Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:30-08-2015
Uruchomiony przez admin (administrator)  ADMIN-KOMPUTER (31-08-2015 13:38:05)
Uruchomiony z C:\Users\admin\Downloads
Załadowane profile: admin (Dostępne profile: admin)
Platform: Windows 7 Home Premium (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka nie została wykryta!)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRTP.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
() C:\Program Files (x86)\Canon\IJPLM\ijplmsvc.exe
(Beijing Rising Information Technology Co., Ltd.) C:\AdwCleaner\Quarantine\C\Program Files (x86)\Rising\RSD\RsMgrSvc.exe.vir
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13672304 2014-03-21] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-11-21] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2634896 2015-07-24] (NVIDIA Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2726728 2010-03-25] (CANON INC.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [gpuminer] => C:\Users\admin\AppData\Roaming\cpuminer\sgminer\start.cmd
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-12-20] (Intel Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1185112 2010-04-02] (CANON INC.)
HKLM-x32\...\Run: [mbot_pl_014010075] => [X]
HKLM-x32\...\Run: [setup.exe -start] => C:\Users\admin\AppData\Local\Temp\setup.exe -start <===== UWAGA
HKLM-x32\...\Run: [gmsd_pl_005010075] => [X]
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCTRAY.EXE [355296 2015-08-30] (Tencent)
HKLM-x32\...\Run: [RSDTRAY] => "C:\Program Files (x86)\Rising\RSD\popwndexe.exe"
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2015-07-27] (Google Inc.)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [RocketDock] => C:\Program Files (x86)\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [2899136 2015-08-19] (Valve Corporation)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [813896 2015-08-18] (Google Inc.)
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [GoogleChromeAutoLaunch_35F47CA955883AC80F45949DB9B0CAE0] => "C:\Program Files (x86)\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
HKU\S-1-5-21-4085586262-2414536989-1598607991-1000\...\Run: [apphide] => C:\Program Files (x86)\baidu\pps.exe
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMGCShellExt64.dll [2015-08-30] (Tencent)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2015-07-28]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()
GroupPolicy: Zasady grupy  Chrome wykryto <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci..)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{8B1F688D-F054-4615-8E3B-2C6BCF8B7F33}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BDAE2B72-4628-42D3-BDD7-2E8B0E23C2B3}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130854058241495833&GUID=FBB5DADD-B5C5-483E-92F7-45F8BDEABD29
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-4085586262-2414536989-1598607991-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-28] (Google Inc.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-28] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2015-07-28] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2015-07-28] (Google Inc.)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)

FireFox:
========
FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [Brak pliku]
FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [Brak pliku]
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2010-04-15] (CANON INC.)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-06-17] (NVIDIA Corporation)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\npQMExtensionsMozilla.dll [2015-08-30] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-27] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (2048) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\clgddkicplcbgjfobecebadodeggpghp [2015-07-30]
