Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:05-03-2016 01
Uruchomiony przez KK (administrator)  KK-KOMPUTER (22-03-2016 17:23:33)
Uruchomiony z C:\Users\KK\Desktop\FRST
Załadowane profile: KK (Dostępne profile: KK)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) D:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Windows\SysWOW64\srvany.exe
() C:\Windows\KMService.exe
(DotC United Inc) C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(AVAST Software) D:\Program Files\AVAST Software\Avast\avastui.exe
(Disc Soft Ltd) D:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Mozilla Corporation) D:\Program Files (x86)\Mozilla Firefox\firefox.exe
() D:\Program Files (x86)\NapiProjekt\napisy.exe
(Gabest) C:\Users\KK\Desktop\mplayerc.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [BCSSync] => D:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => D:\Program Files\AVAST Software\Avast\AvastUI.exe [7139256 2016-03-21] (AVAST Software)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [3074128 2016-03-10] (Valve Corporation)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [ALLUpdate] => D:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3670472 2015-07-28] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [DAEMON Tools Lite Automount] => D:\Program Files\DAEMON Tools Lite\DTAgent.exe [4179288 2015-11-18] (Disc Soft Ltd)
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\...\MountPoints2: E - E:\setup_underrail_2.0.0.2.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => D:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-03-21] (AVAST Software)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 62.179.1.63 62.179.1.62
Tcpip\..\Interfaces\{C7B4F5D7-DD4C-43F1-BB79-1D58AADC6D94}: [DhcpNameServer] 62.179.1.63 62.179.1.62

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=90098758_hao_pg
HKU\S-1-5-21-2654877866-3961693125-3265583649-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.hao123.com/?tn=90098758_hao_pg
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> D:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-03-21] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> D:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-03-21] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default
FF Homepage: hxxps://www.google.pl/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-21] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> D:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-21] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @qq.com/npAndroidAssistant -> C:\Program Files (x86)\Common Files\Tencent\QQPhoneManager\2.0.201.3192\npQQPhoneManagerExt.dll [Brak pliku]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)
FF Extension: Eliminator Slajdów - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\jid0-GaZOxvWNYcafEsmayJDIG3XXVi8@jetpack.xpi [2015-11-18]
FF Extension: Awesome screenshot: Capture and Annotate - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi [2016-03-02]
FF Extension: Adblock Plus - C:\Users\KK\AppData\Roaming\Mozilla\Firefox\Profiles\4pwtucvu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-02-24]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - D:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - D:\Program Files\AVAST Software\Avast\WebRep\FF [2016-03-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - D:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - D:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2016-03-21]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S4 ABBYY.Licensing.FineReader.Professional.12.0; D:\Program Files (x86)\ABBYY FineReader 12\NetworkLicenseServer.exe [965848 2015-07-02] (ABBYY Production LLC)
