Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:14-12-2015 Uruchomiony przez AREK (administrator) AREK-KOMPUTER (14-12-2015 19:35:38) Uruchomiony z C:\Users\AREK\Downloads Załadowane profile: AREK (Dostępne profile: AREK & Paulina & Zbigniew) Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Taiwan Shui Mu Chih Ching Technology Limited) C:\Program Files (x86)\Picexa\picexasvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Taiwan Shui Mu Chih Ching Technology Limited) C:\Program Files (x86)\WinZipper\winzipersvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgfws.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe (Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe (Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe (Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe (pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (DEVGURU Co., LTD.) C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe (Splashtop Inc.) C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc) HKLM-x32\...\Run: [STCAgent] => C:\Program Files (x86)\Splashtop\Splashtop Connect IE\STCAgent.exe [776064 2011-01-21] (Splashtop Inc.) HKLM-x32\...\Run: [ZyngaGamesAgent] => C:\Program Files (x86)\Splashtop\Splashtop Connect\ZyngaGamesAgent.exe [841544 2010-11-15] (Splashtop Inc.) HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe /AUTORUN HKLM-x32\...\Run: [PCSuiteTrayApplication] => C:\Program Files (x86)\Nokia\Nokia PC Suite 6\LaunchApplication.exe [271360 2007-06-18] (Nokia) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [Wondershare Helper Compact.exe] => C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [2072928 2014-10-31] (Wondershare) HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1136552 2015-11-12] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [3855272 2015-12-09] (AVG Technologies CZ, s.r.o.) HKU\S-1-5-21-74317436-289575424-2793545732-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3671872 2012-04-17] (DT Soft Ltd) HKU\S-1-5-21-74317436-289575424-2793545732-1000\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation) HKU\S-1-5-21-74317436-289575424-2793545732-1000\...\Policies\system: [LogonHoursAction] 2 HKU\S-1-5-21-74317436-289575424-2793545732-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\S-1-5-18\...\Run: [Nokia.PCSync] => C:\Program Files (x86)\Nokia\Nokia PC Suite 6\PcSync2.exe [1241088 2007-06-19] (Time Information Services Ltd.) Startup: C:\Users\Paulina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk [2015-12-14] ShortcutTarget: Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) GroupPolicyUsers\S-1-5-21-74317436-289575424-2793545732-1004\User: Ograniczenia <======= UWAGA GroupPolicyUsers\S-1-5-21-74317436-289575424-2793545732-1003\User: Ograniczenia <======= UWAGA CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.20 Tcpip\Parameters: [NameServer] 199.203.131.145 82.163.143.167 Tcpip\..\Interfaces\{CB860721-8BDA-4005-8E26-5C160DD7D67F}: [NameServer] 199.203.131.145 82.163.143.167,8.8.8.8,8.8.4.4 Tcpip\..\Interfaces\{CB860721-8BDA-4005-8E26-5C160DD7D67F}: [DhcpNameServer] 192.168.1.20 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1447228033&z=3e6f03e8de92d5ddb4f2578g9z4zam4o9obbfe0m8w&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1447228033&z=3e6f03e8de92d5ddb4f2578g9z4zam4o9obbfe0m8w&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-21-74317436-289575424-2793545732-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.omniboxes.com/web/?type=ds&ts=1447228033&z=3e6f03e8de92d5ddb4f2578g9z4zam4o9obbfe0m8w&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG&q={searchTerms} HKU\S-1-5-21-74317436-289575424-2793545732-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-21-74317436-289575424-2793545732-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1445846513&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t