CHR Extension: (Steam inventory helper) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-07-30]
CHR Extension: (Night Time In New York City) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnimonidkipnhnpgkhgliocfnnpgkhek [2015-07-30]
CHR Extension: (Chrome Web Store Payments) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-28]

Opera: 
=======
OPR Extension: (Brak nazwy) - C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-08-30]
OPR Extension: (Jungle Net) - C:\Users\admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\pcgpjljifiicmbeheknnnooledmnjcld [2015-07-29]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1155216 2015-07-24] (NVIDIA Corporation)
S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
R2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1871504 2015-07-24] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5544592 2015-07-24] (NVIDIA Corporation)
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQPCRtp.exe [301728 2015-08-30] (Tencent)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 jimocoso; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\jnslF93E.tmp [X]
S2 mofihimy; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\knsgD6AB.tmpfs [X]
R4 RsMgrSvc; "C:\Program Files (x86)\Rising\RSD\RsMgrSvc.exe" [X]
S2 totyseku; C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009\hnslE46.tmp [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-07-24] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47976 2015-07-03] (NVIDIA Corporation)
R4 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QMUdisk64.sys [62264 2015-08-30] (Tencent)
R4 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\QQSysMonX64.sys [138040 2015-08-30] (电脑管家)
R4 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2015-08-30] (电脑管家)
R4 TS888x64; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TS888x64.sys [28984 2015-08-31] (Tencent)
R1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TsDefenseBT64.sys [28472 2015-08-30] (Tencent)
R4 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\10.11.16588.235\TSSysKit64.sys [87352 2015-08-30] (电脑管家)
R4 TAOAccelerator; \??\C:\Windows\system32\Drivers\TAOAccelerator64.sys [X]
R4 TAOKernelDriver; System32\Drivers\TAOKernel64.sys [X]
R4 TSSKX64; System32\drivers\tsskx64.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-08-31 13:38 - 2015-08-31 13:38 - 00013465 _____ C:\Users\admin\Downloads\FRST.txt
2015-08-31 13:37 - 2015-08-31 13:37 - 00000000 ____D C:\Users\admin\Downloads\FRST-OlderVersion
2015-08-31 13:11 - 2015-08-31 13:11 - 01618432 _____ C:\Users\admin\Downloads\AdwCleaner.pl 5.004.exe
2015-08-31 11:06 - 2015-08-31 11:07 - 00002532 _____ C:\Windows\System32\Tasks\Relive
2015-08-31 11:06 - 2015-08-31 11:07 - 00000240 _____ C:\Windows\Tasks\Relive.job
2015-08-30 15:14 - 2015-08-31 10:51 - 00003326 _____ C:\Windows\System32\Tasks\RsDelayLauncher_{8A34248E-7D35-4832-8378-7659E0B0A380}
2015-08-30 15:07 - 2015-08-30 15:07 - 00001455 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-30 14:56 - 2015-08-30 14:58 - 00000000 ____D C:\ProgramData\LocalStorage
2015-08-30 14:53 - 2015-08-31 10:51 - 00000000 ____D C:\Users\admin\AppData\Roaming\ppslog
2015-08-30 14:53 - 2015-08-30 14:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\QyGameClient
2015-08-30 14:53 - 2015-08-30 14:53 - 00000000 ____D C:\Users\admin\.android
2015-08-30 14:46 - 2015-08-30 14:46 - 00000000 ____D C:\ProgramData\TXQMPC
2015-08-30 14:41 - 2015-08-31 13:38 - 00000000 ____D C:\FRST
