Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:05-03-2016 01
Uruchomiony przez KK (administrator)  KK-KOMPUTER (21-03-2016 16:27:25)
Uruchomiony z C:\Users\KK\Desktop
Załadowane profile: KK (Dostępne profile: KK)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ABBYY Production LLC) D:\Program Files (x86)\ABBYY FineReader 12\NetworkLicenseServer.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Valve Corporation) D:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) D:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Disc Soft Ltd) D:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Users\KK\Desktop\q_PatchFix_v_1_0_0.exe
(BitTorrent Inc.) C:\Users\KK\AppData\Roaming\uTorrent\uTorrent.exe
(BitTorrent Inc.) C:\Users\KK\AppData\Roaming\uTorrent\updates\3.4.6_41845\utorrentie.exe
(BitTorrent Inc.) C:\Users\KK\AppData\Roaming\uTorrent\updates\3.4.6_41845\utorrentie.exe
() C:\Users\KK\AppData\Local\Temp\pps-qq-19.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCRTP.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCTray.exe
(Tencent) C:\Program Files (x86)\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\plugins\QMNetMon\QQPCNetFlow.exe
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCRealTimeSpeedup.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe
() C:\ProgramData\CloudPrinter\CloudPrinter.exe
() C:\ProgramData\Konksolex\Konksolex.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Windows\Temp\1BFF.tmp
(Tencent) C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCTray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
() C:\Program Files (x86)\00000000-1458507602-0000-0000-001FD09D80C3\knsd2B47.tmp


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [BCSSync] => D:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [ QQPCTray] => C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCTray.exe [355296 2016-03-20] (Tencent)
HKLM-x32\...\RunOnce: [Update] => C:\Users\KK\AppData\Roaming\ASPackage\ASPackage.exe [875304 2016-03-20] ()
HKLM-x32\...\RunOnce: [GrpConv] => grpconv -o
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [3074128 2016-03-10] (Valve Corporation)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [ALLUpdate] => D:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3670472 2015-07-28] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [DAEMON Tools Lite Automount] => D:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-18] (Disc Soft Ltd)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\MountPoints2: E - E:\setup_underrail_2.0.0.2.exe
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\MountPoints2: {d375fdf7-a27e-11e5-bde0-001fd09d80c3} - E:\setup_underrail_2.0.0.2.exe
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QMGCShellExt64.dll [2016-03-20] (Tencent)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 62.179.1.63 62.179.1.62
Tcpip\..\Interfaces\{C7B4F5D7-DD4C-43F1-BB79-1D58AADC6D94}: [DhcpNameServer] 62.179.1.63 62.179.1.62
ManualProxies: 

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=90098758_hao_pg
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=90098758_hao_pg
BHO: 电脑管家网页防火墙 -> {7C260B4B-F7A0-40B5-B403-BEFCDC6A4C3B} -> C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\TSWebMon64.dat [2016-03-20] (Tencent)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.mysites123.com/?type=sc&ts=1458507544&z=6e3f3163376538ec1ba416dg7z6w5b2wbe9m0wezez&from=wscy2&uid=WDCXWD3200AAKS-22B3A0_WD-WCAT1258761487614

FireFox:
========
FF ProfilePath: C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default
FF NewTab: chrome://quick_start/content/index.html
FF DefaultSearchEngine: yoursearching
FF SelectedSearchEngine: yoursearching
