Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:13-09-2015
Uruchomiony przez Zero (administrator)  ZERO-KOMPUTER (13-09-2015 16:22:48)
Uruchomiony z C:\Users\Zero\Downloads
Załadowane profile: Zero (Dostępne profile: Zero)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Hi-Rez Studios) C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Enigma Software Group USA, LLC.) C:\Nasze\WWW\SpyHunter 4.20.9.4533 Portable\App\SpyHunter\SpyHunter4.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Akamai Technologies, Inc.) C:\Users\Zero\AppData\Local\Akamai\netsession_win.exe
(Aeria Games & Entertainment) C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe
(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe
(Akamai Technologies, Inc.) C:\Users\Zero\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files (x86)\Common Files\LogiShrd\LQCVFX\COCIManager.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5595848 2015-07-08] (ESET)
HKLM-x32\...\Run: [Aeria Ignite] => C:\Program Files (x86)\Aeria Games\Ignite\aeriaignite.exe [1925656 2013-06-06] (Aeria Games & Entertainment)
HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-08-12] (Logitech Inc.)
HKLM-x32\...\Run: [wenguanjia] => C:\Users\Zero\AppData\Roaming\wenguanjia\SurfAnonymous.exe /autorun
HKU\S-1-5-21-2733219707-495623863-2652868773-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Zero\AppData\Local\Akamai\netsession_win.exe [4691384 2015-07-23] (Akamai Technologies, Inc.)
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.0.16765.217\QMGCShellExt64.dll Brak pliku
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
ShellIconOverlayIdentifiers: [Fatlfn] -> {646BAAE7-7538-4866-8EEE-974C0AA910AB} => C:\ProgramData\gowwdyygvnef.dll [2015-09-08] ()
ShellIconOverlayIdentifiers-x32: [Fatlfn] -> {646BAAE7-7538-4866-8EEE-974C0AA910AB} => C:\ProgramData\gowwdyygvnef.dll [2015-09-08] ()
BootExecute: autocheck autochk * sh4native Sh4Removal

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{A50D06CC-C42F-4D25-8F81-1E557AE47DF1}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-12] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-12] (Oracle Corporation)
BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Arc\plugins\ArcPluginIE.dll [2015-07-23] (Perfect World Entertainment Inc)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-12] ()
FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-12] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-12] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-12] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation)
FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Arc\plugins\npArcPluginFF.dll [2015-07-23] (Perfect World Entertainment Inc)
FF Plugin-x32: @raidcall.en/RCplugin -> C:\Users\Zero\AppData\Roaming\raidcall\plugins\nprcplugin.dll [2014-05-27] (Raidcall)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-09] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.13\npGoogleUpdate3.dll [2015-09-09] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.pl/"
CHR Profile: C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-09-09]
CHR Extension: (YouTube) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-09]
CHR Extension: (Google Search) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-09-09]
CHR Extension: (Google Docs Offline) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-09]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-09-09]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-09-09]
CHR Extension: (Gmail) - C:\Users\Zero\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-09]

Opera: 
=======
OPR Extension: (Brak nazwy) - C:\Users\Zero\AppData\Roaming\Opera Software\Opera Stable\Extensions\akaelkiagnbfcccfnmbimdbplecgbikh [2015-09-08]
OPR Extension: (Brak nazwy) - C:\Users\Zero\AppData\Roaming\Opera Software\Opera Stable\Extensions\hdhmofnopkgkpgnpggloijpbnaonhplc [2015-09-08]
OPR Extension: (Brak nazwy) - C:\Users\Zero\AppData\Roaming\Opera Software\Opera Stable\Extensions\kfgaibfbmkjgmimhbbaikfnpkkjkpoan [2015-09-08]
OPR Extension: (Brak nazwy) - C:\Users\Zero\AppData\Roaming\Opera Software\Opera Stable\Extensions\lkadffjmnaiokkdncgdlecdegajoiemi [2015-09-08]
OPR Extension: (Brak nazwy) - C:\Users\Zero\AppData\Roaming\Opera Software\Opera Stable\Extensions\papbadoldddalgcjcicnikcfenodpghp [2015-09-08]
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe http://www.istartsurf.com/?type=sc&ts=1441744090&z=e9d71c9f486913b5c39772eg9z7z5gcm0z7c0tcb8e&from=face&uid=HitachiXHDT721032SLA360_STF204ML0U2DSP0U2DSPX

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 ArcService; C:\Program Files (x86)\Arc\ArcService.exe [88400 2015-07-23] (Perfect World Entertainment Inc)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1353720 2015-07-08] (ESET)
R2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [8704 2015-09-02] (Hi-Rez Studios) [Brak podpisu cyfrowego]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-14] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-14] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [231520 2015-07-14] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [53360 2015-07-14] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [72400 2015-07-14] (ESET)
S3 esgiguard; C:\Nasze\WWW\SpyHunter 4.20.9.4533 Portable\App\SpyHunter\esgiguard.sys [15920 2015-09-09] (Enigma Software Group USA, LLC.)
