Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:29-08-2015
Uruchomiony przez admin (administrator)  ADMIN-KOMPUTER (30-08-2015 14:42:55)
Uruchomiony z C:\Users\admin\Downloads
Załadowane profile: admin (Dostępne profile: admin)
Platform: Windows 7 Home Premium (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" -- "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
() C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\jnslF93E.tmp
() C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\knsgD6AB.tmpfs
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\hnslE46.tmp
(DTools LIMITED) C:\ProgramData\eWdsManProe\WdsManPro.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\RocketDock\RocketDock.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
() C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(TODO: <公司名>) C:\Program Files (x86)\SFK\SSFK.exe
() C:\Program Files (x86)\SFK\SFKEX64.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Open Source) C:\Users\admin\AppData\Roaming\cpuminer\sgminer\sgm.exe
() C:\Program Files (x86)\baidu\pps.exe
(iQIYI.COM) C:\IQIYI Video\Common\QyKernel.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAOFrame.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRTP.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCTray.exe
(Tencent) C:\Program Files (x86)\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\plugins\QMNetMon\QQPCNetFlow.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCPatch.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCPatch.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRealTimeSpeedup.exe
(Tencent) C:\Program Files (x86)\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files (x86)\Rising\RSD\popwndexe.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files (x86)\Rising\RAV\ravmond.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files (x86)\Rising\RAV\rstray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-21] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-11-21] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634896 2015-07-24] (NVIDIA Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [gpuminer] => C:\Users\admin\AppData\Roaming\cpuminer\sgminer\start.cmd [214 2015-08-21] ()
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-12-20] (Intel Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [mbot_pl_014010075] => [X]
HKLM-x32\...\Run: [setup.exe -start] => C:\Users\admin\AppData\Local\Temp\setup.exe -start <===== UWAGA
HKLM-x32\...\Run: [gmsd_pl_005010075] => [X]
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCTray.exe [355296 2015-08-30] (Tencent)
HKLM-x32\...\Run: [RSDTRAY] => C:\Program Files (x86)\Rising\RSD\popwndexe.exe [126808 2012-09-25] (Beijing Rising Information Technology Co., Ltd.)
HKLM-x32\...\Run: [RavTRAY] => C:\Program Files (x86)\Rising\RAV\RSTRAY.EXE [111000 2014-05-15] (Beijing Rising Information Technology Co., Ltd.)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2015-07-27] (Google Inc.)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-08-18] (Google Inc.)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [GoogleChromeAutoLaunch_35F47CA955883AC80F45949DB9B0CAE0] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [apphide] => C:\Program Files (x86)\baidu\pps.exe [77824 2015-08-12] ()
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [HCDNClient] => C:\IQIYI Video\Common\QyKernel.exe [576104 2015-05-12] (iQIYI.COM)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\crossbrowse.lnk [2015-08-30]
ShortcutTarget: crossbrowse.lnk -> C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe (Brak pliku)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2015-07-28]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMGCShellExt64.dll [2015-08-30] (Tencent)
BootExecute: autocheck autochk *  bsmain
GroupPolicy: Zasady grupy  Chrome wykryto <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci..)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130854058241495833&GUID=FBB5DADD-B5C5-483E-92F7-45F8BDEABD29
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=97951667_hao_pg
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=97951667_hao_pg
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-4085586262-2414536989-1598607991-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSWebMon64.dat [2015-08-30] (Tencent)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-28] (Google Inc.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-28] (Google Inc.)
BHO-x32: °®ĆćŇŐÖúĘÖ -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> C:\IQIYI Video\Common\Accelerator\IEHelper.dll [2015-04-29] (爱奇艺)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-28] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-28] (Google Inc.)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{8B1F688D-F054-4615-8E3B-2C6BCF8B7F33}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BDAE2B72-4628-42D3-BDD7-2E8B0E23C2B3}: [DhcpNameServer] 192.168.0.1
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1440936042&z=5a4b70160b4bbfb13f82ab9g0z3z1eat7c0w6tcg1b&from=face&uid=WDCXWD10EZEX-00BN5A0_WD-WCC3F7KDZNH8DZNH8

FireFox:
========
FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] ()
FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-04-15] (CANON INC.)
