243133-2252115748-3518476468-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://www.bing.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-730243133-2252115748-3518476468-1000 -> DefaultScope {ielnksrch} URL = hxxp://www.bing.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-730243133-2252115748-3518476468-1000 -> {ielnksrch} URL = hxxp://www.bing.com/search?q={searchTerms} BHO: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.) BHO-x32: AcroIEHlprObj Class -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> D:\Pinacle\Adobe Reader\Reader\ActiveX\AcroIEHelper.dll [2003-11-03] (Adobe Systems Incorporated) BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2016-02-23] (CANON INC.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation) Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2016-02-23] (CANON INC.) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: rlw29mzz.default FF ProfilePath: C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\rlw29mzz.default\Profiles\rlw29mzz.default [nie znaleziono] FF ProfilePath: C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default [2017-04-08] FF user.js: detected! => C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default\user.js [2016-09-18] FF NewTab: Mozilla\Firefox\Profiles\rlw29mzz.default -> FF Homepage: Mozilla\Firefox\Profiles\rlw29mzz.default -> about:home FF Extension: (AdBlocker Ultimate) - C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default\Extensions\adblockultimate@adblockultimate.net.xpi [2016-12-28] FF Extension: (Browser-Security) - C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default\Extensions\firefox@browser-security.de.xpi [2016-09-21] FF Extension: (Dark YouTube Theme) - C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default\Extensions\jid1-hDf2iQXGiUjzGQ@jetpack.xpi [2017-01-18] FF Extension: (Disable Prefetch) - C:\Users\Kacper\AppData\Roaming\Mozilla\Firefox\Profiles\rlw29mzz.default\features\{10a0dd73-7ce0-44de-9fc9-e3b15ee14754}\disable-prefetch@mozilla.org.xpi [2017-04-04] FF Extension: (Site Deployment Checker) - C:\Program Files (x86)\Mozilla Firefox\browser\features\deployment-checker@mozilla.org.xpi [2017-03-28] [Brak podpisu cyfrowego] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_25_0_0_127.dll [2017-03-15] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin: @wacom.com/wtPlugin,version=2.1.0.2 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-05-23] (Wacom) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_25_0_0_127.dll [2017-03-15] () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.2 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2012-05-23] (Wacom) FF Plugin HKU\S-1-5-21-730243133-2252115748-3518476468-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [Brak pliku] FF Plugin HKU\S-1-5-21-730243133-2252115748-3518476468-1000: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2012-05-23] (Wacom) Chrome: ======= CHR DefaultProfile: ChromeDefaultData CHR HomePage: ChromeDefaultData -> hxxp://www.initialpage123.com/?z=db7e005d0d3892cb2984bdbgbzft0gaq2z3e3z4m3o&from=wak&uid=SAMSUNGXSP2514N_S08BJ1HL312211&type=hp CHR StartupUrls: ChromeDefaultData -> "hxxp://www.initialpage123.com/?z=db7e005d0d3892cb2984bdbgbzft0gaq2z3e3z4m3o&from=wak&uid=SAMSUNGXSP2514N_S08BJ1HL312211&type=hp" CHR DefaultSearchURL: ChromeDefaultData -> hxxp://www.initialpage123.com/search/?q={searchTerms}&z=db7e005d0d3892cb2984bdbgbzft0gaq2z3e3z4m3o&from=wak&uid=SAMSUNGXSP2514N_S08BJ1HL312211&type=sp CHR DefaultSearchKeyword: ChromeDefaultData -> initialpage123 CHR Profile: C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-04-08] <==== UWAGA