Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:05-03-2016 01
Uruchomiony przez cis (UWAGA: Użytkownik nie jest administratorem)  UTER (05-04-2016 16:32:58)
Uruchomiony z C:\Users\cis\Downloads
Załadowane profile: cis (Dostępne profile: cis & Justyna & Paulina2)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Safe Mode (with Networking)
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

Brak dostępu do procesu -> smss.exe
Brak dostępu do procesu -> csrss.exe
Brak dostępu do procesu -> wininit.exe
Brak dostępu do procesu -> csrss.exe
Brak dostępu do procesu -> winlogon.exe
Brak dostępu do procesu -> services.exe
Brak dostępu do procesu -> lsass.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> dwm.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> svchost.exe
Brak dostępu do procesu -> PSANHost.exe
Brak dostępu do procesu -> PSUAService.exe
Brak dostępu do procesu -> WmiPrvSE.exe
Brak dostępu do procesu -> svchost.exe
(Microsoft Corporation) C:\Windows\HelpPane.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [IAStorIcon] => G:\sterowniki\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2894664 2013-08-08] (ELAN Microelectronics Corp.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [903384 2013-07-24] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [lxczbmgr.exe] => C:\Program Files (x86)\Lexmark 1200 Series\lxczbmgr.exe [74408 2009-04-27] (Lexmark International, Inc.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2016-03-12] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2016-03-12] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-09] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PowerDVD15Agent] => C:\Program Files (x86)\CyberLink\PowerDVD15\PowerDVD15Agent.exe [949960 2015-10-11] (CyberLink Corp.)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [99064 2015-12-07] (Panda Security, S.L.)
HKLM-x32\...\Run: [NetTime] => C:\Program Files (x86)\NetTime\NetTime.exe [772096 2012-05-12] ()
HKLM\...\RunOnce: [*WerKernelReporting] => C:\Windows\SYSTEM32\WerFault.exe [465320 2014-11-21] (Microsoft Corporation)
HKLM-x32\...\RunOnce: [] => [X]
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [Steam] => G:\steam\steam.exe [3077712 2016-03-31] (Valve Corporation)
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [SandboxieControl] => G:\sand\SbieCtrl.exe [797328 2016-02-26] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [go1984] => C:\Program Files (x86)\go1984\go1984.exe
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [FerroCCTV] => C:\Program Files (x86)\FERRO Software\Ferro CCTV\FerroCCTV.exe
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [f.lux] => C:\Users\cis\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-24] (Flux Software LLC)
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [SOS_Agent] => "C:\Program Files (x86)\Steganos Online Shield\OnlineShieldClient.exe" -agent
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\Run: [TunnelBear] => C:\Program Files (x86)\TunnelBear\TBear.Client.exe [2602496 2016-03-18] (TunnelBear)
HKU\S-1-5-21-528719921-3342016946-942049042-1001\...\MountPoints2: {7d5bb496-c83d-11e5-8254-142d27eff382} - "I:\AutoRun.exe" 
HKU\S-1-5-21-528719921-3342016946-942049042-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\scrnsave.scr [11776 2014-11-21] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-01-31]
ShortcutTarget: Bluetooth.lnk -> G:\sterowniki\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.101
Tcpip\..\Interfaces\{A722E64E-1286-45F0-8FD6-8C4393BB64B5}: [DhcpNameServer] 192.168.0.101
Tcpip\..\Interfaces\{A9538712-985F-4762-83E5-75C974622316}: [DhcpNameServer] 172.18.10.1

Internet Explorer:
==================
HKU\S-1-5-21-528719921-3342016946-942049042-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.wykop.pl/
IE Session Restore: HKU\S-1-5-21-528719921-3342016946-942049042-1001 -> [funkcja włączona]

FireFox:
========
FF ProfilePath: C:\Users\cis\AppData\Roaming\Mozilla\Firefox\Profiles\iszvxm0w.default
FF DefaultSearchEngine: DuckDuckGo
FF NetworkProxy: "autoconfig_url", "data:text/plain, function FindProxyForURL(url, host) {if(host == 'nl1-base.cd-n.net') return 'DIRECT'; \nif(host == 'us1-base.cd-n.net') return 'DIRECT'; \nif(host == 'ca1-base.cd-n.net') return 'DIRECT'; \nif(host == 'au1-base.cd-n.net') return 'DIRECT'; \nif(host == 'jp1-base.cd-n.net') return 'DIRECT'; \nif(host == 'de1-base.cd-n.net') return 'DIRECT'; \nif(host == 'fr1-base.cd-n.net') return 'DIRECT'; \nif(host == '127.0.0.1') return 'DIRECT'; \nif(host == 'localhost') return 'DIRECT'; \nif(host == '192.168.0.0/16') return 'DIRECT'; \nreturn 'HTTPS es2.cd-n.net:143';}"
FF NetworkProxy: "type", 0
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-02] (Google Inc.)