2015-08-30 14:41 - 2015-08-31 13:37 - 02188288 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-08-30 14:38 - 2015-08-31 13:13 - 00000000 ___RD C:\RavBin
2015-08-30 14:38 - 2015-08-31 13:13 - 00000000 ____D C:\Program Files (x86)\Rising
2015-08-30 14:38 - 2015-08-30 14:38 - 00000000 ____D C:\ProgramData\Rising
2015-08-30 14:38 - 2014-07-30 04:44 - 00091928 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\SysWOW64\vpatch.dll
2015-08-30 14:36 - 2015-08-31 11:11 - 00000000 ____D C:\Users\admin\AppData\Roaming\Tencent
2015-08-30 14:36 - 2015-08-30 14:49 - 00000000 ____D C:\ProgramData\Tencent
2015-08-30 14:36 - 2015-08-30 14:36 - 00087864 ____N (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Program Files\Common Files\Tencent
2015-08-30 14:36 - 2015-08-30 14:36 - 00000000 ____D C:\Program Files (x86)\Tencent
2015-08-30 14:06 - 2015-08-31 11:38 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup
2015-08-30 14:05 - 2015-08-30 14:05 - 00000000 ____D C:\Windows\SysWOW64\Flash
2015-08-30 14:04 - 2015-08-31 11:37 - 00000000 ____D C:\Users\admin\AppData\Local\SysassistByHotWheel
2015-08-30 14:04 - 2015-08-31 10:53 - 00000000 ____D C:\Users\admin\AppData\Local\Unity
2015-08-30 14:04 - 2015-08-30 14:51 - 00000000 ____D C:\IQIYI Video
2015-08-30 14:04 - 2015-08-30 14:04 - 00613255 _____ (CMI Limited) C:\Users\admin\AppData\Local\nsx9D4B.tmp
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 __SHD C:\Users\admin\AppData\Roaming\AnyProtectEx
2015-08-30 14:04 - 2015-08-30 14:04 - 00000000 ____D C:\Users\Public\QiYi
2015-08-30 14:03 - 2015-08-31 11:01 - 00000000 ____D C:\ProgramData\IQIYI Video
2015-08-30 14:03 - 2015-08-31 10:50 - 00001024 _____ C:\Windows\Tasks\DgTeb5kgyhligOag2NJr6Air5x.job
2015-08-30 14:03 - 2015-08-30 14:03 - 00004062 _____ C:\Windows\System32\Tasks\DgTeb5kgyhligOag2NJr6Air5x
2015-08-30 14:02 - 2015-08-30 14:02 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-08-30 14:02 - 2015-08-30 14:02 - 00000000 ____D C:\Users\admin\AppData\Local\globalUpdate
2015-08-30 14:01 - 2015-08-31 11:38 - 00000000 ____D C:\Users\admin\AppData\Roaming\cpuminer
2015-08-30 14:01 - 2015-08-31 11:37 - 00000000 ____D C:\Users\admin\AppData\Local\SmartWeb
2015-08-30 14:01 - 2015-08-31 11:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Crossbrowse
2015-08-30 14:01 - 2015-08-31 11:25 - 00000000 ____D C:\Program Files (x86)\SFK
2015-08-30 14:01 - 2015-08-30 14:53 - 00000000 ____D C:\Program Files (x86)\baidu
2015-08-30 14:01 - 2015-08-30 14:01 - 00000217 _____ C:\task.vbs
2015-08-30 14:01 - 2015-08-30 14:01 - 00000000 ____D C:\Users\admin\AppData\Local\Crossbrowse
2015-08-30 14:00 - 2015-08-30 14:00 - 00000000 ____D C:\ProgramData\7WdsManPro7
2015-08-30 12:58 - 2015-08-31 10:52 - 00000000 ____D C:\Program Files (x86)\03000200-1440932295-0500-0006-000700080009
2015-08-30 12:58 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-08-30 12:57 - 2015-08-30 12:57 - 00000000 ____D C:\Users\admin\AppData\Local\Temp尰
2015-08-30 12:56 - 2015-08-30 14:00 - 00000102 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-08-30 12:56 - 2015-08-30 12:57 - 00000000 ____D C:\ProgramData\eWdsManProe
2015-08-27 23:08 - 2015-08-27 23:08 - 00000048 _____ C:\Users\admin\Desktop\1.txt
2015-08-25 13:34 - 2015-08-25 13:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Jetdogs Studios
2015-08-23 00:38 - 2015-08-23 00:47 - 194223015 _____ C:\Users\admin\Documents\1.mp4
2015-08-22 15:20 - 2015-08-22 15:20 - 00000000 ____D C:\Users\admin\AppData\Roaming\Sony Creative Software Inc
2015-08-22 11:37 - 2015-08-22 11:37 - 00000000 ____D C:\Users\admin\AppData\Local\Sony
2015-08-22 11:37 - 2015-08-22 11:37 - 00000000 ____D C:\ProgramData\Sony
2015-08-22 11:36 - 2015-08-22 11:36 - 00001180 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Vegas Pro.lnk
