Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:16-12-2015 02
Uruchomiony przez User (administrator)  USER-KOMPUTER (17-12-2015 16:40:45)
Uruchomiony z C:\Users\User\Desktop\wirusy
Załadowane profile: User (Dostępne profile: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 9 (Domyślna przeglądarka: Opera)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\ng\ngservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(BitTorrent, Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe
(ALLPlayer Group Ltd.) C:\Program Files (x86)\ALLPlayer Remote\ALLPlayerRemoteControl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(GOG.com) C:\Program Files (x86)\GalaxyClient\GalaxyClient Helper.exe
(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\34.0.2036.25\opera.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13423688 2013-02-26] (Realtek Semiconductor)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-04-11] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [amd_dc_opt] => C:\Program Files (x86)\AMD\Dual-Core Optimizer\amd_dc_opt.exe [77824 2008-07-22] (AMD)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [56080 2015-10-01] (Raptr, Inc)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1075296 2013-04-25] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5515496 2015-06-14] (Avast Software s.r.o.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-07-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-11-09] (Oracle Corporation)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [uTorrent] => C:\Program Files (x86)\uTorrent\uTorrent.exe [328568 2013-09-24] (BitTorrent, Inc.)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [ALLUpdate] => C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [2765256 2015-04-27] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673696 2013-08-01] (Disc Soft Ltd)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [GG] => "C:\Users\User\AppData\Local\GG\Application\gghub.exe"
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [Plex Media Server] => C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [4525192 2014-08-01] (Plex, Inc.)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3638256 2015-11-19] (Electronic Arts)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3013712 2015-12-14] (Valve Corporation)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [Napisy24Update] => C:\Program Files (x86)\Napisy24\Napisy24Update.exe [2790344 2015-03-12] (Napisy24.pl)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [ALLPlayer WiFi Remote] => C:\Program Files (x86)\ALLPlayer Remote\ALLPlayerRemoteControl.exe [5182896 2014-07-23] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [Napisy24.pl] => C:\Program Files (x86)\Napisy24\Napisy24.exe [5509064 2015-07-29] (Napisy24.pl)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\Run: [GalaxyClient] => C:\Program Files (x86)\GalaxyClient\GalaxyClient.exe [7744568 2015-10-14] (GOG.com)
HKU\S-1-5-21-1760844222-3365795311-1753932860-1000\...\MountPoints2: {e6860a6a-c7ec-11e3-9964-94de80b746f5} - E:\setup.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-06-13] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
GroupPolicy: Ograniczenia - Chrome <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{9C2461D8-FC2C-459C-B1E4-280BFEDCED1F}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{CEBC3A67-612A-491C-93B3-8A4540F2EDCD}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-12-12] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-06-13] (Avast Software s.r.o.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-12] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-06-13] (Avast Software s.r.o.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)