FF Extension: NoScript - C:\Users\cis\AppData\Roaming\Mozilla\Firefox\Profiles\iszvxm0w.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2016-03-23]
FF Extension: Hoxx VPN Proxy - C:\Users\cis\AppData\Roaming\Mozilla\Firefox\Profiles\iszvxm0w.default\Extensions\@hoxx-vpn.xpi [2016-03-30]
FF Extension: Ghostery - C:\Users\cis\AppData\Roaming\Mozilla\Firefox\Profiles\iszvxm0w.default\Extensions\firefox@ghostery.com.xpi [2016-03-25]
FF Extension: British English Dictionary (Marco Pinto) - C:\Users\cis\AppData\Roaming\Mozilla\Firefox\Profiles\iszvxm0w.default\Extensions\marcoagpinto@mail.telepac.pt [2016-04-01]
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-03-19] [Brak podpisu cyfrowego]

Chrome: 
=======
CHR Profile: C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-02]
CHR Extension: (Dokumenty Google) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-02]
CHR Extension: (Dysk Google) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-02]
CHR Extension: (YouTube) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-02]
CHR Extension: (Adblock Plus) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-10]
CHR Extension: (Google Search) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-02]
CHR Extension: (Arkusze Google) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-02]
CHR Extension: (Dokumenty Google offline) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-03]
CHR Extension: (Gmail) - C:\Users\cis\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-02]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-08] (Broadcom Corporation.)
S2 btwdins; G:\sterowniki\Bluetooth Software\btwdins.exe [976600 2013-09-04] (Broadcom Corporation.)
S2 EMET_Service; C:\Program Files (x86)\EMET 5.5\EMET_Service.exe [33960 2016-01-29] (Microsoft Corporation)
S2 ETDService; C:\Program Files\Elantech\ETDService.exe [92160 2013-07-29] (ELAN Microelectronics Corp.)
S2 IAStorDataMgrSvc; G:\sterowniki\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
S2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
R2 lmhosts; C:\Windows\system32\svchost.exe [38792 2014-11-21] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [33088 2014-11-21] (Microsoft Corporation)
S3 lxcz_device; C:\Windows\system32\lxczcoms.exe [566192 2007-04-19] ( )
S3 lxcz_device; C:\Windows\SysWOW64\lxczcoms.exe [537520 2007-04-19] ( )
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2015-12-07] (Panda Security, S.L.)
S2 NetTimeSvc; C:\Program Files (x86)\NetTime\NetTimeService.exe [473088 2012-05-12] () [Brak podpisu cyfrowego]
R2 NlaSvc; C:\Windows\System32\svchost.exe [38792 2014-11-21] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [33088 2014-11-21] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [38792 2014-11-21] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [33088 2014-11-21] (Microsoft Corporation)
S2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [73176 2016-02-22] (Panda Security, S.L.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2015-12-07] (Panda Security, S.L.)
S2 SbieSvc; G:\sand\SbieSvc.exe [187024 2016-02-26] (Sandboxie Holdings, LLC)
S2 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [41472 2016-03-18] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-22] (Advanced Micro Devices, Inc.)
S3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-08-08] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [8536752 2013-07-01] (Broadcom Corporation)
R0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
S1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [94456 2015-12-04] (Panda Security, S.L.)
S1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [201464 2015-12-04] (Panda Security, S.L.)
S1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110840 2015-12-04] (Panda Security, S.L.)
S1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [110840 2015-12-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [58616 2015-06-19] (Panda Security, S.L.)
S1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [103160 2015-12-04] (Panda Security, S.L.)
S1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [78584 2015-12-04] (Panda Security, S.L.)
S1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [124152 2015-12-04] (Panda Security, S.L.)
S1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [300280 2015-12-04] (Panda Security, S.L.)
S1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [170232 2015-12-04] (Panda Security, S.L.)
S1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [113400 2015-12-04] (Panda Security, S.L.)
S1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [257784 2015-12-04] (Panda Security, S.L.)
S1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [106232 2015-12-04] (Panda Security, S.L.)
S2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [164088 2015-11-22] (Panda Security, S.L.)
S2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [120056 2015-11-29] (Panda Security, S.L.)
S1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [197880 2015-11-22] (Panda Security, S.L.)
S2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [124152 2015-12-04] (Panda Security, S.L.)
S2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [136952 2015-12-04] (Panda Security, S.L.)
S2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107768 2015-11-29] (Panda Security, S.L.)
S3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [61712 2015-05-22] (Panda Security, S.L.)
S3 SbieDrv; G:\sand\SbieDrv.sys [204944 2016-02-26] (Sandboxie Holdings, LLC)
R3 tap-tb-0901; C:\Windows\system32\DRIVERS\tap-tb-0901.sys [38656 2015-08-10] (The OpenVPN Project)
S3 tap0901; C:\Windows\system32\DRIVERS\tap0901.sys [27136 2014-11-05] (The OpenVPN Project) [Brak podpisu cyfrowego]
S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42064 2016-02-17] (Anchorfree Inc.)
S3 visctap0901; C:\Windows\system32\DRIVERS\visctap0901.sys [49880 2016-02-18] (The OpenVPN Project)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S2 {687703DE-DC6D-4649-892B-B8497854A6AB}; C:\Program Files (x86)\CyberLink\PowerDVD15\Common\NavFilter\000.fcl [29896 2015-10-11] (CyberLink Corp.)
