Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 23.08.2018
Uruchomiony przez Michu (administrator)  MICHU-KOMPUTER (06-09-2018 18:02:30)
Uruchomiony z C:\Users\Michu\Desktop
Załadowane profile: Michu (Dostępne profile: Michu)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.17\GoogleCrashHandler64.exe
(Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe
(www.shadowexplorer.com) E:\ShadowExplorer\sesvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe
(Valve Corporation) D:\Steam\Steam.exe
(Spotify Ltd) C:\Users\Michu\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Epic Games, Inc.) D:\BORDNIDE\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(SteelSeries ApS) C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Valve Corporation) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Epic Games, Inc.) D:\BORDNIDE\Epic Games\Launcher\Engine\Binaries\Win64\UnrealCEFSubProcess.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-08-30] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [601424 2018-07-07] (Oracle Corporation)
HKLM-x32\...\RunOnce: [] => [X]
HKLM\SOFTWARE\Policies\Microsoft\Windows Defender: Ograniczenia <==== UWAGA
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4836032 2017-08-14] (Disc Soft Ltd)
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\Run: [Steam] => D:\Steam\steam.exe [3207968 2018-08-29] (Valve Corporation)
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\Run: [Spotify Web Helper] => C:\Users\Michu\AppData\Roaming\Spotify\SpotifyWebHelper.exe [782736 2018-05-13] (Spotify Ltd)
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\Run: [EpicGamesLauncher] => D:\BORDNIDE\Epic Games\Launcher\Portal\Binaries\Win64\EpicGamesLauncher.exe [32973712 2018-07-26] (Epic Games, Inc.)
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-339128542-2538225779-843380110-1000\...\MountPoints2: {9de1ba87-a061-11e8-bb6e-bc5ff4730b3b} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\start-heute.html
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SteelSeries Engine 3.lnk [2018-03-30]
ShortcutTarget: SteelSeries Engine 3.lnk -> C:\Program Files\SteelSeries\SteelSeries Engine 3\SteelSeriesEngine3.exe (SteelSeries ApS)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{4DD3CA32-8D62-40ED-A876-A33C8ADE3833}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_181\bin\ssv.dll [2018-07-21] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_181\bin\jp2ssv.dll [2018-07-21] (Oracle Corporation)
BHO-x32: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2017-08-24] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-21] (Microsoft Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2017-02-23] (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2017-08-15] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: tctou1og.default-1525712636087
FF ProfilePath: C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087 [2018-09-06]
FF Extension: (Steam Database) - C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087\Extensions\firefox-extension@steamdb.info.xpi [2018-05-07]
FF Extension: (Honey) - C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087\Extensions\jid1-93CWPmRbVPjRQA@jetpack.xpi [2018-07-15]
FF Extension: (Avast SafePrice) - C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087\Extensions\sp@avast.com.xpi [2018-07-26]
FF Extension: (Avast Online Security) - C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087\Extensions\wrc@avast.com.xpi [2018-05-25]
FF Extension: (Adblock Plus) - C:\Users\Michu\AppData\Roaming\Mozilla\Firefox\Profiles\tctou1og.default-1525712636087\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2018-08-30]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_30_0_0_154.dll [2018-08-15] ()
FF Plugin: @java.com/DTPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\dtplugin\npDeployJava1.dll [2018-07-21] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.181.2 -> C:\Program Files\Java\jre1.8.0_181\bin\plugin2\npjp2.dll [2018-07-21] (Oracle Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_30_0_0_154.dll [2018-08-15] ()
FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2017-08-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2018-07-30] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2018-07-30] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-25] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.17\npGoogleUpdate3.dll [2018-07-25] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2018-06-29] (Adobe Systems Inc.)