CHR Extension: (Prezentacje Google) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-14] CHR Extension: (Dokumenty Google) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-14] CHR Extension: (Dysk Google) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-14] CHR Extension: (YouTube) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-14] CHR Extension: (Arkusze Google) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-14] CHR Extension: (Dokumenty Google offline) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-14] CHR Extension: (SafeFinder Search) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\jidkebcigjgheaahopdnlfaohgnocfai [2016-09-14] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-14] CHR Extension: (Gmail) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-14] CHR Extension: (Chrome Media Router) - C:\Users\Kacper\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-14] CHR HKLM-x32\...\Chrome\Extension: [jidkebcigjgheaahopdnlfaohgnocfai] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1146128 2016-12-06] (AVG Technologies CZ, s.r.o.) R2 backlh; C:\ProgramData\Logic Handler\set.exe [2089472 2016-05-15] () [Brak podpisu cyfrowego] R3 Disc Soft Lite Bus Service; D:\DAEMON Tools Lite\DiscSoftBusService.exe [1443520 2016-04-12] (Disc Soft Ltd) U2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2016-06-09] (Hi-Rez Studios) [Brak podpisu cyfrowego] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego] R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [140456 2012-03-28] () R2 KuaizipUpdateChecker; C:\Program Files\żěŃą\X86\kuaizipUpdateChecker.dll [219032 2017-04-08] () R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [61440 2006-12-14] (Hewlett-Packard Company) [Brak podpisu cyfrowego] R3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) [Brak podpisu cyfrowego] S3 Origin Client Service; D:\Origin\OriginClientService.exe [2120712 2016-04-20] (Electronic Arts) R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [5906704 2017-02-21] (AVG Technologies CZ, s.r.o.) R2 UCBrowserSvc; C:\Program Files (x86)\UCBrowser\Application\UCService.exe [599440 2017-02-15] () R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [56080 2017-02-21] (AVG Technologies CZ, s.r.o.) R2 UxTuneUp; C:\Windows\SysWOW64\uxtuneup.dll [48912 2017-02-21] (AVG Technologies CZ, s.r.o.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.3.1.1\WsAppService.exe [437392 2016-10-10] (Wondershare) S3 WsDrvInst; C:\Program Files (x86)\Wondershare\Dr.Fone for Android\DriverInstall.exe [104248 2015-12-12] (Wondershare) R2 WTabletServiceCon; C:\Program Files\Tablet\Pen\WTabletServiceCon.exe [619904 2012-11-14] (Wacom Technology, Corp.) S2 En9IpgiXoZLe Updater; C:\Program Files (x86)\En9IpgiXoZLe Updater\En9IpgiXoZLe Updater.exe [X] R2 GoogleChromeUpService; C:\ProgramData\service.exe /s GoogleChromeUpService /uid:51504 /local:br [X] <==== UWAGA ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2016-12-23] () [Brak podpisu cyfrowego] R1 cryptfd; C:\Windows\System32\drivers\cryptfd.sys [193448 2017-03-03] () R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-05-29] (Disc Soft Ltd) R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-05-29] (Disc Soft Ltd) R0 flowhlp; C:\Windows\System32\drivers\flowhlp.dat [155168 2017-04-08] () [Brak podpisu cyfrowego] R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92832 2017-04-08] (WinMount International Inc) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43168 2016-05-29] () R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] () S1 PCLEPCI; C:\Windows\SysWOW64\drivers\pclepci.sys [14165 2005-02-09] (Pinnacle Systems