FF Homepage: hxxp://www.yoursearching.com/?type=hp&ts=1458508457&z=ad55b056f1800208071f620g9zew6bawce4b3zewbm&from=brd&uid=WDCXWD3200AAKS-22B3A0_WD-WCAT1258761487614
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_19_0_0_245.dll [2015-11-19] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-19] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @qq.com/QQPCMgr -> C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\npQMExtensionsMozilla.dll [2016-03-20] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\searchplugins\mysites123.xml [2016-03-20]
FF SearchPlugin: C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\searchplugins\yoursearching.xml [2016-03-20]
FF Extension: Quick Searcher - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\extensions\{d720d64d-c71a-4316-b59e-8a41b860178f} [2016-03-20] [Brak podpisu cyfrowego]
FF Extension: FirefixTab - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\extensions\deskCutv2@gmail.com [2016-03-20] [Brak podpisu cyfrowego]
FF Extension: YahooToolsProtected  - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\extensions\yahooprotected@gmail.com [2016-03-20] [Brak podpisu cyfrowego]
FF Extension: Eliminator Slajdów - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\jid0-GaZOxvWNYcafEsmayJDIG3XXVi8@jetpack.xpi [2015-11-18]
FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2016-03-02]
FF Extension: Adblock Plus - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-24]
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\extensions\deskCutv2@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\extensions\yahooprotected@gmail.com
StartMenuInternet: FIREFOX.EXE - D:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursearching.com/?type=sc&ts=1458508457&z=ad55b056f1800208071f620g9zew6bawce4b3zewbm&from=brd&uid=WDCXWD3200AAKS-22B3A0_WD-WCAT1258761487614

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R4 ABBYY.Licensing.FineReader.Professional.12.0; D:\Program Files (x86)\ABBYY FineReader 12\NetworkLicenseServer.exe [965848 2015-07-02] (ABBYY Production LLC)
R2 CloudPrinter; C:\ProgramData\\CloudPrinter\\CloudPrinter.exe [774144 2016-03-20] () [Brak podpisu cyfrowego]
R3 Disc Soft Lite Bus Service; D:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1369432 2015-11-18] (Disc Soft Ltd)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2016-01-08] () [Brak podpisu cyfrowego]
R2 Konksolex; C:\ProgramData\\Konksolex\\Konksolex.exe [774144 2016-03-20] () [Brak podpisu cyfrowego]
R2 kuzusugozbt; C:\Program Files (x86)\00000000-1458507602-0000-0000-001FD09D80C3\knsd2B47.tmp [315392 2016-03-21] () [Brak podpisu cyfrowego]
R2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-03-20] (DotC United Inc)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-11-18] ()
R2 QQPCRTP; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQPCRTP.exe [301728 2016-03-20] (Tencent)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-07-18] (Microsoft Corporation)
S2 gerocyni; C:\Program Files (x86)\00000000-1458507602-0000-0000-001FD09D80C3\jnsj823D.tmp [X]
S2 GoogleChromeUpService; C:\ProgramData\service.exe /s GoogleChromeUpService /uid:51477 /local:br [X]
S2 rowugoqo; Brak ImagePath
S2 wucotusy; C:\Program Files (x86)\00000000-1458507602-0000-0000-001FD09D80C3\hnsu96E8.tmp [X]
S2 zigipyro; C:\Users\KK\AppData\Local\00000000-1458511829-0000-0000-001FD09D80C3\qnsn321.tmp [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-11-20] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47160 2015-11-20] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-03-20] (DotC United Inc)
R1 QMUdisk; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QMUdisk64.sys [184536 2016-03-02] (Tencent)
R2 QQSysMonX64; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QQSysMonX64.sys [138040 2016-03-20] (电脑管家)
