Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja: 26-10-2017 Uruchomiony przez Stas (administrator) STAS-KOMPUTER (28-10-2017 00:54:39) Uruchomiony z C:\Users\Stas\Desktop Załadowane profile: Stas (Dostępne profile: Stas) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) Język: Polski (Polska) Internet Explorer Wersja 9 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\stacsv.exe (AMD) C:\Windows\System32\atieclxx.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\TeamViewer_Service.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe (Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (CyberLink) C:\Program Files\CyberLink\YouCam\YCMMirage.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe (Microsoft Corporation) C:\Windows\System32\dinotify.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe (Malwarebytes) C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-28] (Advanced Micro Devices, Inc.) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [1704028 2013-12-04] (IDT, Inc.) HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\Run: [Facebook Update] => C:\Users\Stas\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2014-12-02] (Facebook Inc.) HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\MountPoints2: {240c18cc-999b-11e3-8ac3-806e6f6e6963} - E:\start.exe HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\MountPoints2: {7830a817-0a7a-11e4-935a-80c16e419071} - F:\iLinker.exe HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\MountPoints2: {ce36efe5-8d8f-11e7-910e-80c16e419071} - F:\autorun.exe HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\MountPoints2: {db3bdd11-e94a-11e3-8882-80c16e419071} - F:\LGAutoRun.exe HKU\S-1-5-21-4113310034-2617919798-1752997-1000\...\MountPoints2: {efd7f91e-307c-11e7-ad75-80c16e419071} - F:\autorun.exe ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{8B43164B-795C-4E75-9C1A-919E788788F5}: [NameServer] 8.8.8.8 Tcpip\..\Interfaces\{8B43164B-795C-4E75-9C1A-919E788788F5}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank HKU\S-1-5-21-4113310034-2617919798-1752997-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2011-06-07] (Advanced Micro Devices) BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2017-10-22] (AO Kaspersky Lab) Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2017-10-22] (AO Kaspersky Lab) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-07] (Advanced Micro Devices) Chrome: ======= CHR DefaultProfile: Default CHR DefaultSearchURL: Default -> hxxps://s6.otomoto.pl/static/otomotopl/naspersclassifieds-regional/verticals-cars-atlas-web-otomotopl/static/img/favicon.ico?v=4 CHR Session Restore: Default -> [funkcja włączona] CHR Profile: C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default [2017-10-28] CHR Extension: (Prezentacje) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-13] CHR Extension: (Dokumenty) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-13] CHR Extension: (Dysk Google) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21] CHR Extension: (YouTube) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25] CHR Extension: (Google Search) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Arkusze) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-13] CHR Extension: (Dokumenty Google offline) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-31] CHR Extension: (Skype) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-08-22] CHR Extension: (Używane Alfa Romeo 159 - 16 500 PLN, ...) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\menclggflcbafeioijcdcngcgnijfbgn [2016-12-14] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-22] CHR Extension: (Gmail) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-05-23] CHR Extension: (Chrome Media Router) - C:\Users\Stas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-09-27] CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 ALG; C:\Windows\System32\alg.exe [59392 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R2 AMD External Events Utility; C:\Windows\system32\atiesrxx.exe [176128 2017-09-01] (AMD) [Brak podpisu cyfrowego] R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2017-09-01] (Advanced Micro Devices, Inc.) [Brak podpisu cyfrowego] S2 AVP16.0.