S3 ew_hwusbdev; \SystemRoot\system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; \SystemRoot\System32\drivers\ew_usbenumfilter.sys [X]
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
S3 hwusb_cdcacm; \SystemRoot\system32\DRIVERS\ew_cdcacm.sys [X]
S3 hwusb_wwanecm; \SystemRoot\system32\DRIVERS\ew_wwanecm.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-04-05 17:30 - 2016-04-05 17:30 - 00000000 _____ C:\Recovery.txt
2016-04-05 16:31 - 2016-04-05 16:33 - 00129692 _____ C:\Windows\ntbtlog.txt
2016-04-05 15:58 - 2016-04-05 16:34 - 00016781 _____ C:\Users\cis\Downloads\FRST.txt
2016-04-05 11:52 - 2016-04-05 12:00 - 00015002 _____ C:\Windows\Minidump\MTB.txt
2016-04-05 11:30 - 2016-04-05 11:04 - 04715178 _____ (Igor Pavlov) C:\Users\cis\Desktop\viwgq309.exe
2016-04-05 09:44 - 2016-04-05 09:44 - 00281408 _____ C:\Windows\Minidump\040516-17406-01.dmp
2016-04-05 07:01 - 2016-04-05 07:02 - 00281352 _____ C:\Windows\Minidump\040516-25546-01.dmp
2016-04-05 05:25 - 2016-04-05 05:26 - 00362712 _____ C:\Windows\Minidump\040516-20921-01.dmp
2016-04-05 04:10 - 2016-04-05 04:10 - 00281408 _____ C:\Windows\Minidump\040516-23968-01.dmp
2016-04-05 02:36 - 2016-04-05 02:37 - 00000000 ____D C:\Users\cis\Desktop\firewall
2016-04-04 16:20 - 2016-04-04 16:20 - 00281408 _____ C:\Windows\Minidump\040416-29921-01.dmp
2016-04-04 13:18 - 2016-04-04 13:18 - 13936808 _____ (TunnelBear) C:\Users\cis\Downloads\TunnelBear-Install (2).exe
2016-04-04 13:17 - 2016-04-05 15:52 - 00000000 ____D C:\Program Files (x86)\TunnelBear
2016-04-04 13:17 - 2016-04-05 04:07 - 00000000 ____D C:\Users\cis\AppData\Roaming\TunnelBear
2016-04-04 13:17 - 2016-04-04 13:17 - 00001889 _____ C:\Users\Public\Desktop\TunnelBear.lnk
2016-04-04 13:17 - 2016-04-04 13:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TunnelBear
2016-04-04 13:15 - 2016-04-04 13:16 - 13936808 _____ (TunnelBear) C:\Users\cis\Downloads\TunnelBear-Install (1).exe
2016-04-04 12:35 - 2016-04-04 12:35 - 13936808 _____ (TunnelBear) C:\Users\cis\Downloads\TunnelBear-Install.exe
2016-04-04 11:33 - 2016-04-04 11:33 - 00000000 ____D C:\Program Files (x86)\proXPN
2016-04-04 10:28 - 2016-04-04 10:28 - 00000000 ____D C:\Windows\LastGood.Tmp
2016-04-04 10:26 - 2016-04-04 10:26 - 00000000 ____D C:\Users\cis\AppData\Roaming\Steganos VPN
2016-04-04 10:26 - 2016-04-04 10:26 - 00000000 ____D C:\Users\cis\AppData\Roaming\Steganos
2016-04-04 10:18 - 2016-04-04 12:22 - 00000000 ____D C:\Program Files (x86)\Steganos Online Shield
2016-04-04 07:36 - 2016-04-04 07:36 - 00000201 _____ C:\Users\cis\Desktop\realMyst.url
2016-04-04 06:05 - 2016-04-04 06:05 - 00380928 _____ C:\Users\cis\zynmb4sj.exe
2016-04-03 11:30 - 2016-04-03 11:30 - 01679444 _____ C:\Users\cis\Desktop\BON_zyj_zdrowo.pdf
2016-04-03 07:56 - 2016-04-03 07:56 - 00001093 _____ C:\Users\Public\Desktop\Revo Uninstaller Pro.lnk
2016-04-03 07:56 - 2016-04-03 07:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2016-04-03 07:55 - 2016-04-03 07:55 - 00000000 ____D C:\ProgramData\VS Revo Group
2016-04-03 07:55 - 2016-04-03 07:55 - 00000000 ____D C:\Program Files\VS Revo Group
2016-04-03 07:55 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2016-04-03 07:49 - 2016-04-03 07:49 - 00389232 _____ C:\Windows\Minidump\040316-28687-01.dmp
2016-04-02 14:49 - 2016-04-02 14:49 - 00000000 ____D C:\Users\cis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2016-04-02 14:48 - 2016-04-02 14:48 - 00000000 ____D C:\Users\cis\AppData\Local\FluxSoftware
2016-04-02 08:04 - 2016-04-02 08:04 - 00002637 _____ C:\Users\cis\Documents\ustawieniaDNS.txt
2016-04-02 07:57 - 2016-04-02 07:57 - 00069632 _____ C:\Users\cis\Documents\systemOstatnie.evtx
2016-04-02 07:56 - 2016-04-02 07:56 - 00069632 _____ C:\Users\cis\Documents\Zabezpiecznia.evtx
2016-04-02 07:55 - 2016-04-02 07:55 - 00069632 _____ C:\Users\cis\Documents\AplikacjaInformacje.evtx
2016-04-02 07:53 - 2016-04-02 07:57 - 00000000 ____D C:\Users\cis\Documents\LocaleMetaData
2016-04-02 07:53 - 2016-04-02 07:54 - 00069632 _____ C:\Users\cis\Documents\aplikacjaBledy.evtx
2016-04-02 07:52 - 2016-04-02 07:53 - 00069632 _____ C:\Users\cis\Documents\systemOstrzeżenia2.evtx
2016-04-02 07:50 - 2016-04-02 07:50 - 00069632 _____ C:\Users\cis\Documents\systemOstrzeżenia.evtx
2016-04-02 07:49 - 2016-04-02 07:49 - 00000139 _____ C:\Users\cis\Documents\DHCPclientlist.txt
2016-03-31 19:08 - 2016-03-24 20:19 - 00046784 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-03-31 19:08 - 2016-03-24 15:20 - 01385472 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 01169408 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 00698368 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 00499200 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2016-03-31 19:08 - 2016-03-24 15:20 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-03-31 06:53 - 2016-03-31 06:58 - 00000000 ____D C:\Users\cis\.gimp-2.8
2016-03-31 06:53 - 2016-03-31 06:53 - 00000000 ____D C:\Users\cis\AppData\Local\gegl-0.2
2016-03-31 06:49 - 2016-03-31 06:49 - 00000910 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-03-31 06:48 - 2016-03-31 06:49 - 00000000 ____D C:\Program Files\GIMP 2
2016-03-31 05:59 - 2016-03-31 05:59 - 00000000 ____D C:\Windows\SysWOW64\Hotspot Shield