FF Plugin-x32: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] ()
FF Plugin-x32: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\npQMExtensionsMozilla.dll [2015-08-30] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll [2013-06-27] (Beijing Rising Information Technology Co., Ltd.)
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [Brak pliku]
FF Plugin-x32: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll [Brak pliku]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)
FF Plugin HKU\S-1-5-21-4085586262-2414536989-1598607991-1000: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin HKU\S-1-5-21-4085586262-2414536989-1598607991-1000: @rising.com.cn/nprising -> C:\Program Files (x86)\Rising\RAV\nprising.dll [2013-06-27] (Beijing Rising Information Technology Co., Ltd.)

Chrome: 
=======
CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (2048) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\clgddkicplcbgjfobecebadodeggpghp [2015-07-30]
CHR Extension: (Steam inventory helper) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-07-30]
CHR Extension: (Night Time In New York City) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek [2015-07-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe http://www.istartsurf.com/?type=sc&ts=1440936042&z=5a4b70160b4bbfb13f82ab9g0z3z1eat7c0w6tcg1b&from=face&uid=WDCXWD10EZEX-00BN5A0_WD-WCC3F7KDZNH8DZNH8

Opera: 
=======
OPR Extension: (Brak nazwy) - C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-08-30]
OPR Extension: (Jungle Net) - C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\pcgpjljifiicmbeheknnnooledmnjcld [2015-07-29]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155216 2015-07-24] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 jimocoso; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\jnslF93E.tmp [227328 2015-08-30] () [Brak podpisu cyfrowego]
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1871504 2015-07-24] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544592 2015-07-24] (NVIDIA Corporation)
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRTP.exe [301728 2015-08-30] (Tencent)
R2 RsMgrSvc; C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe [179992 2014-09-02] (Beijing Rising Information Technology Co., Ltd.)
R2 RsRavMon; C:\Program Files (x86)\Rising\RAV\ravmond.exe [277552 2014-05-15] (Beijing Rising Information Technology Co., Ltd.)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [448000 2015-08-30] (TODO: <公司名>) [Brak podpisu cyfrowego]
R3 TAOFrame; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TAOFrame.exe [293856 2015-08-30] (Tencent)
R2 totyseku; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\hnslE46.tmp [137728 2015-08-30] () [Brak podpisu cyfrowego]
R4 WdsManPro; C:\ProgramData\eWdsManProe\WdsManPro.exe [709288 2015-08-30] (DTools LIMITED)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /svc [X] <==== UWAGA
S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\globalupdate.exe /medsvc [X] <==== UWAGA
R2 mofihimy; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\knsgD6AB.tmpfs [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-07-24] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47976 2015-07-03] (NVIDIA Corporation)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUdisk64.sys [62264 2015-08-30] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys [138040 2015-08-30] (电脑管家)
R1 rsutils; C:\Windows\System32\DRIVERS\rsutils.sys [69336 2014-08-15] (Beijing Rising Information Technology Co., Ltd.)
R0 sysmon; C:\Windows\System32\DRIVERS\sysmon.sys [119344 2014-09-10] (Beijing Rising Information Technology Co., Ltd.)