2015-08-22 11:36 - 2015-08-22 11:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Vegas Pro 12.0 (64-bit)
2015-08-22 11:36 - 2015-08-22 11:36 - 00000000 ____D C:\Program Files (x86)\Sony
2015-08-22 10:54 - 2015-08-22 13:41 - 00000000 ____D C:\Users\admin\AppData\Roaming\Sony
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\Documents\Adobe
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Roaming\PACE Anti-Piracy
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Local\PACE Anti-Piracy
2015-08-21 01:11 - 2015-08-21 01:11 - 00000000 ____D C:\ProgramData\PACE Anti-Piracy
2015-08-21 01:06 - 2015-08-21 01:06 - 00001075 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CS6.lnk
2015-08-21 01:06 - 2015-08-21 01:06 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2015-08-21 01:05 - 2015-08-21 01:05 - 00000973 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CS6.lnk
2015-08-21 01:04 - 2015-08-21 01:04 - 00000997 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Users\Default\AppData\Roaming\Macromedia
2015-08-21 01:04 - 2015-08-21 01:04 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Macromedia
2015-08-21 01:03 - 2015-08-21 01:06 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-08-21 00:59 - 2015-08-21 01:12 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2015-08-21 00:59 - 2015-08-21 01:11 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2015-08-21 00:59 - 2015-08-21 01:06 - 00000000 ____D C:\ProgramData\Adobe
2015-08-21 00:59 - 2015-08-21 00:59 - 00000000 ____D C:\Users\admin\AppData\Roaming\Macromedia
2015-08-20 14:39 - 2015-08-20 14:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2015-08-18 21:25 - 2015-08-18 21:25 - 00003108 _____ C:\Windows\System32\Tasks\{2B4AC000-FC77-4F35-850D-BB235F312C0B}
2015-08-18 21:20 - 2015-08-18 21:30 - 00000000 ____D C:\Program Files (x86)\PicosmosTools
2015-08-18 21:06 - 2015-08-18 21:06 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FormatFactory
2015-08-18 21:06 - 2015-08-18 21:06 - 00000000 ____D C:\Program Files (x86)\FormatFactory
2015-08-18 10:36 - 2015-08-18 10:36 - 00000000 ____D C:\Program Files (x86)\RocketDock
2015-08-15 01:18 - 2015-08-15 01:18 - 00384040 _____ C:\Windows\Minidump\081515-19843-01.dmp
2015-08-14 20:55 - 2015-08-14 20:55 - 00061312 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vt_1_10_0_22.sys
2015-08-14 20:55 - 2015-08-14 20:55 - 00057728 _____ (TermCoach) C:\Windows\system32\Drivers\tcfd_vw_1_10_0_22.sys
2015-08-14 11:11 - 2015-07-24 06:21 - 01756608 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01710568 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01423304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-08-14 11:11 - 2015-07-24 06:21 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-08-14 11:09 - 2015-07-03 06:28 - 00065896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-08-14 11:09 - 2015-07-03 06:28 - 00047976 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-08-13 20:12 - 2015-08-13 20:12 - 00000000 __RHD C:\Users\admin\AppData\Roaming\SecuROM
2015-08-13 11:21 - 2015-08-29 00:32 - 00000000 ____D C:\Users\admin\AppData\Roaming\Audacity
2015-08-13 11:21 - 2015-08-13 11:21 - 00001023 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2015-08-13 11:21 - 2015-08-13 11:21 - 00000000 ____D C:\Program Files (x86)\Audacity
2015-08-13 11:12 - 2015-08-13 11:12 - 05530560 _____ C:\Windows\SysWOW64\SpoonUninstall.exe
2015-08-13 11:12 - 2015-08-13 11:12 - 00016385 _____ C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp.dat
2015-08-13 11:12 - 2015-08-13 11:12 - 00014618 _____ C:\Windows\SysWOW64\SpoonUninstall-dBpoweramp DSP Effects.dat
2015-08-13 11:12 - 2015-08-13 11:12 - 00000000 ____D C:\Program Files\dBpoweramp
