Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:17-04-2016 01 Ran by SYSTEM on MININT-JT0CV3P (18-04-2016 18:12:14) Running from F:\kB Platform: Windows 7 Professional Service Pack 1 (X64) Language: Angielski (Stany Zjednoczone) Internet Explorer Version 11 Boot Mode: Recovery Default: ControlSet001 [b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b] Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [] => [X] HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-18] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation) HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [967544 2011-03-09] (TOSHIBA Corporation) HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1933584 2011-01-05] (Intel(R) Corporation) HKLM\...\Run: [TFPUPWDBankService] => C:\Program Files\TOSHIBA\TFPU\TFPUPWDBank.exe [925104 2010-03-02] (TOSHIBA) HKLM\...\Run: [TFPUService] => C:\Program Files\TOSHIBA\TFPU\TFPUTaskMonitor.exe [789368 2010-11-04] (TOSHIBA) HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1544104 2011-04-07] (TOSHIBA Corporation) HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation) HKLM\...\Run: [ThpSrv] => C:\windows\system32\thpsrv /logon HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2011-04-05] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2011-03-03] (TOSHIBA Corporation) HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2011-03-30] (TOSHIBA Corporation) HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-09] (Toshiba Europe GmbH) HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2011-08-08] (Toshiba Europe GmbH) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40336 2015-09-24] (Adobe Systems Incorporated) HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1409424 2011-06-29] (Nero AG) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [113656 2013-07-02] (Intel Corporation) HKLM-x32\...\Run: [TOSDCR] => %ProgramFiles%\TOSHIBA\PasswordUtility\TOSDCR.exe HKLM-x32\...\Run: [TWebCamera] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2475384 2011-01-16] (TOSHIBA CORPORATION.) HKLM-x32\...\Run: [ITSecMng] => %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation) HKLM-x32\...\Run: [TSleepSrv] => %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe HKLM-x32\...\Run: [TSUScheduler] => %ProgramFiles(x86)%\TOSHIBA\Sync Utility\TosSyncScheduler.exe HKLM\...\RunOnce: [RollbackOnline] => C:\$WINDOWS.~BT\Sources\SetupPlatform.exe [173760 2016-02-12] (Microsoft Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\BOGUSLAW\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA) HKU\BOGUSLAW\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-08-08] (Google Inc.) HKU\BOGUSLAW\...\Run: [OfficeSyncProcess] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-01] (Microsoft Corporation) HKU\BOGUSLAW\...\RunOnce: [ShowWU] => C:\windows\system32\wuauclt.exe [140288 2016-02-12] (Microsoft Corporation) HKU\BOGUSLAW\...\RunOnce: [Application Restart #0] => C:\Program Files\Windows Sidebar\sidebar.exe [1475584 2010-11-20] (Microsoft Corporation) HKU\BOGUSLAW\...\RunOnce: [Application Restart #1] => C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE [721504 2015-09-01] (Microsoft Corporation) HKU\Default\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA) HKU\Default User\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-15] (TOSHIBA) Startup: C:\Users\BOGUSLAW\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk [2015-07-11] ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AVP15.0.2; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.2\avp.exe [194000 2015-06-29] (Kaspersky Lab ZAO) S2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2753720 2015-07-01] (Microsoft Corporation) S2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-10-27] () S3 MSSQL$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\sqlservr.exe [43010392 2009-03-29] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-01-05] () S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [651856 2013-10-26] () S4 SQLAgent$MSSMLBIZ; C:\Program Files (x86)\Microsoft SQL Server\MSSQL10.MSSMLBIZ\MSSQL\Binn\SQLAGENT.EXE [366936 2009-03-29] (Microsoft