R2 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator64.sys [74040 2015-08-30] (Tencent)
R2 TAOKernelDriver; C:\Windows\system32\Drivers\TAOKernel64.sys [274232 2015-08-30] (Tencent Technology(Shenzhen) Company Limited)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2015-08-30] (电脑管家)
R1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSDefenseBT64.sys [28472 2015-08-30] (Tencent)
R3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2015-08-30] (电脑管家)
R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKit64.sys [87352 2015-08-30] (电脑管家)
R1 wsafd_1_10_0_19; system32\drivers\wsafd_1_10_0_19.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-08-30 14:42 - 2015-08-30 14:43 - 00021036 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-30 14:41 - 2015-08-30 14:43 - 00000000 ____D C:\FRST
2015-08-30 14:41 - 2015-08-30 14:41 - 02186752 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-30 14:38 - 2015-08-30 14:38 - 00000150 __RSH C:\rising.ini
2015-08-30 14:38 - 2015-08-30 14:38 - 00000134 _____ C:\Windows\SysWOW64\BsMain.ini
2015-08-30 14:38 - 2015-08-30 14:38 - 00000000 ___RD C:\RavBin
2015-08-30 14:38 - 2015-08-30 14:38 - 00000000 ____D C:\ProgramData\Rising
2015-08-30 14:38 - 2015-08-30 14:38 - 00000000 ____D C:\Program Files (x86)\Rising
2015-08-30 14:38 - 2014-09-10 08:11 - 00119344 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\sysmon.sys
2015-08-30 14:38 - 2014-08-15 03:22 - 00069336 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsutils.sys
2015-08-30 14:38 - 2014-07-30 04:44 - 00091928 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\vpatch.dll
2015-08-30 14:38 - 2014-01-02 09:37 - 00325400 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\ravext64.dll
2015-08-30 14:38 - 2013-12-30 09:33 - 00256280 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\ravext.dll
2015-08-30 14:38 - 2012-09-06 02:30 - 00240472 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\bsmain.exe
2015-08-30 14:38 - 2012-02-29 09:49 - 00011888 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsndisp.sys
2015-08-30 14:36 - 2015-08-30 14:38 - 00000000 ____D C:\ProgramData\Tencent
2015-08-30 14:36 - 2015-08-30 14:36 - 00274232 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernel64.sys
2015-08-30 14:36 - 2015-08-30 14:36 - 00087864 _____ (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2015-08-30 14:36 - 2015-08-30 14:36 - 00074040 _____ (Tencent) C:\Windows\system32\Drivers\TAOAccelerator64.sys
2015-08-30 14:36 - 2015-08-30 14:36 - 00038200 _____ (电脑管家) C:\Windows\system32\Drivers\TSSKX64.sys
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Tencent
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Program Files\Common Files\Tencent
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Program Files (x86)\Tencent
2015-08-30 14:07 - 2015-08-30 14:07 - 00002424 _____ C:\Users\admin\Desktop\Reimage2.lnk
2015-08-30 14:06 - 2015-08-30 14:06 - 00000832 _____ C:\Users\admin\Desktop\AnyProtect.lnk
2015-08-30 14:06 - 2015-08-30 14:06 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-08-30 14:05 - 2015-08-30 14:05 - 00000000 ____D C:\Windows\SysWOW64\Flash
2015-08-30 14:04 - 2015-08-30 14:07 - 00000000 ____D C:\Users\admin\AppData\Local\Unity
2015-08-30 14:04 - 2015-08-30 14:05 - 00000000 ____D C:\Users\admin\AppData\Local\SysassistByHotWheel
2015-08-30 14:04 - 2015-08-30 14:04 - 00613255 _____ (CMI Limited) C:\Users\admin\AppData\Local\nsx9D4B.tmp
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 __SHD C:\Users\admin\AppData\Roaming\AnyProtectEx