2015-08-12 22:02 - 2015-08-12 22:02 - 00000040 ____H C:\6C011B113E50
2015-08-12 22:01 - 2015-08-23 00:51 - 00000000 ____D C:\Adobe Photoshop CS6 [by RED]
2015-08-12 21:58 - 2015-08-12 22:01 - 00000000 ____D C:\Users\admin\AppData\Local\Microsoft Games
2015-08-12 12:01 - 2015-08-12 12:01 - 00372120 _____ C:\Windows\Minidump\081215-20155-01.dmp
2015-08-12 10:17 - 2015-08-12 10:17 - 00349624 _____ C:\Windows\Minidump\081215-19344-01.dmp
2015-08-12 00:10 - 2015-08-29 00:32 - 00000000 ____D C:\Users\admin\AppData\Roaming\OBS
2015-08-12 00:06 - 2015-08-12 00:09 - 00000000 ____D C:\Program Files\OBS
2015-08-12 00:05 - 2015-08-12 00:05 - 00000000 ____D C:\Users\admin\AppData\Roaming\obs-studio
2015-08-09 12:57 - 2015-08-09 12:57 - 00000000 ____D C:\Games
2015-08-07 22:37 - 2015-08-07 22:37 - 00000000 ____D C:\Users\admin\AppData\Roaming\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000975 _____ C:\ProgramData\Microsoft\Windows\Start Menu\WinRAR.lnk
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2015-08-07 22:36 - 2015-08-07 22:36 - 00000000 ____D C:\Program Files\WinRAR
2015-08-05 12:56 - 2015-08-05 12:56 - 00002117 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2015-08-05 12:56 - 2015-08-05 12:56 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2015-08-05 12:55 - 2015-08-05 12:56 - 00000000 ____D C:\Program Files\Microsoft Security Client
2015-08-05 07:37 - 2015-08-05 07:37 - 00000000 ____D C:\Program Files (x86)\64bit
2015-08-05 01:08 - 2015-08-05 01:08 - 00360696 _____ C:\Windows\Minidump\080515-21730-01.dmp
2015-08-03 17:08 - 2015-08-30 14:04 - 00000000 ____D C:\Users\admin\AppData\Roaming\TS3Client
2015-08-03 17:08 - 2015-08-03 17:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client
2015-08-03 01:33 - 2015-08-03 01:33 - 00390152 _____ C:\Windows\Minidump\080315-20592-01.dmp

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-08-31 13:14 - 2015-07-29 16:24 - 00000000 ____D C:\AdwCleaner
2015-08-31 13:14 - 2009-07-14 06:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-31 13:14 - 2009-07-14 06:45 - 00009776 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-31 12:53 - 2015-07-27 13:30 - 01099995 _____ C:\Windows\WindowsUpdate.log
2015-08-31 12:51 - 2015-07-27 13:41 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-31 11:37 - 2015-07-29 00:31 - 00000000 ____D C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de
2015-08-31 10:56 - 2009-07-14 19:55 - 00688628 _____ C:\Windows\system32\perfh015.dat
2015-08-31 10:56 - 2009-07-14 19:55 - 00131712 _____ C:\Windows\system32\perfc015.dat
2015-08-31 10:56 - 2009-07-14 07:13 - 01526834 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-31 10:50 - 2015-07-27 13:51 - 00000000 ____D C:\ProgramData\NVIDIA
2015-08-31 10:50 - 2015-07-27 13:41 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-31 10:50 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-31 10:50 - 2009-07-14 06:51 - 00041995 _____ C:\Windows\setupact.log
2015-08-31 10:49 - 2015-07-27 13:42 - 00020192 _____ C:\Windows\PFRO.log
2015-08-30 15:07 - 2015-07-27 13:30 - 00001421 _____ C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-08-30 15:06 - 2009-07-14 06:45 - 04893272 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-30 14:57 - 2015-07-27 13:30 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
2015-08-30 14:53 - 2015-07-27 13:30 - 00000000 ____D C:\Users\admin
2015-08-30 14:39 - 2015-07-27 13:36 - 00060336 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
2015-08-30 14:01 - 2015-07-30 18:00 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Aplikacje Chrome
2015-08-30 14:01 - 2015-07-27 13:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-08-30 13:26 - 2015-07-29 00:08 - 00000000 ____D C:\ProgramData\yWinManProy