Corporation) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-09] (Toshiba Europe GmbH) S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation) S2 WMCoreService; C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\mini_WMCore.exe [584232 2011-01-07] (Ericsson AB) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [247016 2015-06-29] (Kaspersky Lab UK Ltd) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-02-23] (Ericsson AB) S3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-02-23] (Ericsson AB) S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [246272 2013-06-29] (Huawei Technologies Co., Ltd.) S0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2016-03-10] (Kaspersky Lab ZAO) S2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [64368 2015-06-29] (Kaspersky Lab ZAO) S3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [159960 2015-06-29] (Kaspersky Lab ZAO) S1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [227512 2016-03-10] (AO Kaspersky Lab) S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [838048 2016-03-10] (Kaspersky Lab ZAO) S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [39792 2015-06-29] (Kaspersky Lab ZAO) S3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [49008 2016-03-10] (Kaspersky Lab ZAO) S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [48504 2016-03-10] (Kaspersky Lab ZAO) S1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [24944 2015-06-29] (Kaspersky Lab ZAO) S1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [89272 2016-03-10] (Kaspersky Lab ZAO) S1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [190648 2015-10-06] (Kaspersky Lab ZAO) S3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [411208 2010-10-31] (MCCI Corporation) S3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [419912 2010-10-31] (MCCI Corporation) S3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2010-10-31] (MCCI Corporation) S3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [472648 2010-10-31] (MCCI Corporation) S3 t36wgps; C:\Windows\System32\DRIVERS\t36wgps64.sys [101416 2010-12-01] (Ericsson AB) S3 Tosrfcom; no ImagePath S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [276008 2010-12-28] (Ericsson AB) S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X] S1 kltdi; system32\DRIVERS\kltdi.sys [X] S3 massfilter; system32\DRIVERS\massfilter.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-18 18:11 - 2016-04-18 18:12 - 00000000 ____D C:\FRST 2016-04-17 13:05 - 2016-04-17 13:05 - 00273184 _____ C:\Windows\Minidump\041716-24258-01.dmp 2016-04-14 01:13 - 2016-04-14 01:13 - 00273184 _____ C:\Windows\Minidump\041416-33789-01.dmp 2016-04-13 05:25 - 2016-04-13 05:25 - 00273184 _____ C:\Windows\Minidump\041316-21808-01.dmp 2016-04-13 04:56 - 2016-04-13 04:56 - 00273184 _____ C:\Windows\Minidump\041316-23368-01.dmp 2016-04-11 02:52 - 2016-04-11 02:52 - 00273184 _____ C:\Windows\Minidump\041116-21730-01.dmp 2016-04-11 02:43 - 2016-04-17 13:18 - 02297518 _____ C:\Windows\ntbtlog.txt 2016-04-08 03:23 - 2016-04-09 12:01 - 00000000 ____D C:\Users\BOGUSLAW\Desktop\Amoris laetitia Esortazione Apostolica sull'amore nella famiglia (19 marzo 2016) _ Francis_pliki 2016-04-08 03:23 - 2016-04-08 03:23 - 00621648 _____ C:\Users\BOGUSLAW\Desktop\papa-francesco_esortazione-ap_20160319_amoris-laetitia.pdf 2016-04-08 03:23 - 2016-04-08 03:23 - 00460885 _____ C:\Users\BOGUSLAW\Desktop\Amoris laetitia Esortazione Apostolica sull'amore nella famiglia (19 marzo 2016) _ Francis.htm 2016-03-21 03:21 - 2016-03-21 03:07 - 00000030 _____ C:\AVScanner.ini 2016-03-21 03:10 - 2016-03-21 03:10 - 00000000 ____D C:\Users\BOGUSLAW\AppData\Local\Macromedia 2016-03-21 02:56 - 2016-03-21 02:56 - 19910848 _____ (Adobe Systems Incorporated) C:\Users\BOGUSLAW\Downloads\install_flash_player.exe 2016-03-21 02:56 - 2016-03-21 02:56 - 00000000 ____D C:\ProgramData\25c596c5-18e5-0 2016-03-21 02:56 - 2016-03-21 02:56 - 00000000 ____D C:\ProgramData\25c596c5-0537-1 ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-17 13:21 - 2011-02-14 02:41 - 00809996 _____ C:\Windows\System32\perfh015.dat 2016-04-17 13:21 - 2011-02-14 02:41 - 00182408 _____ C:\Windows\System32\perfc015.dat 2016-04-17 13:21 - 2009-07-13 21:13 - 01865896 _____ C:\Windows\System32\PerfStringBackup.INI 2016-04-17 13:21 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\inf 2016-04-17 13:05 - 2015-03-21 04:03 - 188230440 _____ C:\Windows\MEMORY.DMP 2016-04-17 13:05 - 2014-08-28 05:56 - 00000000 ____D C:\Windows\Minidump 2016-04-09 12:00 - 2016-02-13 10:45 - 00000000 ___HD C:\$WINDOWS.