Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 02-07-2016
Uruchomiony przez Rysio (administrator)  RYSIO-KOMPUTER (05-07-2016 12:40:54)
Uruchomiony z C:\Users\Rysio\Desktop
Załadowane profile: Rysio (Dostępne profile: Rysio)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe
(SecureMix LLC) C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(SecureMix LLC) C:\Program Files (x86)\GlassWire\GlassWire.exe
(SecureMix LLC) C:\Program Files (x86)\GlassWire\GWIdlMon.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe
(QIHU 360 SOFTWARE CO. LIMITED) C:\Program Files (x86)\360\Total Security\safemon\QHWatchdog.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Rysio\Desktop\FRST64 (1).exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM-x32\...\Run: [QHSafeTray] => C:\Program Files (x86)\360\Total Security\safemon\QHSafeTray.exe [1773992 2016-05-18] (QIHU 360 SOFTWARE CO. LIMITED)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Run: [GlassWire] => C:\Program Files (x86)\GlassWire\glasswire.exe [10572288 2016-02-05] (SecureMix LLC)
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {37601600-187d-11e4-a294-001a6b7a4f5f} - F:\AutoRun.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {5ca20862-6585-11e4-84aa-001b77e0e1a0} - F:\AutoRun.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {5ca20865-6585-11e4-84aa-001b77e0e1a0} - F:\AutoRun.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {5ca2086b-6585-11e4-84aa-001b77e0e1a0} - F:\AutoRun.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {e6c34868-890c-11e4-ae3a-001b77e0e1a0} - F:\AutoRun.exe
HKU\S-1-5-21-794183964-744495429-4238896772-1000\...\MountPoints2: {e6c3486d-890c-11e4-ae3a-001b77e0e1a0} - F:\AutoRun.exe
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 1 (GFS Unread Stub)] -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2 (GFS Stub)] -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)] -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 3 (GFS Folder)] -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [Groove Explorer Icon Overlay 4 (GFS Unread Mark)] -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{25AB51D5-1460-4521-A31B-2A43C7B47200}: [DhcpNameServer] 62.179.1.60 62.179.1.61
Tcpip\..\Interfaces\{41CB4DC1-D2BD-4E84-9527-990797DA9AB0}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-794183964-744495429-4238896772-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKU\S-1-5-21-794183964-744495429-4238896772-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=619797&pc=UE07&ocid=UE07DHP
HKU\S-1-5-21-794183964-744495429-4238896772-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?pc=UE07&ocid=UE07DHP
SearchScopes: HKLM -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKLM-x32 -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\.DEFAULT -> DefaultScope {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\S-1-5-21-794183964-744495429-4238896772-1000 -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon64.dll [2016-05-18] (Qihu 360 Software Co., Ltd.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Programy\office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Programy\office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: SafeMon Class -> {B69F34DD-F0F9-42DC-9EDD-957187DA688D} -> C:\Program Files (x86)\360\Total Security\safemon\safemon.dll [2016-02-01] (Qihu 360 Software Co., Ltd.)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  Brak pliku
Toolbar: HKLM - Brak nazwy - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Brak pliku

