Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:01-06-2016
Uruchomiony przez Magdalena (administrator)  MAGDALENAS (03-06-2016 10:11:50)
Uruchomiony z C:\Users\Magdalena\Downloads
Załadowane profile: Magdalena (Dostępne profile: Magdalena)
Platform: Windows 8.1 (Update) (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchService.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Wacom Technology, Corp.) C:\Windows\System32\Pen_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
(Wacom Technology, Corp.) C:\Windows\System32\WTablet\Pen_TabletUser.exe
(Wacom Technology, Corp.) C:\Windows\System32\Pen_Tablet.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\tv_x64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(BitTorrent, Inc.) C:\Users\Magdalena\AppData\Roaming\BitTorrent Sync\BTSync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe
(Windows (R) Win 7 DDK provider) C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13651672 2013-09-03] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1796056 2014-08-19] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorIcon.exe [280064 2013-09-26] (Intel Corporation)
HKLM-x32\...\Run: [FLxHCIm64] => C:\Program Files\Fresco Logic\Fresco Logic USB3.0 Host Controller\amd64_host\FLxHCIm.exe [183808 2013-07-12] (Windows (R) Win 7 DDK provider)
HKLM-x32\...\Run: [ADSKAppManager] => C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgr.exe [523144 2015-07-30] (Autodesk Inc.)
HKLM-x32\...\Run: [iTunesHelper] => D:\DOM\KOMPUTER\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCEPServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CEPServiceManager4\CEPServiceManager.exe [1039240 2013-05-16] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [WEPRODUCT21BB3] => C:\Users\Magdalena\AppData\Local\Temp\I5XM880YVG.exe [175616 2016-06-02] () <===== UWAGA
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [Akamai NetSession Interface] => "C:\Users\Magdalena\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [Spotify Web Helper] => C:\Users\Magdalena\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-09] (Spotify Ltd)
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [Dropbox Update] => C:\Users\Magdalena\AppData\Local\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-16] (Dropbox, Inc.)
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8619224 2016-01-15] (Piriform Ltd)
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\...\Run: [BitTorrent Sync] => C:\Users\Magdalena\AppData\Roaming\BitTorrent Sync\BTSync.exe [8957432 2016-05-20] (BitTorrent, Inc.)
HKU\S-1-5-21-3207241678-2084453937-2149904728-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [788480 2014-10-29] (Microsoft Corporation)
HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [!BTSync2.3.7Done] -> {581FFA04-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_1C3.dll [2016-05-20] ()
ShellIconOverlayIdentifiers: [!BTSync2.3.7RO] -> {581FFA03-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_1C3.dll [2016-05-20] ()
ShellIconOverlayIdentifiers: [!BTSync2.3.7RW] -> {581FFA02-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay64_1C3.dll [2016-05-20] ()
ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\DropboxExt64.34.dll [2016-05-07] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.7Done] -> {581FFA04-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay86_1C3.dll [2016-05-20] ()
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.7RO] -> {581FFA03-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay86_1C3.dll [2016-05-20] ()
ShellIconOverlayIdentifiers-x32: [!BTSync2.3.7RW] -> {581FFA02-FC33-0007-0302-95003A5CDE89} => C:\ProgramData\BitTorrent Sync\ShellExtensionOverlay86_1C3.dll [2016-05-20] ()
Startup: C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2015-12-13]
ShortcutTarget: Dropbox.lnk -> C:\Users\Magdalena\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk [2014-11-17]
ShortcutTarget: EvernoteClipper.lnk -> D:\STUDIA\Nowy folder\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{98BA5690-6C65-4662-9889-6D26913EF5DC}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{E35B586B-020A-449E-A750-3D3C2BA5FE78}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
SearchScopes: HKU\S-1-5-21-3207241678-2084453937-2149904728-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www-searching.com/search.aspx?s=g62zamobl2140bq,b2d06a37-9aac-4599-ada9-42322c59585b,&site=shyosie&prd=setgo&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3207241678-2084453937-2149904728-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www-searching.com/search.aspx?s=g62zamobl2140bq,b2d06a37-9aac-4599-ada9-42322c59585b,&site=shyosie&prd=setgo&q={searchTerms}
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-05-06] (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> D:\STUDIA\Nowy folder\EvernoteIE.dll [2014-11-05] (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-05-06] (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-05-06] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-05-06] (Google Inc.)