GmbH) [Brak podpisu cyfrowego] R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [32304 2016-03-29] (AVG Netherlands B.V.) R1 ucdrv; C:\Program Files (x86)\UCBrowser\Security:ucdrv-x64.sys [25444 ] (UC Web Inc.) <==== UWAGA S1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [132120 2016-10-18] (Oracle Corporation) S3 RTL85n64; system32\DRIVERS\RTL85n64.sys [X] S3 vmci; \SystemRoot\system32\DRIVERS\vmci.sys [X] S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-04-08 16:22 - 2017-04-08 16:22 - 00019107 _____ C:\Users\Kacper\Desktop\FRST.txt 2017-04-08 16:21 - 2017-04-08 16:21 - 00001617 _____ C:\Users\Kacper\Desktop\Fixlog.txt 2017-04-08 16:09 - 2017-04-08 16:08 - 02424832 _____ (Farbar) C:\Users\Kacper\Desktop\FRST64.exe 2017-04-08 16:08 - 2017-04-08 16:21 - 00000000 ____D C:\FRST 2017-04-08 16:05 - 2017-04-08 16:05 - 00000000 _____ C:\Users\Kacper\Desktop\Nowy dokument tekstowy.txt 2017-04-08 11:00 - 2017-04-08 10:42 - 00797672 _____ (深圳市史宾赛科技有限公司) C:\Users\Kacper\AppData\Local\FlowSprit.dll 2017-04-08 11:00 - 2017-04-08 10:42 - 00516072 _____ (深圳市史宾赛科技有限公司) C:\Users\Kacper\AppData\Local\uninst.tmp 2017-04-08 10:55 - 2017-04-08 10:55 - 00003344 ____N C:\bootsqm.dat 2017-04-08 10:42 - 2017-04-08 16:11 - 00003476 _____ C:\Windows\System32\Tasks\UCBrowserSecureUpdater 2017-04-08 10:42 - 2017-04-08 10:42 - 00155168 _____ C:\Windows\system32\Drivers\flowhlp.dat 2017-04-08 10:41 - 2017-04-08 10:56 - 00000000 ____D C:\Program Files (x86)\UCBrowser 2017-04-08 10:41 - 2017-04-08 10:41 - 00000000 ____D C:\Users\Kacper\AppData\Local\UCBrowser 2017-04-08 10:39 - 2017-04-08 10:46 - 00000000 ____D C:\Program Files\żěŃą 2017-04-08 10:39 - 2017-04-08 10:39 - 00092832 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys 2017-04-08 10:39 - 2017-04-08 10:39 - 00000837 _____ C:\Users\Kacper\AppData\Roaming\Microsoft\Windows\Start Menu\żěŃą.lnk 2017-04-08 10:39 - 2017-04-08 10:39 - 00000813 _____ C:\Users\Kacper\Desktop\żěŃą.lnk 2017-04-08 10:39 - 2017-04-08 10:39 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\Softlink 2017-04-08 10:39 - 2017-04-08 10:39 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\KuaiZip 2017-04-08 10:38 - 2017-04-08 10:40 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\UCChannel 2017-04-08 10:38 - 2017-04-08 10:38 - 00000000 __SHD C:\Users\Kacper\AppData\Local\svchost 2017-04-08 10:38 - 2017-04-08 10:38 - 00000000 ____D C:\Users\Kacper\AppData\Local\kemgadeojglibflomicgnfeopkdfflnw 2017-04-08 10:38 - 2017-04-08 10:38 - 00000000 ____D C:\Program Files (x86)\ttt 2017-04-08 10:38 - 2017-04-06 22:56 - 01062400 ___SH C:\ProgramData\igfxDH.dll 2017-04-08 10:36 - 2017-04-08 10:36 - 00021544 _____ C:\Windows\System32\Tasks\En9IpgiXoZLe 2017-04-08 10:36 - 2017-04-08 10:36 - 00000000 ____D C:\Users\Public\Documents\XMUpdate 2017-04-08 10:36 - 2017-04-08 10:36 - 00000000 ____D C:\Users\Kacper\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk 2017-04-08 10:35 - 2017-04-08 10:36 - 00000000 ____D C:\Program Files (x86)\En9IpgiXoZLe 2017-04-08 10:34 - 2017-04-08 10:56 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\Coehaplahaph 2017-04-08 10:34 - 2017-04-08 10:35 - 00000000 ____D C:\Users\Kacper\AppData\Local\Zerkerward 2017-04-08 10:34 - 2017-04-08 10:34 - 00006012 _____ C:\Windows\System32\Tasks\Coasuent Monitor 2017-04-08 10:34 - 2017-04-08 10:34 - 00005054 _____ C:\Windows\System32\Tasks\Shofsy 2017-04-08 10:34 - 2017-04-08 10:34 - 00000000 ____D C:\Program Files (x86)\Zoqusedrerbash 2017-04-08 10:34 - 2017-04-08 10:34 - 00000000 ____D C:\Program Files (x86)\Coasuent Monitor 2017-04-08 09:05 - 2017-04-08 09:05 - 02599473 _____ (AIMP