Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 21-08-2016 01
Uruchomiony przez Szymek (administrator)  SZYMON-KOMPUTER (22-08-2016 15:06:14)
Uruchomiony z C:\Users\Szymek\Desktop
Załadowane profile: Szymek (Dostępne profile: Szymek)
Platform: Windows 10 Pro (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: "C:\Program Files (x86)\UCBrowser\Application\UCBrowser.exe" -- "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
() C:\Users\Szymek\AppData\Roaming\GowvePitpagf\Lurzem.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
() C:\Users\Szymek\AppData\Roaming\Geunfy\Geunfy.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(@ByELDI) C:\Program Files\KMSpico\Service_KMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Users\Szymek\AppData\Roaming\Hemkajdoa\Hemkajdoa.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
() C:\Users\Szymek\AppData\Roaming\Geunfy\Yurejjaeb.exe
() C:\Users\Szymek\AppData\Roaming\Geunfy\Yjetipudl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Valve Corporation) D:\Steam\Steam.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Waterfox) E:\Waterfox\waterfox.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
() C:\Users\Szymek\AppData\Roaming\Hemkajdoa\Sejheb.exe
() C:\Users\Szymek\AppData\Roaming\Hemkajdoa\Soccartuwc.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2398776 2016-06-03] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1767944 2016-06-03] (NVIDIA Corporation)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKU\S-1-5-21-2393552708-3704467510-2414285713-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8894680 2016-08-05] (Piriform Ltd)
HKU\S-1-5-21-2393552708-3704467510-2414285713-1001\...\MountPoints2: {66619526-3e9a-11e6-9bcb-0024215d5fe7} - "H:\LGAutoRun.exe" 
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Brak pliku
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Brak pliku
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} =>  Brak pliku
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Brak pliku
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Brak pliku
Startup: C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TCYUCPCgXcXSeOHU.cmd.lnk [2016-08-21]
ShortcutTarget: TCYUCPCgXcXSeOHU.cmd.lnk -> C:\Users\Szymek\AppData\Roaming\KfiUCSFbYAeXdeLgTGIKG.cmd ()
Startup: C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UBAOUJJKYhEceYCi.cmd.lnk [2016-08-21]
ShortcutTarget: UBAOUJJKYhEceYCi.cmd.lnk -> C:\Users\Szymek\AppData\Roaming\OQFPETVYIOcIgdeAFYWeG.cmd ()
GroupPolicyScripts: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

AutoConfigURL: [S-1-5-21-2393552708-3704467510-2414285713-1001] => hxxp://stoppblock.org/wpad.dat?c4a183707b1c1561ca2ad33dde5562a714879554
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 176.98.112.18 176.98.112.21
Tcpip\..\Interfaces\{26b11a49-585f-4b43-a90c-9af3c3d7b25b}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{6bb4f047-2706-11e5-9bbe-806e6f6e6963}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{b46bd732-d562-4bf7-8d9c-4f8a375af839}: [NameServer] 104.197.191.4
Tcpip\..\Interfaces\{b46bd732-d562-4bf7-8d9c-4f8a375af839}: [DhcpNameServer] 192.168.1.1 176.98.112.18 176.98.112.21
ManualProxies: 0hxxp://stoppblock.org/wpad.dat?c4a183707b1c1561ca2ad33dde5562a714879554

Internet Explorer:
==================
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-07-30] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-30] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Szymek\AppData\Roaming\Mozilla\Firefox\Profiles\igmkaogv.default