2016-03-28 02:58 - 2016-03-28 02:58 - 00000000 ____D C:\Users\cis\AppData\Local\CrashRpt
2016-03-28 02:29 - 2016-04-04 11:39 - 00000000 ____D C:\Program Files\OpenVPN
2016-03-27 07:08 - 2016-03-27 07:08 - 00000146 _____ C:\Users\cis\Desktop\Dolby Digital Plus Advanced Audio — skrót.lnk
2016-03-27 05:37 - 2016-03-27 05:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NetTime
2016-03-27 05:14 - 2016-03-27 05:14 - 00336712 _____ C:\Windows\Minidump\032716-17984-01.dmp
2016-03-27 05:14 - 2015-05-22 10:45 - 00061712 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-03-27 04:42 - 2016-04-05 16:32 - 00000000 ____D C:\FRST
2016-03-27 04:41 - 2016-03-27 04:41 - 02374144 _____ (Farbar) C:\Users\cis\Downloads\FRST64.exe
2016-03-27 04:12 - 2016-04-05 11:52 - 00000000 ____D C:\Windows\Minidump
2016-03-27 04:12 - 2016-04-05 09:44 - 480043647 _____ C:\Windows\MEMORY.DMP
2016-03-27 04:12 - 2016-03-27 04:13 - 00281464 _____ C:\Windows\Minidump\032716-19687-01.dmp
2016-03-27 03:47 - 2016-03-27 03:47 - 00380928 _____ C:\Users\cis\Downloads\xhkbq77y.exe
2016-03-27 03:40 - 2016-03-27 03:41 - 00240702 _____ C:\TDSSKiller.3.1.0.9_27.03.2016_03.40.17_log.txt
2016-03-27 03:26 - 2016-03-27 05:37 - 00000000 ____D C:\Program Files (x86)\NetTime
2016-03-27 03:00 - 2015-07-30 16:04 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2016-03-27 03:00 - 2015-07-30 15:48 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2016-03-26 12:33 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2016-03-26 12:33 - 2014-06-10 00:13 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2016-03-26 03:45 - 2016-03-26 03:45 - 00000000 __SHD C:\Windows\ftpcache
2016-03-26 03:33 - 2016-03-26 03:41 - 00000000 ____D C:\Users\cis\AppData\Roaming\LANGMasterEiA
2016-03-25 23:28 - 2016-03-25 23:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel XP-2003 - praktyczny kurs obsługi
2016-03-25 23:27 - 2016-03-25 23:27 - 00000000 ____D C:\Program Files (x86)\Excel XP-2003 - praktyczny kurs obsługi
2016-03-25 23:24 - 2016-03-25 23:24 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2016-03-25 23:24 - 2016-03-25 23:24 - 00000000 ____D C:\Program Files\Reference Assemblies
2016-03-25 23:24 - 2016-03-25 23:24 - 00000000 ____D C:\Program Files\MSBuild
2016-03-25 23:24 - 2016-03-25 23:24 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2016-03-25 23:24 - 2016-03-25 23:24 - 00000000 ____D C:\Program Files (x86)\MSBuild
2016-03-25 23:22 - 2013-08-03 06:48 - 01166520 _____ (Microsoft Corporation) C:\Windows\system32\PresentationNative_v0300.dll
2016-03-25 23:22 - 2013-08-03 06:41 - 00778936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationNative_v0300.dll
2016-03-25 19:48 - 1998-10-29 16:45 - 00306688 _____ (InstallShield Software Corporation) C:\Windows\IsUninst.exe
2016-03-25 19:46 - 1998-10-07 13:54 - 00327168 _____ (InstallShield Software Corporation) C:\Windows\IsUn0415.exe
2016-03-25 14:38 - 2016-02-18 02:31 - 00049880 _____ (The OpenVPN Project) C:\Windows\system32\Drivers\visctap0901.sys
2016-03-23 15:23 - 2016-03-23 15:23 - 02404659 _____ C:\Users\cis\Downloads\366_9.zip
2016-03-22 01:07 - 2016-03-22 01:08 - 00024109 _____ C:\Users\cis\Desktop\PrivatoriaAccountDetails.pdf
2016-03-21 17:39 - 2016-03-21 17:39 - 00333147 _____ C:\Users\cis\Desktop\2016-03-03__ifwom_ArielLenor.pdf
2016-03-19 23:44 - 2016-03-26 01:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-03-18 13:29 - 2016-03-18 13:29 - 00000000 ____D C:\ProgramData\Energy Management
2016-03-17 22:00 - 2016-03-17 22:00 - 00000754 _____ C:\Users\cis\AppData\Local\recently-used.xbel
2016-03-17 21:57 - 2016-03-17 21:57 - 00000000 ____D C:\Users\cis\AppData\Local\fontconfig
2016-03-17 21:55 - 2016-03-17 21:55 - 00000000 ____D C:\Users\cis\AppData\Roaming\inkscape
2016-03-16 08:17 - 2016-02-09 03:31 - 22365472 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-03-16 08:17 - 2016-02-09 03:31 - 19794896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-03-16 08:17 - 2016-02-09 03:31 - 02757616 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2016-03-16 08:17 - 2016-02-09 03:31 - 02412576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2016-03-16 08:17 - 2016-02-09 03:31 - 00273264 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlows.exe
2016-03-16 08:17 - 2016-02-08 22:55 - 02712576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2016-03-16 08:17 - 2016-02-08 22:15 - 02551808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\themecpl.dll
2016-03-16 08:17 - 2016-02-08 22:02 - 01197056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll
2016-03-16 08:17 - 2016-02-08 21:48 - 12879360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2016-03-16 08:17 - 2016-02-08 21:43 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2016-03-16 08:17 - 2016-02-08 21:40 - 00539648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hgcpl.dll
2016-03-16 08:17 - 2016-02-08 21:39 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\stobject.dll
2016-03-16 08:17 - 2016-02-08 21:37 - 00141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingMonitor.dll
2016-03-16 08:17 - 2016-02-08 21:35 - 00954880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.appcore.dll
2016-03-16 08:17 - 2016-02-08 21:34 - 00667648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncCore.dll