~BT 2016-04-09 11:54 - 2016-02-29 02:17 - 00000000 ____D C:\Windows\SysWOW64\%Data% 2016-04-09 11:54 - 2012-10-02 07:25 - 00000000 ____D C:\Windows\SysWOW64\1033 2016-04-09 11:54 - 2012-01-03 03:24 - 00000000 ____D C:\users\BOGUSLAW 2016-04-09 11:54 - 2011-10-07 10:58 - 00000000 ____D C:\Windows\SysWOW64\sda 2016-04-09 11:54 - 2010-11-20 23:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep 2016-04-09 11:54 - 2009-07-13 19:20 - 00000000 __RSD C:\Windows\Media 2016-04-09 11:53 - 2015-08-24 14:36 - 00000000 ____D C:\Windows\ELAMBKUP 2016-04-09 11:53 - 2015-07-11 04:49 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft 2016-04-09 11:53 - 2012-10-03 11:51 - 00000000 ____D C:\Windows\System32\appmgmt 2016-04-09 11:53 - 2012-10-02 07:25 - 00000000 ____D C:\Windows\System32\1033 2016-04-09 11:53 - 2012-02-08 09:36 - 00000000 ____D C:\ProgramData\Toshiba 2016-04-09 11:53 - 2012-01-03 03:29 - 00000000 ____D C:\Users\BOGUSLAW\AppData\Local\TOSHIBA 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\tr 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\sv 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\sk 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\ru 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\pt 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\no 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\nl 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\it 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\fr 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\fi 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\es 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\de 2016-04-09 11:53 - 2011-10-07 11:22 - 00000000 ____D C:\Windows\System32\da 2016-04-09 11:53 - 2011-10-07 10:44 - 00000000 ____D C:\ProgramData\Intel 2016-04-09 11:53 - 2011-10-07 10:43 - 00000000 ____D C:\Program Files\Common Files\Intel 2016-04-09 11:53 - 2011-10-07 10:40 - 00000000 ____D C:\Program Files\Intel 2016-04-09 11:53 - 2011-10-07 10:36 - 00000000 ____D C:\Program Files (x86)\Intel 2016-04-09 11:53 - 2011-08-08 09:24 - 00000000 ____D C:\Windows\pl 2016-04-09 11:53 - 2011-08-08 09:23 - 00000000 ____D C:\Windows\sk 2016-04-09 11:53 - 2011-08-08 09:23 - 00000000 ____D C:\Windows\en 2016-04-09 11:53 - 2011-08-08 09:22 - 00000000 ____D C:\Windows\hu 2016-04-09 11:53 - 2011-08-08 09:22 - 00000000 ____D C:\Windows\el 2016-04-09 11:53 - 2011-08-08 09:22 - 00000000 ____D C:\Windows\cs 2016-04-09 11:53 - 2011-08-08 08:48 - 00000000 ____D C:\Program Files (x86)\TOSHIBA 2016-04-09 11:53 - 2011-02-14 02:50 - 00000000 ____D C:\Windows\System32\el 2016-04-09 11:53 - 2011-02-14 02:41 - 00000000 ____D C:\Windows\System32\pl 2016-04-09 11:53 - 2011-02-14 02:32 - 00000000 ____D C:\Windows\System32\hu 2016-04-09 11:53 - 2011-02-14 02:16 - 00000000 ____D C:\Windows\System32\cs 2016-04-09 11:53 - 2010-11-20 23:17 - 00000000 ____D C:\Windows\ShellNew 2016-04-09 11:53 - 2010-11-20 23:16 - 00000000 ___RD C:\Users\Public\Recorded TV 2016-04-09 11:53 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\Downloaded Program Files 2016-04-09 11:53 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF 2016-04-09 11:53 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\Resources 2016-04-09 11:53 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\ModemLogs 2016-04-09 11:53 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\Cursors 2016-04-09 11:53 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2016-04-09 10:46 - 2012-09-22 02:26 - 00000000 ____D C:\Users\BOGUSLAW\Documents\Pliki programu Outlook 2016-04-09 10:35 - 2012-10-04 01:58 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2016-04-05 22:44 - 2013-12-07 13:29 - 00000000 ____D C:\Users\BOGUSLAW\Desktop\DOKTORATY I PRACE MAGISTERSKIE 2016-03-29 01:13 - 2014-09-01 10:42 - 00002418 _____ C:\Users\BOGUSLAW\Desktop\Bezpieczne