Chrome: 
=======
CHR HomePage: ChromeDefaultData2 -> hxxp://google.pl/
CHR StartupUrls: ChromeDefaultData2 -> "hxxps://www.google.pl/"

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [1129864 2015-07-30] (Autodesk Inc.)
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [Brak podpisu cyfrowego]
R2 IAStorDataMgrSvc; C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology enterprise\IAStorDataMgrSvc.exe [7168 2013-09-26] (Intel Corporation) [Brak podpisu cyfrowego]
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) [Brak podpisu cyfrowego]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [242264 2014-11-20] ()
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7032080 2016-05-12] (TeamViewer GmbH)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127784 2009-11-24] (Wacom Technology, Corp.)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [22680 2012-10-25] ()
R3 e1cexpress; C:\Windows\system32\DRIVERS\e1c64x64.sys [469264 2013-06-20] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 FLxHCIh; C:\Windows\System32\drivers\FLxHCIh.sys [77480 2013-07-03] (Fresco Logic)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-04-12] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-06-03] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-06-03 10:11 - 2016-06-03 10:11 - 00017109 _____ C:\Users\Magdalena\Downloads\FRST.txt
2016-06-03 10:07 - 2016-06-03 10:07 - 00037098 _____ C:\Users\Magdalena\Downloads\Fixlog.txt
2016-06-03 10:05 - 2016-06-03 10:07 - 00218052 _____ C:\Windows\ntbtlog.txt
2016-06-03 10:01 - 2016-06-03 10:01 - 00512000 _____ C:\ProgramData\smp2.exe
2016-06-03 10:01 - 2016-06-03 10:01 - 00004168 _____ C:\Windows\System32\Tasks\SMW_P
2016-06-03 10:01 - 2016-06-03 10:01 - 00003534 _____ C:\Windows\System32\Tasks\IBUpd
2016-06-03 10:01 - 2016-06-03 10:01 - 00003278 _____ C:\Windows\System32\Tasks\IBUpd2
2016-06-03 10:01 - 2016-06-03 10:01 - 00000000 ____D C:\Users\Magdalena\AppData\Local\BrowserAir
2016-06-03 09:59 - 2016-06-03 09:59 - 00250912 _____ C:\Windows\SysWOW64\kz.exe
2016-06-03 09:46 - 2016-06-03 09:46 - 00498176 _____ C:\Windows\system32\bi3.exe
2016-06-02 19:00 - 2016-06-02 20:20 - 00000000 ____D C:\Users\Magdalena\Downloads\Nowy folder
2016-06-02 18:52 - 2016-06-03 10:11 - 00000000 ____D C:\FRST
2016-06-02 18:52 - 2016-06-02 18:52 - 02383872 _____ (Farbar) C:\Users\Magdalena\Downloads\FRST64.exe
2016-06-02 18:52 - 2016-06-02 18:52 - 00380928 _____ C:\Users\Magdalena\Downloads\ybjr19hf.exe
2016-06-02 18:52 - 2016-06-02 18:52 - 00380928 _____ C:\Users\Magdalena\Downloads\xssw0iii.exe
2016-06-02 18:52 - 2016-06-02 18:52 - 00380928 _____ C:\Users\Magdalena\Downloads\hqn0z6zy.exe
2016-06-02 18:21 - 2016-06-02 18:21 - 11438608 _____ (SurfRight B.V.) C:\Users\Magdalena\Downloads\hitmanpro_x64.exe
2016-06-02 17:23 - 2016-06-02 17:23 - 00000000 _____ C:\autoexec.bat
2016-06-02 16:26 - 2016-06-03 10:08 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-02 16:25 - 2016-06-02 16:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-06-02 16:25 - 2016-06-02 16:25 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-06-02 16:25 - 2016-06-02 16:25 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-06-02 16:25 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-06-02 16:25 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-06-02 16:25 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-06-02 16:24 - 2016-06-02 16:25 - 22851472 _____ (Malwarebytes ) C:\Users\Magdalena\Downloads\mbam-setup-2.2.1.1043.exe
2016-06-02 15:43 - 2016-06-03 10:01 - 00001360 _____ C:\Users\Magdalena\Desktop\Google Chrome.lnk
2016-06-02 15:43 - 2016-06-03 10:01 - 00001192 _____ C:\Users\Magdalena\Desktop\Internet Explorer.lnk
2016-06-02 15:43 - 2016-06-02 15:48 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\OwiffMuste
2016-06-02 15:42 - 2016-06-02 16:36 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Apps\2.0
2016-05-25 10:22 - 2016-05-25 10:22 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-05-25 10:22 - 2016-05-25 10:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2016-05-22 23:49 - 2016-05-24 19:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-05-20 10:31 - 2016-05-20 10:31 - 00000000 ____D C:\Users\Public\Documents\Autodesk
2016-05-20 10:25 - 2016-05-20 10:25 - 00000926 _____ C:\Users\Magdalena\Desktop\BitTorrent Sync.lnk
2016-05-20 10:25 - 2016-05-20 10:25 - 00000906 _____ C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent Sync.lnk
2016-05-20 10:25 - 2016-05-20 10:25 - 00000000 ____D C:\ProgramData\BitTorrent Sync
2016-05-20 10:24 - 2016-06-03 10:09 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\BitTorrent Sync
2016-05-20 10:23 - 2016-05-20 10:23 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Autodesk, Inc
2016-05-15 10:29 - 2016-05-15 10:29 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-05-08 20:45 - 2016-06-02 15:44 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Mozilla
2016-05-08 20:45 - 2016-05-08 20:53 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Thunderbird
2016-05-08 20:45 - 2016-05-08 20:45 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Thunderbird