S3 hxsyol; C:\Windows\system32\hxsy64.sys [86352 2014-11-16] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.)
S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-09-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
U3 aftciaod; \??\C:\Users\Zero\AppData\Local\Temp\aftciaod.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-09-13 16:22 - 2015-09-13 16:22 - 00039366 _____ C:\Users\Zero\Downloads\Addition.txt
2015-09-13 16:21 - 2015-09-13 16:22 - 00013417 _____ C:\Users\Zero\Downloads\FRST.txt
2015-09-13 16:21 - 2015-09-13 16:22 - 00000000 ____D C:\FRST
2015-09-13 16:21 - 2015-09-13 16:21 - 02190336 _____ (Farbar) C:\Users\Zero\Downloads\FRST64.exe
2015-09-13 16:12 - 2015-09-13 16:12 - 00000000 _____ C:\Users\Zero\Desktop\Nowy dokument tekstowy (2).txt
2015-09-13 16:04 - 2014-01-28 19:36 - 00380416 _____ C:\Users\Zero\Desktop\gmer.exe
2015-09-13 16:03 - 2015-09-13 16:03 - 00370943 _____ C:\Users\Zero\Downloads\gmer.zip
2015-09-13 15:59 - 2015-09-13 15:59 - 01660416 _____ C:\Users\Zero\Downloads\AdwCleaner.exe
2015-09-13 08:09 - 2015-09-13 08:32 - 00000000 ____D C:\ProgramData\TuneUp Software
2015-09-13 08:08 - 2015-09-13 08:08 - 28385592 _____ (TuneUp Software) C:\Users\Zero\Downloads\TuneUpUtilities2014_en-US.exe
2015-09-11 22:27 - 2015-09-11 22:29 - 147210400 _____ (Microsoft Corporation) C:\Users\Zero\Downloads\msert.exe
2015-09-11 08:07 - 2015-09-11 08:23 - 00000000 ____D C:\ProgramData\HitmanPro
2015-09-11 08:02 - 2015-09-11 08:04 - 11352032 _____ (SurfRight B.V.) C:\Users\Zero\Downloads\HitmanPro_x64.exe
2015-09-09 17:30 - 2015-09-09 17:31 - 00000260 _____ C:\Users\Zero\Downloads\debug.log
2015-09-09 15:19 - 2015-09-13 16:01 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-09-09 15:19 - 2015-09-13 15:24 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-09-09 15:19 - 2015-09-09 15:19 - 00003890 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-09-09 15:19 - 2015-09-09 15:19 - 00003638 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-09-09 15:19 - 2015-09-09 15:19 - 00002261 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-09-09 15:19 - 2015-09-09 15:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-09-09 12:13 - 2015-09-09 12:13 - 00003284 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2015-09-09 10:59 - 2015-09-11 08:05 - 00158015 _____ C:\spyhunter.fix
2015-09-09 10:59 - 2015-09-09 01:24 - 00022400 _____ C:\Windows\SysWOW64\sh4native.exe
2015-09-09 09:31 - 2015-09-09 09:31 - 03237248 _____ (Enigma Software Group USA, LLC.) C:\Users\Zero\Downloads\SpyHunter-Installer.exe
2015-09-09 08:05 - 2015-09-09 08:05 - 00001128 _____ C:\Users\Zero\Desktop\JRT.txt
2015-09-09 07:23 - 2015-09-09 07:23 - 01799392 _____ (Malwarebytes Corporation) C:\Users\Zero\Downloads\JRT.exe
2015-09-09 07:06 - 2015-09-09 07:06 - 01660416 _____ C:\Users\Zero\Downloads\adwcleaner_5.007 (1).exe
2015-09-09 06:59 - 2015-09-13 16:00 - 00000000 ____D C:\AdwCleaner