R2 avast! Antivirus; D:\Program Files\AVAST Software\Avast\AvastSvc.exe [237096 2016-03-21] (AVAST Software)
R3 Disc Soft Lite Bus Service; D:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1369432 2015-11-18] (Disc Soft Ltd)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2016-01-08] () [Brak podpisu cyfrowego]
R2 MPCProtectService; C:\Program Files (x86)\MPC Cleaner\MPCProtectService.exe [350688 2016-03-20] (DotC United Inc)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-11-18] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2015-07-18] (Microsoft Corporation)
S2 GoogleChromeUpService; C:\ProgramData\service.exe /s GoogleChromeUpService /uid:51477 /local:br [X]
S2 QQRepair15a8; "C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\QQRepair15a8" [X]
U2 QQRepair2658; "C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\QQRepair2658" [X]
S2 QQRepairFixSVC; C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\QQRepairFixSVC [X]
S2 rowugoqo; Brak ImagePath

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-03-21] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-03-21] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-03-21] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-03-21] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-03-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [463744 2016-03-21] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [165344 2016-03-21] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287016 2016-03-21] (AVAST Software)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-11-20] (Disc Soft Ltd)
R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47160 2015-11-20] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 MPCKpt; C:\Windows\System32\DRIVERS\MPCKpt.sys [60136 2016-03-20] (DotC United Inc)
R1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\QMUdisk64.sys [X]
R1 softaal; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.3.17195.214\softaal64.sys [X]
R1 SRepairDrv; \??\C:\Program Files (x86)\Tencent\QQPCMGR\Plugins\SRepairDrv [X]
R4 TAOKernelDriver; \??\C:\Windows\system32\Drivers\TAOKernel64.sys [X]
S3 TSSKX64; System32\drivers\tsskx64.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-22 08:25 - 2016-03-22 08:25 - 00046658 _____ C:\Users\KK\Desktop\przelew.pdf
2016-03-21 23:19 - 2016-03-21 23:19 - 00038520 _____ (Tencent) C:\Windows\SysWOW64\Drivers\TS888x64.sys
2016-03-21 23:17 - 2016-03-21 23:17 - 00001729 _____ C:\Users\Public\Desktop\MPC Cleaner.lnk
2016-03-21 23:17 - 2016-03-21 23:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC
2016-03-21 23:15 - 2016-03-21 23:27 - 00000000 ____D C:\ProgramData\TXQMPC
2016-03-21 23:09 - 2016-03-21 23:29 - 00000000 ____D C:\AdwCleaner
2016-03-21 23:09 - 2016-03-21 23:09 - 01530368 _____ C:\Users\KK\Desktop\adwcleaner_5.105.exe
2016-03-21 23:06 - 2016-03-21 23:06 - 00000000 ____D C:\Users\KK\AppData\Roaming\MCorp
2016-03-21 18:50 - 2016-03-21 19:44 - 00202746 _____ C:\Windows\ntbtlog.txt
2016-03-21 17:15 - 2016-03-22 16:43 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-03-21 17:15 - 2016-03-21 17:21 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-03-21 17:02 - 2016-03-21 16:59 - 00398152 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-03-21 17:00 - 2016-03-21 17:00 - 00000982 _____ C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2016-03-21 17:00 - 2016-03-21 17:00 - 00000000 ____D C:\Users\KK\AppData\Roaming\AVAST Software