2016-05-08 20:44 - 2016-05-25 09:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-08 20:44 - 2016-05-08 20:44 - 00001225 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-05-08 20:44 - 2016-05-08 20:44 - 00001213 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-06-03 10:10 - 2016-01-16 10:47 - 00000000 ____D C:\Program Files (x86)\DriverToolkit
2016-06-03 10:10 - 2014-12-16 21:05 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Adobe
2016-06-03 10:10 - 2014-12-16 21:05 - 00000000 ____D C:\ProgramData\Adobe
2016-06-03 10:09 - 2014-11-03 23:47 - 00000000 __RDO C:\Users\Magdalena\SkyDrive
2016-06-03 10:08 - 2014-11-03 23:40 - 00000000 ____D C:\ProgramData\NVIDIA
2016-06-03 10:08 - 2014-11-03 23:35 - 00001074 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-03 10:08 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-03 10:07 - 2014-11-08 23:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2016-06-03 10:07 - 2014-11-08 20:17 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Autodesk
2016-06-03 10:07 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-06-03 10:01 - 2014-11-04 22:16 - 00004008 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5550C298-C0D6-4BBE-9A6F-CE4B2092D379}
2016-06-03 10:01 - 2014-11-03 23:35 - 00002409 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-06-03 10:01 - 2014-11-03 23:29 - 00001642 _____ C:\Users\Magdalena\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-06-03 09:56 - 2014-11-03 23:35 - 00001078 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-03 09:56 - 2014-11-03 23:34 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3207241678-2084453937-2149904728-1001
2016-06-02 20:29 - 2015-06-16 14:19 - 00001200 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3207241678-2084453937-2149904728-1001UA.job
2016-06-02 20:13 - 2014-11-07 16:02 - 00273408 ___SH C:\Users\Magdalena\Downloads\Thumbs.db
2016-06-02 18:48 - 2014-11-03 23:27 - 01828496 _____ C:\Windows\system32\PerfStringBackup.INI
2016-06-02 18:48 - 2013-08-23 01:12 - 00806956 _____ C:\Windows\system32\perfh015.dat
2016-06-02 18:48 - 2013-08-23 01:12 - 00163808 _____ C:\Windows\system32\perfc015.dat
2016-06-02 18:48 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\Inf
2016-06-02 18:13 - 2013-08-22 17:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2016-06-02 18:13 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2016-06-02 18:01 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\Resources
2016-06-02 17:00 - 2015-01-07 21:24 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-06-02 16:58 - 2015-01-06 20:08 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\WTablet
2016-06-02 16:48 - 2014-11-03 23:28 - 00000000 ____D C:\Users\Magdalena
2016-06-02 16:14 - 2014-11-03 23:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-06-02 16:02 - 2016-01-16 10:34 - 00000000 ____D C:\ProgramData\Ableton
2016-06-02 15:59 - 2014-11-04 20:37 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\uTorrent
2016-06-02 15:55 - 2013-08-22 16:44 - 05300320 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-02 15:49 - 2015-03-18 15:11 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-06-02 15:49 - 2014-11-03 23:29 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Adobe
2016-05-31 21:25 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-05-31 21:25 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2016-05-31 10:29 - 2015-06-16 14:19 - 00001148 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-3207241678-2084453937-2149904728-1001Core.job
2016-05-30 10:18 - 2014-12-12 14:00 - 00000000 ____D C:\Windows\Minidump
2016-05-29 13:55 - 2014-11-03 23:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-05-28 23:44 - 2014-11-04 21:28 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\vlc
2016-05-27 13:29 - 2015-06-14 14:37 - 00000132 _____ C:\Users\Magdalena\AppData\Roaming\Adobe PNG Format CS6 Prefs
2016-05-26 00:50 - 2014-12-01 20:48 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Skype
2016-05-25 10:22 - 2014-12-01 20:48 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Skype
2016-05-25 10:22 - 2014-12-01 20:48 - 00000000 ____D C:\ProgramData\Skype
2016-05-24 19:00 - 2014-11-16 21:01 - 00144816 _____ C:\Users\Magdalena\AppData\Local\GDIPFONTCACHEV1.DAT
2016-05-22 20:01 - 2014-12-28 10:43 - 00166400 ___SH C:\Users\Magdalena\Desktop\Thumbs.db
2016-05-20 10:31 - 2014-11-08 21:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoCAD 2014 - English
2016-05-15 10:30 - 2014-11-04 00:09 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\Dropbox
2016-05-13 21:34 - 2016-04-19 11:42 - 00000983 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-05-11 02:50 - 2014-11-03 23:35 - 00004050 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 02:50 - 2014-11-03 23:35 - 00003814 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-06 21:58 - 2015-01-16 01:23 - 00000000 ____D C:\Users\Magdalena\AppData\Roaming\TeamViewer
2016-05-06 14:26 - 2014-11-04 00:17 - 00000000 ___RD C:\Users\Magdalena\Dropbox
2016-05-06 00:21 - 2015-06-16 14:19 - 00000000 ____D C:\Users\Magdalena\AppData\Local\Dropbox