HKU\S-1-5-21-74317436-289575424-2793545732-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.omniboxes.com/web/?type=ds&ts=1447228033&z=3e6f03e8de92d5ddb4f2578g9z4zam4o9obbfe0m8w&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG&q={searchTerms} URLSearchHook: HKLM-x32 -> Domyślne = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D} SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = SearchScopes: HKLM-x32 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} SearchScopes: HKLM-x32 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = ${SEARCH_URL}{searchTerms} SearchScopes: HKU\.DEFAULT -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKU\.DEFAULT -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} SearchScopes: HKU\S-1-5-21-74317436-289575424-2793545732-1000 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} SearchScopes: HKU\S-1-5-21-74317436-289575424-2793545732-1000 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1445846513&from=zzgbkk123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=d45a88d1f69fcf52b86bc18g0zbzeweb8z5qcw5z5t&q={searchTerms} Toolbar: HKU\S-1-5-21-74317436-289575424-2793545732-1000 -> Brak nazwy - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Brak pliku StartMenuInternet: IEXPLORE.EXE - c:\program files\internet explorer\iexplore.exe hxxp://www.yoursites123.com/?type=sc&ts=1450112037&z=b087b853da6a7e27a0eae5cg2z3wfeeg9g5o4e4cam&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG FireFox: ======== FF ProfilePath: C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default FF NewTab: chrome://quick_start/content/index.html FF DefaultSearchEngine: omniboxes FF SearchEngineOrder.1: Google FF SelectedSearchEngine: omniboxes FF Homepage: hxxp://www.v9.com?type=hp&ts=1447686710&from=mych123&uid=st31000524as_6vped1vgxxxx6vped1vg&z=007d6341aa2d6e09d5207bbg2z4zbmdqcb5q0m9w0m FF NetworkProxy: "backup.ftp", "119.252.160.34" FF NetworkProxy: "backup.ftp_port", 8080 FF NetworkProxy: "backup.socks", "119.252.160.34" FF NetworkProxy: "backup.socks_port", 8080 FF NetworkProxy: "backup.ssl", "119.252.160.34" FF NetworkProxy: "backup.ssl_port", 8080 FF NetworkProxy: "ftp", "103.30.90.230" FF NetworkProxy: "ftp_port", 8080 FF NetworkProxy: "http", "103.30.90.230" FF NetworkProxy: "http_port", 8080 FF NetworkProxy: "share_proxy_settings", true FF NetworkProxy: "socks", "103.30.90.230" FF NetworkProxy: "socks_port", 8080 FF NetworkProxy: "ssl", "103.30.90.230" FF NetworkProxy: "ssl_port", 8080 FF NetworkProxy: "type", 0 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-09] () FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [Brak pliku] FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [Brak pliku] FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-09] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1215155.dll [2014-12-02] (Adobe Systems, Inc.) FF Plugin-x32: @esn/esnlaunch,version=1.110.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll [Brak pliku] FF Plugin-x32: @esn/esnlaunch,version=1.118.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll [Brak pliku] FF Plugin-x32: @esn/esnlaunch,version=1.132.