R1 softaal; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\softaal64.sys [35128 2016-03-20] (Tencent)
R3 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator64.sys [89464 2016-03-20] (Tencent)
R1 TAOKernelDriver; C:\Windows\system32\Drivers\TAOKernel64.sys [131896 2016-03-20] (Tencent Technology(Shenzhen) Company Limited)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFltX64.sys [87864 2016-03-20] (电脑管家)
R1 TSDefenseBt; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\TSDefenseBT64.sys [28984 2016-03-20] (Tencent)
R3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [38200 2016-03-20] (电脑管家)
R1 TSSysKit; C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\TSSysKit64.sys [87352 2016-03-20] (电脑管家)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-21 16:27 - 2016-03-21 16:28 - 00013637 _____ C:\Users\KK\Desktop\FRST.txt
2016-03-21 16:26 - 2016-03-21 16:27 - 00000000 ____D C:\FRST
2016-03-21 08:11 - 2016-03-21 08:11 - 00000266 __RSH C:\Users\KK\ntuser.pol
2016-03-20 22:17 - 2016-03-20 22:17 - 00380928 _____ C:\Users\KK\Desktop\wx8m1oux.exe
2016-03-20 22:16 - 2016-03-20 22:16 - 02374144 _____ (Farbar) C:\Users\KK\Desktop\FRST64.exe
2016-03-20 22:14 - 2016-03-20 22:14 - 00000000 ____D C:\Users\KK\AppData\Roaming\yoursearching
2016-03-20 22:14 - 2016-03-20 22:14 - 00000000 ____D C:\ProgramData\9WdM9
2016-03-20 22:13 - 2016-03-20 22:14 - 00000000 ____D C:\ProgramData\Konksolex
2016-03-20 22:13 - 2016-03-20 22:14 - 00000000 ____D C:\Program Files\ktip
2016-03-20 22:13 - 2016-03-20 22:13 - 06493696 _____ C:\Users\KK\AppData\Roaming\agent.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 01622132 _____ C:\Users\KK\AppData\Roaming\Trantop.tst
2016-03-20 22:13 - 2016-03-20 22:13 - 00848437 _____ C:\Users\KK\AppData\Roaming\Jobex.bin
2016-03-20 22:13 - 2016-03-20 22:13 - 00774144 _____ C:\Users\KK\AppData\Roaming\Trantop.exe
2016-03-20 22:13 - 2016-03-20 22:13 - 00774144 _____ C:\Users\KK\AppData\Roaming\GeoTom.exe
2016-03-20 22:13 - 2016-03-20 22:13 - 00188540 _____ () C:\Users\KK\AppData\Roaming\Trippletop.bin
2016-03-20 22:13 - 2016-03-20 22:13 - 00127488 _____ C:\Users\KK\AppData\Roaming\Installer.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00126464 _____ C:\Users\KK\AppData\Roaming\noah.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00126464 _____ C:\Users\KK\AppData\Roaming\lobby.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00072707 _____ C:\Users\KK\AppData\Roaming\GeoTom.tst
2016-03-20 22:13 - 2016-03-20 22:13 - 00065424 _____ C:\Users\KK\AppData\Roaming\Config.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 00054272 _____ C:\Users\KK\AppData\Roaming\ApplicationHosting.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00018432 _____ C:\Users\KK\AppData\Roaming\Main.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00017760 _____ C:\Users\KK\AppData\Roaming\InstallationConfiguration.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 00005568 _____ C:\Users\KK\AppData\Roaming\md.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 00000000 ____D C:\ProgramData\CloudPrinter
2016-03-20 22:13 - 2016-03-20 22:13 - 00000000 ____D C:\Program Files\Windows Screen Manager
2016-03-20 22:12 - 2016-03-20 22:12 - 00002118 _____ C:\ProgramData\service.exe.lnk
2016-03-20 22:12 - 2016-03-20 22:12 - 00000872 _____ C:\Users\KK\Desktop\SpaceSoundPro.lnk
2016-03-20 22:12 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpaceSoundPro 1.0
2016-03-20 22:12 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Local\mpck_en_005030273
2016-03-20 22:12 - 2016-03-20 22:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MOBILEPCSTARTERKIT
2016-03-20 22:12 - 2016-03-20 22:12 - 00000000 ____D C:\Program Files (x86)\mpck_en_005030273