2016-03-16 08:17 - 2016-02-08 21:33 - 00520192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSync.dll
2016-03-16 08:17 - 2016-02-08 20:50 - 03120640 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2016-03-16 08:17 - 2016-02-08 19:55 - 02592256 _____ (Microsoft Corporation) C:\Windows\system32\themecpl.dll
2016-03-16 08:17 - 2016-02-08 19:33 - 01278464 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll
2016-03-16 08:17 - 2016-02-08 19:12 - 14466560 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2016-03-16 08:17 - 2016-02-08 19:02 - 00653824 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2016-03-16 08:17 - 2016-02-08 19:00 - 00599552 _____ (Microsoft Corporation) C:\Windows\system32\hgcpl.dll
2016-03-16 08:17 - 2016-02-08 18:58 - 00336384 _____ (Microsoft Corporation) C:\Windows\system32\stobject.dll
2016-03-16 08:17 - 2016-02-08 18:55 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\SettingMonitor.dll
2016-03-16 08:17 - 2016-02-08 18:53 - 02171904 _____ (Microsoft Corporation) C:\Windows\system32\SystemSettingsAdminFlowUI.dll
2016-03-16 08:17 - 2016-02-08 18:53 - 01348096 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-03-16 08:17 - 2016-02-08 18:50 - 01220096 _____ (Microsoft Corporation) C:\Windows\system32\twinui.appcore.dll
2016-03-16 08:17 - 2016-02-08 18:50 - 00841728 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncCore.dll
2016-03-16 08:17 - 2016-02-08 18:48 - 00655872 _____ (Microsoft Corporation) C:\Windows\system32\SettingSync.dll
2016-03-16 08:17 - 2016-02-08 18:47 - 02819584 _____ (Microsoft Corporation) C:\Windows\system32\SettingsHandlers.dll
2016-03-16 08:17 - 2016-02-08 18:44 - 00955392 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-03-16 08:17 - 2016-02-05 16:46 - 01455104 _____ (Microsoft Corporation) C:\Windows\system32\VSSVC.exe
2016-03-16 08:17 - 2016-02-03 17:14 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\IPMIDrv.sys
2016-03-16 08:17 - 2016-02-03 17:11 - 01673728 _____ (Microsoft Corporation) C:\Windows\system32\workfolderssvc.dll
2016-03-16 08:17 - 2016-02-02 20:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rasl2tp.sys
2016-03-16 08:17 - 2016-02-02 19:51 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2016-03-16 08:17 - 2016-02-02 19:19 - 00144384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2016-03-16 08:17 - 2016-02-02 19:15 - 00787456 _____ (Microsoft Corporation) C:\Windows\system32\WorkfoldersControl.dll
2016-03-16 08:17 - 2016-02-02 19:01 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\WsmAgent.dll
2016-03-16 08:17 - 2016-02-02 18:51 - 02609152 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2016-03-16 08:17 - 2016-02-02 18:48 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2016-03-16 08:17 - 2016-02-02 18:46 - 00026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAgent.dll
2016-03-16 08:17 - 2016-02-02 18:41 - 02170880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2016-03-16 08:17 - 2016-02-02 18:39 - 00236032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2016-03-16 08:17 - 2016-01-31 21:17 - 00118624 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2016-03-16 08:17 - 2016-01-31 20:07 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2016-03-16 08:17 - 2016-01-31 19:42 - 03320832 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2016-03-16 08:17 - 2016-01-31 19:14 - 03607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2016-03-16 08:17 - 2016-01-31 18:24 - 02778624 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2016-03-16 08:17 - 2016-01-31 18:20 - 02464256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2016-03-16 08:17 - 2016-01-27 17:18 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2016-03-16 08:17 - 2016-01-21 21:35 - 00952928 _____ (Microsoft Corporation) C:\Windows\system32\mfmp4srcsnk.dll
2016-03-16 08:17 - 2016-01-21 20:42 - 00786152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfmp4srcsnk.dll
2016-03-16 08:16 - 2016-02-11 22:17 - 07452504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-03-16 08:16 - 2016-02-11 22:17 - 01737088 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2016-03-16 08:16 - 2016-02-11 22:17 - 01663184 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2016-03-16 08:16 - 2016-02-11 22:17 - 01523208 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2016-03-16 08:16 - 2016-02-11 22:17 - 01490120 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2016-03-16 08:16 - 2016-02-11 22:17 - 01358952 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2016-03-16 08:16 - 2016-02-11 22:16 - 01501488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2016-03-16 08:16 - 2016-02-09 20:07 - 00246784 _____ (Microsoft Corporation) C:\Windows\system32\microsoft-windows-system-events.dll
2016-03-16 08:16 - 2016-02-06 19:02 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dsparse.dll
2016-03-16 08:16 - 2016-02-06 18:35 - 00024064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dsparse.dll
2016-03-16 08:16 - 2016-02-05 21:07 - 00378712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-03-16 08:16 - 2016-02-05 17:11 - 00845312 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2016-03-16 08:16 - 2016-02-05 17:11 - 00422400 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2016-03-16 08:16 - 2016-02-05 17:07 - 00272384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2016-03-16 08:16 - 2016-02-05 17:02 - 01083904 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2016-03-16 08:16 - 2016-02-04 20:07 - 00222720 _____ (Microsoft Corporation) C:\Windows\system32\dhcpsapi.dll