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-12-07] (Kaspersky Lab ZAO) S3 ehRecvr; C:\Windows\ehome\ehRecvr.exe [556544 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 ehSched; C:\Windows\ehome\ehsched.exe [94720 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 Fax; C:\Windows\system32\fxssvc.exe [523264 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R3 MBAMService; C:\Program Files\Malwarebytes\Anti-Malware\mbamservice.exe [4430792 2017-08-07] (Malwarebytes) S3 MSDTC; C:\Windows\System32\msdtc.exe [134144 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 msiserver; C:\Windows\System32\msiexec.exe [73216 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 RpcLocator; C:\Windows\system32\locator.exe [9216 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 SNMPTRAP; C:\Windows\System32\snmptrap.exe [12800 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R2 Spooler; C:\Windows\System32\spoolsv.exe [317440 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S2 sppsvc; C:\Windows\system32\sppsvc.exe [3179520 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R2 STacSV; C:\Program Files\IDT\WDM\STacSV.exe [319570 2013-12-04] (IDT, Inc.) [Brak podpisu cyfrowego] R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [241752 2017-08-24] (Synaptics Incorporated) R2 TeamViewer; C:\Program Files\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-17] (TeamViewer GmbH) S3 TrustedInstaller; C:\Windows\servicing\TrustedInstaller.exe [204800 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 UI0Detect; C:\Windows\system32\UI0Detect.exe [35840 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 vds; C:\Windows\System32\vds.exe [453632 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 VSS; C:\Windows\system32\vssvc.exe [1025536 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 wbengine; C:\Windows\system32\wbengine.exe [1203200 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation) S3 wmiApSrv; C:\Windows\system32\wbem\WmiApSrv.exe [136192 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] R2 WMPNetworkSvc; C:\Program Files\Windows Media Player\wmpnetwk.exe [1121792 2017-09-01] (Microsoft Corporation) [Brak podpisu cyfrowego] ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [73928 2015-03-30] (Advanced Micro Devices) R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [36040 2015-03-30] (Advanced Micro Devices) R0 CD8ABCCD; C:\Windows\System32\drivers\CD8ABCCD.sys [153784 2017-09-01] (Kaspersky Lab ZAO) R0 CD8ABCCD6; C:\Windows\System32\drivers\CD8ABCCD6.sys [153784 2017-05-06] (Kaspersky Lab ZAO) R0 CD8ABCCD61; C:\Windows\System32\drivers\CD8ABCCD61.sys [153784 2017-09-01] (Kaspersky Lab ZAO) R0 CD8ABCCD614; C:\Windows\System32\drivers\CD8ABCCD614.sys [153784 2017-09-01] (Kaspersky Lab ZAO) R0 CD8ABCCD6142; C:\Windows\System32\drivers\CD8ABCCD6142.sys [153784 2017-09-01] (Kaspersky Lab ZAO) R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [201912 2015-07-06] (Kaspersky Lab ZAO) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [153784 2015-06-22] (Kaspersky Lab ZAO) R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [46776 2015-06-06] (Kaspersky Lab ZAO) R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [58224 2015-06-27] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [66976 2017-10-22] (AO Kaspersky Lab) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [147328 2015-12-07] (AO Kaspersky Lab) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [53168 2017-10-22] (AO Kaspersky Lab) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [785328 2017-10-22] (AO Kaspersky Lab) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [44120 2017-10-22] (AO Kaspersky Lab) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [37048 2015-06-06] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [38072 2015-06-07] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [39304 