Opera: 
=======
OPR Extension: (YouTube Center) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\cdcifocibecgcgigbanojipblimlaoij [2015-07-22]
OPR Extension: (YouWatch) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\lolpdhiocgjpmamiogamfejeakmnlehj [2015-07-22]
OPR Extension: (Adblock Plus) - C:\Users\User\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2015-12-01]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-06-13] (Avast Software s.r.o.)
R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [4034896 2015-06-13] (Avast Software)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1616440 2015-10-14] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7184440 2015-12-08] (GOG.com)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-04-11] (Intel Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2099720 2015-11-19] (Electronic Arts)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-06-13] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-06-13] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-06-13] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-06-13] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-06-13] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-06-26] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-06-13] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-06-13] ()
S3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [29184 2009-08-13] (CSR, plc)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-14] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 MotioninJoyXFilter; C:\Windows\System32\DRIVERS\MijXfilt.sys [115272 2012-03-25] (MotioninJoy) [Brak podpisu cyfrowego]
S3 RtkBtFilter; C:\Windows\System32\DRIVERS\RtkBtfilter.sys [585944 2014-12-18] (Realtek Semiconductor Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2014-04-19] (Duplex Secure Ltd.)
R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [273824 2015-06-13] (Avast Software)
U3 aunkrx8l; C:\Windows\System32\Drivers\aunkrx8l.sys [0 ] (Microsoft Corporation) <==== UWAGA (zerobajtowy plik/folder)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-17 16:26 - 2015-12-17 16:26 - 00003148 _____ C:\Windows\System32\Tasks\{EA7E4F0B-B522-4DB7-80FD-4ECA9947398A}
2015-12-16 17:06 - 2015-12-17 16:40 - 00000000 ____D C:\FRST
2015-12-16 16:59 - 2015-12-17 16:40 - 00000000 ____D C:\Users\User\Desktop\wirusy
2015-12-12 02:39 - 2015-12-12 02:39 - 00110176 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2015-12-12 02:39 - 2015-12-12 02:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-12-12 01:35 - 2015-12-12 01:35 - 00000000 ____D C:\Users\User\AppData\Roaming\Sun
2015-12-12 01:35 - 2015-12-12 01:35 - 00000000 ____D C:\Users\User\.oracle_jre_usage
2015-12-11 12:39 - 2015-12-11 13:05 - 00000000 ____D C:\Users\User\Downloads\Taken (2008) [1080p]
2015-12-07 11:51 - 2015-12-07 11:51 - 00000000 ____D C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera Password Recovery
2015-12-07 11:51 - 2015-12-07 11:51 - 00000000 ____D C:\Program Files (x86)\Passcape
2015-12-03 17:25 - 2015-12-03 17:25 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2015-12-03 17:25 - 2015-12-03 17:25 - 00000000 ____D C:\Program Files\Common Files\AV
2015-11-27 01:08 - 2015-11-27 01:08 - 00000742 _____ C:\Users\User\Desktop\StarCraft II Offline — skrót.lnk
2015-11-25 23:23 - 2015-11-25 23:29 - 00000000 ____D C:\Users\User\Documents\StarCraft II
2015-11-25 13:04 - 2015-11-25 13:04 - 00000567 _____ C:\Users\Public\Desktop\StarCraft II.lnk
2015-11-25 13:04 - 2015-11-25 13:04 - 00000567 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StarCraft II.lnk
2015-11-21 08:43 - 2015-11-21 08:43 - 00000000 ____D C:\Users\User\Documents\HardWest
2015-11-20 18:16 - 2015-11-20 18:16 - 00000851 _____ C:\Users\User\Desktop\Hard West.lnk
2015-11-20 18:16 - 2015-11-20 18:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hard West
2015-11-19 18:05 - 2015-11-19 18:05 - 00782808 _____ C:\Windows\Minidump\111915-16083-01.dmp
2015-11-19 17:56 - 2015-11-19 18:05 - 644239835 _____ C:\Windows\MEMORY.DMP
2015-11-19 17:56 - 2015-11-19 17:56 - 00782808 _____ C:\Windows\Minidump\111915-18579-01.dmp
2015-11-19 17:38 - 2015-11-19 17:38 - 00000832 _____ C:\Users\User\Desktop\Game of Thrones Episode 6.lnk
2015-11-19 17:37 - 2015-11-19 17:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game of Thrones Episode 6