2016-03-16 08:16 - 2016-02-04 19:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpsapi.dll
2016-03-16 08:16 - 2016-02-04 18:23 - 00713216 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2016-03-16 08:16 - 2016-02-04 18:22 - 00561664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2016-03-16 08:16 - 2016-02-02 19:18 - 01574912 _____ (Microsoft Corporation) C:\Windows\system32\wbengine.exe
2016-03-16 08:16 - 2016-01-31 19:17 - 00779264 _____ (Microsoft Corporation) C:\Windows\system32\WindowsAnytimeUpgradeui.exe
2016-03-16 08:16 - 2016-01-26 21:15 - 00072024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vpci.sys
2016-03-16 08:16 - 2016-01-22 07:22 - 02487296 _____ (Microsoft Corporation) C:\Windows\system32\storagewmi.dll
2016-03-16 08:16 - 2016-01-22 07:11 - 01482240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\storagewmi.dll
2016-03-16 08:16 - 2016-01-21 00:40 - 00099672 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2016-03-16 08:15 - 2016-02-07 01:05 - 00551256 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys
2016-03-16 08:15 - 2016-02-07 00:41 - 00316760 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2016-03-16 05:11 - 2016-04-05 08:55 - 00000000 ____D C:\Users\Justyna
2016-03-16 05:06 - 2016-03-16 05:06 - 00001105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Baseline Security Analyzer 2.3.lnk
2016-03-16 05:06 - 2016-03-16 05:06 - 00001093 _____ C:\Users\Public\Desktop\Microsoft Baseline Security Analyzer 2.3.lnk
2016-03-16 05:06 - 2016-03-16 05:06 - 00000000 ____D C:\Program Files\Microsoft Baseline Security Analyzer 2
2016-03-16 05:03 - 2016-03-16 05:03 - 01818624 _____ C:\Users\cis\Downloads\MBSASetup-x64-EN.msi
2016-03-15 13:16 - 2016-03-15 13:16 - 00041889 _____ C:\Users\cis\Desktop\20160314164540-56.pdf
2016-03-15 11:18 - 2016-03-15 11:18 - 00135241 _____ C:\Users\cis\Desktop\fundacjaOchronyZwierząt.pdf
2016-03-15 04:53 - 2016-03-16 04:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Enhanced Mitigation Experience Toolkit
2016-03-15 04:53 - 2016-03-16 04:04 - 00000000 ____D C:\Program Files (x86)\EMET 5.5
2016-03-15 04:12 - 2016-04-05 11:25 - 00000000 ____D C:\Users\Paulina2
2016-03-15 04:00 - 2016-03-15 04:00 - 00000000 ____D C:\Users\cis\Downloads\PUA_Windows8_81_10
2016-03-13 03:31 - 2016-03-13 03:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2016-03-13 03:31 - 2016-03-13 03:31 - 00000000 ____D C:\Program Files\7-Zip
2016-03-12 11:45 - 2016-03-12 11:45 - 00000000 ____D C:\Users\cis\AppData\Local\Intel_Corporation
2016-03-12 11:35 - 2016-03-12 11:35 - 00000044 _____ C:\Users\cis\Desktop\gmail.txt
2016-03-12 11:35 - 2016-03-12 11:35 - 00000000 ____D C:\Program Files\Lenovo
2016-03-12 11:35 - 2016-03-12 11:35 - 00000000 ____D C:\Program Files\DIFX
2016-03-12 11:35 - 2016-03-12 11:34 - 00039008 _____ (Lenovo.) C:\Windows\system32\Drivers\LhdX64.sys
2016-03-12 11:35 - 2016-03-12 11:34 - 00019872 _____ (Lenovo (Beijing) Limited) C:\Windows\system32\LenovoSDKEmSubSystem.dll
2016-03-12 11:34 - 2016-03-12 11:34 - 00000000 ____D C:\ProgramData\Downloaded Installations
2016-03-12 10:20 - 2016-03-12 10:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sandboxie
2016-03-12 09:35 - 2016-03-12 09:35 - 00000000 ____D C:\TCPView
2016-03-12 09:01 - 2016-03-27 03:40 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-03-12 09:00 - 2016-03-27 03:39 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-03-12 09:00 - 2016-03-27 03:39 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-03-12 09:00 - 2016-03-27 03:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-03-12 09:00 - 2016-03-12 09:00 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-03-12 09:00 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-03-12 09:00 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-03-12 09:00 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-03-12 07:02 - 2016-03-15 18:33 - 00000195 _____ C:\Users\cis\Desktop\ip_udp.txt
2016-03-10 15:14 - 2016-03-10 15:15 - 00000000 ____D C:\Users\cis\Desktop\Outlook.com
2016-03-10 05:29 - 2016-03-10 05:29 - 00001822 _____ C:\Users\cis\Desktop\ImageMagick Display.lnk
2016-03-10 05:29 - 2016-03-10 05:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ImageMagick 6.9.3 Q16 (64-bit)
2016-03-10 05:28 - 2016-03-10 05:28 - 00000000 ____D C:\Program Files\ImageMagick-6.9.3-Q16
2016-03-10 05:24 - 2016-03-10 05:24 - 00000000 ____D C:\Users\cis\AppData\Roaming\npm-cache
2016-03-10 05:21 - 2016-03-23 21:02 - 00002351 _____ C:\Users\cis\.node_repl_history
2016-03-10 05:21 - 2016-03-10 08:03 - 00000000 ____D C:\Users\cis\AppData\Roaming\npm
2016-03-10 05:21 - 2016-03-10 05:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Node.js
2016-03-08 21:38 - 2016-02-08 23:05 - 20352512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-03-08 21:38 - 2016-02-08 22:39 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-03-08 21:38 - 2016-02-08 22:34 - 02280448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-03-08 21:38 - 2016-02-08 22:29 - 00099328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\hlink.dll