2016-03-21 17:00 - 2016-03-21 17:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2016-03-21 16:59 - 2016-03-21 23:03 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-03-21 16:59 - 2016-03-21 16:59 - 01070904 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00463744 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00287016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00165344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00107792 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00052184 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-03-21 16:59 - 2016-03-21 16:59 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-03-21 16:59 - 2016-03-21 16:59 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2016-03-21 16:59 - 2016-03-21 16:59 - 00000000 ____D C:\Program Files\Common Files\AV
2016-03-21 16:57 - 2016-03-21 16:57 - 00000000 ____D C:\ProgramData\AVAST Software
2016-03-21 16:34 - 2016-03-22 17:23 - 00000000 ____D C:\Users\KK\Desktop\FRST
2016-03-21 16:26 - 2016-03-22 17:23 - 00000000 ____D C:\FRST
2016-03-21 08:11 - 2016-03-21 08:11 - 00000266 __RSH C:\Users\KK\ntuser.pol
2016-03-20 22:13 - 2016-03-20 22:13 - 06493696 _____ C:\Users\KK\AppData\Roaming\agent.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 01622132 _____ C:\Users\KK\AppData\Roaming\Trantop.tst
2016-03-20 22:13 - 2016-03-20 22:13 - 00848437 _____ C:\Users\KK\AppData\Roaming\Jobex.bin
2016-03-20 22:13 - 2016-03-20 22:13 - 00127488 _____ C:\Users\KK\AppData\Roaming\Installer.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00126464 _____ C:\Users\KK\AppData\Roaming\noah.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00126464 _____ C:\Users\KK\AppData\Roaming\lobby.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00072707 _____ C:\Users\KK\AppData\Roaming\GeoTom.tst
2016-03-20 22:13 - 2016-03-20 22:13 - 00065424 _____ C:\Users\KK\AppData\Roaming\Config.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 00054272 _____ C:\Users\KK\AppData\Roaming\ApplicationHosting.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00018432 _____ C:\Users\KK\AppData\Roaming\Main.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 00017760 _____ C:\Users\KK\AppData\Roaming\InstallationConfiguration.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 00005568 _____ C:\Users\KK\AppData\Roaming\md.xml
2016-03-20 22:11 - 2016-03-21 18:46 - 00000000 ____D C:\Program Files (x86)\MPC Cleaner
2016-03-20 22:11 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Local\Yeaplayer
2016-03-20 22:11 - 2016-03-20 22:11 - 00060136 ____N (DotC United Inc) C:\Windows\system32\Drivers\MPCKpt.sys
2016-03-20 22:10 - 2016-03-20 22:12 - 00000000 ____D C:\Users\KK\AppData\Roaming\UPUpdata
2016-03-20 22:10 - 2016-03-20 22:10 - 00005120 _____ C:\Users\KK\AppData\Roaming\GiftBag.db
2016-03-20 22:10 - 2016-03-20 22:10 - 00000000 ____D C:\Program Files\Common Files\Tencent
2016-03-20 22:09 - 2016-03-21 23:34 - 00000000 ____D C:\Users\KK\AppData\Roaming\Tencent
2016-03-20 22:09 - 2016-03-20 22:12 - 00000000 ____D C:\ProgramData\Tencent
2016-03-20 22:09 - 2016-03-20 22:09 - 00087864 ____N (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2016-03-20 22:00 - 2016-03-20 21:58 - 00001039 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-03-20 21:58 - 2016-03-20 21:58 - 00000660 __RSH C:\ProgramData\ntuser.pol
2016-03-20 18:11 - 2016-03-20 18:11 - 00369296 _____ C:\Windows\Minidump\032016-19219-01.dmp
2016-03-20 17:32 - 2016-03-20 17:33 - 00000000 ____D C:\Users\KK\AppData\Roaming\12ibt6
2016-03-20 17:31 - 2016-03-20 17:31 - 00000661 _____ C:\Users\Public\Desktop\12 is Better Than 6.lnk
2016-03-20 17:31 - 2016-03-20 17:31 - 00000661 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\12 is Better Than 6.lnk
2016-03-20 17:31 - 2016-03-20 17:31 - 00000000 ____D C:\ProgramData\Steam
2016-03-20 13:52 - 2016-03-20 13:52 - 00370272 _____ C:\Windows\Minidump\032016-16255-01.dmp