2016-03-20 22:11 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Local\Yeaplayer
2016-03-20 22:11 - 2016-03-20 22:12 - 00000000 ____D C:\Program Files\SpaceSoundPro
2016-03-20 22:11 - 2016-03-20 22:11 - 00060136 _____ (DotC United Inc) C:\Windows\system32\Drivers\MPCKpt.sys
2016-03-20 22:11 - 2016-03-20 22:11 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-03-20 22:11 - 2016-01-14 10:47 - 00128280 _____ (电脑管家) C:\Windows\SysWOW64\Drivers\TsFltMgr.sys
2016-03-20 22:10 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Roaming\UPUpdata
2016-03-20 22:10 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Local\00000000-1458511829-0000-0000-001FD09D80C3
2016-03-20 22:10 - 2016-03-20 22:10 - 00005120 _____ C:\Users\KK\AppData\Roaming\GiftBag.db
2016-03-20 22:10 - 2016-03-20 22:10 - 00000000 ____D C:\Program Files\Common Files\Tencent
2016-03-20 22:10 - 2016-03-20 22:09 - 00131896 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernel64.sys
2016-03-20 22:10 - 2016-03-20 22:09 - 00089464 _____ (Tencent) C:\Windows\system32\Drivers\TAOAccelerator64.sys
2016-03-20 22:09 - 2016-03-20 22:40 - 00000000 ____D C:\Users\KK\AppData\Roaming\Tencent
2016-03-20 22:09 - 2016-03-20 22:12 - 00000000 ____D C:\ProgramData\Tencent
2016-03-20 22:09 - 2016-03-20 22:09 - 00087864 _____ (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2016-03-20 22:09 - 2016-03-20 22:09 - 00038200 _____ (电脑管家) C:\Windows\system32\Drivers\TSSKX64.sys
2016-03-20 22:09 - 2016-03-20 22:09 - 00000000 ____D C:\Users\KK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2016-03-20 22:09 - 2016-03-20 22:09 - 00000000 ____D C:\ProgramData\TXQMPC
2016-03-20 22:09 - 2016-03-20 22:09 - 00000000 ____D C:\Program Files (x86)\Tencent
2016-03-20 22:01 - 2016-03-20 22:14 - 00000000 ____D C:\Users\KK\AppData\Local\00000000-1458511280-0000-0000-001FD09D80C3
2016-03-20 22:00 - 2016-03-21 16:25 - 00000000 ____D C:\Program Files (x86)\00000000-1458507602-0000-0000-001FD09D80C3
2016-03-20 22:00 - 2016-03-20 22:00 - 00000000 ____D C:\Users\KK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ASPackage
2016-03-20 22:00 - 2016-03-20 22:00 - 00000000 ____D C:\Users\KK\AppData\Roaming\ASPackage
2016-03-20 22:00 - 2016-03-20 21:58 - 00001039 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-03-20 21:59 - 2016-03-20 22:14 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2016-03-20 21:59 - 2016-03-20 22:00 - 00000000 ____D C:\Users\KK\AppData\Roaming\mysites123
2016-03-20 21:59 - 2016-03-20 22:00 - 00000000 ____D C:\ProgramData\5WdM5
2016-03-20 21:58 - 2016-03-21 08:11 - 00000000 ____D C:\Users\KK\AppData\Roaming\FreeVPN
2016-03-20 21:58 - 2016-03-20 21:58 - 03633808 _____ C:\Users\KK\Desktop\q_PatchFix_v_1_0_0.exe
2016-03-20 21:58 - 2016-03-20 21:58 - 00000660 __RSH C:\ProgramData\ntuser.pol
2016-03-20 18:11 - 2016-03-20 18:11 - 00369296 _____ C:\Windows\Minidump\032016-19219-01.dmp
2016-03-20 17:32 - 2016-03-20 17:33 - 00000000 ____D C:\Users\KK\AppData\Roaming\12ibt6
2016-03-20 17:31 - 2016-03-20 17:31 - 00000661 _____ C:\Users\Public\Desktop\12 is Better Than 6.lnk
2016-03-20 17:31 - 2016-03-20 17:31 - 00000661 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\12 is Better Than 6.lnk
2016-03-20 17:31 - 2016-03-20 17:31 - 00000000 ____D C:\ProgramData\Steam
2016-03-20 13:52 - 2016-03-20 13:52 - 00370272 _____ C:\Windows\Minidump\032016-16255-01.dmp
2016-03-16 20:10 - 2016-03-16 20:10 - 00000018 _____ C:\Users\KK\Desktop\menu1.pdf
2016-03-14 21:09 - 2016-03-16 09:39 - 00000000 ____D C:\Users\KK\Desktop\house of cards
2016-03-12 08:19 - 2016-03-12 08:19 - 00370216 _____ C:\Windows\Minidump\031216-23930-01.dmp
2016-03-11 19:56 - 2016-03-20 22:03 - 00000000 ____D C:\Users\KK\AppData\LocalLow\uTorrent
2016-03-11 15:13 - 2016-03-11 15:13 - 00000000 _____ C:\Windows\system32\diskpart