pieniądze.lnk 2016-03-29 01:01 - 2015-08-24 14:38 - 00002224 _____ C:\Users\Public\Desktop\Kaspersky Internet Security.lnk 2016-03-29 00:51 - 2015-08-02 13:32 - 00020895 _____ C:\Windows\diagerr.xml 2016-03-29 00:51 - 2015-08-02 13:32 - 00019053 _____ C:\Windows\diagwrn.xml 2016-03-29 00:51 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration 2016-03-29 00:50 - 2016-02-26 03:44 - 00003996 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2016-03-29 00:50 - 2015-09-03 00:12 - 00004154 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1d0e620562d7ac8 2016-03-29 00:50 - 2015-09-03 00:12 - 00003902 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1d0e62054d119ff 2016-03-29 00:30 - 2015-08-02 14:56 - 00000000 ____D C:\Intel 2016-03-29 00:00 - 2009-07-13 20:45 - 00028080 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-03-29 00:00 - 2009-07-13 20:45 - 00028080 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-03-28 23:35 - 2011-08-08 17:57 - 00000000 ____D C:\Windows\Panther 2016-03-28 23:31 - 2015-09-22 10:13 - 00000000 ____D C:\Users\BOGUSLAW\Desktop\WT UAM 2016-03-28 23:28 - 2015-10-20 04:37 - 00000000 ____D C:\Users\BOGUSLAW\Desktop\PKA 2015-16 2016-03-28 23:28 - 2013-10-09 19:40 - 00000000 ____D C:\Users\BOGUSLAW\Desktop\WNIOSKI STATUTOWE WT UAM 2016-03-28 23:21 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-03-28 13:19 - 2015-04-06 23:41 - 00000000 ___SD C:\Windows\SysWOW64\GWX 2016-03-28 13:19 - 2015-04-06 23:41 - 00000000 ___SD C:\Windows\System32\GWX 2016-03-21 03:10 - 2013-03-21 21:23 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-03-21 03:10 - 2012-01-04 13:50 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-03-21 03:09 - 2012-01-03 04:07 - 00000000 ____D C:\Users\BOGUSLAW\AppData\Local\Adobe 2016-03-21 03:07 - 2011-08-08 09:30 - 00000000 ____D C:\ProgramData\McAfee Some files in TEMP: ==================== C:\Users\BOGUSLAW\AppData\Local\Temp\autorun.dll C:\Users\BOGUSLAW\AppData\Local\Temp\la-xciyt.dll C:\Users\BOGUSLAW\AppData\Local\Temp\{BD3A1F17-B453-40F6-A1A0-AE0B547545F0}-GoogleUpdateSetup.exe ==================== Known DLLs (Whitelisted) ========================= ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe [2016-02-14 09:28] - [2016-01-21 21:19] - 3231232 ____A (Microsoft Corporation) 9D77CC4A36FEEA644D002CFB9B2D42C0 C:\Windows\SysWOW64\explorer.exe [2016-02-14 09:27] - [2016-01-21 21:12] - 2973184 ____A (Microsoft Corporation) 2A156D5EBF221EF2A6AE7CE452324DAC C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll [2015-12-16 02:39] - [2015-11-10 10:55] - 1008640 ____A (Microsoft Corporation) 06BF84D26A05D400F6B3FB3D3DE0B03A C:\Windows\SysWOW64\User32.dll [2015-12-16 02:39] - [2015-11-10 10:37] - 0833024 ____A (Microsoft Corporation) 0A78439765E31510D75C9E2284F3A722 C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\dnsapi.dll => MD5 is legit C:\Windows\SysWOW64\dnsapi.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE Association (Whitelisted) ============= ==================== Restore Points ========================= ==================== Memory info =========================== Percentage of memory in use: 17% Total physical RAM: 3975.43 MB Available physical RAM: 3278.79 MB Total Virtual: 3973.63 MB Available Virtual: 3265.03 MB ==================== Drives ================================ Drive c: (TI30811000A) (Fixed) (Total:449.98 GB) (Free:378.07 GB) NTFS ==>[system with boot components (obtained from drive)] Drive d: (System) (Fixed) (Total:1.46 GB) (Free:1.21 GB) NTFS ==>[system with boot components (obtained from drive)] Drive e: (GSP1RMCPRXFRER_PL_DVD) (CDROM) (Total:2.98 GB) (Free:0 GB) UDF Drive f: (ADATA) (Removable) (Total:7.26 GB) (Free:3 GB) NTFS Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: DA99459D) Partition 1: (Active) - (Size=1.5 GB) - (Type=27) Partition 2: (Not Active) - (Size=450 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=14.3 GB) - (Type=17) ======================================================== Disk: 1 (Size: 7.3 GB) (Disk ID: 002E5457) Partition 1: (Active) - (Size=7.3 GB) - (Type=07 NTFS) LastRegBack: 2014-08-16 10:33 ==================== End of FRST.txt ============================