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 ____D C:\Users\Public\QiYi
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 ____D C:\Users\admin\AppData\Roaming\IQIYI Video
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 ____D C:\IQIYI Video
2015-08-30 14:03 - 2015-08-30 14:08 - 00000000 ____D C:\ProgramData\IQIYI Video
2015-08-30 14:03 - 2015-08-30 14:03 - 00004062 _____ C:\Windows\System32\Tasks\DgTeb5kgyhligOag2NJr6Air5x
2015-08-30 14:03 - 2015-08-30 14:03 - 00001024 _____ C:\Windows\Tasks\DgTeb5kgyhligOag2NJr6Air5x.job
2015-08-30 14:02 - 2015-08-30 14:07 - 00000974 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-08-30 14:02 - 2015-08-30 14:07 - 00000970 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-08-30 14:02 - 2015-08-30 14:02 - 00003972 _____ C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineUA
2015-08-30 14:02 - 2015-08-30 14:02 - 00003718 _____ C:\Windows\System32\Tasks\globalUpdateUpdateTaskMachineCore
2015-08-30 14:02 - 2015-08-30 14:02 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-30 14:02 - 2015-08-30 14:02 - 00000000 ____D C:\Users\admin\AppData\Local\globalUpdate
2015-08-30 14:01 - 2015-08-30 14:07 - 00000000 ____D C:\Users\admin\AppData\Roaming\cpuminer
2015-08-30 14:01 - 2015-08-30 14:03 - 00000000 ____D C:\Users\admin\AppData\Local\SmartWeb
2015-08-30 14:01 - 2015-08-30 14:01 - 00004094 _____ C:\Windows\System32\Tasks\Crossbrowse
2015-08-30 14:01 - 2015-08-30 14:01 - 00004046 _____ C:\Windows\System32\Tasks\SmartWeb Upgrade Trigger Task
2015-08-30 14:01 - 2015-08-30 14:01 - 00002404 _____ C:\Users\Public\Desktop\Crossbrowse.lnk
2015-08-30 14:01 - 2015-08-30 14:01 - 00001056 _____ C:\Windows\Tasks\Crossbrowse.job
2015-08-30 14:01 - 2015-08-30 14:01 - 00000217 _____ C:\task.vbs
2015-08-30 14:01 - 2015-08-30 14:01 - 00000000 ____D C:\Users\admin\AppData\Local\Crossbrowse
2015-08-30 14:01 - 2015-08-30 14:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-08-30 14:01 - 2015-08-30 14:01 - 00000000 ____D C:\Program Files (x86)\SFK
2015-08-30 14:01 - 2015-08-30 14:01 - 00000000 ____D C:\Program Files (x86)\baidu
2015-08-30 14:00 - 2015-08-30 14:00 - 00004180 _____ C:\Windows\System32\Tasks\WordSurfer Auto Updater 1.10.0.19 Pending Update
2015-08-30 14:00 - 2015-08-30 14:00 - 00000000 ____D C:\ProgramData\7WdsManPro7
2015-08-30 13:27 - 2015-08-30 13:27 - 01605632 _____ C:\Users\admin\Downloads\AdwCleaner.pl 5.003.exe
2015-08-30 12:58 - 2015-08-30 12:58 - 00000000 ____D C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009
2015-08-30 12:58 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-08-30 12:57 - 2015-08-30 12:57 - 00000000 ____D C:\Users\admin\AppData\Local\Temp尰
2015-08-30 12:56 - 2015-08-30 14:00 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-08-30 12:56 - 2015-08-30 12:57 - 00000000 ____D C:\ProgramData\eWdsManProe
2015-08-27 23:08 - 2015-08-27 23:08 - 00000048 _____ C:\Users\admin\Desktop\1.txt
2015-08-25 13:34 - 2015-08-25 13:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Jetdogs Studios
2015-08-23 00:38 - 2015-08-23 00:47 - 194223015 _____ C:\Users\admin\Documents\1.mp4
2015-08-22 15:20 - 2015-08-22 15:20 - 00000000 ____D C:\Users\admin\AppData\Roaming\Sony Creative Software Inc
2015-08-22 11:37 - 2015-08-22 11:37 - 00000000 ____D C:\Users\admin\AppData\Local\Sony
2015-08-22 11:37 - 2015-08-22 11:37 - 00000000 ____D C:\ProgramData\Sony
2015-08-22 11:36 - 2015-08-22 11:36 - 00001180 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Vegas Pro.lnk