2015-08-30 13:02 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-08-30 02:04 - 2015-07-30 00:37 - 509901405 _____ C:\Windows\MEMORY.DMP
2015-08-30 02:04 - 2015-07-30 00:37 - 00000000 ____D C:\Windows\Minidump
2015-08-25 13:34 - 2015-07-29 16:14 - 00027522 _____ C:\Windows\DirectX.log
2015-08-22 00:38 - 2015-07-29 00:00 - 00000000 ___RD C:\Kamil
2015-08-21 01:13 - 2015-07-31 10:37 - 00000000 ____D C:\Users\admin\AppData\Roaming\NVIDIA
2015-08-21 01:11 - 2015-07-04 21:12 - 00000000 ___HD C:\Users\admin\AppData\Local\dZYqOQU0QMtAEs5
2015-08-21 01:11 - 2015-05-23 04:03 - 00000000 ___HD C:\Users\admin\AppData\Local\9PpoiqQeS7ka
2015-08-21 01:11 - 2014-08-31 07:02 - 00000000 ___HD C:\Users\admin\AppData\Local\yxCvtZTp
2015-08-21 01:11 - 2013-12-22 16:06 - 00000000 ___HD C:\Users\admin\AppData\Local\EG0x26T7ts
2015-08-21 01:03 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2015-08-14 11:11 - 2015-07-27 13:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:50 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:49 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-08-14 11:11 - 2015-07-27 13:48 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-08-05 12:58 - 2015-07-29 00:14 - 00001912 _____ C:\Windows\epplauncher.mif
2015-08-05 12:54 - 2015-07-29 00:32 - 00000000 ____D C:\ProgramData\Panda Security
2015-08-05 12:53 - 2015-07-29 00:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\Panda Security
2015-08-05 12:52 - 2015-07-29 00:32 - 00000000 ____D C:\Program Files (x86)\Panda Security
2015-08-03 17:08 - 2015-07-28 23:54 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2015-08-03 17:06 - 2015-07-27 13:49 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-08-01 00:36 - 2015-07-29 15:51 - 00000000 ____D C:\ProgramData\CanonIJPLM

==================== Pliki w katalogu głównym wybranych folderów =======

2015-08-30 14:04 - 2015-08-30 14:04 - 0613255 _____ (CMI Limited) C:\Users\admin\AppData\Local\nsx9D4B.tmp
2015-07-27 13:35 - 2015-07-27 13:35 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-08-30 12:56 - 2015-08-30 14:00 - 0000102 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Niektóre pliki w TEMP:
====================
C:\Users\admin\AppData\Local\Temp\6046.exe
C:\Users\admin\AppData\Local\Temp\6693.exe
C:\Users\admin\AppData\Local\Temp\8257.exe
C:\Users\admin\AppData\Local\Temp\beeajcfdca.exe
C:\Users\admin\AppData\Local\Temp\bitool.dll
C:\Users\admin\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\admin\AppData\Local\Temp\FormatFactory-13295-dp.exe
C:\Users\admin\AppData\Local\Temp\install1804741.exe
C:\Users\admin\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb006.exe
C:\Users\admin\AppData\Local\Temp\masauto_runxx.dl.dll
C:\Users\admin\AppData\Local\Temp\masblog_runxx.dl.dll
C:\Users\admin\AppData\Local\Temp\masflag_runxx.dl.dll
C:\Users\admin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\admin\AppData\Local\Temp\mytmpinstaller.exe
C:\Users\admin\AppData\Local\Temp\OfshK1618280c.exe
C:\Users\admin\AppData\Local\Temp\On1618280c.exe
C:\Users\admin\AppData\Local\Temp\OSnFG1618280c.exe
C:\Users\admin\AppData\Local\Temp\ppstreamsetup_unfix.exe
C:\Users\admin\AppData\Local\Temp\qqpcmgr_v10.11.16588.235_72609_Silence.exe
C:\Users\admin\AppData\Local\Temp\Quarantine.exe
C:\Users\admin\AppData\Local\Temp\QYAgent_runxx.dl.dll
C:\Users\admin\AppData\Local\Temp\setup3.exe
C:\Users\admin\AppData\Local\Temp\sqlite3.dll
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
C:\Users\admin\AppData\Local\Temp\{60325F52-3196-4989-A403-188C9358CE13}.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-08-22 09:47

==================== Koniec  FRST.txt ============================