2016-03-08 21:38 - 2016-02-08 22:28 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-03-08 21:38 - 2016-02-08 22:10 - 04611072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-03-08 21:38 - 2016-02-08 22:03 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-03-08 21:38 - 2016-02-08 22:02 - 13012480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-03-08 21:38 - 2016-02-08 22:02 - 00687104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-03-08 21:38 - 2016-02-08 22:01 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-03-08 21:38 - 2016-02-08 21:39 - 01311744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-03-08 21:38 - 2016-02-08 20:27 - 02887680 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-03-08 21:38 - 2016-02-08 20:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-03-08 21:38 - 2016-02-08 19:34 - 00798720 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-03-08 21:38 - 2016-02-08 19:33 - 02123264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-03-08 21:38 - 2016-02-08 19:07 - 01546752 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-03-08 21:37 - 2016-02-11 16:21 - 00869576 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2016-03-08 21:37 - 2016-02-11 16:21 - 00678600 _____ (Microsoft Corporation) C:\Windows\system32\msvcp120_clr0400.dll
2016-03-08 21:37 - 2016-02-11 16:20 - 00875720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2016-03-08 21:37 - 2016-02-11 16:20 - 00536776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp120_clr0400.dll
2016-03-08 21:37 - 2016-02-08 22:07 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2016-03-08 21:37 - 2016-02-08 22:05 - 25816576 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-03-08 21:37 - 2016-02-08 21:43 - 02121216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-03-08 21:37 - 2016-02-08 21:38 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-03-08 21:37 - 2016-02-08 20:16 - 06052352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-03-08 21:37 - 2016-02-08 20:14 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\hlink.dll
2016-03-08 21:37 - 2016-02-08 20:13 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-03-08 21:37 - 2016-02-08 19:51 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-03-08 21:37 - 2016-02-08 19:42 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2016-03-08 21:37 - 2016-02-08 19:37 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-03-08 21:37 - 2016-02-08 19:33 - 14613504 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-03-08 21:37 - 2016-02-08 19:19 - 02597376 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-03-08 21:37 - 2016-02-08 19:15 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2016-03-08 21:37 - 2016-02-08 18:55 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-03-08 21:37 - 2016-02-06 20:08 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\seclogon.dll
2016-03-08 21:37 - 2016-02-06 18:58 - 00987648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-03-08 21:37 - 2016-02-06 18:32 - 00801792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-03-08 21:37 - 2016-02-05 21:07 - 00292696 _____ (Microsoft Corporation) C:\Windows\system32\WMASF.DLL
2016-03-08 21:37 - 2016-02-05 21:07 - 00243032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMASF.DLL
2016-03-08 21:37 - 2016-02-05 17:03 - 15432704 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-03-08 21:37 - 2016-02-05 17:00 - 13318144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-03-08 21:37 - 2016-02-05 16:59 - 07784960 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-03-08 21:37 - 2016-02-05 16:55 - 05264384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-03-08 21:37 - 2016-02-05 16:48 - 07075840 _____ (Microsoft Corporation) C:\Windows\system32\glcndFilter.dll
2016-03-08 21:37 - 2016-02-05 16:47 - 05268480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\glcndFilter.dll
2016-03-08 21:37 - 2016-02-04 20:18 - 04174336 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-03-08 21:37 - 2016-02-04 20:18 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2016-03-08 21:37 - 2016-02-04 20:12 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2016-03-08 21:37 - 2016-02-04 19:44 - 00301568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2016-03-08 21:37 - 2016-02-04 19:39 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2016-03-08 21:37 - 2016-02-04 19:24 - 00603648 _____ (Microsoft Corporation) C:\Windows\system32\mfds.dll
2016-03-08 21:37 - 2016-02-03 22:37 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-03-08 21:37 - 2016-02-03 22:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-03-08 21:37 - 2016-02-03 17:09 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\olepro32.dll
2016-03-08 21:37 - 2016-02-03 17:00 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\asycfilt.dll
2016-03-08 21:37 - 2016-02-03 17:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\asycfilt.dll
2016-03-08 21:37 - 2016-01-31 21:16 - 00148832 ____C (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2016-03-08 21:36 - 2016-02-04 19:02 - 00483328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfds.dll