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-30] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-30] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll [2013-05-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-06-03] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-06-03] (NVIDIA Corporation)
FF user.js: detected! => C:\Users\Szymek\AppData\Roaming\Mozilla\Firefox\Profiles\igmkaogv.default\user.js [2016-08-22]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Bokvunnu; C:\Users\Szymek\AppData\Roaming\GowvePitpagf\Lurzem.exe [121344 2016-08-11] () [Brak podpisu cyfrowego]
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-20] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1165368 2016-06-03] (NVIDIA Corporation)
S2 KuaizipUpdateChecker; C:\Program Files\żěŃą\X86\kuaizipUpdateChecker.dll [219072 2016-08-22] ()
R2 Noije; C:\Users\Szymek\AppData\Roaming\Geunfy\Geunfy.exe [170496 2016-08-11] () [Brak podpisu cyfrowego]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1881144 2016-06-03] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3634232 2016-06-03] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2522680 2016-06-03] (NVIDIA Corporation)
S3 Origin Client Service; D:\Origin\OriginClientService.exe [2122248 2016-06-29] (Electronic Arts)
R2 Service KMSELDI; C:\Program Files\KMSpico\Service_KMS.exe [985280 2015-08-12] (@ByELDI) [Brak podpisu cyfrowego]
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 Viokdojvaf; C:\Users\Szymek\AppData\Roaming\Hemkajdoa\Hemkajdoa.exe [170496 2016-08-11] () [Brak podpisu cyfrowego]
S3 vmicvss; C:\Windows\System32\ICSvc.dll [506880 2015-07-10] (Microsoft Corporation)
S3 VSStandardCollectorService140; E:\Visual Studio 2015\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [108768 2016-07-08] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation)
S2 Citdhwa; "C:\Users\Szymek\AppData\Roaming\AzigcWig\Geeswu.exe" -cms [X]
S2 GhrCntvakokvaqapy.exe; "C:\Program Files (x86)\Zerlucult\GhrCntvakokvaqapy.exe" {C25DA384-2010-45A4-A1ED-BFA540D4789B} {9DC74CD5-24EA-4ADE-9C42-608A8CE17116} [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92872 2016-08-22] (WinMount International Inc)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28216 2016-06-03] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-06-03] (NVIDIA Corporation)
R3 rt640x64; C:\Windows\System32\drivers\rt640x64.sys [587264 2015-07-10] (Realtek                                            )
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [214016 2015-07-10] (Microsoft Corporation)
S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation)
R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation)
S1 UCGuard; system32\DRIVERS\ucguard.sys [X] <==== UWAGA
S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-22 15:06 - 2016-08-22 15:06 - 00011559 _____ C:\Users\Szymek\Desktop\FRST.txt
2016-08-22 15:05 - 2016-08-22 15:06 - 00000000 ____D C:\FRST
2016-08-22 15:03 - 2016-08-22 15:04 - 02396672 _____ (Farbar) C:\Users\Szymek\Desktop\FRST64.exe
2016-08-22 14:56 - 2016-08-22 14:56 - 00016148 _____ C:\Windows\system32\SZYMON-KOMPUTER_Szymek_HistoryPrediction.bin
2016-08-22 14:54 - 2016-08-22 14:54 - 00000000 ____D C:\Windows\system32\vyt
2016-08-22 14:50 - 2016-08-22 14:51 - 07616340 _____ C:\Users\Szymek\AppData\Roaming\setup.apk
2016-08-22 14:50 - 2016-08-22 14:51 - 00732869 _____ C:\Users\Szymek\AppData\Roaming\xdo.zip
2016-08-22 14:50 - 2016-08-22 14:50 - 00000000 ____D C:\Program Files\żěŃą
2016-08-22 14:49 - 2016-08-22 14:50 - 00003562 _____ C:\Windows\System32\Tasks\KuaiZip_Update
2016-08-22 14:49 - 2016-08-22 14:50 - 00000882 _____ C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\żěŃą.lnk