2015-08-22 11:36 - 2015-08-22 11:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vegas Pro 12.0 (64-bit)
2015-08-22 11:36 - 2015-08-22 11:36 - 00000000 ____D C:\Program Files (x86)\Sony
2015-08-22 10:54 - 2015-08-22 13:41 - 00000000 ____D C:\Users\admin\AppData\Roaming\Sony
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\Documents\Adobe
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Roaming\PACE Anti-Piracy
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\PACE Anti-Piracy
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\ProgramData\PACE Anti-Piracy
2015-08-21 01:06 - 2015-08-21 01:06 - 00001075 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS6.lnk
2015-08-21 01:06 - 2015-08-21 01:06 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-08-21 01:05 - 2015-08-21 01:05 - 00000973 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
2015-08-21 01:04 - 2015-08-21 01:04 - 00000997 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2015-08-21 01:03 - 2015-08-21 01:06 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-08-21 00:59 - 2015-08-21 01:12 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2015-08-21 00:59 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2015-08-21 00:59 - 2015-08-21 01:06 - 00000000 ____D C:\ProgramData\Adobe
2015-08-21 00:59 - 2015-08-21 00:59 - 00000000 ____D C:\Users\admin\AppData\Roaming\Macromedia
2015-08-20 14:39 - 2015-08-20 14:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-08-18 21:25 - 2015-08-18 21:25 - 00003108 _____ C:\Windows\System32\Tasks\{2B4AC000-FC77-4F35-850D-BB235F312C0B}
2015-08-18 21:20 - 2015-08-18 21:30 - 00000000 ____D C:\Program Files (x86)\PicosmosTools
2015-08-18 21:06 - 2015-08-18 21:06 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2015-08-18 21:06 - 2015-08-18 21:06 - 00000000 ____D C:\Program Files (x86)\FormatFactory
2015-08-18 10:36 - 2015-08-18 10:36 - 00000000 ____D C:\Program Files (x86)\RocketDock
2015-08-15 01:18 - 2015-08-15 01:18 - 00384040 _____ C:\Windows\Minidump\081515-19843-01.dmp
2015-08-14 20:55 - 2015-08-14 20:55 - 00061312 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vt_1_10_0_22.sys
2015-08-14 20:55 - 2015-08-14 20:55 - 00057728 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vw_1_10_0_22.sys
2015-08-14 11:11 - 2015-07-24 06:21 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01710568 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01423304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-08-14 11:09 - 2015-07-03 06:28 - 00065896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-08-14 11:09 - 2015-07-03 06:28 - 00047976 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-08-13 20:12 - 2015-08-13 20:12 - 00000000 __RHD C:\Users\admin\AppData\Roaming\SecuROM
2015-08-13 11:21 - 2015-08-29 00:32 - 00000000 ____D C:\Users\admin\AppData\Roaming\Audacity
2015-08-13 11:21 - 2015-08-13 11:21 - 00001023 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-08-13 11:21 - 2015-08-13 11:21 - 00000000 ____D C:\Program Files (x86)\Audacity
2015-08-13 11:12 - 2015-08-13 11:12 - 05530560 _____ C:\Windows\SysWOW64\SpoonUninstall.exe
2015-08-13 11:12 - 2015-08-13 11:12 - 00016385 _____ C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp.dat
2015-08-13 11:12 - 2015-08-13 11:12 - 00014618 _____ C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2015-08-13 11:12 - 2015-08-13 11:12 - 00000000 ____D C:\Program Files\dBpoweramp
2015-08-12 22:02 - 2015-08-12 22:02 - 00000040 ____H C:\6C011B113E50
2015-08-12 22:01 - 2015-08-23 00:51 - 00000000 ____D C:\Adobe Photoshop CS6 [by RED]