==================== Pliki w katalogu głównym wybranych folderów =======

2015-06-19 07:17 - 2015-06-19 07:17 - 0000132 _____ () C:\Users\Magdalena\AppData\Roaming\Adobe BMP Format CS6 Prefs
2015-07-07 01:48 - 2015-07-07 01:48 - 0000132 _____ () C:\Users\Magdalena\AppData\Roaming\Adobe IllExport Filter CS6 Prefs
2015-06-14 14:37 - 2016-05-27 13:29 - 0000132 _____ () C:\Users\Magdalena\AppData\Roaming\Adobe PNG Format CS6 Prefs
2015-10-15 13:21 - 2015-10-15 13:30 - 0001456 _____ () C:\Users\Magdalena\AppData\Local\Adobe Save for Web 13.0 Prefs
2014-11-03 23:39 - 2014-11-03 23:39 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2014-11-08 20:14 - 2014-11-08 20:14 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
2016-06-03 10:01 - 2016-06-03 10:01 - 0512000 _____ () C:\ProgramData\smp2.exe

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\Magdalena\AppData\Local\Temp\I5XM880YVG.exe
C:\ProgramData\smp2.exe


Niektóre pliki w TEMP:
====================
C:\Users\Magdalena\AppData\Local\Temp\1METM260N7.exe
C:\Users\Magdalena\AppData\Local\Temp\30VJ20OROJ.exe
C:\Users\Magdalena\AppData\Local\Temp\9YA0NJSPAC.exe
C:\Users\Magdalena\AppData\Local\Temp\A7DY2WWX57.exe
C:\Users\Magdalena\AppData\Local\Temp\GCYC5GYXWQ.exe
C:\Users\Magdalena\AppData\Local\Temp\HJ2E43UDSV.exe
C:\Users\Magdalena\AppData\Local\Temp\HNSQDHTJ5P.exe
C:\Users\Magdalena\AppData\Local\Temp\HUJREZ4FTV.exe
C:\Users\Magdalena\AppData\Local\Temp\I5XM880YVG.exe
C:\Users\Magdalena\AppData\Local\Temp\nsa3002.tmp.exe
C:\Users\Magdalena\AppData\Local\Temp\nskB0C8.tmp.exe
C:\Users\Magdalena\AppData\Local\Temp\nsn833.tmp.exe
C:\Users\Magdalena\AppData\Local\Temp\nso3A1C.tmp.exe
C:\Users\Magdalena\AppData\Local\Temp\PU1D8N0TQ1.exe
C:\Users\Magdalena\AppData\Local\Temp\qqpcmgr_v11.4.17339.217_45303_Silence.exe
C:\Users\Magdalena\AppData\Local\Temp\setup.dll
C:\Users\Magdalena\AppData\Local\Temp\setup.exe
C:\Users\Magdalena\AppData\Local\Temp\uninst.exe
C:\Users\Magdalena\AppData\Local\Temp\WGAIXKKQG5.exe
C:\Users\Magdalena\AppData\Local\Temp\Y622X81Z8B.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-05-26 11:49

==================== Koniec  FRST.txt ============================