2016-08-22 14:49 - 2016-08-22 14:49 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
2016-08-22 14:49 - 2016-08-22 14:49 - 00002872 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-08-22 14:49 - 2016-08-22 14:49 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Softlink
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Kuaizip
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-08-22 14:49 - 2016-08-22 14:49 - 00000000 ____D C:\Program Files\CCleaner
2016-08-22 14:49 - 2016-07-05 07:58 - 09216000 _____ (eee) C:\Users\Szymek\AppData\Roaming\THREADAPP.exe
2016-08-22 14:48 - 2016-08-22 14:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MaohaWiFi
2016-08-22 14:46 - 2016-08-22 14:56 - 00000490 _____ C:\Windows\Tasks\UCBrowserUpdater.job
2016-08-22 14:46 - 2016-08-22 14:46 - 00003510 _____ C:\Windows\System32\Tasks\UCBrowserUpdater
2016-08-22 14:46 - 2016-07-01 11:19 - 08284704 _____ (深圳市伟创科技软件有限公司) C:\Users\Szymek\AppData\Roaming\MaoHaWiFiSetup_262.exe
2016-08-22 14:45 - 2016-08-22 14:46 - 00000000 ____D C:\Program Files (x86)\UCBrowser
2016-08-22 14:45 - 2016-08-22 14:45 - 00001599 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-08-22 14:45 - 2016-08-22 14:45 - 00000000 ____D C:\Users\Szymek\AppData\Local\UCBrowser
2016-08-22 14:45 - 2016-08-22 14:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器
2016-08-22 14:41 - 2016-06-30 09:59 - 05267952 _____ () C:\Users\Szymek\AppData\Roaming\ziptool_wc-9025_setup.exe
2016-08-22 14:40 - 2016-08-22 14:40 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Hemkajdoa
2016-08-22 14:38 - 2016-08-22 14:40 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Notepad++
2016-08-22 14:38 - 2016-08-22 14:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2016-08-22 14:37 - 2016-08-22 14:40 - 00000000 ____D C:\Users\Szymek\AppData\Local\Tempfolder
2016-08-22 14:37 - 2016-08-22 14:37 - 00009082 _____ C:\Windows\System32\Tasks\Ghurcult Controls
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ___HD C:\Program Files (x86)\r2337DB
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ___HD C:\Program Files (x86)\54i4A0C
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\GowvePitpagf
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Geunfy
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ____D C:\Users\Szymek\AppData\LocalLow\Company
2016-08-22 14:37 - 2016-08-22 14:37 - 00000000 ____D C:\ProgramData\AVAST Software
2016-08-22 14:36 - 2016-08-22 14:52 - 00000000 ____D C:\Users\Szymek\AppData\Local\Apps\2.0
2016-08-22 14:36 - 2016-08-22 14:36 - 00000000 _____ C:\Windows\SysWOW64\Number of results
2016-08-22 14:27 - 2016-08-22 14:34 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\NetBeans
2016-08-22 14:27 - 2016-08-22 14:27 - 00000000 ____D C:\Users\Szymek\AppData\Local\NetBeans
2016-08-22 14:23 - 2016-08-22 14:23 - 00019983 _____ C:\Users\Szymek\Desktop\php-login-minimal-master.zip
2016-08-22 14:19 - 2016-08-22 14:36 - 00000000 ____D C:\Users\Szymek\.nbi
2016-08-22 14:12 - 2016-08-22 14:12 - 00000687 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Waterfox.lnk
2016-08-22 14:12 - 2016-08-22 14:12 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\WaterfoxProject
2016-08-22 14:12 - 2016-08-22 14:12 - 00000000 ____D C:\Users\Szymek\AppData\Local\Mozilla
2016-08-22 14:01 - 2016-08-22 13:59 - 00001006 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-08-22 14:00 - 2016-08-22 14:00 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Mozilla
2016-08-22 13:48 - 2016-08-22 13:48 - 00000000 ____D C:\Users\Szymek\Documents\My Web Sites