2015-08-12 21:58 - 2015-08-12 22:01 - 00000000 ____D C:\Users\admin\AppData\Local\Microsoft Games
2015-08-12 12:01 - 2015-08-12 12:01 - 00372120 _____ C:\Windows\Minidump\081215-20155-01.dmp
2015-08-12 10:17 - 2015-08-12 10:17 - 00349624 _____ C:\Windows\Minidump\081215-19344-01.dmp
2015-08-12 00:10 - 2015-08-29 00:32 - 00000000 ____D C:\Users\admin\AppData\Roaming\OBS
2015-08-12 00:06 - 2015-08-12 00:09 - 00000000 ____D C:\Program Files\OBS
2015-08-12 00:05 - 2015-08-12 00:05 - 00000000 ____D C:\Users\admin\AppData\Roaming\obs-studio
2015-08-09 12:57 - 2015-08-09 12:57 - 00000000 ____D C:\Games
2015-08-07 22:37 - 2015-08-07 22:37 - 00000000 ____D C:\Users\admin\AppData\Roaming\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000975 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\Program Files\WinRAR
2015-08-05 12:56 - 2015-08-05 12:56 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-08-05 12:56 - 2015-08-05 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-08-05 12:55 - 2015-08-05 12:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-08-05 07:37 - 2015-08-05 07:37 - 00000000 ____D C:\Program Files (x86)\64bit
2015-08-05 01:08 - 2015-08-05 01:08 - 00360696 _____ C:\Windows\Minidump\080515-21730-01.dmp
2015-08-03 17:08 - 2015-08-30 14:04 - 00000000 ____D C:\Users\admin\AppData\Roaming\TS3Client
2015-08-03 17:08 - 2015-08-03 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2015-08-03 01:33 - 2015-08-03 01:33 - 00390152 _____ C:\Windows\Minidump\080315-20592-01.dmp
2015-07-31 10:37 - 2015-08-21 01:13 - 00000000 ____D C:\Users\admin\AppData\Roaming\NVIDIA
2015-07-31 00:41 - 2015-07-31 00:41 - 00341128 _____ C:\Windows\Minidump\073115-20654-01.dmp

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-08-30 14:39 - 2015-07-27 13:36 - 00060336 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-08-30 14:36 - 2015-07-27 13:30 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
2015-08-30 14:32 - 2015-07-27 13:30 - 01068850 _____ C:\Windows\WindowsUpdate.log
2015-08-30 14:01 - 2015-07-30 18:00 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome
2015-08-30 14:01 - 2015-07-27 13:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-30 13:51 - 2015-07-27 13:41 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-30 13:51 - 2015-07-27 13:41 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-30 13:35 - 2009-07-14 19:55 - 00688628 _____ C:\Windows\system32\perfh015.dat
2015-08-30 13:35 - 2009-07-14 19:55 - 00131712 _____ C:\Windows\system32\perfc015.dat
2015-08-30 13:35 - 2009-07-14 07:13 - 01526834 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-30 13:34 - 2015-07-29 16:24 - 00000000 ____D C:\AdwCleaner
2015-08-30 13:29 - 2015-07-27 13:51 - 00000000 ____D C:\ProgramData\NVIDIA
2015-08-30 13:29 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-30 13:29 - 2009-07-14 06:51 - 00041323 _____ C:\Windows\setupact.log
2015-08-30 13:28 - 2009-07-14 06:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-30 13:28 - 2009-07-14 06:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-30 13:26 - 2015-07-29 00:08 - 00000000 ____D C:\ProgramData\yWinManProy
2015-08-30 13:04 - 2015-07-27 13:42 - 00007866 _____ C:\Windows\PFRO.log
2015-08-30 13:02 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-30 13:01 - 2015-07-27 13:30 - 00001455 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-30 13:01 - 2015-07-27 13:30 - 00001421 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-08-30 02:04 - 2015-07-30 00:37 - 509901405 _____ C:\Windows\MEMORY.DMP