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-17 16:36 - 2013-09-14 11:16 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-17 16:32 - 2015-08-26 17:57 - 00000000 ____D C:\Users\User\AppData\Local\Xmas Mix
2015-12-17 16:32 - 2013-09-24 11:27 - 00000000 ____D C:\Users\User\AppData\Roaming\uTorrent
2015-12-17 16:31 - 2015-07-02 10:29 - 00000000 ____D C:\Program Files (x86)\MyFree Codec
2015-12-17 16:22 - 2015-03-02 17:54 - 00000000 ____D C:\Program Files (x86)\Steam
2015-12-17 16:02 - 2014-09-05 18:40 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-12-17 16:02 - 2014-05-27 16:43 - 00000000 ____D C:\Users\User\AppData\Roaming\Raptr
2015-12-17 16:02 - 2013-09-13 15:12 - 00110128 _____ C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2015-12-17 16:01 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-17 16:01 - 2009-07-14 05:45 - 05033296 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-17 15:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2015-12-17 15:59 - 2009-07-14 03:34 - 00000580 _____ C:\Windows\win.ini
2015-12-17 15:30 - 2013-09-27 10:36 - 00000000 ____D C:\Users\User\AppData\Roaming\GG
2015-12-16 17:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2015-12-15 18:43 - 2013-09-14 12:18 - 00000000 ____D C:\Program Files (x86)\Opera
2015-12-15 18:41 - 2013-09-15 15:10 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2015-12-15 16:26 - 2010-11-21 08:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2015-12-15 16:25 - 2013-11-20 12:32 - 00000000 ____D C:\Users\User\AppData\Roaming\Media Player Classic
2015-12-12 02:39 - 2014-06-08 20:02 - 00000000 ____D C:\Program Files\Java
2015-12-12 01:36 - 2014-04-06 10:33 - 00000000 ____D C:\Program Files (x86)\Java
2015-12-10 11:53 - 2015-07-22 07:42 - 00003898 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1437547343
2015-12-09 01:36 - 2013-09-14 11:16 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-09 01:36 - 2013-09-14 11:16 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-09 01:36 - 2013-09-14 11:16 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-07 11:59 - 2013-09-13 15:58 - 01691862 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-12-07 11:59 - 2011-02-04 18:20 - 00742356 _____ C:\Windows\system32\perfh015.dat
2015-12-07 11:59 - 2011-02-04 18:20 - 00156374 _____ C:\Windows\system32\perfc015.dat
2015-12-07 11:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2015-12-04 15:33 - 2014-01-12 12:39 - 00000000 ____D C:\ProgramData\Origin
2015-12-03 19:03 - 2014-12-06 22:13 - 00000000 ____D C:\Users\User\AppData\Local\Battle.net
2015-12-03 18:13 - 2014-12-06 22:13 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-11-25 23:23 - 2014-12-06 22:13 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2015-11-20 20:41 - 2009-07-14 06:13 - 01666088 _____ C:\Windows\system32\PerfStringBackup.INI
2015-11-19 18:10 - 2014-12-10 19:25 - 00000000 ____D C:\Program Files (x86)\Origin
2015-11-19 18:05 - 2014-12-27 20:30 - 00000000 ____D C:\Windows\Minidump
2015-11-19 17:41 - 2013-12-15 16:41 - 00000000 ____D C:\Users\User\Documents\Telltale Games
2015-11-19 17:26 - 2013-09-14 12:08 - 00000000 ____D C:\Users\User\AppData\Roaming\DAEMON Tools Lite

==================== Pliki w katalogu głównym wybranych folderów =======

2013-09-14 12:19 - 2013-09-14 12:19 - 0000088 _____ () C:\Users\User\AppData\Roaming\WB.CFG
2015-10-26 18:39 - 2015-11-13 20:39 - 0004608 _____ () C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-21 20:39 - 2015-01-28 19:38 - 0007602 _____ () C:\Users\User\AppData\Local\Resmon.ResmonCfg

Niektóre pliki w TEMP:
====================
C:\Users\User\AppData\Local\Temp\1525.exe
C:\Users\User\AppData\Local\Temp\1682.exe
C:\Users\User\AppData\Local\Temp\2067.exe
C:\Users\User\AppData\Local\Temp\341.exe
C:\Users\User\AppData\Local\Temp\FramedDisplayUntemp.exe
C:\Users\User\AppData\Local\Temp\ggdrive-menu.exe
C:\Users\User\AppData\Local\Temp\ggdrive-overlay.exe
C:\Users\User\AppData\Local\Temp\installstats.exe
C:\Users\User\AppData\Local\Temp\Napisy24.exe
C:\Users\User\AppData\Local\Temp\rldfw32_s13k.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s1fo.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s31k.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s3eg.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s3fk.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s3hs.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s488.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s4g8.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s4h0.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s4l4.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s5f0.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s5pc.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s5s8.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s5tk.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s624.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s62k.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s648.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s64o.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s66s.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s698.dll
C:\Users\User\AppData\Local\Temp\rldfw32_s6fs.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s1hc.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s2hk.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s330.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s3ps.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s4k0.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s4kg.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s4oo.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s5g8.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s5hs.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s63o.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s670.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6c4.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6c8.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6h8.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6hk.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6lg.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6m4.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6ts.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6vg.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s6vo.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s8gg.dll
C:\Users\User\AppData\Local\Temp\rldfw64_s8oc.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll
[2010-11-21 04:24] - [2013-09-13 15:12] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2010-11-21 04:24] - [2013-09-13 15:12] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-10 00:54

==================== Koniec  FRST.txt ============================