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll [Brak pliku] FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [2013-11-21] (EA Digital Illusions CE AB) FF Plugin-x32: @ganymede/GanymedeNetPlugin,version=1.0 -> C:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll [2011-08-30] ( ) FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Windows\SysWOW64\npdeployJava1.dll [2015-02-03] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [Brak pliku] FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [Brak pliku] FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-12-13] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-12-13] (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku] FF Plugin-x32: @soe.sony.com/installer,version=1.0.3 -> C:\Users\AREK\AppData\LocalLow\Sony Online Entertainment\npsoe.dll [2012-03-19] () FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-02] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-74317436-289575424-2793545732-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\AREK\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-04-12] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-74317436-289575424-2793545732-1000: electronicarts.com/GameFacePlugin -> C:\Users\AREK\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll [2012-07-27] (Electronic Arts) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npganymedenet.dll [2011-08-30] ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-29] (Adobe Systems Inc.) FF SearchPlugin: C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\searchplugins\delta-homes.xml [2015-10-26] FF SearchPlugin: C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\searchplugins\mystartsearch.xml [2015-10-14] FF SearchPlugin: C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\searchplugins\omniboxes.xml [2015-12-13] FF SearchPlugin: C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\searchplugins\v9-.xml [2015-12-01] FF Extension: xRocket Toolbar - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\arthurj8283@gmail.com [2015-11-16] [Brak podpisu cyfrowego] FF Extension: Default NewTab - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\default_newtabff@gmail.com [2015-10-21] [Brak podpisu cyfrowego] FF Extension: Default SearchProtected - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\defsearchp@gmail.com.xpi [2015-10-21] [Brak podpisu cyfrowego] FF Extension: sidebar - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\sidebarff@gmail.com [2015-11-07] [Brak podpisu cyfrowego] FF Extension: YahooToolsProtected - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\yahooprotected@gmail.com [2015-12-02] [Brak podpisu cyfrowego] FF Extension: Brak nazwy - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\Extensions\defsearchp@gmail.com [2015-11-18] [Brak podpisu cyfrowego] FF Extension: Adblock Plus - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-11-29] FF Extension: z - C:\Program Files (x86)\Mozilla Firefox\extensions\{14a245ea-8e79-e9fb-f863-ca42bc14046a} [2015-07-14] [Brak podpisu cyfrowego] FF Extension: z - C:\Program Files (x86)\Mozilla Firefox\extensions\{2c2e30f8-4bdb-82c4-cd12-61daca5bca84} [2015-07-14] [Brak podpisu cyfrowego] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-07-14] [Brak podpisu cyfrowego] FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-10] [Brak podpisu cyfrowego] FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\defsearchp@gmail.com FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\deskCutv2@gmail.com => nie znaleziono FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\default_newtabff@gmail.com FF HKLM-x32\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\sidebarff@gmail.com FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\arthurj8283@gmail.com FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\AREK\AppData\Roaming\Mozilla\Firefox\Profiles\g4evef9w.default\extensions\yahooprotected@gmail.com FF HKU\S-1-5-21-74317436-289575424-2793545732-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi => nie znaleziono StartMenuInternet: FIREFOX.EXE - c:\program files (x86)\mozilla firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1450112037&z=b087b853da6a7e27a0eae5cg2z3wfeeg9g5o4e4cam&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG Chrome: ======= CHR HomePage: Default -> hxxp://google.pl/ CHR StartupUrls: Default -> "hxxp://google.pl/" CHR DefaultSearchURL: Default -> hxxps://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR DefaultSearchKeyword: Default -> google.com_ CHR DefaultSuggestURL: Default -> hxxps://www.google.com/complete/search?q={searchTerms} CHR Profile: C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Dysk Google) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-27] [UpdateUrl: hxxps://mynamedomain.koko/00] <==== UWAGA CHR Extension: (YouTube) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-27] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA CHR Extension: (Google Search) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-27] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA CHR Extension: (Clear Cache) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\cppjkneekbjaeellbfkmgnhonkkjfpdn [2015-09-16] CHR Extension: (HTTPS Everywhere) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2015-10-24] CHR Extension: (AdBlock) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-04] CHR Extension: (Ghostery) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\mlomiejdfkolichcflejclcbmpeaniij [2015-10-24] CHR Extension: (Google Wallet) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-27] [UpdateUrl: hxxps://mynamedomain.koko/00] <==== UWAGA CHR Extension: (Gmail) - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-27] [UpdateUrl: hxxp://mynamedomain.koko/00] <==== UWAGA CHR HKLM\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07] CHR HKU\S-1-5-21-74317436-289575424-2793545732-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [kfecnpmgnlnbmipaogfhoacoioifjgko] - hxxp://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\AREK\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07] CHR HKLM-x32\...\Chrome\Extension: [kfecnpmgnlnbmipaogfhoacoioifjgko] - hxxp://clients2.google.com/service/update2/crx StartMenuInternet: Google Chrome - c:\program files (x86)\google\chrome\application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1450112037&z=b087b853da6a7e27a0eae5cg2z3wfeeg9g5o4e4cam&from=wpm07173&uid=ST31000524AS_6VPED1VGXXXX6VPED1VG ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [615584 2015-12-09] (AVG Technologies CZ, s.r.o.) R2 avgfws; C:\Program Files (x86)\AVG\Av\avgfws.exe [1587128 2015-12-09] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagent.exe [3857272 2015-12-09] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1046952 2015-11-12] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe [579776 2015-12-09] (AVG Technologies CZ, s.r.o.) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation) S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2011-11-09] () [Brak podpisu cyfrowego] R2 MSSQL$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation) S4 msvsmon90; C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x64\msvsmon.exe [4737024 2008-07-29] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation) S3 Origin Client Service; D:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2015-12-09] (Electronic Arts) R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR) R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR) R2 PicexaService; C:\Program Files (x86)\Picexa\PicexaSvc.exe [731784 2015-12-09] (Taiwan Shui Mu Chih Ching Technology Limited) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-07-13] () S3 PrintNotify; C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll [2675200 2012-07-25] (Microsoft Corporation) [Brak podpisu cyfrowego] S4 SQLAgent$SQLEXPRESS; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation) R2 ss_conn_service; C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.) R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [711344 