DevTeam) C:\Users\Kacper\Downloads\Ghost_Master.exe 2017-04-07 23:24 - 2017-04-07 23:24 - 00000000 ____D C:\Users\Public\Documents\Ghost Master 2017-04-04 21:03 - 2017-04-04 21:03 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\Canon 2017-03-28 19:23 - 2017-03-28 19:23 - 00000000 ___HD C:\ProgramData\CanonIJQuickMenu 2017-03-28 19:22 - 2017-03-28 19:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon iP7200 series 2017-03-28 19:22 - 2012-04-16 05:00 - 00392192 _____ (CANON INC.) C:\Windows\system32\CNMXLMBA.DLL 2017-03-28 19:21 - 2017-03-28 19:21 - 00000000 ____D C:\ProgramData\Canon IJ Network Tool 2017-03-28 19:20 - 2017-03-28 19:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rejestracja użytkownika drukarki Canon iP7200 series 2017-03-28 19:19 - 2017-03-28 19:19 - 00000000 ____D C:\Users\Kacper\AppData\LocalLow\Canon Easy-WebPrint EX 2017-03-28 19:19 - 2017-03-28 19:19 - 00000000 ____D C:\Program Files\Common Files\CANON 2017-03-28 19:18 - 2017-03-28 19:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities 2017-03-28 19:18 - 2017-03-28 19:19 - 00000000 ____D C:\Program Files\Canon 2017-03-28 19:18 - 2017-03-28 19:18 - 00002021 _____ C:\Users\Public\Desktop\Canon Quick Menu.lnk 2017-03-28 19:18 - 2017-03-28 19:18 - 00000000 ___HD C:\Windows\system32\CanonIJ Uninstaller Information 2017-03-28 19:18 - 2017-03-28 19:18 - 00000000 ___HD C:\ProgramData\CanonBJ 2017-03-28 19:18 - 2017-03-28 19:18 - 00000000 ___HD C:\Program Files\CanonBJ 2017-03-28 19:18 - 2017-03-28 19:18 - 00000000 ____D C:\ProgramData\CanonIJWSpt 2017-03-28 19:18 - 2012-04-16 05:00 - 00389120 _____ (CANON INC.) C:\Windows\system32\CNMLMBA.DLL 2017-03-28 19:17 - 2017-03-28 19:17 - 00000000 ____D C:\Windows\system32\STRING 2017-03-28 19:17 - 2012-03-28 19:01 - 00039424 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL 2017-03-28 19:17 - 2012-03-28 19:00 - 00359936 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL 2017-03-28 19:15 - 2017-04-01 21:37 - 00000000 ____D C:\ProgramData\CanonIJPLM 2017-03-28 19:15 - 2017-03-28 19:15 - 00000000 ___HD C:\ProgramData\CanonIJETV 2017-03-28 19:14 - 2017-03-28 19:23 - 00000000 ____D C:\Program Files (x86)\Canon ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-04-08 16:16 - 2016-05-16 20:06 - 00001195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-04-08 16:16 - 2016-05-16 20:06 - 00001183 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2017-04-08 16:16 - 2016-05-10 15:47 - 00001487 _____ C:\Users\Kacper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2017-04-08 16:16 - 2016-05-10 15:47 - 00001453 _____ C:\Users\Kacper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2017-04-08 16:09 - 2016-05-29 09:49 - 00000000 ____D C:\ProgramData\Avg 2017-04-08 16:07 - 2009-07-14 06:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-04-08 16:07 - 2009-07-14 06:45 - 00010208 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-04-08 16:03 - 2016-11-19 11:09 - 00000000 ____D C:\Users\Kacper\AppData\LocalLow\Mozilla 2017-04-08 16:00 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-04-08 15:49 - 2009-07-14 19:55 - 00737942 _____ C:\Windows\system32\perfh015.dat 2017-04-08 15:49 - 2009-07-14 19:55 - 00154630 _____ C:\Windows\system32\perfc015.dat 2017-04-08 15:49 - 2009-07-14 07:13 - 01663412 _____ C:\Windows\system32\PerfStringBackup.INI 2017-04-08 15:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2017-04-08 10:44 - 2016-05-10 16:02 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2017-04-08 10:26 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\Downloaded Program Files 2017-04-08 00:31 - 2016-05-29 09:26 - 00000000 ____D C:\Users\Kacper\AppData\Roaming\uTorrent 