2015-09-09 06:58 - 2015-09-09 06:58 - 01660416 _____ C:\Users\Zero\Downloads\adwcleaner_5.007.exe
2015-09-09 03:08 - 2015-09-09 03:08 - 00000000 ____D C:\Users\Zero\AppData\Roaming\ESET
2015-09-09 03:08 - 2015-09-09 03:08 - 00000000 ____D C:\Users\Zero\AppData\Local\ESET
2015-09-09 03:05 - 2015-09-09 03:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2015-09-09 03:05 - 2015-09-09 03:05 - 00000000 ____D C:\ProgramData\ESET
2015-09-09 03:05 - 2015-09-09 03:05 - 00000000 ____D C:\Program Files\ESET
2015-09-09 03:01 - 2015-09-09 03:02 - 95208960 _____ C:\Users\Zero\Downloads\ess_nt64_plk.msi
2015-09-09 00:43 - 2015-09-09 00:43 - 00000000 ____D C:\Windows\SysWOW64\vbox
2015-09-09 00:43 - 2015-09-09 00:43 - 00000000 ____D C:\Windows\system32\vbox
2015-09-09 00:39 - 2015-09-09 00:39 - 00000000 ____D C:\ProgramData\AVAST Software
2015-09-09 00:38 - 2015-09-09 00:38 - 05657376 _____ (AVAST Software) C:\Users\Zero\Downloads\avast_premier_antivirus_setup_online.exe
2015-09-08 23:17 - 2015-09-09 02:44 - 00001115 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2015-09-08 23:16 - 2015-09-08 23:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2015-09-08 23:16 - 2015-09-08 23:16 - 00000000 ____D C:\Program Files\VS Revo Group
2015-09-08 23:16 - 2009-12-30 11:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2015-09-08 23:02 - 2015-09-08 23:03 - 00000000 ____D C:\Users\Zero\AppData\Roaming\WB_CFG
2015-09-08 23:02 - 2015-09-08 23:02 - 00447024 _____ C:\ProgramData\gowwdyygvnef.dll
2015-09-08 23:02 - 2015-09-08 23:02 - 00000000 ____D C:\ProgramData\vakosmurhgmuvdajgmefuk
2015-09-08 23:02 - 2015-09-08 23:02 - 00000000 _____ C:\ProgramData\inf.dat
2015-09-08 22:59 - 2015-09-08 22:59 - 00000000 ____D C:\ProgramData\adb
2015-09-08 22:37 - 2015-09-13 16:01 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-09-08 22:37 - 2015-09-09 02:44 - 00001096 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-09-08 22:37 - 2015-09-08 22:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-09-08 22:37 - 2015-09-08 22:37 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-09-08 22:37 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-09-08 22:37 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-09-08 22:37 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-09-08 22:33 - 2015-09-09 02:44 - 00001054 _____ C:\Users\Public\Desktop\Special Uninstaller.lnk
2015-09-08 22:31 - 2015-09-08 22:31 - 00003152 _____ C:\Windows\System32\Tasks\{85011294-C40C-4489-ACB7-829B7ACFA856}
2015-09-08 22:30 - 2015-09-13 16:01 - 00001016 _____ C:\Windows\Tasks\kcUkSugonhjjhcSDt5kWE5ei.job
2015-09-08 22:30 - 2015-09-08 22:30 - 00004050 _____ C:\Windows\System32\Tasks\kcUkSugonhjjhcSDt5kWE5ei
2015-09-08 22:29 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\7409d675-62b6-4754-abfd-8bfec488c60e
2015-09-08 22:25 - 2015-09-13 16:01 - 00000996 _____ C:\Windows\Tasks\9UuNVKTD1p1SQA.job