2015-12-09] (Taiwan Shui Mu Chih Ching Technology Limited) <==== UWAGA ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2014-07-28] () R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [184240 2015-11-06] (AVG Technologies CZ, s.r.o.) R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [97208 2015-08-29] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [313776 2015-11-06] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [298416 2015-08-20] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [284080 2015-10-21] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [398256 2015-08-14] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [256432 2015-11-06] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [42416 2015-08-10] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [302000 2015-10-08] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-08-11] (AVG Technologies) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-05-18] (DT Soft Ltd) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2014-07-28] () R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2014-07-28] (Duplex Secure Ltd.) S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [206080 2014-10-13] (DEVGURU Co., LTD.(www.devguru.co.kr)) R3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] () S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 FXDrv32; \??\E:\FXDrv64.sys [X] S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X] S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X] S3 tsusbhub; system32\drivers\tsusbhub.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] S3 wanatw; system32\DRIVERS\wanatw64.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-12-14 19:35 - 2015-12-14 19:36 - 00033006 _____ C:\Users\AREK\Downloads\FRST.txt 2015-12-14 19:35 - 2015-12-14 19:35 - 00000000 ____D C:\FRST 2015-12-14 19:34 - 2015-12-14 19:34 - 02369536 _____ (Farbar) C:\Users\AREK\Downloads\FRST64.exe 2015-12-14 19:33 - 2015-12-14 19:33 - 00055848 _____ C:\Users\AREK\Downloads\Addition.txt 2015-12-14 18:06 - 2015-12-14 18:06 - 00000000 ____D C:\Users\AREK\AppData\Roaming\AVG 2015-12-14 18:05 - 2015-12-14 18:05 - 00000936 _____ C:\Users\Public\Desktop\AVG Protection.lnk 2015-12-14 18:05 - 2015-12-14 18:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2015-12-14 18:05 - 2015-12-14 18:05 - 00000000 ____D C:\Program Files\Common Files\AV 2015-12-14 18:04 - 2015-12-14 18:04 - 00000000 ___HD C:\$AVG 2015-12-14 18:00 - 2015-12-14 18:00 - 00000000 ____D C:\Users\AREK\AppData\Local\MFAData 2015-12-14 17:59 - 2015-12-14 18:04 - 00000000 ____D C:\ProgramData\Avg 2015-12-14 17:57 - 2015-12-14 18:06 - 00000000 ____D C:\Users\AREK\AppData\Local\Avg 2015-12-14 17:57 - 2015-12-14 18:00 - 00000000 ____D C:\Users\AREK\AppData\Local\AvgSetupLog 2015-12-14 17:57 - 2015-12-14 17:57 - 02970096 _____ (AVG Technologies CZ, s.r.o.) C:\Users\AREK\Downloads\AVG_Antivirus_Free_692.exe 2015-12-14 17:53 - 2015-12-14 18:05 - 00000000 ____D C:\ProgramData\HWdMH 2015-12-13 20:57 - 2015-12-13 20:57 - 00049126 ____X C:\Users\AREK\Desktop\ArekGajdaPrzelewGrudzień.pdf 2015-12-13 20:57 - 2015-12-13 20:57 - 00049126 _____ C:\Users\AREK\Downloads\Potwierdzenie wykonania operacji_20151213_205704.pdf 2015-12-13 20:55 - 2015-12-13 20:55 - 00049156 _____ C:\Users\AREK\Downloads\Potwierdzenie wykonania operacji_20150928_210953 (1).pdf 2015-12-11 07:39 - 2015-12-14 18:48 - 00000000 ____D C:\ProgramData\8WdM8 2015-12-11 07:39 - 2015-12-14 18:26 - 00000000 ____D C:\Program Files (x86)\Picexa 2015-12-11 07:39 - 2015-12-11 07:39 - 00001785 _____ C:\Users\Public\Desktop\Picexa.lnk 2015-12-11 07:39 - 2015-12-11 07:39 - 00000000 ____D C:\Users\AREK\AppData\Roaming\Picexa Viewer 2015-12-11 07:39 - 2015-12-11 07:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picexa 2015-12-09 16:43 - 2015-12-09 16:43 - 00049428 ____X C:\Users\AREK\Desktop\opłata za rezerwacje.pdf 2015-12-09 16:43 - 2015-12-09 16:43 - 00049428 _____ C:\Users\AREK\Downloads\TA_PdfFileTitle_20151209_164337.pdf 2015-12-05 23:42 - 2015-12-05 23:42 - 00000509 ____X C:\Users\AREK\Desktop\Programy i funkcje — skrót.lnk 2015-12-05 20:59 - 2015-12-05 20:59 - 00217210 ____X C:\Users\AREK\Desktop\cc_20151205_205932.reg 2015-12-05 20:53 - 2015-12-05 20:53 - 06801752 _____ (Piriform Ltd) C:\Users\AREK\Downloads\ccsetup512.exe 2015-12-03 21:01 - 2015-12-03 21:01 - 00072884 ____X C:\Users\AREK\Desktop\Zwrot.pdf 2015-12-02 16:41 - 2015-12-14 17:53 - 00000000 ____D C:\ProgramData\cWMiniProc 2015-12-01 21:15 - 2015-12-01 21:15 - 00002333 _____ C:\Users\AREK\Downloads\hist.txt 2015-11-25 20:48 - 2015-11-25 20:48 - 00000990 _____ C:\Users\AREK\Downloads\Formulo (3).rar 2015-11-25 20:48 - 2015-11-25 20:23 - 00000574 ____X C:\Users\AREK\Desktop\formulo.php 2015-11-25 20:38 - 2015-11-25 20:38 - 00000990 _____ C:\Users\AREK\Downloads\Formulo (2).rar 2015-11-25 20:35 - 2015-11-25 20:35 - 00000990 _____ C:\Users\AREK\Downloads\Formulo (1).rar 2015-11-25 20:34 - 2015-11-25 20:35 - 00000000 ___DX C:\Users\AREK\Desktop\Nowy folder (2) 2015-11-25 20:34 - 2015-11-25 20:34 - 00000990 _____ C:\Users\AREK\Downloads\Formulo.rar 2015-11-24 21:15 - 2015-11-24 21:15 - 00000000 ___DX C:\Users\AREK\Desktop\rozkład jazdy 2015-11-24 18:21 - 2015-11-24 18:34 - 01212416 ____X C:\Users\AREK\Desktop\ArkadiuszGajdaHurtownia4D.accdb 2015-11-24 18:21 - 2015-11-24 18:21 - 00610304 _____ C:\Users\AREK\Downloads\Hurtownia komputerowa_JedrzejczykDaniel.accdb 2015-11-23 20:47 - 2015-11-23 20:47 - 00004246 _____ C:\Users\AREK\AppData\LocalLow\wbk438D.tmp 2015-11-23 20:17 - 2015-11-23 20:17 - 00598084 _____ C:\Users\AREK\Downloads\firma.es.pptx 2015-11-22 21:37 - 2015-11-22 23:45 - 00585728 ____X C:\Users\AREK\Desktop\hurtownia.accdb 2015-11-22 21:12 - 2015-11-22 23:45 - 01261568 _____ C:\Users\AREK\Downloads\hurtownia_2000 (1).mdb 2015-11-22 21:11 - 2015-11-22 21:37 - 00917504 _____ C:\Users\AREK\Documents\Database3.accdb 2015-11-22 21:10 - 2015-11-22 21:10 - 01261568 _____ C:\Users\AREK\Downloads\hurtownia_2000.mdb 2015-11-22 21:09 - 2015-11-22 21:09 - 00288768 _____ C:\Users\AREK\Downloads\zalzao.mdb 2015-11-22 21:05 - 2015-11-22 21:11 - 02449408 _____ C:\Users\AREK\Downloads\sklep_komputerowy.mdb 2015-11-22 21:02 - 2015-11-22 21:09 - 00454656 _____ C:\Users\AREK\Documents\Database2.accdb 2015-11-19 19:08 - 2015-11-19 19:09 - 02543239 _____ C:\Users\AREK\Downloads\Obwody_prądu_stałego_-_podręcznik_dla_uczniów (1).pdf 2015-11-19 19:07 - 2015-11-19 19:07 - 02543239 _____ C:\Users\AREK\Downloads\Obwody_prądu_stałego_-_podręcznik_dla_uczniów.pdf 2015-11-18 21:50 - 2015-11-18 21:51 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2015-11-18 21:50 - 2015-11-18 21:50 - 00002047 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk 2015-11-18 21:31 - 2015-11-18 21:31 - 00003158 _____ C:\Windows\System32\Tasks\{868DD70B-A316-40BA-913F-576201D499A5} 2015-11-18 17:07 - 2015-11-18 17:08 - 00033931 _____ C:\Users\AREK\Downloads\pobrane (3) 2015-11-16 20:22 - 2015-11-16 20:22 - 00213911 _____ C:\Users\AREK\Downloads\lightbox2-master.zip 2015-11-16 18:31 - 2015-11-16 20:23 - 00000000 ___DX C:\Users\AREK\Desktop\Nowy folder 2015-11-16 18:31 - 2015-11-16 18:31 - 00001886 _____ C:\Users\AREK\Downloads\example.rar 2015-11-15 20:50 - 2015-11-15 20:50 - 00002439 _____ C:\Users\AREK\Downloads\lcodzienny2.zip 2015-11-15 20:48 - 2015-11-15 20:48 - 00000530 _____ C:\Users\AREK\Downloads\Licznik.zip 2015-11-15 18:59 - 2015-11-15 18:59 - 00003773 _____ C:\Users\AREK\Downloads\ksi__garnia.sql 2015-11-14 