2017-04-07 23:10 - 2016-12-22 19:58 - 00000000 ____D C:\Users\Kacper\AppData\LocalLow\uTorrent 2017-04-07 22:22 - 2016-10-31 14:28 - 00000984 _____ C:\Users\Public\Desktop\AVG.lnk 2017-04-07 22:22 - 2016-05-29 09:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen 2017-04-07 22:21 - 2016-09-20 19:51 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task 2017-04-05 22:10 - 2016-12-06 22:41 - 00003188 _____ C:\Windows\System32\Tasks\OneDrive Standalone Update Task v2 2017-04-05 22:10 - 2016-09-29 18:15 - 00002210 _____ C:\Users\Kacper\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk 2017-04-04 21:05 - 2016-09-29 18:44 - 00000000 ___RD C:\Users\Kacper\Desktop\ZHP 2017-03-29 09:26 - 2016-11-18 23:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-03-29 09:26 - 2016-05-16 20:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-03-15 15:00 - 2016-05-16 20:23 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-03-15 15:00 - 2016-05-16 20:23 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-03-15 15:00 - 2016-05-16 20:23 - 00004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-03-15 15:00 - 2016-05-16 20:23 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-03-15 15:00 - 2016-05-16 20:23 - 00000000 ____D C:\Windows\system32\Macromed 2017-03-10 00:39 - 2017-02-07 19:37 - 00000000 ____D C:\Users\Kacper\AppData\Local\Battle.net 2017-03-09 23:17 - 2017-02-04 12:11 - 00000000 ____D C:\ProgramData\Corel ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-06-06 15:05 - 2016-06-06 15:05 - 6863360 _____ () C:\Users\Kacper\AppData\Roaming\agent.dat 2016-06-06 15:05 - 2016-06-06 15:05 - 0067968 _____ () C:\Users\Kacper\AppData\Roaming\Config.xml 2016-06-06 15:04 - 2016-06-06 15:05 - 0014448 _____ () C:\Users\Kacper\AppData\Roaming\InstallationConfiguration.xml 2016-06-06 15:04 - 2016-06-06 15:04 - 0128512 _____ () C:\Users\Kacper\AppData\Roaming\Installer.dat 2016-06-06 15:05 - 2016-06-06 15:05 - 0018432 _____ () C:\Users\Kacper\AppData\Roaming\Main.dat 2016-06-06 15:05 - 2016-06-06 15:04 - 0792064 _____ () C:\Users\Kacper\AppData\Roaming\MathRunzap.exe 2016-06-06 15:05 - 2016-06-06 15:05 - 1757907 _____ () C:\Users\Kacper\AppData\Roaming\MathRunzap.tst 2016-06-06 15:05 - 2016-06-06 15:05 - 0005568 _____ () C:\Users\Kacper\AppData\Roaming\md.xml 2016-06-06 15:05 - 2016-06-06 15:05 - 0126464 _____ () C:\Users\Kacper\AppData\Roaming\noah.dat 2016-06-06 15:05 - 2016-06-06 15:05 - 2279413 _____ () C:\Users\Kacper\AppData\Roaming\Opeex.bin 2016-06-06 15:05 - 2016-06-06 15:05 - 0032038 _____ () C:\Users\Kacper\AppData\Roaming\uninstall_temp.ico 2016-06-09 13:39 - 2016-06-09 13:39 - 0004608 _____ () C:\Users\Kacper\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2017-04-08 11:00 - 2017-04-08 10:42 - 0797672 _____ (深圳市史宾赛科技有限公司) C:\Users\Kacper\AppData\Local\FlowSprit.dll 2017-03-06 00:01 - 2017-03-06 00:01 - 0026277 _____ () C:\Users\Kacper\AppData\Local\recently-used.xbel 2017-03-02 20:43 - 2017-03-02 20:43 - 0000017 _____ () C:\Users\Kacper\AppData\Local\resmon.resmoncfg 2017-04-08 11:00 - 2017-04-08 10:42 - 0516072 _____ (深圳市史宾赛科技有限公司) C:\Users\Kacper\AppData\Local\uninst.tmp 2017-04-08 10:38 - 2017-04-06 22:56 - 1062400 ___SH () C:\ProgramData\igfxDH.dll 2016-06-08 18:25 - 2016-06-08 18:26 - 0002354 _____ () C:\ProgramData\__wdump.txt Pliki do przeniesienia lub usunięcia: ==================== C:\Users\Kacper\AppData\Local\Temp\00008959\msiql.exe C:\ProgramData\igfxDH.dll C:\Windows\Tasks\{2CD4C103-6F92-5EA9-C790-6A2FBDD8D73C}.job ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-04-03 18:31 ==================== Koniec FRST.txt ============================