2016-03-12 08:19 - 2016-03-12 08:19 - 00370216 _____ C:\Windows\Minidump\031216-23930-01.dmp
2016-03-11 15:13 - 2016-03-11 15:13 - 00000000 _____ C:\Windows\system32\diskpart
2016-03-11 15:11 - 2016-03-11 15:12 - 00000000 _____ C:\Users\KK\diskpart
2016-03-09 09:17 - 2016-03-09 09:18 - 00000000 ____D C:\Users\KK\Desktop\listy
2016-03-08 22:13 - 2016-03-08 22:13 - 00369144 _____ C:\Windows\Minidump\030816-17643-01.dmp
2016-03-08 21:00 - 2016-03-08 21:00 - 00370160 _____ C:\Windows\Minidump\030816-15475-01.dmp
2016-03-06 12:47 - 2016-03-06 12:47 - 00369264 _____ C:\Windows\Minidump\030616-13603-01.dmp
2016-03-05 12:47 - 2016-03-05 12:47 - 00369256 _____ C:\Windows\Minidump\030516-15459-01.dmp
2016-03-05 12:31 - 2016-03-05 12:31 - 00370216 _____ C:\Windows\Minidump\030516-15334-01.dmp
2016-03-04 09:02 - 2016-03-04 09:02 - 00369384 _____ C:\Windows\Minidump\030416-13993-01.dmp
2016-03-03 23:24 - 2016-03-03 23:24 - 00369520 _____ C:\Windows\Minidump\030316-14508-01.dmp
2016-03-03 18:54 - 2016-03-03 18:54 - 00369208 _____ C:\Windows\Minidump\030316-13681-01.dmp
2016-03-03 17:21 - 2016-03-03 17:21 - 00369224 _____ C:\Windows\Minidump\030316-15600-01.dmp
2016-03-03 08:59 - 2016-03-03 08:59 - 00370648 _____ C:\Windows\Minidump\030316-18111-01.dmp
2016-03-01 08:32 - 2016-03-01 08:33 - 00369256 _____ C:\Windows\Minidump\030116-15085-01.dmp
2016-02-29 23:15 - 2016-02-29 23:15 - 00369256 _____ C:\Windows\Minidump\022916-15974-01.dmp
2016-02-29 19:23 - 2016-02-29 19:23 - 00369704 _____ C:\Windows\Minidump\022916-22495-01.dmp
2016-02-29 15:56 - 2016-02-29 15:56 - 00000165 ____H C:\Users\KK\Desktop\~$Warsztaty - wpłaty.xlsx
2016-02-27 22:11 - 2016-02-27 22:11 - 00369376 _____ C:\Windows\Minidump\022716-19234-01.dmp
2016-02-27 17:53 - 2011-07-15 04:39 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-02-21 12:58 - 2016-02-21 12:58 - 00369384 _____ C:\Windows\Minidump\022116-19718-01.dmp

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-03-22 17:21 - 2015-12-01 13:19 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-03-22 16:52 - 2009-07-14 05:45 - 00025296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-03-22 16:52 - 2009-07-14 05:45 - 00025296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-03-21 23:19 - 2015-12-01 13:19 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-03-21 23:17 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-03-21 23:15 - 2015-11-18 17:07 - 00000742 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-03-21 23:15 - 2015-11-18 17:07 - 00000742 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-03-21 23:01 - 2009-07-14 05:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-03-21 23:00 - 2015-11-17 22:35 - 00001425 _____ C:\Users\KK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-03-21 19:01 - 2015-12-01 12:35 - 00000000 ____D C:\Users\KK\Desktop\Paragraf22
2016-03-21 18:48 - 2009-07-14 05:45 - 04963744 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-21 18:40 - 2015-11-18 17:28 - 00000000 ____D C:\Users\KK\AppData\Roaming\uTorrent
2016-03-21 17:21 - 2015-11-19 22:42 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-21 17:21 - 2015-11-19 22:42 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-03-21 08:11 - 2015-11-17 22:35 - 00000000 ____D C:\Users\KK
2016-03-20 22:12 - 2015-11-18 17:29 - 00088120 _____ C:\Users\KK\AppData\Local\GDIPFONTCACHEV1.DAT
2016-03-20 21:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2016-03-20 18:11 - 2015-11-19 07:25 - 00000000 ____D C:\Windows\Minidump
2016-03-19 22:34 - 2011-04-12 14:21 - 00739706 _____ C:\Windows\system32\perfh015.dat
2016-03-19 22:34 - 2011-04-12 14:21 - 00155280 _____ C:\Windows\system32\perfc015.dat