2016-03-11 15:11 - 2016-03-11 15:12 - 00000000 _____ C:\Users\KK\diskpart
2016-03-11 15:00 - 2016-03-11 15:00 - 01630647 _____ C:\Users\KK\Desktop\reczonkowieparagrafunaokresprbnypropozycja.zip
2016-03-11 15:00 - 2016-03-11 15:00 - 00000000 ____D C:\Users\KK\Desktop\reczonkowieparagrafunaokresprbnypropozycja
2016-03-09 09:17 - 2016-03-09 09:18 - 00000000 ____D C:\Users\KK\Desktop\listy
2016-03-08 22:13 - 2016-03-08 22:13 - 00369144 _____ C:\Windows\Minidump\030816-17643-01.dmp
2016-03-08 21:00 - 2016-03-08 21:00 - 00370160 _____ C:\Windows\Minidump\030816-15475-01.dmp
2016-03-06 12:47 - 2016-03-06 12:47 - 00369264 _____ C:\Windows\Minidump\030616-13603-01.dmp
2016-03-05 12:47 - 2016-03-05 12:47 - 00369256 _____ C:\Windows\Minidump\030516-15459-01.dmp
2016-03-05 12:31 - 2016-03-05 12:31 - 00370216 _____ C:\Windows\Minidump\030516-15334-01.dmp
2016-03-04 15:57 - 2016-03-04 15:57 - 00568906 _____ C:\Users\KK\Desktop\Zadanie rekrutacyjne.pdf
2016-03-04 09:02 - 2016-03-04 09:02 - 00369384 _____ C:\Windows\Minidump\030416-13993-01.dmp
2016-03-03 23:24 - 2016-03-03 23:24 - 00369520 _____ C:\Windows\Minidump\030316-14508-01.dmp
2016-03-03 18:54 - 2016-03-03 18:54 - 00369208 _____ C:\Windows\Minidump\030316-13681-01.dmp
2016-03-03 17:21 - 2016-03-03 17:21 - 00369224 _____ C:\Windows\Minidump\030316-15600-01.dmp
2016-03-03 08:59 - 2016-03-03 08:59 - 00370648 _____ C:\Windows\Minidump\030316-18111-01.dmp
2016-03-01 08:32 - 2016-03-01 08:33 - 00369256 _____ C:\Windows\Minidump\030116-15085-01.dmp
2016-02-29 23:15 - 2016-02-29 23:15 - 00369256 _____ C:\Windows\Minidump\022916-15974-01.dmp
2016-02-29 19:23 - 2016-02-29 19:23 - 00369704 _____ C:\Windows\Minidump\022916-22495-01.dmp
2016-02-29 15:56 - 2016-02-29 15:56 - 00000165 ____H C:\Users\KK\Desktop\~$Warsztaty - wpłaty.xlsx
2016-02-27 22:11 - 2016-02-27 22:11 - 00369376 _____ C:\Windows\Minidump\022716-19234-01.dmp
2016-02-27 17:53 - 2011-07-15 04:39 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-02-27 17:51 - 2016-02-27 17:51 - 00374888 _____ C:\Users\KK\Desktop\435480_intl_x64_zip.exe
2016-02-23 21:47 - 2016-03-07 18:30 - 00011079 _____ C:\Users\KK\Desktop\Warsztaty - wpłaty.xlsx
2016-02-21 12:58 - 2016-02-21 12:58 - 00369384 _____ C:\Windows\Minidump\022116-19718-01.dmp
2016-02-20 21:09 - 2016-02-20 21:09 - 00371088 _____ C:\Windows\Minidump\022016-31106-01.dmp

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-21 16:28 - 2015-11-18 17:28 - 00000000 ____D C:\Users\KK\AppData\Roaming\uTorrent
2016-03-21 16:25 - 2015-12-01 13:19 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-21 08:16 - 2009-07-14 05:45 - 00025296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-21 08:16 - 2009-07-14 05:45 - 00025296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-21 08:11 - 2015-11-17 22:35 - 00000000 ____D C:\Users\KK
2016-03-20 22:14 - 2015-11-18 17:07 - 00001118 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-03-20 22:14 - 2015-11-18 17:07 - 00001118 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-20 22:12 - 2015-11-18 17:29 - 00088120 _____ C:\Users\KK\AppData\Local\GDIPFONTCACHEV1.DAT
2016-03-20 22:00 - 2015-11-17 22:35 - 00001437 _____ C:\Users\KK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-20 21:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2016-03-20 19:21 - 2015-12-01 13:19 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-20 18:11 - 2015-11-19 07:25 - 00000000 ____D C:\Windows\Minidump
2016-03-20 18:11 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-19 22:34 - 2011-04-12 14:21 - 00739706 _____ C:\Windows\system32\perfh015.dat
2016-03-19 22:34 - 2011-04-12 14:21 - 00155280 _____ C:\Windows\system32\perfc015.dat
