Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:05-03-2016 01 Uruchomiony przez acer (administrator) ACER1 (02-04-2016 15:38:29) Uruchomiony z C:\Users\acer\Downloads Załadowane profile: acer (Dostępne profile: acer) Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Atheros) C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Windows\System32\alg.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe (Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Peter Pawlowski) C:\DANE\foobar2000\foobar2000.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\swriter.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin (Microsoft Corporation) C:\Windows\splwow64.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2892072 2012-01-17] (ELAN Microelectronics Corp.) HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-08] (Acer Incorporated) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452456 2012-02-21] (Realtek Semiconductor) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.) HKU\S-1-5-21-2578688233-1128249932-317870856-1000\...\Policies\Explorer: [] HKU\S-1-5-21-2578688233-1128249932-317870856-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation) HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} AppInit_DLLs: C:\ProgramData\Quotenamron\TamNix.dll => C:\ProgramData\Quotenamron\TamNix.dll [363520 2016-04-02] () AppInit_DLLs-x32: C:\ProgramData\Quotenamron\TanZamstock.dll => C:\ProgramData\Quotenamron\TanZamstock.dll [257536 2016-04-02] () ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2012-02-06] (Autodesk, Inc.) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{45401114-4E61-4293-B5E2-144491397D05}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{50A238E7-A131-470E-BBA2-8A4C8332D25F}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{E9439CA5-3514-471B-A719-C509B50D7FD9}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA HKU\S-1-5-21-2578688233-1128249932-317870856-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2578688233-1128249932-317870856-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://%66%65%65%64.%68%65%6C%70%65%72%62%61%72.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oC_4w0czkSSQLyfPVfY2fkOqKhsAVJJanjCP0fSvqR890_UbeV4eLhGo5EpH6RwjO1N6NmTPQbH9rEBtlncxXpozaPRC_L6 HKU\S-1-5-21-2578688233-1128249932-317870856-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} HKU\S-1-5-21-2578688233-1128249932-317870856-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} HKU\S-1-5-21-2578688233-1128249932-317870856-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = SearchScopes: HKLM-x32 -> ielnksrch URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-2578688233-1128249932-317870856-1000 -> DefaultScope {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} SearchScopes: HKU\S-1-5-21-2578688233-1128249932-317870856-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredibar.com/mb201/?search={searchTerms}&loc=IB_DS&a=6R8RQlLk9E&i=26 SearchScopes: HKU\S-1-5-21-2578688233-1128249932-317870856-1000 -> {DD95CDBF-AD1E-4CD5-881B-9DC2BA807971} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3220468 SearchScopes: HKU\S-1-5-21-2578688233-1128249932-317870856-1000 -> {ielnksrch} URL = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn5dJ8gs0DGDT3GOWsi_8CTz4dOPhKRDZNIMBCaScL8ajo9LZP05mlgd1QQC44ntB-v0Cb6bl84TKM4nJZzgM-0Z1oCzIP_mVouJ-K4z5wSyMmGE1jtBhAv70SPTgW6a9LlJvJWtR86Iygb8OH4RNhEHybrxLNUWg4P0djrlJw-TIh07LE8u72nD&q={searchTerms} BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.) BHO-x32: DIALux 3.1 ULDBrowserHelper Class -> {69AB812A-8CE4-4BF3-B49B-3B60A9F31FB2} -> C:\Program Files (x86)\DIALux\DLXShellExtension.dll [2012-06-26] (DIAL GmbH, Germany) BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\ArcPluginIE.dll [2015-04-09] (Perfect World Entertainment Inc) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.) Handler-x32: dialux - {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Program Files (x86)\DIALux\DLXToolBox.dll [2012-06-26] (DIAL GmbH, Germany) FireFox: ======== FF ProfilePath: C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\8hthvero.default-1459602820837 FF Homepage: www.google.pl FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-18] () FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-18] () FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation) FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> C:\Program Files (x86)\Perfect World Entertainment\Arc\Plugins\npArcPluginFF.dll [2015-04-09] (Perfect World Entertainment Inc) FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-12-09] (VideoLAN) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2010-12-08] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.) FF Extension: Adblock Plus - C:\Users\acer\AppData\Roaming\Mozilla\Firefox\Profiles\8hthvero.default-1459602820837\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-02] FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-19] [Brak podpisu cyfrowego] FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\IB Updater\Firefox => nie znaleziono FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] - C:\Program Files (x86)\Common Files\McAfee\SystemCore => nie znaleziono Chrome: ======= CHR Profile: C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Brak nazwy) - C:\Users\acer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejpbbhjlbipncjklfjjaedaieimbmdda [2012-10-16] CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx CHR HKU\S-1-5-21-2578688233-1128249932-317870856-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\acer\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26] CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - CHR HKLM-x32\...\Chrome\Extension: [ejpbbhjlbipncjklfjjaedaieimbmdda] - C:\Users\acer\AppData\Local\CRE\ejpbbhjlbipncjklfjjaedaieimbmdda.crx [2012-08-26] CHR HKLM-x32\...\Chrome\Extension: [jidkebcigjgheaahopdnlfaohgnocfai] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S4 ArcService; C:\Program Files (x86)\Perfect World Entertainment\Arc\ArcService.exe [88584 2015-04-09] (Perfect World Entertainment Inc) S4 DialComService; C:\Program Files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [1685808 2012-04-05] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation) S2 Quotenamron; C:\ProgramData\\Quotenamron\\Quotenamron.exe [1043968 2016-04-02] () [Brak podpisu cyfrowego] S4 RSLinx; C:\Program Files (x86)\Rockwell Software\RSLinx\RSLINX.EXE [3306528 2014-10-30] (Rockwell Automation, Inc.) R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [72864 2012-01-18] (Atheros) [Brak podpisu cyfrowego] ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation) S3 RAUSBCIP; C:\Windows\System32\drivers\rausbcipwdf.sys [87552 2013-10-10] (Rockwell Automation, Inc.) R1 VirtualBackplane; C:\Windows\System32\Drivers\VirtualBackplane.sys [51200 2013-10-10] (Rockwell Automation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 massfilter_lte; \??