2016-08-22 13:48 - 2016-08-22 13:48 - 00000000 ____D C:\Users\Szymek\Documents\IISExpress
2016-08-22 11:29 - 2016-08-22 11:29 - 00000000 ____D C:\Program Files (x86)\AppInsights
2016-08-22 11:27 - 2016-08-22 11:46 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2016-08-22 11:27 - 2016-08-22 11:27 - 00000000 ____D C:\ProgramData\Microsoft DNX
2016-08-22 11:27 - 2016-08-22 11:27 - 00000000 ____D C:\Program Files\Microsoft DNX
2016-08-22 11:25 - 2016-08-22 11:27 - 00000000 ____D C:\Program Files (x86)\Microsoft Web Tools
2016-08-22 11:18 - 2016-08-22 11:18 - 00000000 ____D C:\Program Files\IIS Express
2016-08-22 11:18 - 2016-08-22 11:18 - 00000000 ____D C:\Program Files (x86)\IIS Express
2016-08-21 17:04 - 2016-08-21 17:04 - 00007821 _____ C:\Users\Szymek\AppData\Local\recently-used.xbel
2016-08-21 16:04 - 2016-08-21 16:04 - 00000000 ____D C:\ProgramData\Client
2016-08-21 16:04 - 2016-07-25 22:04 - 00828928 ___SH C:\Users\Szymek\AppData\Roaming\KfiUCSFbYAeXdeLgTGIKG.cmd
2016-08-21 16:04 - 2016-07-25 22:04 - 00463376 ___SH C:\Users\Szymek\AppData\Roaming\TCYUCPCgXcXS
2016-08-21 16:04 - 2016-07-25 22:04 - 00036379 ___SH C:\Users\Szymek\AppData\Roaming\WUGAKRLcYgXFdHSgJEX
2016-08-21 16:04 - 2016-04-06 05:22 - 00025486 ___SH C:\Users\Szymek\AppData\Roaming\Loader.exe
2016-08-21 16:03 - 2016-07-25 22:03 - 00828928 ___SH C:\Users\Szymek\AppData\Roaming\OQFPETVYIOcIgdeAFYWeG.cmd
2016-08-21 16:03 - 2016-07-25 22:03 - 00036379 ___SH C:\Users\Szymek\AppData\Roaming\FMXCMZTdfGJETOQZhCa
2016-08-21 16:03 - 2016-07-25 22:02 - 00463376 ___SH C:\Users\Szymek\AppData\Roaming\UBAOUJJKYhEc
2016-08-21 16:03 - 2016-07-01 10:34 - 00082432 ___SH C:\Users\Szymek\AppData\Roaming\Keygen.exe
2016-08-21 15:52 - 2016-08-21 16:05 - 00737280 _____ (Indigo Rose Corporation) C:\Windows\iun6002.exe
2016-08-21 15:51 - 2016-08-21 15:55 - 00000000 ____D C:\Users\Szymek\Documents\WYSIWYG Web Builder
2016-08-20 17:06 - 2016-08-20 17:11 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Qt
2016-08-20 14:56 - 2016-08-20 14:56 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Macromedia
2016-08-20 14:36 - 2016-08-20 14:36 - 00000000 ____D C:\Users\Szymek\.designer
2016-08-20 14:33 - 2016-08-20 17:21 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\QtProject
2016-08-20 14:31 - 2016-08-20 16:09 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Qt
2016-08-19 17:41 - 2016-08-19 17:41 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Microsoft FxCop
2016-08-17 16:24 - 2016-08-22 14:54 - 00000000 ____D C:\AdwCleaner
2016-08-17 16:18 - 2016-08-17 16:18 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Construct2
2016-08-17 13:54 - 2016-08-17 13:54 - 00000000 ____D C:\Users\Szymek\AppData\Local\TeamSpeak 3
2016-08-17 13:54 - 2016-08-17 13:54 - 00000000 ____D C:\Users\Szymek\.TeamSpeak 3
2016-08-17 13:54 - 2016-08-17 13:54 - 00000000 ____D C:\Users\Szymek\.QtWebEngineProcess
2016-08-16 12:45 - 2016-08-16 12:46 - 30269133 _____ C:\Users\Szymek\Downloads\fwd_chuj.zip
2016-08-16 12:23 - 2016-08-16 12:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VisualLightBox
2016-08-15 16:32 - 2016-08-15 16:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Innonics
2016-08-15 16:14 - 2016-08-15 16:14 - 00000000 ____D C:\Users\Szymek\AppData\Local\Skyrim
2016-08-13 13:54 - 2016-08-13 13:54 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\.mono
2016-08-13 13:54 - 2016-08-13 13:54 - 00000000 ____D C:\Users\Szymek\AppData\Local\Colossal Order
2016-08-13 13:54 - 2016-08-13 13:54 - 00000000 ____D C:\ProgramData\.mono
2016-08-08 18:50 - 2016-08-08 19:44 - 00000000 ____D C:\Users\Szymek\.gradle