2015-09-08 22:25 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\e06d9fd0-1eb7-4725-b867-4274b4b17e2f
2015-09-08 22:25 - 2015-09-08 22:25 - 00004030 _____ C:\Windows\System32\Tasks\9UuNVKTD1p1SQA
2015-09-08 22:24 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\374ea95a-d7e5-4dd9-a6b0-16c696d57ab3
2015-09-08 22:23 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\e4307fa5-386f-40c1-b746-b1e384ba8814
2015-09-08 22:22 - 2015-09-08 22:22 - 00000000 ____D C:\ppsfile
2015-09-08 22:21 - 2015-09-13 16:01 - 00000306 _____ C:\Windows\Tasks\itbh.job
2015-09-08 22:21 - 2015-09-08 23:19 - 00000000 ____D C:\Users\Zero\AppData\Local\Unity
2015-09-08 22:21 - 2015-09-08 22:21 - 00002586 _____ C:\Windows\System32\Tasks\itbh
2015-09-08 22:20 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\525dfe53-d6f4-422a-92eb-3aa6c3a183a7
2015-09-08 22:19 - 2015-09-13 16:01 - 00001004 _____ C:\Windows\Tasks\5JXwigXFj3tmdPOLow.job
2015-09-08 22:19 - 2015-09-08 23:12 - 00000000 ____D C:\Program Files (x86)\baidu
2015-09-08 22:18 - 2015-09-08 23:06 - 00000000 ____D C:\Program Files (x86)\2e5083e6-a781-40de-af3e-422e41049f96
2015-09-08 22:18 - 2015-09-08 22:29 - 00000004 _____ C:\Windows\SysWOW64\029B560A371F4E00AB32838EBC01B9E7
2015-09-08 22:18 - 2014-11-06 14:19 - 00000921 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-09-05 19:23 - 2015-09-05 19:23 - 00000000 ____D C:\Users\Zero\AppData\Local\VS Revo Group
2015-09-05 19:23 - 2015-09-05 19:23 - 00000000 ____D C:\ProgramData\VS Revo Group
2015-09-05 19:16 - 2015-09-05 19:17 - 10801984 _____ (VS Revo Group ) C:\Users\Zero\Downloads\RevoUninProSetup.exe
2015-09-05 18:53 - 2015-09-05 18:53 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Zero\Downloads\mbam-setup-2.1.8.1057.exe
2015-09-05 12:52 - 2015-09-08 23:08 - 00000000 ____D C:\Users\Zero\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-09-05 12:49 - 2015-09-09 02:44 - 00002312 _____ C:\Users\Public\Desktop\Painkiller Czarna Edycja.lnk
2015-09-05 12:41 - 2015-09-05 12:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DreamCatcher
2015-09-05 12:41 - 2015-09-05 12:41 - 00000000 ____D C:\Program Files (x86)\DreamCatcher
2015-09-05 10:21 - 2015-09-05 10:21 - 04707192 _____ (http://www.specialuninstaller.com/ ) C:\Users\Zero\Downloads\WinUninstaller_Setup.exe
2015-08-29 19:27 - 2015-08-29 19:27 - 00000000 ____D C:\ProgramData\pwd
2015-08-25 18:56 - 2015-08-25 18:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-08-18 13:11 - 2015-08-18 13:11 - 00000000 ____D C:\Users\Zero\Documents\Fax
2015-08-18 13:10 - 2015-08-18 13:10 - 00000000 ____D C:\ProgramData\Hewlett-Packard

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-09-13 16:07 - 2014-10-08 13:04 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-09-13 16:01 - 2015-07-01 22:48 - 00000000 _____ C:\Windows\system32\Drivers\lvuvc.hs
2015-09-13 16:01 - 2014-10-08 10:00 - 00000000 ____D C:\ProgramData\NVIDIA