14:15 - 2015-11-14 14:15 - 00000222 ____X C:\Users\AREK\Desktop\DARK SOULS II Scholar of the First Sin.url ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-12-14 19:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows 2015-12-14 19:15 - 2011-09-26 16:03 - 00000000 ____D C:\ProgramData\MFAData 2015-12-14 18:55 - 2012-07-04 18:07 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-12-14 18:50 - 2015-11-11 08:48 - 00000000 ____D C:\ProgramData\ZWMiniProZ 2015-12-14 18:50 - 2015-11-11 08:47 - 00000000 ____D C:\ProgramData\vWMiniProv 2015-12-14 18:48 - 2015-10-14 09:19 - 00000000 ____D C:\ProgramData\DWdsManProD 2015-12-14 18:48 - 2013-03-27 18:59 - 00000000 ____D C:\ProgramData\Boroowsee2save 2015-12-14 18:47 - 2015-09-07 19:20 - 00000000 ____D C:\Program Files (x86)\RelayAppend 2015-12-14 18:47 - 2015-08-26 08:20 - 00000000 ____D C:\Program Files (x86)\TrimEdit 2015-12-14 18:46 - 2015-09-07 19:15 - 00000000 ____D C:\Program Files (x86)\LighterModule 2015-12-14 18:46 - 2015-05-01 08:04 - 00000000 ____D C:\Program Files (x86)\Avant Downloader 2015-12-14 18:39 - 2015-10-24 08:28 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-12-14 18:33 - 2009-07-14 05:45 - 00017472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-12-14 18:33 - 2009-07-14 05:45 - 00017472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-12-14 18:26 - 2015-10-14 09:21 - 00000000 ____D C:\Program Files (x86)\WinZipper 2015-12-14 18:23 - 2015-10-24 08:28 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-12-14 18:23 - 2015-10-14 09:20 - 00000000 ____D C:\Users\AREK\AppData\Roaming\TSv 2015-12-14 18:23 - 2011-09-26 15:59 - 00000000 ____D C:\ProgramData\NVIDIA 2015-12-14 18:23 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-12-14 18:21 - 2015-06-11 12:58 - 00000000 ____D C:\Program Files (x86)\Smarmy Hall 2015-12-14 18:08 - 2015-10-14 09:21 - 00000000 ____D C:\Program Files (x86)\SFK 2015-12-14 18:04 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2015-12-14 18:03 - 2011-09-26 16:04 - 00000000 ____D C:\Program Files (x86)\AVG 2015-12-14 17:54 - 2015-10-06 16:36 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat 2015-12-14 17:53 - 2015-10-06 16:35 - 00002532 ____X C:\Users\AREK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder.lnk 2015-12-14 16:44 - 2013-06-19 18:39 - 00000936 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-74317436-289575424-2793545732-1003UA.job 2015-12-13 22:51 - 2014-12-28 21:08 - 00000000 ____D C:\Program Files (x86)\Steam 2015-12-13 19:44 - 2013-06-19 18:39 - 00000914 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-74317436-289575424-2793545732-1003Core.job 2015-12-10 21:41 - 2015-10-24 08:29 - 00002481 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2015-12-09 19:55 - 2012-07-04 18:07 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-12-09 19:55 - 2012-07-04 18:07 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-12-09 19:55 - 2011-09-26 19:29 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-12-09 17:19 - 2011-12-24 17:51 - 00000000 ____D C:\ProgramData\Origin 2015-12-05 23:48 - 2015-10-06 16:35 - 00000000 ____D C:\Users\AREK\AppData\Roaming\WarThunder 2015-12-05 23:44 - 2011-09-26 15:51 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2015-12-05 23:38 - 2014-05-25 12:56 - 00000000 ____D C:\Users\AREK\AppData\Roaming\IrfanView 2015-12-05 23:37 - 2011-12-25 11:35 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins 2015-12-05 23:33 - 2011-11-07 20:46 - 00000000 ____D C:\Program Files (x86)\Brother 2015-12-05 21:02 - 2012-05-18 15:48 - 00000000 ____D C:\Users\AREK\AppData\Roaming\DAEMON Tools Lite 2015-12-04 16:48 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2015-12-02 16:40 - 2015-06-24 10:07 - 00001447 