2016-08-08 18:48 - 2016-08-08 18:48 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eclipse
2016-08-08 18:42 - 2016-08-08 18:48 - 00000000 ____D C:\Users\Szymek\.p2
2016-08-08 18:42 - 2016-08-08 18:43 - 00000000 ____D C:\Users\Szymek\.eclipse
2016-08-05 18:54 - 2016-08-05 18:54 - 00000000 ____D C:\Users\Szymek\AppData\Local\NuGet
2016-08-05 18:54 - 2016-08-05 18:54 - 00000000 ____D C:\Users\Szymek\.nuget
2016-08-02 14:19 - 2016-08-02 14:21 - 00000000 ____D C:\Users\Szymek\AppData\Local\Comms
2016-07-31 18:32 - 2016-07-31 18:32 - 00000000 ____D C:\Program Files (x86)\ClockworkMod
2016-07-31 18:28 - 2016-07-31 18:28 - 00000000 ____D C:\Users\Szymek\.android
2016-07-30 14:02 - 2016-07-30 14:02 - 00000000 ____D C:\Program Files\Java

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-22 14:56 - 2016-06-28 11:34 - 00000000 ____D C:\ProgramData\NVIDIA
2016-08-22 14:56 - 2015-07-10 14:21 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-22 14:55 - 2015-07-10 11:05 - 00131072 ___SH C:\Windows\system32\config\BBI
2016-08-22 14:50 - 2016-06-28 12:11 - 00000000 ____D C:\Windows\Panther
2016-08-22 14:50 - 2016-06-28 11:44 - 00000000 ____D C:\Users\Szymek\AppData\Local\CrashDumps
2016-08-22 14:50 - 2015-07-10 13:02 - 00000000 ____D C:\Windows\INF
2016-08-22 14:33 - 2016-06-29 10:59 - 00000000 ____D C:\Users\Szymek\.oracle_jre_usage
2016-08-22 14:27 - 2016-06-28 11:41 - 00000000 ____D C:\Program Files\WinRAR
2016-08-22 14:19 - 2016-06-28 11:27 - 00000000 ____D C:\Users\Szymek
2016-08-22 14:12 - 2016-06-28 11:34 - 00000000 ____D C:\Users\Szymek\AppData\Local\Google
2016-08-22 14:12 - 2016-06-28 11:34 - 00000000 ____D C:\Program Files (x86)\Google
2016-08-22 13:59 - 2015-07-10 12:55 - 00000000 ____D C:\Windows\CbsTemp
2016-08-22 12:33 - 2016-06-28 11:32 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-22 12:17 - 2016-06-30 07:27 - 00000000 ____D C:\Program Files\Microsoft SQL Server
2016-08-22 12:17 - 2016-06-30 07:27 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server
2016-08-22 12:17 - 2015-07-10 13:04 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-08-22 11:17 - 2016-06-30 07:33 - 00000000 ____D C:\Windows\SysWOW64\1033
2016-08-22 11:17 - 2016-06-30 07:23 - 00000000 ____D C:\Windows\system32\1033
2016-08-21 17:04 - 2016-06-30 13:09 - 00000000 ____D C:\Users\Szymek\.gimp-2.8
2016-08-21 13:58 - 2016-06-28 09:54 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\.minecraft
2016-08-20 14:03 - 2016-07-02 16:23 - 00000600 _____ C:\Users\Szymek\AppData\Local\PUTTY.RND
2016-08-19 17:39 - 2016-06-30 13:15 - 00000000 ____D C:\Users\Szymek\AppData\Local\gtk-2.0
2016-08-19 17:38 - 2016-06-30 13:11 - 00000000 ____D C:\Users\Szymek\.thumbnails
2016-08-19 16:26 - 2016-06-30 08:46 - 00000000 ____D C:\Users\Szymek\Documents\Visual Studio 2015
2016-08-15 16:32 - 2016-06-30 09:51 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-08-09 17:08 - 2016-06-28 11:32 - 01854610 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-09 17:08 - 2015-07-10 18:30 - 00814466 _____ C:\Windows\system32\perfh015.dat
2016-08-09 17:08 - 2015-07-10 18:30 - 00166972 _____ C:\Windows\system32\perfc015.dat
2016-08-07 13:43 - 2016-07-14 07:54 - 00000651 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP.lnk
2016-08-06 14:19 - 2016-06-30 12:46 - 00000000 ____D C:\Users\Szymek\AppData\LocalLow\DefaultCompany
2016-08-06 14:19 - 2016-06-30 09:46 - 00000000 ____D C:\ProgramData\Unity
2016-08-06 13:51 - 2015-07-10 13:04 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-08-05 20:38 - 2016-07-11 12:05 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\obs-studio