2015-12-07] (AO Kaspersky Lab) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54328 2015-06-11] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [87736 2015-06-16] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [156856 2015-06-23] (Kaspersky Lab ZAO) R3 MBAMSwissArmy; C:\Windows\System32\Drivers\mbamswissarmy.sys [221112 2017-10-28] (Malwarebytes) R3 RSPCIESTOR; C:\Windows\System32\DRIVERS\RtsPStor.sys [299488 2017-05-25] (Realtek Semiconductor Corp.) S3 RTL8192Ce; C:\Windows\System32\DRIVERS\rtl8192Ce.sys [982120 2011-07-19] (Realtek Semiconductor Corporation ) R3 RTWlanE; C:\Windows\System32\DRIVERS\rtwlane.sys [3175128 2015-01-06] (Realtek Semiconductor Corporation ) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-10-28 00:54 - 2017-10-28 00:55 - 000013906 _____ C:\Users\Stas\Desktop\FRST.txt 2017-10-28 00:53 - 2017-10-28 00:53 - 000001629 _____ C:\Users\Stas\Desktop\MWBytes.txt 2017-10-27 17:03 - 2017-10-27 17:03 - 000208657 _____ C:\Users\Stas\Downloads\Sleeper (2).exe 2017-10-27 17:03 - 2017-10-27 17:03 - 000132096 _____ C:\Users\Stas\Downloads\SLEEPER (1).EXE 2017-10-27 17:02 - 2017-10-27 17:02 - 000065536 _____ (Sigma) C:\Users\Stas\Downloads\Sleeper.exe 2017-10-27 16:50 - 2017-10-27 16:51 - 000015939 _____ C:\Users\Stas\Desktop\Fixlog.txt 2017-10-27 16:49 - 2017-10-27 16:49 - 000000000 ____D C:\Users\Stas\Desktop\FRST-OlderVersion 2017-10-27 16:46 - 2017-10-27 16:46 - 008250832 _____ (Malwarebytes) C:\Users\Stas\Downloads\adwcleaner_7.0.3.1.exe 2017-10-27 16:25 - 2017-10-27 16:25 - 000000000 ____D C:\Users\Stas\AppData\Roaming\Synaptics 2017-10-27 16:25 - 2017-10-27 16:25 - 000000000 ____D C:\ProgramData\Synaptics 2017-10-23 00:20 - 2017-10-23 00:20 - 000038148 _____ C:\Users\Stas\Downloads\Shortcut.txt 2017-10-23 00:20 - 2017-10-23 00:20 - 000025403 _____ C:\Users\Stas\Downloads\Addition.txt 2017-10-23 00:19 - 2017-10-23 00:20 - 000028328 _____ C:\Users\Stas\Downloads\FRST.txt 2017-10-23 00:14 - 2017-10-23 00:17 - 000016662 _____ C:\Users\Stas\Desktop\Kaspersky.txt 2017-10-23 00:10 - 2017-10-28 00:54 - 000000000 ____D C:\FRST 2017-10-23 00:09 - 2017-10-27 16:49 - 001799680 _____ (Farbar) C:\Users\Stas\Desktop\FRST.exe 2017-10-23 00:06 - 2017-10-23 00:06 - 000002104 _____ C:\MalwareBytes_22.10.2017_15;00.txt 2017-10-22 23:55 - 2012-08-03 12:49 - 000034800 _____ (CyberLink Corporation) C:\Windows\system32\Drivers\clwvd.sys 2017-10-22 23:54 - 2017-10-22 23:54 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_SynTP_01011.Wdf 2017-10-22 23:54 - 2017-10-22 23:54 - 000000000 ____D C:\Program Files\Synaptics 2017-10-22 23:54 - 2015-01-06 11:41 - 003175128 _____ (Realtek Semiconductor Corporation ) C:\Windows\system32\Drivers\rtwlane.sys 2017-10-22 23:53 - 2017-08-24 03:21 - 001629040 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01011.dll 2017-10-22 23:53 - 2017-08-24 03:21 - 000534616 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys 2017-10-22 23:53 - 2017-08-24 03:21 - 000278104 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo59.dll 2017-10-22 23:53 - 2017-08-24 03:21 - 000228952 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll 2017-10-22 23:53 - 2017-08-24 03:21 - 000050264 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynRMIHID_Aux.sys 2017-10-22 23:53 - 2017-08-24 03:20 - 000428632 _____ (Synaptics Incorporated) C:\Windows\system32\SynCOM.dll 2017-10-22 23:53 - 2017-08-24 03:20 - 000038488 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel_Aux.sys 2017-10-22 23:53 - 2017-08-24 03:20 - 000037464 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_AMDASF_Aux.sys 2017-10-22 23:51 - 2013-12-04 23:32 - 008157184 _____ (IDT, Inc.) C:\Windows\system32\IDTNHP.dll 2017-10-22 23:51 - 2013-12-04 23:32 - 008131584 _____ (IDT, Inc.) C:\Windows\system32\IDTNGUI.exe 2017-10-22 23:51 - 2013-12-04 23:32 - 006164480 _____ (IDT, Inc.) C:\Windows\system32\stlang.dll 2017-10-22 23:51 - 2013-12-04 23:32 - 002233344 _____ (IDT, Inc.) C:\Windows\system32\IDTNX.dll 2017-10-22 23:51 - 2013-12-04 23:32 - 001862656 _____ (IDT, Inc.) C:\Windows\system32\IDTNCPL.cpl 2017-10-22 23:51 - 2013-12-04 23:32 - 001704028 _____ (IDT, Inc.) C:\Windows\sttray.exe 2017-10-22 23:51 - 2013-12-04 23:32 - 000571392 ____N (IDT, Inc.) C:\Windows\system32\stapi32.dll 2017-10-22 23:51 - 2013-12-04 23:32 - 000536576 _____ (IDT, Inc.) C:\Windows\system32\idtmini1.exe 2017-10-22 23:51 - 2013-12-04 23:32 - 000253952 _____ (IDT, Inc.) C:\Windows\system32\IDTNJ.exe 2017-10-22 23:51 - 2012-02-23 14:31 - 000086544 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\AtihdW73.sys 2017-10-22 23:50 - 2017-10-22 23:51 - 000000000 ____D C:\Program Files\IDT 2017-10-22 23:50 - 2017-10-22 23:50 - 000000000 ____D C:\Windows\system32\SRSLabs 2017-10-22 23:49 - 2013-12-04 23:32 - 001478656 _____ (IDT, Inc.) C:\Windows\system32\stapo.dll 2017-10-22 23:49 - 2013-12-04 23:32 - 000459264 _____ (IDT, Inc.) C:\Windows\system32\Drivers\stwrt.sys 2017-10-22 23:49 - 2013-12-04 23:32 - 000454656 _____ (IDT, Inc.) C:\Windows\system32\stcplx.dll 2017-10-22 23:49 - 2013-12-04 23:32 - 000211968 _____ (IDT, Inc.) C:\Windows\system32\st326498.dll 2017-10-22 23:48 - 2015-03-30 03:38 - 000073928 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amd_sata.sys 2017-10-22 23:48 - 2015-03-30 03:38 - 000036040 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amd_xata.sys 2017-10-22 23:46 - 2017-10-22 23:46 - 000000000 ____D C:\Windows\system32\sda 2017-10-22 23:46 - 2017-09-19 01:07 - 000805856 _____ (Realtek ) C:\Windows\system32\Drivers\Rt86win7.sys 2017-10-22 23:46 - 2017-09-19 01:07 - 000109024 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp32.dll 2017-10-22 23:46 - 2017-05-25 04:23 - 009890816 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RsCRIcon.dll 2017-10-22 23:46 - 2017-05-25 04:23 - 003570176 _____ (Realtek Semiconductor Corp.) C:\Windows\RtCRU32.exe 2017-10-22 23:46 - 2017-05-25 04:23 - 000299488 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RtsPStor.sys 2017-10-22 23:46 - 2017-05-25 04:23 - 000074752 _____ (Realtek Semiconductor.) C:\Windows\system32\RtCRX.dll 2017-10-22 23:38 - 2017-10-28 00:26 - 000221112 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys 2017-10-22 23:34 - 2017-10-22 23:45 - 000000000 ____D C:\Users\Stas\Downloads\SDI_R1790 2017-10-22 23:33 - 2017-10-22 23:33 - 004206193 _____ C:\Users\Stas\Downloads\SDI_R1790.zip 2017-10-22 17:15 - 2017-10-22 18:10 - 000000000 ____D C:\Program Files\Common Files\AV 2017-10-22 17:03 - 2017-10-22 17:03 - 000002374 _____ C:\Users\Stas\Desktop\Bezpieczne pieniądze.lnk 2017-10-22 17:02 - 2017-10-22 17:02 - 000002114 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk 2017-10-22 17:02 - 2017-10-22 17:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Internet Security 2017-10-22 17:01 - 2017-10-28 00:25 - 000000000 ____D C:\ProgramData\Kaspersky Lab 2017-10-22 17:01 - 2017-10-22 17:15 - 000785328 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys 2017-10-22 17:01 - 2017-10-22 17:01 - 000000000 ____D C:\Windows\ELAMBKUP 2017-10-22 17:01 - 2017-10-22 17:01 - 000000000 ____D C:\Program Files\Kaspersky Lab 2017-10-22 17:01 - 2015-12-07 19:54 - 000147328 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klflt.sys 2017-10-22 14:54 - 2017-10-22 15:56 - 000002020 _____ C:\Users\Public\Desktop\Malwarebytes.lnk 2017-10-22 14:54 - 2017-10-22 15:56 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes 2017-10-22 14:54 - 2017-10-22 14:54 - 000000000 ____D C:\ProgramData\Malwarebytes 2017-10-22 14:54 - 2017-10-04 13:15 - 000059904 _____ C:\Windows\system32\Drivers\mbae.sys 2017-10-22 14:02 - 2017-10-22 14:02 - 000000000 ____D C:\Program Files\Malwarebytes 2017-10-22 14:00 - 2017-10-22 14:01 - 071535032 _____ (Malwarebytes ) C:\Users\Stas\Downloads\mb3-setup-consumer-3.2.2.2029-1.0.212-1.0.2951.exe 2017-10-22 13:46 - 2016-04-01 20:56 - 162692312 _____ (Kaspersky Lab) C:\kis16.0.0.614pl-pl.exe 2017-10-22 13:46 - 2016-03-31 19:08 - 002892288 _____ (Collective Intelligence forum.ru-board) C:\KRT_5.0.0.112.exe 2017-10-05 09:00 - 2017-10-05 09:00 - 000000940 _____ C:\Windows\system32\Underwear_ white jacket, white bra, white lace, lingerie, white lingerie, sexy lingerie, bralette, lace bralette, top, bra, white, lace bra, pantys, set, lace, white sexy laced, lingerie set, thong, la.lnk 2017-10-05 08:59 - 2017-10-05 08:59 - 000029468 _____ C:\Users\Stas\Desktop\d63f11db414086b96d64c37f4c19 2017-10-05 08:58 - 2017-10-05 08:58 - 000029468 _____ C:\Users\Stas\Desktop\d63f11db414086b96d64c37f4c19 (1) 2017-10-05 08:57 - 2017-10-05 08:57 - 000029468 _____ C:\Users\Stas\Downloads\d63f11db414086b96d64c37f4c19 ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-10-27 23:47 - 2014-12-02 13:59 - 000000924 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4113310034-2617919798-1752997-1000UA.job 2017-10-27 16:59 - 2009-07-14 06:34 - 000021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-10-27 16:59 - 2009-07-14 06:34 - 000021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-10-27 16:52 - 2009-07-14 06:53 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2017-10-27 16:47 - 2017-05-06 17:22 - 000000000 ____D C:\AdwCleaner 2017-10-22 23:55 - 2009-07-14 04:37 - 000000000 ____D C:\Windows\inf 2017-10-22 17:15 - 2015-06-11 19:32 - 000044120 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klim6.sys 2017-10-22 17:14 - 2015-06-06 08:48 - 000066976 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\kldisk.sys 2017-10-22 17:07 - 2014-12-13 22:20 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2017-10-22 17:07 - 2014-12-13 22:20 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2017-10-22 17:07 - 2014-12-13 22:20 - 000000000 ____D C:\Windows\system32\Macromed 2017-10-22 17:05 - 2015-12-07 19:54 - 000053168 _____ (AO Kaspersky Lab) C:\Windows\system32\Drivers\klhk.sys 2017-10-22 16:56 - 2017-05-04 20:59 - 003275928 _____ C:\Windows\ntbtlog.txt 2017-10-22 12:09 - 2009-07-14 01:57 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\taskkill.exe 2017-10-22 12:02 - 2010-11-20 23:29 - 000941568 _____ (Microsoft Corporation) C:\Windows\system32\mblctr.exe 2017-10-22 12:02 - 2009-07-14 01:25 - 000086016 _____ (Microsoft Corporation) C:\Windows\system32\colorcpl.exe 2017-10-22 12:02 - 2009-07-14 01:16 - 000008192 _____ (Microsoft Corporation) C:\Windows\system32\dinotify.exe 2017-10-22 12:02 - 2009-07-14 01:12 - 000097792 _____ (Microsoft Corporation) C:\Windows\system32\BdeUnlockWizard.exe 2017-10-22 12:01 - 2009-07-14 01:41 - 000179712 _____ (Microsoft Corporation) C:\Windows\notepad.exe 2017-10-22 11:30 - 2014-12-02 14:30 - 000000000 ____D C:\Users\Stas\Documents\Youcam 2017-10-22 11:30 - 2014-02-18 22:45 - 000000000 ____D C:\Users\Stas\Documents\My Skype Pictures 2017-10-11 13:22 - 2014-12-02 13:59 - 000000902 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-4113310034-2617919798-1752997-1000Core.job ==================== Pliki w katalogu głównym wybranych folderów ======= 2017-08-30 16:35 - 2017-08-30 16:35 - 000044584 _____ () C:\Users\Stas\AppData\Local\ListHost12.txt 2017-05-06 18:24 - 2017-05-06 18:24 - 000000000 _____ () C:\Users\Stas\AppData\Local\{4D0D53BC-8020-4CFC-A836-98E698BE785C} 2015-10-31 01:43 - 2015-10-31 01:47 - 000000000 _____ () C:\Users\Stas\AppData\Local\{62F2F5BD-6207-4A6C-A538-F4B66EC5732D} 2014-12-30 08:56 - 2014-12-30 08:56 - 000000000 _____ () C:\Users\Stas\AppData\Local\{731C0073-2E7F-456F-833B-84D0784B8759} 2015-01-10 22:03 - 2015-01-10 22:08 - 000000000 _____ () C:\Users\Stas\AppData\Local\{7F3114ED-3D54-4B0F-9987-4E0F99001DD6} 2016-05-30 12:28 - 2016-05-30 12:28 - 000000000 _____ () C:\Users\Stas\AppData\Local\{9FCE8B92-A4F0-4510-9E3D-A51180107852} ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\explorer.exe [2011-05-11 17:31] - [2017-09-01 11:59] - 002616320 _____ (Microsoft Corporation) D8A1D0FE047B04255AA0B5E6C90AF8D3 C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe [2010-11-20 23:29] - [2017-09-01 11:59] - 000026624 _____ (Microsoft Corporation) 22127B5ACD77C1FEE22A0FC936C5A6AE C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-07-25 10:42 ==================== Koniec FRST.txt ============================