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Programy\office\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Programy\office\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> C:\Programy\RealPlayer\Real Alternative\browser\plugins\nppl3260.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> C:\Programy\RealPlayer\Real Alternative\browser\plugins\nprpjplug.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://wp.pl/"
CHR Profile: C:\Users\Rysio\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Users\Rysio\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-06-01]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Rysio\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR HKLM-x32\...\Chrome\Extension: [fkmkpnjoioaielnmocemighdcejngela] - C:\Users\Rysio\AppData\Local\Google\Chrome\User Data\Default\Extensions\EpuapSign.crx [2012-11-08]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 GlassWire; C:\Program Files (x86)\GlassWire\GWCtlSrv.exe [8924672 2016-02-05] (SecureMix LLC)
S4 Microsoft SharePoint Workspace Audit Service; C:\Programy\office\Office14\GROOVE.EXE [30814400 2013-12-19] (Microsoft Corporation)
R2 QHActiveDefense; C:\Program Files (x86)\360\Total Security\safemon\QHActiveDefense.exe [912808 2016-05-18] (QIHU 360 SOFTWARE CO. LIMITED)
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2013-12-31] (Microsoft Corporation) [Brak podpisu cyfrowego]
S3 TuneUp.UtilitiesSvc; C:\Programy\Tune UP\TuneUpUtilitiesService64.exe [2365792 2012-10-15] (TuneUp Software)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-12-20] (Microsoft Corporation)
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.11.292\McCHSvc.exe" [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 360AntiHacker; C:\Windows\System32\Drivers\360AntiHacker64.sys [151784 2016-05-18] (360.cn)
R3 360AvFlt; C:\Windows\System32\DRIVERS\360AvFlt.sys [77904 2016-05-18] (360.cn)
R3 360AvFlt; C:\Windows\SysWOW64\DRIVERS\360AvFlt.sys [77904 2016-05-18] (360.cn)
R1 360Box64; C:\Windows\System32\DRIVERS\360Box64.sys [321616 2016-05-18] (360.cn)
S3 360Camera; C:\Windows\System32\Drivers\360Camera64.sys [40520 2016-02-01] (360.cn)
R1 360FsFlt; C:\Windows\System32\DRIVERS\360FsFlt.sys [370768 2016-05-18] (360.cn)
S3 b06diag; C:\Windows\system32\drivers\bxdiaga.sys [88104 2012-03-08] (Broadcom Corporation)
R1 BAPIDRV; C:\Windows\System32\DRIVERS\BAPIDRV64.sys [182352 2016-05-18] (360.cn)
S3 BFN7x64; C:\Windows\system32\drivers\Xeno7x64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 BFNVis64; C:\Windows\system32\drivers\XenoVa64.sys [157288 2012-02-22] (Bigfoot Networks, Inc.)
S3 bxfcoe; C:\Windows\system32\drivers\bxfcoe.sys [178216 2012-02-22] (Broadcom Corporation)
S3 bxois; C:\Windows\system32\drivers\bxois.sys [539176 2012-02-22] (Broadcom Corporation)
S3 cbaf; C:\Windows\System32\Drivers\cbaf.sys [15872 2008-01-09] (Intel Corp.)
S3 dfuuwb; C:\Windows\System32\Drivers\DfuUWB.sys [503296 2008-09-11] (Intel Corp.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-01-30] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3341904 2012-03-26] (Broadcom Corporation)
S3 EtronSTOR; C:\Windows\System32\Drivers\EtronSTOR.sys [32512 2012-08-07] (Etron Technology Inc)
S3 FLxHCIh; C:\Windows\system32\drivers\FLxHCIh.sys [77040 2012-11-02] (Fresco Logic)
R1 gwdrv; C:\Windows\System32\DRIVERS\gwdrv.sys [33248 2015-05-29] (SecureMix LLC)
S3 HWA; C:\Windows\System32\Drivers\HWA.sys [61440 2008-09-29] (Intel Corp.)
S3 IAMTVE; C:\Windows\system32\drivers\IAMTVE.sys [43416 2007-04-11] (Intel Corporation)
S3 IAMTXPE; C:\Windows\system32\drivers\IAMTXPE.sys [51096 2007-04-11] (Intel Corporation)
S3 IFCoEMP; C:\Windows\system32\drivers\ifM60x64.sys [387344 2012-04-21] (Intel(R) Corporation)
S3 IFCoEVB; C:\Windows\system32\drivers\ifP60X64.sys [77584 2012-04-21] (Intel(R) Corporation)
S3 rusb3hub; C:\Windows\system32\drivers\rusb3hub.sys [114568 2012-08-27] (Renesas Electronics Corporation)