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\x64\aswidsagenta.exe [7994520 2018-08-30] (AVAST Software)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [322464 2018-08-30] (AVAST Software)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [7211968 2018-08-07] ()
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [2291904 2017-08-14] (Disc Soft Ltd)
S3 EasyAntiCheat; C:\Program Files (x86)\EasyAntiCheat\EasyAntiCheat.exe [774272 2018-03-08] (EasyAntiCheat Ltd)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [764456 2018-07-19] (NVIDIA Corporation)
S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [764456 2018-07-19] (NVIDIA Corporation)
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 sesvc; E:\ShadowExplorer\sesvc.exe [9216 2013-01-02] (www.shadowexplorer.com) [Brak podpisu cyfrowego]
S3 wampapache64; E:\STRONY\WAMP\bin\apache\apache2.4.33\bin\httpd.exe [30720 2018-03-18] (Apache Software Foundation) [Brak podpisu cyfrowego]
S3 wampmariadb64; E:\STRONY\WAMP\bin\mariadb\mariadb10.2.14\bin\mysqld.exe [14550440 2018-03-26] ()
S3 wampmysqld64; E:\STRONY\WAMP\bin\mysql\mysql5.7.21\bin\mysqld.exe [39551488 2017-12-28] () [Brak podpisu cyfrowego]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2016-08-20] (Microsoft Corporation)
R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 
R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugins" -r

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [199712 2018-08-30] (AVAST Software)
R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdrivera.sys [229384 2018-08-30] (AVAST Software)
R0 aswbidsh; C:\Windows\System32\drivers\aswbidsha.sys [201320 2018-08-30] (AVAST Software)
R0 aswblog; C:\Windows\System32\drivers\aswbloga.sys [346664 2018-08-30] (AVAST Software)
R0 aswbuniv; C:\Windows\System32\drivers\aswbuniva.sys [59568 2018-08-30] (AVAST Software)
R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [249016 2018-08-30] (AVAST Software)
S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [46968 2018-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [163272 2018-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\drivers\aswRdr2.sys [111864 2018-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [87904 2018-08-30] (AVAST Software)
R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [1027720 2018-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [467320 2018-09-04] (AVAST Software)
R2 aswStm; C:\Windows\System32\drivers\aswStm.sys [215728 2018-09-05] (AVAST Software)
R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [381560 2018-08-30] (AVAST Software)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-11-02] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2017-11-02] (Disc Soft Ltd)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30656 2018-07-12] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [69544 2018-06-08] (NVIDIA Corporation)
R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [65792 2018-04-24] (NVIDIA Corporation)
R3 ssdevfactory; C:\Windows\System32\DRIVERS\ssdevfactory.sys [46408 2017-06-02] (SteelSeries ApS)
S3 sshid; C:\Windows\System32\DRIVERS\sshid.sys [45928 2017-10-10] (SteelSeries ApS)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-09-06 18:02 - 2018-09-06 18:02 - 000015985 _____ C:\Users\Michu\Desktop\FRST.txt
2018-09-06 18:01 - 2018-09-06 18:02 - 000000000 ____D C:\FRST
2018-09-06 18:01 - 2018-09-06 18:01 - 004047008 _____ (SOSVirus) C:\Users\Michu\Desktop\UsbFix_11.002.exe
2018-09-06 18:01 - 2018-09-06 18:01 - 002413056 _____ (Farbar) C:\Users\Michu\Desktop\FRST64.exe
2018-09-06 18:01 - 2018-09-06 18:01 - 000001887 _____ C:\Users\Michu\Desktop\UsbFix Anti-Malware.lnk
2018-09-06 18:01 - 2018-09-06 18:01 - 000000000 ____D C:\Program Files (x86)\UsbFix
2018-09-06 07:29 - 2018-09-06 07:52 - 000035800 _____ C:\url_setting_definitions.txt
2018-09-06 07:29 - 2018-09-06 07:29 - 000319024 _____ C:\active_protection.txt
2018-09-06 07:29 - 2018-09-06 07:29 - 000020064 _____ C:\Users\Michu\Desktop\123123,.txt