2015-08-30 02:04 - 2015-07-30 00:37 - 00000000 ____D C:\Windows\Minidump
2015-08-25 13:34 - 2015-07-29 16:14 - 00027522 _____ C:\Windows\DirectX.log
2015-08-23 12:02 - 2009-07-14 06:45 - 04893216 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-22 00:38 - 2015-07-29 00:00 - 00000000 ___RD C:\Kamil
2015-08-21 01:11 - 2015-07-04 21:12 - 00000000 ___HD C:\Users\admin\AppData\Local\dZYqOQU0QMtAEs5
2015-08-21 01:11 - 2015-05-23 04:03 - 00000000 ___HD C:\Users\admin\AppData\Local\9PpoiqQeS7ka
2015-08-21 01:11 - 2014-08-31 07:02 - 00000000 ___HD C:\Users\admin\AppData\Local\yxCvtZTp
2015-08-21 01:11 - 2013-12-22 16:06 - 00000000 ___HD C:\Users\admin\AppData\Local\EG0x26T7ts
2015-08-21 01:03 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-08-14 11:11 - 2015-07-27 13:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:50 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:49 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-08-05 12:58 - 2015-07-29 00:14 - 00001912 _____ C:\Windows\epplauncher.mif
2015-08-05 12:54 - 2015-07-29 00:32 - 00000000 ____D C:\ProgramData\Panda Security
2015-08-05 12:53 - 2015-07-29 00:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\Panda Security
2015-08-05 12:52 - 2015-07-29 00:32 - 00000000 ____D C:\Program Files (x86)\Panda Security
2015-08-03 17:08 - 2015-07-28 23:54 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2015-08-03 17:06 - 2015-07-27 13:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-08-01 00:36 - 2015-07-29 15:51 - 00000000 ____D C:\ProgramData\CanonIJPLM
2015-07-31 20:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2015-07-31 12:38 - 2015-07-28 23:57 - 00000000 ____D C:\Users\admin\AppData\Roaming\Skype
2015-07-31 10:55 - 2015-07-29 00:31 - 00000000 ____D C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de

==================== Pliki w katalogu głównym wybranych folderów =======

2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\admin\AppData\Roaming\DgTeb5kgyhligOag2NJr6Air5x
2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\admin\AppData\Roaming\DgTeb5kgyhligOag2NJr6Air5x.exe
2015-08-30 14:04 - 2015-08-30 14:04 - 0613255 _____ (CMI Limited) C:\Users\admin\AppData\Local\nsx9D4B.tmp
2015-07-27 13:35 - 2015-07-27 13:35 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-08-30 12:56 - 2015-08-30 14:00 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Niektóre pliki w TEMP:
====================
C:\Users\admin\AppData\Local\Temp\6046.exe
C:\Users\admin\AppData\Local\Temp\6693.exe
C:\Users\admin\AppData\Local\Temp\8257.exe
C:\Users\admin\AppData\Local\Temp\beeajcfdca.exe
C:\Users\admin\AppData\Local\Temp\bitool.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\admin\AppData\Local\Temp\FormatFactory-13295-dp.exe
C:\Users\admin\AppData\Local\Temp\install1804741.exe
C:\Users\admin\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe
C:\Users\admin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\admin\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\admin\AppData\Local\Temp\ppstreamsetup_unfix.exe
C:\Users\admin\AppData\Local\Temp\qqpcmgr_v10.11.16588.235_72609_Silence.exe
C:\Users\admin\AppData\Local\Temp\Quarantine.exe
C:\Users\admin\AppData\Local\Temp\setup3.exe
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
C:\Users\admin\AppData\Local\Temp\{60325F52-3196-4989-A403-188C9358CE13}.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-08-22 09:47

==================== Koniec  FRST.txt ============================