2016-03-07 22:01 - 2016-03-07 22:01 - 00000907 _____ C:\Users\Public\Desktop\Inkscape 0.91.lnk
2016-03-07 21:59 - 2016-03-07 22:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Inkscape 0.91
2016-03-07 21:59 - 2016-03-07 22:01 - 00000000 ____D C:\Program Files\Inkscape

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-04-05 16:29 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-05 16:00 - 2016-02-02 17:49 - 00001052 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-05 15:52 - 2014-11-21 06:46 - 01749158 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-05 15:52 - 2014-11-21 06:07 - 00778904 _____ C:\Windows\system32\perfh015.dat
2016-04-05 15:52 - 2014-11-21 06:07 - 00152624 _____ C:\Windows\system32\perfc015.dat
2016-04-05 15:52 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\Inf
2016-04-05 11:15 - 2016-02-02 17:48 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-05 09:13 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2016-04-05 04:10 - 2016-01-31 15:10 - 00000000 ____D C:\Users\cis
2016-04-04 16:50 - 2016-01-31 19:26 - 00000000 ____D C:\ProgramData\DatacardService
2016-04-04 13:16 - 2016-01-31 20:13 - 00000000 ____D C:\ProgramData\Package Cache
2016-04-04 11:51 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2016-04-03 07:42 - 2016-02-01 11:02 - 00000000 ____D C:\Windows\system32\appraiser
2016-04-02 10:24 - 2016-02-01 07:34 - 00001816 _____ C:\Windows\Sandboxie.ini
2016-03-31 19:09 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2016-03-28 22:57 - 2016-02-02 17:52 - 00002221 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-28 22:57 - 2016-02-02 17:52 - 00002209 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-03-28 10:57 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2016-03-26 01:11 - 2016-01-31 15:11 - 00000000 ____D C:\Users\cis\AppData\Local\VirtualStore
2016-03-26 01:08 - 2016-01-31 19:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-03-25 23:24 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\MUI
2016-03-25 23:24 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\MUI
2016-03-23 20:26 - 2016-02-01 11:02 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2016-03-23 20:26 - 2016-02-01 11:02 - 00000000 ___SD C:\Windows\system32\GWX
2016-03-20 13:13 - 2016-01-31 19:50 - 00000764 _____ C:\Users\cis\Desktop\Start Tor Browser.lnk
2016-03-20 13:13 - 2016-01-31 19:50 - 00000764 _____ C:\Users\cis\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-03-16 08:26 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ToastData
2016-03-16 05:12 - 2013-08-22 16:45 - 00000000 ____D C:\Windows\ServiceProfiles
2016-03-15 11:53 - 2016-02-23 18:40 - 00000000 ____D C:\PIT Format 2015
2016-03-15 09:30 - 2016-01-31 15:03 - 00000000 ____D C:\Windows\Panther
2016-03-15 08:55 - 2016-01-31 15:10 - 00000000 ____D C:\Users\cis\AppData\Local\Packages
2016-03-15 08:54 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-03-13 00:57 - 2016-01-31 20:07 - 00001115 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KeePass.lnk
2016-03-13 00:57 - 2016-01-31 20:07 - 00000000 ____D C:\Program Files (x86)\KeePass Password Safe
2016-03-12 11:34 - 2016-01-31 19:06 - 00000000 ____D C:\Program Files (x86)\Lenovo
2016-03-12 11:34 - 2016-01-31 19:01 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-03-12 11:34 - 2012-05-15 10:22 - 00033560 _____ (Lenovo Corporation) C:\Windows\system32\Drivers\AcpiVpc.sys
2016-03-12 11:34 - 2012-02-21 06:48 - 01511280 _____ (Microsoft Corporation) C:\Windows\system32\WudfUpdate_01011.dll
2016-03-12 10:17 - 2013-08-22 16:44 - 00401144 _____ C:\Windows\system32\FNTCACHE.DAT
2016-03-12 10:12 - 2016-03-05 05:58 - 01259234 _____ C:\Users\cis\Desktop\ćw3.xlsm
2016-03-10 15:14 - 2016-03-04 00:54 - 01417340 _____ C:\Users\cis\Desktop\Outlook.com.zip
2016-03-09 06:16 - 2016-02-02 10:17 - 00000000 ____D C:\Users\cis\AppData\Roaming\Notepad++
2016-03-08 21:53 - 2016-02-01 10:20 - 00000000 ____D C:\Windows\system32\MRT
2016-03-08 21:49 - 2016-02-01 10:20 - 143659408 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-03-08 21:36 - 2016-02-01 10:16 - 00718336 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-03-08 21:36 - 2016-02-01 10:16 - 00372224 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-03-08 21:36 - 2016-02-01 10:16 - 00325632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-03-08 09:00 - 2014-11-21 11:07 - 00829944 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-03-08 09:00 - 2014-11-21 11:07 - 00176632 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Pliki w katalogu głównym wybranych folderów =======

2016-02-14 14:38 - 2016-02-14 14:38 - 0000331 ____H () C:\Users\cis\AppData\Local\CacheConfig.dat
2016-03-17 22:00 - 2016-03-17 22:00 - 0000754 _____ () C:\Users\cis\AppData\Local\recently-used.xbel
2016-01-31 18:52 - 2016-01-31 18:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\cis\zynmb4sj.exe


Niektóre pliki w TEMP:
====================
C:\Users\cis\AppData\Local\Temp\npp.6.9.Installer.exe
C:\Users\cis\AppData\Local\Temp\SandboxieInstall.exe
C:\Users\cis\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


UWAGA: ==> Nie można uzyskać dostępu do BCD. Użytkownik nie jest administratorem

==================== Koniec  FRST.txt ============================