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-12-02 16:40 - 2015-06-24 10:07 - 00001435 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-12-02 16:40 - 2011-09-26 15:44 - 00001709 _____ C:\Users\AREK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-12-02 11:34 - 2015-10-24 08:28 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-12-02 11:34 - 2015-10-24 08:28 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-11-23 09:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF 2015-11-18 21:51 - 2015-06-29 18:26 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2015-11-18 21:50 - 2012-01-13 18:17 - 00000000 ____D C:\Program Files (x86)\Adobe 2015-11-18 21:50 - 2011-09-28 16:24 - 00000000 ____D C:\ProgramData\Adobe 2015-11-18 21:39 - 2012-04-14 11:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UBISOFT 2015-11-18 21:39 - 2011-10-04 16:28 - 00000000 ____D C:\Program Files (x86)\Ubisoft 2015-11-18 21:33 - 2011-09-26 15:51 - 00000000 ___HD C:\Program Files (x86)\Temp 2015-11-18 21:32 - 2015-10-06 16:36 - 00000000 ____D C:\Users\AREK\AppData\Roaming\mystartsearch 2015-11-18 21:32 - 2012-11-16 16:59 - 00000862 _____ C:\Users\Public\Desktop\The War Z.lnk 2015-11-16 20:27 - 2015-11-05 17:28 - 00000000 ___DX C:\Users\AREK\Desktop\strona 2015-11-14 14:33 - 2014-10-05 10:26 - 00000000 ____D C:\Users\AREK\AppData\Roaming\DarkSoulsII 2015-11-14 14:15 - 2013-12-10 22:42 - 00000000 ____D C:\Users\AREK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-04-15 15:00 - 2015-04-15 15:00 - 0000079 _____ () C:\Program Files (x86)\prefs.js 2015-05-15 09:33 - 2015-08-25 22:28 - 0000024 _____ () C:\Users\AREK\AppData\Roaming\appdataFr25.bin 2015-02-03 09:09 - 2015-05-13 09:58 - 0000020 _____ () C:\Users\AREK\AppData\Roaming\appdataFr3.bin 2011-11-04 19:55 - 2013-06-26 22:34 - 0000186 _____ () C:\Users\AREK\AppData\Roaming\default.rss 2012-11-20 15:44 - 2012-11-20 15:44 - 0000000 _____ () C:\Users\AREK\AppData\Roaming\downloads.m3u 2013-12-19 15:09 - 2015-03-22 11:06 - 0000134 _____ () C:\Users\AREK\AppData\Roaming\WB.CFG 2011-10-25 17:51 - 2011-10-25 17:52 - 0003584 _____ () C:\Users\AREK\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2015-10-18 14:00 - 2015-10-18 14:00 - 0004358 _____ () C:\Users\AREK\AppData\Local\recently-used.xbel 2015-09-07 19:14 - 2015-09-07 19:14 - 0000000 _____ () C:\Users\AREK\AppData\Local\Temp.dat 2011-11-17 17:34 - 2011-11-17 17:34 - 0000000 _____ () C:\Users\AREK\AppData\Local\{233B92F5-B77D-4F56-BF59-C5CDE55540A2} 2011-11-25 21:03 - 2011-11-25 21:04 - 0000000 _____ () C:\Users\AREK\AppData\Local\{A4A91293-7A2E-41CA-AC85-9F671E249DB6} 2011-11-18 18:50 - 2011-11-18 18:51 - 0000000 _____ () C:\Users\AREK\AppData\Local\{D9DFDDF7-534F-485C-B6C2-9D0E058D8405} 2011-11-17 17:37 - 2011-11-17 17:37 - 0000000 _____ () C:\Users\AREK\AppData\Local\{E0FE5093-7606-4F35-8A61-87E758D61A9C} 2011-11-18 18:50 - 2011-11-18 18:51 - 0000000 _____ () C:\Users\AREK\AppData\Local\{F20AEB03-E00F-40AF-AA01-B1C4DD28B677} 2011-10-19 17:25 - 2011-10-19 17:25 - 0000000 _____ () C:\Users\AREK\AppData\Local\{FC1DE9E0-6979-4AA9-8B3A-2ABDDD40B7AD} 2013-04-30 11:25 - 2013-04-30 11:25 - 0000057 _____ () C:\ProgramData\Ament.ini 2015-10-06 16:36 - 2015-12-14 17:54 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat Pliki do przeniesienia lub usunięcia: ==================== C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat C:\Users\AREK\steam_api.dll Niektóre pliki w TEMP: ==================== C:\Users\AREK\AppData\Local\Temp\gg10.upgr.exe C:\Users\AREK\AppData\Local\Temp\iv_uninstall.exe C:\Users\AREK\AppData\Local\Temp\_isB89A.exe C:\Users\Zbigniew\AppData\Local\Temp\simbo.exe ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2015-12-10 16:34 ==================== Koniec FRST.txt ============================