2015-09-13 16:01 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-09-13 16:01 - 2009-07-14 06:51 - 00261528 _____ C:\Windows\setupact.log
2015-09-13 16:00 - 2014-10-08 09:31 - 01819916 _____ C:\Windows\WindowsUpdate.log
2015-09-13 16:00 - 2009-07-14 06:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-09-13 16:00 - 2009-07-14 06:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-09-13 14:09 - 2010-11-21 05:47 - 01522980 _____ C:\Windows\PFRO.log
2015-09-13 12:08 - 2015-07-25 18:08 - 00000380 _____ C:\Windows\Tasks\TouchReader.job
2015-09-12 09:36 - 2014-10-18 13:19 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2015-09-09 18:13 - 2014-09-29 17:13 - 00000703 _____ C:\Users\Zero\Desktop\火.txt
2015-09-09 18:12 - 2014-10-16 18:27 - 00000971 _____ C:\Users\Zero\Desktop\Nowy dokument tekstowy.txt
2015-09-09 17:30 - 2014-10-08 10:54 - 00000000 ____D C:\Users\Zero\AppData\Local\Google
2015-09-09 16:46 - 2014-10-08 15:06 - 00408314 _____ C:\Windows\system32\perfh011.dat
2015-09-09 16:46 - 2014-10-08 15:06 - 00121700 _____ C:\Windows\system32\perfc011.dat
2015-09-09 16:46 - 2011-02-04 19:55 - 00740040 _____ C:\Windows\system32\perfh015.dat
2015-09-09 16:46 - 2011-02-04 19:55 - 00155614 _____ C:\Windows\system32\perfc015.dat
2015-09-09 16:46 - 2009-07-14 07:13 - 02198902 _____ C:\Windows\system32\PerfStringBackup.INI
2015-09-09 15:19 - 2014-10-08 10:54 - 00000000 ____D C:\Program Files (x86)\Google
2015-09-09 12:45 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-09-09 09:33 - 2014-10-08 09:31 - 00000000 ____D C:\Users\Zero
2015-09-09 02:44 - 2015-07-03 08:43 - 00001618 _____ C:\Users\Public\Desktop\Logitech Webcam Software  .lnk
2015-09-09 02:44 - 2015-06-25 09:24 - 00001883 _____ C:\Users\Public\Desktop\Swordsman.lnk
2015-09-09 02:44 - 2015-06-25 09:24 - 00001582 _____ C:\Users\Public\Desktop\Arc.lnk
2015-09-09 02:44 - 2014-12-23 19:00 - 00002027 _____ C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk
2015-09-09 02:44 - 2014-12-23 19:00 - 00001978 _____ C:\Users\Public\Desktop\Smite.lnk
2015-09-09 02:44 - 2014-12-23 18:15 - 00000957 _____ C:\Users\Public\Desktop\Steam.lnk
2015-09-09 02:44 - 2014-11-23 15:46 - 00001132 _____ C:\Users\Public\Desktop\Diablo III.lnk
2015-09-09 02:44 - 2014-11-15 23:06 - 00002022 _____ C:\Users\Public\Desktop\Aeria Ignite.lnk
2015-09-09 02:44 - 2014-11-10 13:59 - 00001183 _____ C:\Users\Public\Desktop\Heroes of the Storm.lnk
2015-09-09 02:44 - 2014-11-10 13:39 - 00001138 _____ C:\Users\Public\Desktop\Battle.net.lnk
2015-09-09 02:44 - 2014-10-24 17:49 - 00002429 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-09-09 02:44 - 2014-10-24 17:49 - 00002013 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-09-09 02:44 - 2014-10-17 09:00 - 00001815 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-09-09 02:44 - 2014-10-17 09:00 - 00001809 _____ C:\Users\Public\Desktop\Opera.lnk