\C:\Windows\system32\drivers\massfilter_lte.sys [X] S3 pcidnt; \SystemRoot\System32\Drivers\pcidnt.sys [X] S3 RSSERIAL; \SystemRoot\SYSTEM32\RSSERIAL.SYS [X] S4 sptd; System32\Drivers\sptd.sys [X] S3 vdrive; system32\DRIVERS\vdrive.sys [X] S3 zgdcat; system32\DRIVERS\zgdcat.sys [X] S3 zgdcdiag; system32\DRIVERS\zgdcdiag.sys [X] S3 zgdcmdm; system32\DRIVERS\zgdcmdm.sys [X] S3 zgdcnet; system32\DRIVERS\zgdcnet.sys [X] S3 zgdcnmea; system32\DRIVERS\zgdcnmea.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-04-02 15:14 - 2016-04-02 15:14 - 00000000 ____D C:\Users\acer\Desktop\Stare dane programu Firefox 2016-04-02 15:02 - 2016-04-02 15:02 - 00000226 _____ C:\Windows\wininit.ini 2016-04-02 14:57 - 2016-04-02 14:58 - 00003202 _____ C:\Windows\System32\Tasks\{128D6072-B423-9421-A97D-30E62BD88BBC} 2016-04-02 14:57 - 2016-04-02 14:58 - 00000000 ____D C:\ProgramData\Quotenamrons 2016-04-02 14:57 - 2016-04-02 14:58 - 00000000 ____D C:\ProgramData\Quotenamron 2016-04-02 14:57 - 2016-04-02 14:57 - 00402905 _____ C:\Users\acer\AppData\Roaming\Fresh-Plus.bin 2016-04-02 14:57 - 2016-04-02 14:57 - 00003450 _____ C:\Windows\System32\Tasks\acerMaxwellsProbabilitiesV2 2016-04-02 14:57 - 2016-04-02 14:57 - 00002397 _____ C:\Windows\SysWOW64\findit.xml 2016-04-02 14:57 - 2016-04-02 14:57 - 00000270 _____ C:\Windows\Tasks\{128D6072-B423-9421-A97D-30E62BD88BBC}.job 2016-04-02 14:56 - 2016-04-02 14:56 - 06744360 _____ (Dirk Böttcher ) C:\Users\acer\Downloads\Ahnenblatt 2.88.exe 2016-04-02 14:56 - 2016-04-02 14:56 - 06504960 _____ C:\Users\acer\AppData\Roaming\agent.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 01626591 _____ C:\Users\acer\AppData\Roaming\Laming.tst 2016-04-02 14:56 - 2016-04-02 14:56 - 01043968 _____ C:\Users\acer\AppData\Roaming\Laming.exe 2016-04-02 14:56 - 2016-04-02 14:56 - 00145050 _____ C:\Users\acer\AppData\Roaming\inst.lat 2016-04-02 14:56 - 2016-04-02 14:56 - 00127488 _____ C:\Users\acer\AppData\Roaming\Installer.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 00126464 _____ C:\Users\acer\AppData\Roaming\noah.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 00065856 _____ C:\Users\acer\AppData\Roaming\Config.xml 2016-04-02 14:56 - 2016-04-02 14:56 - 00018432 _____ C:\Users\acer\AppData\Roaming\Main.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 00014448 _____ C:\Users\acer\AppData\Roaming\InstallationConfiguration.xml 2016-04-02 14:56 - 2016-04-02 14:56 - 00005568 _____ C:\Users\acer\AppData\Roaming\md.xml 2016-04-02 14:56 - 2016-04-02 14:56 - 00000000 ____D C:\Users\acer\AppData\Local\Sparta 2016-04-02 14:54 - 2016-04-02 14:54 - 01053325 _____ (Hopita ) C:\Users\acer\Desktop\Ahnenblatt%202.88.exe 2016-04-02 12:05 - 2016-04-02 14:14 - 00000090 ____H C:\Users\acer\Desktop\.~lock.drzewo genealogiczne.odt# 2016-04-02 12:04 - 2016-04-02 14:14 - 00011190 _____ C:\Users\acer\Desktop\drzewo genealogiczne.odt 2016-03-25 02:42 - 2016-03-25 02:47 - 00000000 ____D C:\Program Files\DVDFab Virtual Drive 2016-03-25 02:40 - 2016-03-25 02:40 - 00827120 _____ (Fengtao Software Inc. ) C:\Users\acer\Desktop\DVDFabVirtualDrive1511.exe 2016-03-12 12:25 - 2016-03-18 17:50 - 00011482 _____ C:\Users\acer\Desktop\Nowy OpenDocument Arkusz kalkulacyjny.ods 2016-03-03 10:59 - 2016-03-23 02:54 - 00054675 _____ C:\Users\acer\Desktop\harwatrmoon plan jazdy.txt ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-04-02 15:38 - 2015-11-06 21:24 - 00000000 ____D C:\FRST 2016-04-02 15:38 - 2014-03-07 21:04 - 00016766 _____ C:\Users\acer\Downloads\FRST.txt 2016-04-02 15:27 - 2009-07-14 06:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-04-02 15:27 - 2009-07-14 06:45 - 00016976 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-04-02 15:23 - 2014-03-07 21:04 - 02374144 _____ (Farbar) C:\Users\acer\Downloads\FRST64.exe 2016-04-02 15:17 - 2013-06-02 14:29 - 00000432 _____ C:\Windows\system32\Drivers\etc\hosts.ics 2016-04-02 12:12 - 2012-09-27 18:42 - 00000000 ___RD C:\DANE 2016-04-02 11:30 - 2012-04-28 09:39 - 00823498 _____ C:\Windows\system32\perfh015.dat 2016-04-02 11:30 - 2012-04-28 09:39 - 00191692 _____ C:\Windows\system32\perfc015.dat 2016-04-02 11:30 - 2009-07-14 07:13 - 01877002 _____ C:\Windows\system32\PerfStringBackup.INI 2016-04-02 11:30 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2016-04-02 09:05 - 2014-07-31 05:49 - 00000000 ____D C:\Nowy folder 2016-03-28 13:02 - 2013-01-20 19:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-03-28 13:02 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-03-25 02:48 - 2013-05-27 22:21 - 00000000 ____D C:\Users\acer\AppData\Roaming\Aegisub 2016-03-23 17:41 - 2013-01-11 01:39 - 00007637 _____ C:\Users\acer\AppData\Local\Resmon.ResmonCfg 2016-03-19 10:12 - 2014-05-30 05:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-03-18 23:24 - 2015-05-04 17:05 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-03-18 23:24 - 2015-05-04 17:05 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-03-18 23:24 - 2014-07-14 14:43 - 00000000 ____D C:\Users\acer\AppData\Local\Adobe 2016-03-05 18:26 - 2015-12-31 17:45 - 00000000 ____D C:\Users\acer\Downloads\VIDEO 2016-03-05 14:23 - 2012-09-21 18:43 - 00000000 ____D C:\Users\acer\AppData\Local\Microsoft Games ==================== Pliki w katalogu głównym wybranych folderów ======= 2014-08-26 21:10 - 2014-08-26 21:14 - 215313801 _____ () C:\Users\acer\AppData\Roaming\.minecraft.rar 2016-04-02 14:56 - 2016-04-02 14:56 - 6504960 _____ () C:\Users\acer\AppData\Roaming\agent.dat 2013-06-28 11:52 - 2013-06-28 11:52 - 0002298 _____ () C:\Users\acer\AppData\Roaming\ASSDraw3.cfg 2016-04-02 14:56 - 2016-04-02 14:56 - 0065856 _____ () C:\Users\acer\AppData\Roaming\Config.xml 2016-04-02 14:57 - 2016-04-02 14:57 - 0402905 _____ () C:\Users\acer\AppData\Roaming\Fresh-Plus.bin 2016-04-02 14:56 - 2016-04-02 14:56 - 0145050 _____ () C:\Users\acer\AppData\Roaming\inst.lat 2016-04-02 14:56 - 2016-04-02 14:56 - 0014448 _____ () C:\Users\acer\AppData\Roaming\InstallationConfiguration.xml 2016-04-02 14:56 - 2016-04-02 14:56 - 0127488 _____ () C:\Users\acer\AppData\Roaming\Installer.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 1043968 _____ () C:\Users\acer\AppData\Roaming\Laming.exe 2016-04-02 14:56 - 2016-04-02 14:56 - 1626591 _____ () C:\Users\acer\AppData\Roaming\Laming.tst 2016-04-02 14:56 - 2016-04-02 14:56 - 0018432 _____ () C:\Users\acer\AppData\Roaming\Main.dat 2016-04-02 14:56 - 2016-04-02 14:56 - 0005568 _____ () C:\Users\acer\AppData\Roaming\md.xml 2016-04-02 14:56 - 2016-04-02 14:56 - 0126464 _____ () C:\Users\acer\AppData\Roaming\noah.dat 2013-05-11 21:50 - 2013-05-11 21:50 - 0000024 ___SH () C:\Users\acer\AppData\Roaming\System3192SettingsDB.dat 2013-05-11 21:50 - 2013-05-11 21:50 - 0000024 ___SH () C:\Users\acer\AppData\Roaming\Win4665 Config DB.dlx 2013-01-19 23:27 - 2015-02-17 20:01 - 0012800 _____ () C:\Users\acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-11 01:39 - 2016-03-23 17:41 - 0007637 _____ () C:\Users\acer\AppData\Local\Resmon.ResmonCfg Pliki do przeniesienia lub usunięcia: ==================== C:\Windows\Tasks\{128D6072-B423-9421-A97D-30E62BD88BBC}.job Niektóre pliki w TEMP: ==================== C:\Users\acer\AppData\Local\Temp\PlunderingGargling.dll ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-03-19 02:41 ==================== Koniec FRST.txt ============================