2018-09-06 01:59 - 2018-09-06 01:59 - 000000000 _____ C:\Windows\system32\last.dump
2018-09-06 01:51 - 2018-09-06 01:51 - 000000490 _____ C:\Users\Michu\Desktop\reg.bat
2018-09-06 01:41 - 2018-09-06 01:41 - 000000471 _____ C:\Users\Michu\Desktop\FIX.BAT
2018-09-06 01:40 - 2018-09-06 01:40 - 000000000 ____D C:\Windows\pss
2018-09-06 01:39 - 2018-09-06 01:39 - 000000000 ____D C:\Program Files (x86)\Windows Resource Kits
2018-09-05 20:39 - 2018-09-05 20:39 - 000882680 _____ (Plumbytes Software Lp) C:\Users\Michu\Desktop\antimalwaresetup.exe
2018-09-05 20:31 - 2018-09-05 20:31 - 000605424 _____ (Reimage) C:\Users\Michu\Desktop\ReimageRepair.exe
2018-09-05 20:06 - 2018-09-06 07:25 - 000113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2018-09-05 20:06 - 2018-09-05 20:06 - 000001102 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2018-09-05 20:06 - 2018-09-05 20:06 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2018-09-05 20:06 - 2018-09-05 20:06 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-09-05 20:06 - 2018-09-05 20:06 - 000000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2018-09-05 20:06 - 2015-06-18 08:41 - 000109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2018-09-05 20:06 - 2015-06-18 08:41 - 000063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2018-09-05 20:06 - 2015-06-18 08:41 - 000025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2018-09-05 19:52 - 2018-09-05 19:53 - 024345872 _____ (Malwarebytes Corporation ) C:\Users\Michu\Desktop\mbam-setup.exe
2018-09-05 19:02 - 2018-09-05 19:02 - 000000614 _____ C:\Users\Michu\Desktop\ShadowExplorer.lnk
2018-09-05 19:02 - 2018-09-05 19:02 - 000000000 ____D C:\Users\Michu\AppData\Roaming\www.shadowexplorer.com
2018-09-05 19:02 - 2018-09-05 19:02 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ShadowExplorer
2018-09-05 19:00 - 2018-09-05 19:00 - 000969845 _____ (ShadowExplorer.com ) C:\Users\Michu\Desktop\ShadowExplorer-0.9-setup.exe
2018-09-05 19:00 - 2018-04-03 22:26 - 011385816 _____ (Bitdefender LLC) C:\Users\Michu\Desktop\BDGandCrabDecryptTool.exe
2018-09-05 19:00 - 2018-02-25 15:29 - 000000482 _____ C:\Users\Michu\Desktop\Visit Majorgeeks.website
2018-09-05 18:41 - 2018-09-05 18:41 - 008766889 _____ C:\Users\Michu\Desktop\BDGandCrabDecryptTool.zip
2018-09-05 18:38 - 2018-09-05 18:38 - 000000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2018-09-05 18:36 - 2018-09-05 18:36 - 000001964 _____ C:\Users\Michu\AppData\Roaming\Microsoft\Windows\Start Menu\Avast Passwords.lnk
2018-09-05 18:36 - 2018-09-05 18:36 - 000001940 _____ C:\Users\Michu\Desktop\Avast Passwords.lnk
2018-09-05 18:26 - 2018-09-05 19:55 - 428891132 _____ C:\Users\Michu\Desktop\pl_windows_10_consumer_edition_version_1803_updated_aug_2018_x64_dvd_dffdae15.rar.part
2018-09-05 18:26 - 2018-09-05 18:26 - 000000000 _____ C:\Users\Michu\Desktop\pl_windows_10_consumer_edition_version_1803_updated_aug_2018_x64_dvd_dffdae15.rar
2018-08-30 17:19 - 2018-08-30 17:19 - 000379608 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2018-08-28 20:30 - 2018-08-28 20:30 - 000003004 _____ C:\Users\Michu\AppData\Local\recently-used.xbel
2018-08-28 19:05 - 2018-08-28 19:08 - 000000000 ____D C:\Users\Michu\AppData\Local\gtk-2.0
2018-08-28 18:54 - 2018-08-28 20:45 - 000000000 ____D C:\Users\Michu\AppData\Local\babl-0.1
2018-08-28 18:54 - 2018-08-28 18:54 - 000000000 ____D C:\Users\Michu\AppData\Roaming\GIMP
2018-08-28 18:54 - 2018-08-28 18:54 - 000000000 ____D C:\Users\Michu\AppData\Local\GIMP
2018-08-28 18:54 - 2018-08-28 18:54 - 000000000 ____D C:\Users\Michu\AppData\Local\gegl-0.4
2018-08-28 18:54 - 2018-08-28 18:54 - 000000000 ____D C:\Users\Michu\.cache
2018-08-28 18:52 - 2018-08-28 18:52 - 000000899 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.10.6.lnk
2018-08-28 18:51 - 2018-08-28 18:52 - 000000000 ____D C:\Program Files\GIMP 2
2018-08-15 14:11 - 2018-08-28 19:08 - 000000000 ____D C:\Users\Michu\Desktop\zdjecia

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-09-06 18:01 - 2017-10-28 16:22 - 000111936 _____ C:\Users\Michu\AppData\Local\GDIPFONTCACHEV1.DAT