2015-09-09 02:44 - 2014-10-11 08:27 - 00001607 _____ C:\Users\Public\Desktop\League of Legends.lnk
2015-09-09 02:44 - 2014-10-08 09:26 - 00001333 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2015-09-09 02:44 - 2014-10-08 09:26 - 00001314 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2015-09-09 02:44 - 2009-07-14 06:57 - 00001511 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-09-09 02:44 - 2009-07-14 06:57 - 00001292 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2015-09-09 02:44 - 2009-07-14 06:57 - 00001234 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2015-09-09 02:44 - 2009-07-14 06:54 - 00001198 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2015-09-09 02:43 - 2015-05-30 13:53 - 00001596 _____ C:\Users\Zero\Desktop\Echo of Soul.lnk
2015-09-09 02:43 - 2015-01-07 17:37 - 00001121 _____ C:\Users\Zero\Desktop\DeSmuME.lnk
2015-09-09 02:43 - 2014-12-31 11:49 - 00001069 _____ C:\Users\Zero\Desktop\no$zoomer.lnk
2015-09-09 02:43 - 2014-12-30 19:26 - 00001168 _____ C:\Users\Zero\Desktop\VisualBoyAdvance.lnk
2015-09-09 02:43 - 2014-11-27 17:22 - 00000991 _____ C:\Users\Zero\Desktop\Curse.lnk
2015-09-09 02:43 - 2014-11-27 17:22 - 00000977 _____ C:\Users\Zero\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse.lnk
2015-09-09 02:43 - 2014-11-15 23:14 - 00001672 _____ C:\Users\Zero\Desktop\Aura Kingdom.lnk
2015-09-09 02:43 - 2014-11-15 22:01 - 00001184 _____ C:\Users\Zero\Desktop\snes9x.lnk
2015-09-09 02:43 - 2014-11-06 14:18 - 00000000 ____D C:\Users\Zero\Desktop\Aktywator
2015-09-09 02:43 - 2014-10-18 13:19 - 00001007 _____ C:\Users\Zero\Desktop\SpeedFan.lnk
2015-09-09 02:43 - 2014-10-08 13:52 - 00000762 _____ C:\Users\Zero\Desktop\WWW.lnk
2015-09-09 02:43 - 2014-10-08 11:14 - 00001031 _____ C:\Users\Zero\AppData\Roaming\Microsoft\Windows\Start Menu\RaidCall.lnk
2015-09-09 02:43 - 2014-10-08 11:14 - 00001007 _____ C:\Users\Zero\Desktop\RaidCall.lnk
2015-09-09 02:43 - 2014-10-08 09:31 - 00001421 _____ C:\Users\Zero\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-09-09 02:43 - 2009-07-14 07:01 - 00001218 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2015-09-09 02:43 - 2009-07-14 06:49 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2015-09-09 00:39 - 2015-07-02 08:01 - 00058408 _____ C:\Users\Zero\AppData\Local\GDIPFONTCACHEV1.DAT
2015-09-09 00:04 - 2014-10-08 09:31 - 00000000 ____D C:\Users\Zero\AppData\Local\VirtualStore
2015-09-08 23:12 - 2009-07-14 06:45 - 00269584 _____ C:\Windows\system32\FNTCACHE.DAT
2015-09-08 23:12 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2015-09-08 19:29 - 2014-11-10 13:40 - 00000000 ____D C:\Users\Zero\AppData\Local\Battle.net
2015-09-07 21:17 - 2014-10-08 11:46 - 00000000 ____D C:\Users\Zero\AppData\Roaming\Skype
2015-09-05 17:29 - 2015-06-25 09:24 - 00000000 ____D C:\Program Files (x86)\Arc
2015-09-05 12:49 - 2014-11-04 18:35 - 00028318 _____ C:\Windows\DirectX.log