2016-08-05 17:46 - 2016-06-30 08:26 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-07-30 14:39 - 2016-06-30 07:30 - 00000000 ____D C:\Users\Szymek\AppData\Roaming\starcheat
2016-07-30 14:13 - 2016-06-29 10:58 - 00000000 ____D C:\ProgramData\Oracle
2016-07-30 14:03 - 2016-06-29 11:11 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2016-07-30 14:03 - 2016-06-29 11:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-07-30 14:03 - 2016-06-29 11:10 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2016-07-30 14:03 - 2016-06-29 10:58 - 00000000 ____D C:\Java

==================== Pliki w katalogu głównym wybranych folderów =======

2016-04-26 14:24 - 2016-04-26 14:24 - 0000009 ____N () C:\Users\Szymek\AppData\Roaming\a.bat
2010-08-28 22:43 - 2010-08-28 22:43 - 0577335 ____N () C:\Users\Szymek\AppData\Roaming\adb.exe
2010-08-28 22:43 - 2010-08-28 22:43 - 0096256 ____N (Google, inc) C:\Users\Szymek\AppData\Roaming\AdbWinApi.dll
2010-08-28 22:43 - 2010-08-28 22:43 - 0060928 ____N (Google, inc) C:\Users\Szymek\AppData\Roaming\AdbWinUsbApi.dll
2016-06-28 03:12 - 2016-06-28 03:12 - 0314434 ____N () C:\Users\Szymek\AppData\Roaming\EYapp.apk
2010-08-28 22:43 - 2010-08-28 22:43 - 0356009 ____N () C:\Users\Szymek\AppData\Roaming\fastboot.exe
2016-08-21 16:03 - 2016-07-25 22:03 - 0036379 ___SH () C:\Users\Szymek\AppData\Roaming\FMXCMZTdfGJETOQZhCa
2016-08-21 16:03 - 2016-07-01 10:34 - 0082432 ___SH () C:\Users\Szymek\AppData\Roaming\Keygen.exe
2016-08-21 16:04 - 2016-07-25 22:04 - 0828928 ___SH () C:\Users\Szymek\AppData\Roaming\KfiUCSFbYAeXdeLgTGIKG.cmd
2016-08-21 16:04 - 2016-04-06 05:22 - 0025486 ___SH () C:\Users\Szymek\AppData\Roaming\Loader.exe
2016-08-22 14:46 - 2016-07-01 11:19 - 8284704 _____ (深圳市伟创科技软件有限公司) C:\Users\Szymek\AppData\Roaming\MaoHaWiFiSetup_262.exe
2016-08-21 16:03 - 2016-07-25 22:03 - 0828928 ___SH () C:\Users\Szymek\AppData\Roaming\OQFPETVYIOcIgdeAFYWeG.cmd
2016-08-22 14:50 - 2016-08-22 14:51 - 7616340 _____ () C:\Users\Szymek\AppData\Roaming\setup.apk
2016-08-21 16:04 - 2016-07-25 22:04 - 0463376 ___SH () C:\Users\Szymek\AppData\Roaming\TCYUCPCgXcXS
2016-08-22 14:49 - 2016-07-05 07:58 - 9216000 _____ (eee) C:\Users\Szymek\AppData\Roaming\THREADAPP.exe
2016-08-21 16:03 - 2016-07-25 22:02 - 0463376 ___SH () C:\Users\Szymek\AppData\Roaming\UBAOUJJKYhEc
2016-08-21 16:04 - 2016-07-25 22:04 - 0036379 ___SH () C:\Users\Szymek\AppData\Roaming\WUGAKRLcYgXFdHSgJEX
2016-08-22 14:50 - 2016-08-22 14:51 - 0732869 _____ () C:\Users\Szymek\AppData\Roaming\xdo.zip
2016-08-22 14:41 - 2016-06-30 09:59 - 5267952 _____ () C:\Users\Szymek\AppData\Roaming\ziptool_wc-9025_setup.exe
2016-07-02 16:23 - 2016-08-20 14:03 - 0000600 _____ () C:\Users\Szymek\AppData\Local\PUTTY.RND
2016-08-21 17:04 - 2016-08-21 17:04 - 0007821 _____ () C:\Users\Szymek\AppData\Local\recently-used.xbel
2016-06-29 15:03 - 2016-06-29 15:03 - 0000057 _____ () C:\ProgramData\Ament.ini

Niektóre pliki w TEMP:
====================
C:\Users\Szymek\AppData\Local\Temp\BFEB.tmp.exe
C:\Users\Szymek\AppData\Local\Temp\libeay32.dll
C:\Users\Szymek\AppData\Local\Temp\msvcr120.dll
C:\Users\Szymek\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll
[2015-07-10 13:00] - [2015-07-10 13:00] - 0680256 ____A (Microsoft Corporation) 167112BC1335CB267233BD12744F64F5

C:\Windows\SysWOW64\dnsapi.dll
[2015-07-10 13:00] - [2015-07-10 13:00] - 0534064 ____A (Microsoft Corporation) D7541644A2B6677145581FB4019BFA47

C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-08-19 18:40

==================== Koniec  FRST.txt ============================