2018-09-06 17:58 - 2017-10-28 16:01 - 000000000 ____D C:\Users\Michu\AppData\LocalLow\Mozilla
2018-09-06 17:57 - 2018-07-25 20:56 - 000000000 ____D C:\ProgramData\NVIDIA
2018-09-06 17:56 - 2018-07-18 07:49 - 000000000 ____D C:\Users\Michu\AppData\Local\AVAST Software
2018-09-06 17:52 - 2018-01-18 19:47 - 000000388 _____ C:\Windows\Tasks\update-S-1-5-21-339128542-2538225779-843380110-1000.job
2018-09-06 17:52 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-09-06 07:49 - 2018-01-18 19:47 - 000000388 _____ C:\Windows\Tasks\update-sys.job
2018-09-06 07:31 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-09-06 07:31 - 2009-07-14 06:45 - 000026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-09-06 07:25 - 2018-07-25 22:14 - 000003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2018-09-06 07:25 - 2018-07-25 22:14 - 000003354 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2018-09-06 07:25 - 2018-07-25 22:07 - 000003202 _____ C:\Windows\System32\Tasks\micrsofttasker
2018-09-06 07:25 - 2018-07-25 21:20 - 000004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003940 _____ C:\Windows\System32\Tasks\NvBatteryBoostCheckOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003798 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003792 _____ C:\Windows\System32\Tasks\NvTmRepCR3_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003792 _____ C:\Windows\System32\Tasks\NvTmRepCR2_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003792 _____ C:\Windows\System32\Tasks\NvTmRepCR1_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 21:20 - 000003790 _____ C:\Windows\System32\Tasks\NVIDIA GeForce Experience SelfUpdate_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 20:57 - 000003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 20:57 - 000003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 20:57 - 000003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 20:57 - 000003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}
2018-09-06 07:25 - 2018-07-25 20:11 - 000003220 _____ C:\Windows\System32\Tasks\UpdateChecker
2018-09-06 07:25 - 2018-03-14 03:02 - 000004574 _____ C:\Windows\System32\Tasks\Adobe Flash Player NPAPI Notifier
2018-09-06 07:25 - 2018-01-18 19:47 - 000003396 _____ C:\Windows\System32\Tasks\update-sys
2018-09-06 07:25 - 2018-01-18 19:47 - 000003374 _____ C:\Windows\System32\Tasks\update-S-1-5-21-339128542-2538225779-843380110-1000
2018-09-06 07:25 - 2017-12-29 19:46 - 000004424 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2018-09-06 07:25 - 2017-11-19 12:33 - 000000000 ____D C:\Windows\System32\Tasks\AVAST Software
2018-09-06 07:25 - 2017-11-08 21:57 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2018-09-06 07:25 - 2017-10-29 13:45 - 000003870 _____ C:\Windows\System32\Tasks\CCleaner Update
2018-09-06 07:25 - 2017-10-29 13:45 - 000002802 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2018-09-06 01:57 - 2009-07-14 06:45 - 000434800 _____ C:\Windows\system32\FNTCACHE.DAT
2018-09-06 01:45 - 2017-12-20 20:43 - 000457728 ___SH C:\Users\Michu\Desktop\Thumbs.db
2018-09-06 01:33 - 2018-03-12 02:15 - 000000000 ____D C:\Users\Michu\Desktop\Nowy folder
2018-09-05 20:45 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2018-09-05 20:29 - 2018-07-25 20:08 - 000000000 ____D C:\Users\Michu\AppData\Roaming\Windows_Activator
2018-09-05 18:39 - 2017-10-28 16:29 - 000000000 ____D C:\Users\Michu\AppData\Roaming\TS3Client
2018-09-05 18:38 - 2017-10-28 16:18 - 000000000 ____D C:\Users\Michu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-09-05 18:38 - 2017-10-28 16:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2018-09-05 18:38 - 2017-10-28 16:18 - 000000000 ____D C:\Program Files (x86)\WinRAR
2018-09-05 18:32 - 2011-04-12 15:21 - 000740098 _____ C:\Windows\system32\perfh015.dat
2018-09-05 18:32 - 2011-04-12 15:21 - 000155672 _____ C:\Windows\system32\perfc015.dat
2018-09-05 18:32 - 2009-07-14 07:13 - 001669190 _____ C:\Windows\system32\PerfStringBackup.INI