2015-09-05 12:41 - 2014-10-08 09:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2015-09-03 08:16 - 2015-07-28 15:01 - 00000003 _____ C:\Windows\SysWOW64\HRUPPROG.TXT
2015-09-03 08:16 - 2014-11-04 17:44 - 00000000 ____D C:\Program Files (x86)\Hi-Rez Studios
2015-09-02 17:56 - 2014-11-23 15:43 - 00000000 ____D C:\Program Files (x86)\Diablo III
2015-08-28 21:18 - 2014-11-10 13:42 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2015-08-28 21:03 - 2014-11-10 13:40 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-08-26 18:21 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-25 18:56 - 2014-10-08 11:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-08-25 18:56 - 2014-10-08 11:45 - 00000000 ____D C:\ProgramData\Skype
2015-08-19 17:08 - 2015-06-25 09:25 - 00000000 ____D C:\Users\Zero\AppData\Roaming\Arc

==================== Pliki w katalogu głównym wybranych folderów =======

2015-09-08 22:20 - 2015-09-08 22:20 - 0000187 _____ () C:\Users\Zero\AppData\Local\Transfase.exe.config
2015-09-08 23:02 - 2015-09-08 23:02 - 0447024 _____ () C:\ProgramData\gowwdyygvnef.dll
2014-12-22 21:40 - 2014-12-22 21:41 - 0000684 _____ () C:\ProgramData\HirezPipeError.txt
2015-09-08 23:02 - 2015-09-08 23:02 - 0000000 _____ () C:\ProgramData\inf.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\gowwdyygvnef.dll
C:\ProgramData\inf.dat


Niektóre pliki w TEMP:
====================
C:\Users\Zero\AppData\Local\Temp\47a1ff84a92d198a4c6c49cb436372fc.dll
C:\Users\Zero\AppData\Local\Temp\6db4d0d514004a8cec4f6c85462e106b.dll
C:\Users\Zero\AppData\Local\Temp\cc4c339fab988db768c0d52ef10635ac.dll
C:\Users\Zero\AppData\Local\Temp\d4f5d244a0909d75573750c06e9db24d.dll
C:\Users\Zero\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Zero\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Zero\AppData\Local\Temp\dxwebsetup.exe
C:\Users\Zero\AppData\Local\Temp\install1804741.exe
C:\Users\Zero\AppData\Local\Temp\InstHelper.exe
C:\Users\Zero\AppData\Local\Temp\IQIYIsetup_l_huayukeji@kb005.exe
C:\Users\Zero\AppData\Local\Temp\lws_lws.exe
C:\Users\Zero\AppData\Local\Temp\qdsetup12.exe
C:\Users\Zero\AppData\Local\Temp\qqpcmgr_v11.0.16765.217_72876_Silence.exe
C:\Users\Zero\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Zero\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Zero\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Zero\AppData\Local\Temp\sfextra.dll
C:\Users\Zero\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Zero\AppData\Local\Temp\sqlite3.dll
C:\Users\Zero\AppData\Local\Temp\Uninstall.exe
C:\Users\Zero\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Zero\AppData\Local\Temp\wgjiklit_533_setup.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => MD5 jest poprawne
C:\Windows\SysWOW64\User32.dll => MD5 jest poprawne
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-09-11 22:01

==================== Koniec  FRST.txt ============================