2016-03-19 22:34 - 2009-07-14 06:13 - 01668226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-03-19 22:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-03-13 13:26 - 2016-02-10 11:15 - 00000000 ____D C:\Users\KK\Desktop\Squiga
2016-03-13 10:59 - 2016-01-20 09:11 - 00000000 ____D C:\Users\KK\Desktop\Aplikacja
2016-03-09 15:39 - 2016-01-10 12:12 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk

==================== Pliki w katalogu głównym wybranych folderów =======

2016-03-20 22:13 - 2016-03-20 22:13 - 6493696 _____ () C:\Users\KK\AppData\Roaming\agent.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0054272 _____ () C:\Users\KK\AppData\Roaming\ApplicationHosting.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0065424 _____ () C:\Users\KK\AppData\Roaming\Config.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 0072707 _____ () C:\Users\KK\AppData\Roaming\GeoTom.tst
2016-03-20 22:10 - 2016-03-20 22:10 - 0005120 _____ () C:\Users\KK\AppData\Roaming\GiftBag.db
2016-03-20 22:13 - 2016-03-20 22:13 - 0017760 _____ () C:\Users\KK\AppData\Roaming\InstallationConfiguration.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 0127488 _____ () C:\Users\KK\AppData\Roaming\Installer.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0848437 _____ () C:\Users\KK\AppData\Roaming\Jobex.bin
2016-03-20 22:13 - 2016-03-20 22:13 - 0126464 _____ () C:\Users\KK\AppData\Roaming\lobby.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0018432 _____ () C:\Users\KK\AppData\Roaming\Main.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 0005568 _____ () C:\Users\KK\AppData\Roaming\md.xml
2016-03-20 22:13 - 2016-03-20 22:13 - 0126464 _____ () C:\Users\KK\AppData\Roaming\noah.dat
2016-03-20 22:13 - 2016-03-20 22:13 - 1622132 _____ () C:\Users\KK\AppData\Roaming\Trantop.tst
2016-03-20 22:14 - 2016-03-20 22:14 - 0032038 _____ () C:\Users\KK\AppData\Roaming\uninstall_temp.ico

Niektóre pliki w TEMP:
====================
C:\Users\KK\AppData\Local\Temp\10AE.tmp.exe
C:\Users\KK\AppData\Local\Temp\121612.exe
C:\Users\KK\AppData\Local\Temp\121812.exe
C:\Users\KK\AppData\Local\Temp\123112.exe
C:\Users\KK\AppData\Local\Temp\1240.tmp.exe
C:\Users\KK\AppData\Local\Temp\124212.exe
C:\Users\KK\AppData\Local\Temp\124412.exe
C:\Users\KK\AppData\Local\Temp\1441.tmp.exe
C:\Users\KK\AppData\Local\Temp\20CE.tmp.exe
C:\Users\KK\AppData\Local\Temp\281D.tmp.exe
C:\Users\KK\AppData\Local\Temp\31E9.tmp.exe
C:\Users\KK\AppData\Local\Temp\3D62.tmp.exe
C:\Users\KK\AppData\Local\Temp\4772.tmp.exe
C:\Users\KK\AppData\Local\Temp\598F.tmp.exe
C:\Users\KK\AppData\Local\Temp\607B.tmp.exe
C:\Users\KK\AppData\Local\Temp\73E3.tmp.exe
C:\Users\KK\AppData\Local\Temp\7C1.tmp.exe
C:\Users\KK\AppData\Local\Temp\8CA6.tmp.exe
C:\Users\KK\AppData\Local\Temp\8F12.tmp.exe
C:\Users\KK\AppData\Local\Temp\AA42.tmp.exe
C:\Users\KK\AppData\Local\Temp\AB4A.tmp.exe
C:\Users\KK\AppData\Local\Temp\ABDB.tmp.exe
C:\Users\KK\AppData\Local\Temp\AE68.tmp.exe
C:\Users\KK\AppData\Local\Temp\anysend.exe
C:\Users\KK\AppData\Local\Temp\bitool.dll
C:\Users\KK\AppData\Local\Temp\CEA2.tmp.exe
C:\Users\KK\AppData\Local\Temp\checkedlist.exe
C:\Users\KK\AppData\Local\Temp\D47F.tmp.exe
C:\Users\KK\AppData\Local\Temp\DD36.tmp.exe
C:\Users\KK\AppData\Local\Temp\DFD2.tmp.exe
C:\Users\KK\AppData\Local\Temp\EBAF.tmp.exe
C:\Users\KK\AppData\Local\Temp\EDC.tmp.exe
C:\Users\KK\AppData\Local\Temp\FreeVPNSetup.exe
C:\Users\KK\AppData\Local\Temp\fsd5052.exe
C:\Users\KK\AppData\Local\Temp\K3ALXEHQGZ.exe
C:\Users\KK\AppData\Local\Temp\MY3AAS791P.exe
C:\Users\KK\AppData\Local\Temp\mysites.exe
C:\Users\KK\AppData\Local\Temp\t.dll
C:\Users\KK\AppData\Local\Temp\ts_10051.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-03-19 09:05

==================== Koniec  FRST.txt ============================