2018-09-05 18:18 - 2017-10-28 16:27 - 000215728 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2018-09-04 17:20 - 2017-10-28 16:27 - 000467320 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2018-08-30 18:41 - 2018-02-04 21:29 - 000000000 ____D C:\Users\Michu\AppData\Local\Spotify
2018-08-30 18:41 - 2018-02-04 21:27 - 000000000 ____D C:\Users\Michu\AppData\Roaming\Spotify
2018-08-30 17:20 - 2017-10-28 16:27 - 000087904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2018-08-30 17:20 - 2017-10-28 16:27 - 000003910 _____ C:\Windows\System32\Tasks\Avast Emergency Update
2018-08-30 17:19 - 2018-01-04 18:51 - 000249016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
2018-08-30 17:19 - 2017-11-16 17:52 - 000199712 _____ (AVAST Software) C:\Windows\system32\Drivers\aswArPot.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 001027720 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 000381560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 000163272 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 000111864 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 000059568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbuniva.sys
2018-08-30 17:19 - 2017-10-28 16:27 - 000046968 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2018-08-30 17:19 - 2017-10-28 16:26 - 000346664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbloga.sys
2018-08-30 17:19 - 2017-10-28 16:26 - 000229384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsdrivera.sys
2018-08-30 17:19 - 2017-10-28 16:26 - 000201320 _____ (AVAST Software) C:\Windows\system32\Drivers\aswbidsha.sys
2018-08-28 18:55 - 2017-11-17 10:36 - 000000000 _____ C:\Windows\SysWOW64\last.dump
2018-08-28 18:54 - 2017-10-28 15:54 - 000000000 ____D C:\Users\Michu
2018-08-17 10:10 - 2017-11-08 21:56 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2018-08-16 17:57 - 2009-07-14 07:08 - 000032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-08-15 10:13 - 2017-12-29 19:46 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-08-15 10:13 - 2017-12-29 19:46 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-08-15 10:13 - 2017-12-29 19:46 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-08-15 10:13 - 2017-12-29 19:46 - 000000000 ____D C:\Windows\system32\Macromed
2018-08-10 21:55 - 2018-07-25 21:07 - 000000000 ____D C:\Users\Michu\ansel
2018-08-10 21:55 - 2018-03-29 14:48 - 000000000 __SHD C:\82ace7d6-0197-474d-bf4b-a2043e72329b
2018-08-10 21:55 - 2017-11-08 21:53 - 000000000 ____D C:\Users\Michu\AppData\Local\Adobe
2018-08-10 21:50 - 2018-07-25 21:02 - 000001370 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2018-08-10 21:50 - 2018-07-25 20:56 - 000000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2018-08-10 21:50 - 2018-07-25 20:55 - 000000000 ____D C:\ProgramData\NVIDIA Corporation
2018-08-10 21:50 - 2018-07-25 20:54 - 000000000 ____D C:\Program Files\NVIDIA Corporation
2018-08-10 21:42 - 2017-10-28 16:01 - 000000000 ____D C:\Program Files\Mozilla Firefox
2018-08-10 21:42 - 2017-10-28 16:01 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-08-08 23:24 - 2018-07-25 22:15 - 000002230 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-08-08 23:24 - 2018-07-25 22:15 - 000002189 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Pliki w katalogu głównym wybranych folderów =======

2018-07-25 21:59 - 2018-07-25 22:00 - 007314944 _____ (cuddle) C:\Users\Michu\AppData\Roaming\ggphcnjknqkdw.exe
2018-07-25 20:08 - 2018-07-25 20:08 - 000268264 _____ () C:\Users\Michu\AppData\Roaming\ynnqrbdqs.exe
2018-07-25 20:10 - 2018-07-25 20:10 - 000008430 _____ () C:\Users\Michu\AppData\Local\KRAB-DECRYPT.txt
2018-08-28 20:30 - 2018-08-28 20:30 - 000003004 _____ () C:\Users\Michu\AppData\Local\recently-used.xbel
2018-01-18 19:47 - 2018-01-18 19:47 - 000000003 _____ () C:\Users\Michu\AppData\Local\updater.log
2018-01-18 19:47 - 2018-01-20 19:03 - 000000059 _____ () C:\Users\Michu\AppData\Local\UserProducts.xml

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-08-17 02:01

==================== Koniec  FRST.txt ============================