S3 rusb3xhc; C:\Windows\system32\drivers\rusb3xhc.sys [230280 2012-08-27] (Renesas Electronics Corporation)
S3 SISAGP; C:\Windows\system32\drivers\SISAGPX.sys [67104 2009-08-01] (Silicon Integrated Systems Corporation)
S3 TuneUpUtilitiesDrv; C:\Programy\Tune UP\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software)
S3 uagp35; C:\Windows\system32\drivers\sisagpx.sys [67104 2009-08-01] (Silicon Integrated Systems Corporation)
S3 uwbusb; C:\Windows\System32\Drivers\usbuwbmini.sys [13312 2008-09-15] (Intel Corp.)
S3 viaagp1; C:\Windows\system32\drivers\viaagp1.sys [59392 2005-09-23] (VIA Technologies, Inc.)
S3 VUSB3HUB; C:\Windows\system32\drivers\ViaHub3.sys [210944 2012-05-30] (VIA Technologies, Inc.)
S3 xhcdrv; C:\Windows\system32\drivers\xhcdrv.sys [261120 2012-05-30] (VIA Technologies, Inc.)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-07-05 12:40 - 2016-07-05 12:42 - 00015892 _____ C:\Users\Rysio\Desktop\FRST.txt
2016-07-05 12:39 - 2016-07-05 12:40 - 00000000 ____D C:\FRST
2016-07-05 12:39 - 2016-07-05 12:39 - 02390016 ____N (Farbar) C:\Users\Rysio\Desktop\FRST64 (1).exe
2016-06-28 17:13 - 2016-03-26 13:41 - 01190912 _____ C:\Users\Rysio\Desktop\RepairDNS.exe
2016-06-28 17:01 - 2016-06-28 17:02 - 03703360 _____ C:\Users\Rysio\Downloads\adwcleaner_5.200.exe
2016-06-28 17:00 - 2016-06-28 17:08 - 00000000 ____D C:\AdwCleaner
2016-06-28 16:47 - 2016-06-28 16:57 - 00078208 _____ C:\Windows\ntbtlog.txt
2016-06-28 16:42 - 2016-06-28 16:42 - 00000806 _____ C:\Users\Rysio\Desktop\DAEMON Tools Lite.lnk
2016-06-28 16:32 - 2016-06-28 16:32 - 00413632 _____ C:\Windows\system32\FNTCACHE.DAT
2016-06-27 16:45 - 2016-06-27 16:45 - 00110240 _____ C:\Users\Rysio\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-07-05 12:35 - 2015-07-21 15:56 - 00000000 ____D C:\Users\Rysio\AppData\LocalLow\360WD
2016-07-05 12:34 - 2009-07-14 06:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-05 12:34 - 2009-07-14 06:45 - 00026576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-05 12:29 - 2014-02-08 14:29 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-07-05 12:24 - 2014-02-08 13:20 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-07-05 12:24 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-06-28 16:43 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2016-06-27 22:49 - 2014-02-08 13:20 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-27 16:37 - 2014-02-08 13:23 - 00000000 ____D C:\Users\Rysio\AppData\Roaming\Winamp
2016-06-27 16:32 - 2015-01-21 14:59 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-06-27 16:29 - 2014-02-10 13:25 - 00002720 _____ C:\Windows\System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013
2016-06-27 16:29 - 2014-02-08 13:20 - 00004054 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-06-27 16:29 - 2014-02-08 13:20 - 00003802 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-06-26 14:54 - 2016-02-26 19:14 - 00000000 ____D C:\Windows\rescache
2016-06-26 14:54 - 2015-04-15 18:44 - 00000000 ____D C:\Windows\system32\appraiser
2016-06-26 14:54 - 2015-04-06 07:04 - 00000000 ___SD C:\Windows\system32\GWX
2016-06-26 14:54 - 2014-02-08 12:54 - 00000000 ____D C:\Users\Rysio
2016-06-26 14:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2016-06-26 14:54 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2016-06-26 14:54 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-06-18 08:09 - 2014-02-08 13:20 - 00002171 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

==================== Pliki w katalogu głównym wybranych folderów =======

2014-04-09 13:35 - 2014-04-09 13:35 - 0033193 _____ () C:\Users\Rysio\AppData\Roaming\UserTile.png

Niektóre pliki w TEMP:
====================
C:\Users\Rysio\AppData\Local\Temp\libeay32.dll
C:\Users\Rysio\AppData\Local\Temp\msvcr120.dll
C:\Users\Rysio\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-06-19 12:34

==================== Koniec  FRST.txt ============================