Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 27-02-2017 01 Uruchomiony przez Admin (administrator) ADMIN-KOMPUTER (28-02-2017 14:53:54) Uruchomiony z E:\Download Załadowane profile: Admin (Dostępne profile: Admin) Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe () C:\Program Files\Macrium\Reflect\ReflectService.exe (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [899680 2013-02-04] (Conexant Systems, Inc.) HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2013-03-05] (Conexant Systems, Inc.) HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-04] (Realtek semiconductor) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2876816 2013-03-05] (ELAN Microelectronics Corp.) HKLM\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [318248 2016-01-08] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation) HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [] => [X] Winlogon\Notify\igfxcui: igfxdev.dll [X] HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\MountPoints2: G - G:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\MountPoints2: {46011717-8611-11e4-a2c7-9cd21eebfb98} - G:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\MountPoints2: {4789a8fb-69b1-11e5-a102-9cd21eebfb98} - H:\autorun.exe HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\MountPoints2: {54ebdadb-9838-11e5-9870-00a0c6000000} - H:\HTC_Sync_Manager_PC.exe HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\MountPoints2: {d8067d3a-d714-11e6-9808-9cd21eebfb98} - G:\HTC_Sync_Manager_PC.exe Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) AutoConfigURL: [S-1-5-21-1754145634-2526965675-1269536130-1000] => hxxp://no-block.biz/wpad.dat?e545a3a96472d0b709d1d435f517deda23419413 Tcpip\Parameters: [DhcpNameServer] 62.179.1.62 62.179.1.63 Tcpip\..\Interfaces\{2AAB89A4-EB52-48B1-9168-F20B294E1DE1}: [NameServer] 149.156.67.233,149.156.89.30 Tcpip\..\Interfaces\{DFD26FD3-82D4-485C-92B4-2CEFC78BEA4D}: [DhcpNameServer] 62.179.1.62 62.179.1.63 ManualProxies: 0hxxp://no-block.biz/wpad.dat?e545a3a96472d0b709d1d435f517deda23419413 Internet Explorer: ================== HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131133443925408218&GUID=F972C3A7-DF5B-456E-8184-92884DDAED7F HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131133443925408218&GUID=F972C3A7-DF5B-456E-8184-92884DDAED7F HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131133443925408218&GUID=F972C3A7-DF5B-456E-8184-92884DDAED7F HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=131133443925408218&GUID=F972C3A7-DF5B-456E-8184-92884DDAED7F HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\Software\Microsoft\Internet Explorer\Main,Start Page = HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = SearchScopes: HKLM-x32 -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKU\S-1-5-21-1754145634-2526965675-1269536130-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1754145634-2526965675-1269536130-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?FORM=SK2MDF&PC=SK2M&q={searchTerms}&src=IE-SearchBox SearchScopes: HKU\S-1-5-21-1754145634-2526965675-1269536130-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.) DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.24.0.cab Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - Brak pliku FireFox: ======== FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x0y3wxnh.default [2017-02-28] FF SelectedSearchEngine: Mozilla\Firefox\Profiles\x0y3wxnh.default -> YAC Safe Search FF Homepage: Mozilla\Firefox\Profiles\x0y3wxnh.default -> hxxp://www.onet.pl FF Extension: (uBlock Origin) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x0y3wxnh.default\Extensions\uBlock0@raymondhill.net.xpi [2017-02-20] FF Extension: (Flashblock) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x0y3wxnh.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2016-07-25] FF Extension: (Adblock Plus) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\x0y3wxnh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-24] FF Extension: (Skype) - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-05-25] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2016-02-27] [Brak podpisu cyfrowego] FF HKU\S-1-5-21-1754145634-2526965675-1269536130-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-20] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-20] () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-10-13] (Google, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-17] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1754145634-2526965675-1269536130-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited) FF Plugin HKU\S-1-5-21-1754145634-2526965675-1269536130-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.) FF Plugin HKU\S-1-5-21-1754145634-2526965675-1269536130-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Admin\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.) FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\defaults\pref\106101552.js [2017-01-09] <==== UWAGA (Linkuje do pliku *.cfg) FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\106101552.cfg [2017-01-09] <==== UWAGA Chrome: ======= CHR StartupUrls: Default -> "hxxps://www.google.pl/" CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2017-02-28] CHR Extension: (Dokumenty Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-05-27] CHR Extension: (Dysk Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-27] CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-27] CHR Extension: (Adobe Acrobat) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-02-02] CHR Extension: (Dokumenty Google offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-27] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-02-02] CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-05-27] CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-02-20] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [1008344 2013-02-19] (Broadcom Corporation.) S3 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1364096 2016-05-25] (Microsoft Corporation) S3 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1687680 2016-05-25] (Microsoft Corporation) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] S4 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] () S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego] R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego] R2 ReflectService; C:\Program Files\Macrium\Reflect\ReflectService.exe [301720 2011-07-01] () S3 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S4 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36608 2013-12-13] (Advanced Micro Devices, Inc.) R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [165688 2012-09-25] (Broadcom Corporation.) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [117912 2012-11-19] (Qualcomm Atheros Co., Ltd.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) S3 PSMounter; C:\Windows\system32\drivers\psmounter.sys [40600 2011-07-01] (Macrium Software) R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-04] (Realtek Semiconductor Corp.) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-28 14:51 - 2017-02-28 14:53 - 00000000 ____D C:\Program Files (x86)\Hard Disk Sentinel 2017-02-28 14:51 - 2017-02-28 14:51 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Hard Disk Sentinel 2017-02-28 14:45 - 2017-02-28 14:45 - 00000000 ____D C:\Users\Admin\AppData\Roaming\HD Tune Pro 2017-02-28 14:44 - 2017-02-28 14:44 - 00001037 _____ C:\Users\Admin\Desktop\HD Tune Pro.lnk 2017-02-28 14:44 - 2017-02-28 14:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune Pro 2017-02-28 14:44 - 2017-02-28 14:44 - 00000000 ____D C:\Program Files (x86)\HD Tune Pro 2017-02-28 14:44 - 2015-05-18 07:40 - 00000000 ____D C:\Users\Admin\Desktop\HD Tune Pro 5.60 FINAL + Crack [TechTools.NET] 2017-02-20 19:40 - 2017-02-28 14:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\foobar2000 2017-02-20 19:39 - 2017-02-20 19:39 - 00000000 ____D C:\Program Files (x86)\foobar2000 2017-02-20 19:37 - 2017-02-28 14:53 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Mozilla 2017-02-20 19:37 - 2017-02-27 09:50 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-02-20 18:58 - 2017-02-20 18:58 - 00009709 _____ C:\Users\Admin\Desktop\AdwCleaner[C0].txt 2017-02-20 18:53 - 2017-02-20 18:56 - 00000000 ____D C:\AdwCleaner 2017-02-13 23:58 - 2017-02-28 14:53 - 00000000 ____D C:\FRST 2017-02-08 23:27 - 2017-02-08 23:27 - 00109272 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT 2017-02-08 23:21 - 2017-02-08 23:22 - 00420984 _____ C:\Windows\system32\FNTCACHE.DAT 2017-02-06 19:47 - 2017-02-06 19:46 - 00358832 _____ C:\Users\Admin\Desktop\boarding-pass(1).pdf 2017-02-06 19:47 - 2017-02-06 19:44 - 00358427 _____ C:\Users\Admin\Desktop\boarding-pass.pdf 2017-01-31 17:42 - 2017-01-31 18:36 - 00000000 ____D C:\Users\Admin\Desktop\dżihad ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-28 14:44 - 2014-10-07 18:41 - 00000000 ____D C:\Users\Admin\AppData\Roaming\uTorrent 2017-02-28 10:04 - 2009-07-14 05:45 - 00026288 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-02-28 10:04 - 2009-07-14 05:45 - 00026288 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-02-28 09:57 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-02-25 13:19 - 2014-10-07 15:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-02-20 19:44 - 2014-10-07 15:43 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe 2017-02-20 19:43 - 2014-10-07 15:44 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-02-20 19:43 - 2014-10-07 15:44 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-02-20 19:43 - 2014-10-07 15:44 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-02-20 19:43 - 2014-10-07 15:44 - 00000000 ____D C:\Windows\system32\Macromed 2017-02-20 18:56 - 2015-03-02 21:46 - 00000000 ____D C:\Windows\system32\log 2017-02-13 23:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf 2017-02-08 23:20 - 2015-09-27 10:50 - 00000000 ____D C:\Windows\Minidump 2017-02-08 23:19 - 2016-08-25 18:41 - 00004478 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2017-02-08 23:19 - 2016-07-29 19:39 - 00003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-02-08 23:19 - 2016-07-29 19:39 - 00003354 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-02-08 23:19 - 2014-10-07 18:02 - 00000000 ____D C:\Windows\pss 2017-02-08 23:07 - 2016-05-26 22:44 - 00000000 ____D C:\Program Files (x86)\AVG 2017-02-08 23:07 - 2016-05-26 22:43 - 00000000 ____D C:\ProgramData\Avg 2017-02-08 23:07 - 2016-05-26 22:42 - 00000000 ____D C:\Users\Admin\AppData\Local\AvgSetupLog 2017-02-08 23:03 - 2016-05-26 22:48 - 00000000 ____D C:\ProgramData\MFAData 2017-02-08 23:03 - 2016-05-26 22:42 - 00000000 ____D C:\Users\Admin\AppData\Local\Avg 2017-02-07 21:42 - 2014-10-07 18:51 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Skype 2017-02-07 20:11 - 2016-05-27 19:28 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-02-07 20:11 - 2016-05-27 19:28 - 00002189 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-01-30 10:50 - 2011-04-12 14:21 - 02574308 _____ C:\Windows\system32\perfh015.dat 2017-01-30 10:50 - 2011-04-12 14:21 - 00796790 _____ C:\Windows\system32\perfc015.dat 2017-01-30 10:50 - 2009-07-14 06:13 - 00006224 _____ C:\Windows\system32\PerfStringBackup.INI 2017-01-29 11:07 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-03-04 18:40 - 2016-03-04 18:40 - 1900654 _____ () C:\Users\Admin\AppData\Roaming\Green-Fresh.tst 2016-03-04 18:41 - 2016-03-04 18:41 - 0032038 _____ () C:\Users\Admin\AppData\Roaming\uninstall_temp.ico 2016-05-12 16:41 - 2016-05-21 23:41 - 0000107 _____ () C:\Users\Admin\AppData\Roaming\WB.CFG 2016-06-09 18:12 - 2016-06-09 18:12 - 0000017 _____ () C:\Users\Admin\AppData\Local\resmon.resmoncfg 2016-11-19 21:02 - 2016-11-19 21:02 - 0000000 _____ () C:\Users\Admin\AppData\Local\{B5A4A31A-25EC-4685-B5B0-2CFBBFE87217} 2014-09-23 21:34 - 2014-09-23 21:34 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2016-02-27 22:56 - 2016-06-21 22:02 - 0002267 _____ () C:\ProgramData\hpzinstall.log ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-03-09 11:53 ==================== Koniec FRST.txt ============================