2016-03-19 22:34 - 2009-07-14 06:13 - 01668226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-19 22:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-03-13 13:26 - 2016-02-10 11:15 - 00000000 ____D C:\Users\KK\Desktop\Squiga
2016-03-13 10:59 - 2016-01-20 09:11 - 00000000 ____D C:\Users\KK\Desktop\Aplikacja
2016-03-09 15:39 - 2016-01-10 12:12 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-03-02 21:04 - 2015-12-01 12:35 - 00000000 ____D C:\Users\KK\Desktop\Paragraf22
2016-02-26 22:07 - 2015-12-07 20:39 - 00161545 _____ C:\Users\KK\Desktop\NA MIEJSCU ZDARZENIA - vol. 4.pptx

==================== Pliki w katalogu głównym wybranych folderów =======

2016-03-20 22:13 - 2016-03-20 22:13 - 6493696 _____ () C:\Users\KK\AppData\Roaming\agent.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0054272 _____ () C:\Users\KK\AppData\Roaming\ApplicationHosting.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0065424 _____ () C:\Users\KK\AppData\Roaming\Config.xml
2015-10-28 22:42 - 2015-10-28 22:42 - 0069632 _____ (FelineSoft) C:\Users\KK\AppData\Roaming\Fazala.exe
2016-03-20 22:13 - 2016-03-20 22:13 - 0774144 _____ () C:\Users\KK\AppData\Roaming\GeoTom.exe
2016-03-20 22:13 - 2016-03-20 22:13 - 0072707 _____ () C:\Users\KK\AppData\Roaming\GeoTom.tst
2016-03-20 22:10 - 2016-03-20 22:10 - 0005120 _____ () C:\Users\KK\AppData\Roaming\GiftBag.db
2016-03-20 22:13 - 2016-03-20 22:13 - 0017760 _____ () C:\Users\KK\AppData\Roaming\InstallationConfiguration.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 0127488 _____ () C:\Users\KK\AppData\Roaming\Installer.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0848437 _____ () C:\Users\KK\AppData\Roaming\Jobex.bin
2016-03-20 22:13 - 2016-03-20 22:13 - 0126464 _____ () C:\Users\KK\AppData\Roaming\lobby.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0018432 _____ () C:\Users\KK\AppData\Roaming\Main.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0005568 _____ () C:\Users\KK\AppData\Roaming\md.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 0126464 _____ () C:\Users\KK\AppData\Roaming\noah.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0774144 _____ () C:\Users\KK\AppData\Roaming\Trantop.exe
2016-03-20 22:13 - 2016-03-20 22:13 - 1622132 _____ () C:\Users\KK\AppData\Roaming\Trantop.tst
2016-03-20 22:13 - 2016-03-20 22:13 - 0188540 _____ () C:\Users\KK\AppData\Roaming\Trippletop.bin
2016-03-20 22:14 - 2016-03-20 22:14 - 0032038 _____ () C:\Users\KK\AppData\Roaming\uninstall_temp.ico
2016-03-20 22:12 - 2016-03-20 22:12 - 0002118 _____ () C:\ProgramData\service.exe.lnk
2016-03-20 21:59 - 2016-03-20 22:14 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Niektóre pliki w TEMP:
====================
C:\Users\KK\AppData\Local\Temp\10AE.tmp.exe
C:\Users\KK\AppData\Local\Temp\121612.exe
C:\Users\KK\AppData\Local\Temp\121812.exe
C:\Users\KK\AppData\Local\Temp\123112.exe
C:\Users\KK\AppData\Local\Temp\124212.exe
C:\Users\KK\AppData\Local\Temp\124412.exe
C:\Users\KK\AppData\Local\Temp\3D62.tmp.exe
C:\Users\KK\AppData\Local\Temp\607B.tmp.exe
C:\Users\KK\AppData\Local\Temp\7C1.tmp.exe
C:\Users\KK\AppData\Local\Temp\AE68.tmp.exe
C:\Users\KK\AppData\Local\Temp\anysend.exe
C:\Users\KK\AppData\Local\Temp\bitool.dll
C:\Users\KK\AppData\Local\Temp\checkedlist.exe
C:\Users\KK\AppData\Local\Temp\DD36.tmp.exe
C:\Users\KK\AppData\Local\Temp\FreeVPNSetup.exe
C:\Users\KK\AppData\Local\Temp\K3ALXEHQGZ.exe
C:\Users\KK\AppData\Local\Temp\MY3AAS791P.exe
C:\Users\KK\AppData\Local\Temp\mysites.exe
C:\Users\KK\AppData\Local\Temp\nspE4C8.exe
C:\Users\KK\AppData\Local\Temp\pps-qq-19.exe
C:\Users\KK\AppData\Local\Temp\t.dll
C:\Users\KK\AppData\Local\Temp\ts_10051.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-03-19 09:05

==================== Koniec  FRST.txt ============================