API tools faq
paste
toMiXgaming

FRST

toMiXgaming
Jul 16th, 2017
116
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 31.75 KB | None | 0 0
raw download clone embed print report
  1. Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 15-07-2017
  2. Uruchomiony przez Admin (administrator) ADMIN-ROOT (16-07-2017 11:58:32)
  3. Uruchomiony z C:\Users\Admin\Downloads
  4. Załadowane profile: Admin (Dostępne profile: Admin & ROOT)
  5. Platform: Windows 7 Home Premium (X64) Język: Polski (Polska)
  6. Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome)
  7. Tryb startu: Normal
  8. Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
  9.  
  10. ==================== Procesy (filtrowane) =================
  11.  
  12. (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)
  13.  
  14. (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
  15. (ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe
  16. (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  17. (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
  18. (Microsoft Corporation) C:\Windows\System32\dllhost.exe
  19. (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
  20. (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
  21. (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
  22. (SlimWare Utilities, Inc.) C:\Program Files\SlimService\SlimServiceFactory.exe
  23. (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
  24. (Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
  25. (Valve Corporation) C:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
  26. (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  27. (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
  28. (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorUI.exe
  29. (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_26_0_0_137.exe
  30. (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_26_0_0_137.exe
  31.  
  32. ==================== Rejestr (filtrowane) ====================
  33.  
  34. (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)
  35.  
  36. HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-11-21] (Intel Corporation)
  37. HKLM-x32\...\Run: [] => [X]
  38. HKLM-x32\...\RunOnce: [SlimCleaner Plus] => cmd /c "start "" "C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe" /delay=5 /mode=toaster "
  39. Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
  40. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9818328 2017-06-30] (Piriform Ltd)
  41. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\...\Policies\system: [EnableLUA] 1
  42. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\...\Policies\Explorer: [NolowDiskSpaceChecks] 1
  43. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\...\MountPoints2: {c2331147-fc06-11e6-859a-f46d044ae841} - F:\autorun.exe
  44. GroupPolicy: Ograniczenia <==== UWAGA
  45.  
  46. ==================== Internet (filtrowane) ====================
  47.  
  48. (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)
  49.  
  50. Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
  51. Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
  52. Tcpip\..\Interfaces\{AFC5E4F7-1AD0-4087-9F95-848B6CFCECAD}: [DhcpNameServer] 192.168.0.1
  53.  
  54. Internet Explorer:
  55. ==================
  56. HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
  57. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
  58. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://asus.msn.com
  59. HKU\S-1-5-21-2962629492-4049256685-3869446710-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
  60. SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
  61. SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=ASUTDF&pc=MAAU&src=IE-SearchBox
  62. SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
  63. BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\java 2\bin\ssv.dll [2016-11-27] (Oracle Corporation)
  64. BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
  65. BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-12-08] (Google Inc.)
  66. BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\java 2\bin\jp2ssv.dll [2016-11-27] (Oracle Corporation)
  67. BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
  68. BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2010-09-23] (Microsoft Corporation)
  69. BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-12-08] (Google Inc.)
  70. Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-12-08] (Google Inc.)
  71. Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-12-08] (Google Inc.)
  72. Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-12-21] (Microsoft Corporation)
  73. Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-12-21] (Microsoft Corporation)
  74. Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-12-21] (Microsoft Corporation)
  75. Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-12-21] (Microsoft Corporation)
  76.  
  77. FireFox:
  78. ========
  79. FF DefaultProfile: oneq2956.default
  80. FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oneq2956.default [2017-07-16]
  81. FF Extension: (AdF.ly Skipper ★WORKING: 6/1/2017★) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oneq2956.default\Extensions\jid0-hyjN250ZzTOOX3evFwwAQBxE4ik@jetpack.xpi [2017-06-03]
  82. FF Extension: (uBlock Origin) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oneq2956.default\Extensions\uBlock0@raymondhill.net.xpi [2017-07-03]
  83. FF Extension: (Stylish) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oneq2956.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2017-05-03]
  84. FF Extension: (Adblock Plus) - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\oneq2956.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-08]
  85. FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_137.dll [2017-07-12] ()
  86. FF Plugin: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\java 2\bin\dtplugin\npDeployJava1.dll [2016-11-27] (Oracle Corporation)
  87. FF Plugin: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\java 2\bin\plugin2\npjp2.dll [2016-11-27] (Oracle Corporation)
  88. FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
  89. FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_137.dll [2017-07-12] ()
  90. FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
  91. FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
  92. FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
  93. FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-15] (Google Inc.)
  94. FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-07-15] (Google Inc.)
  95. FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll [2010-01-23] (Zeon Corporation)
  96. FF Plugin HKU\S-1-5-21-2962629492-4049256685-3869446710-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2017-03-09] (Unity Technologies ApS)
  97.  
  98. Chrome:
  99. =======
  100. CHR HomePage: Default -> hxxp://www.oursurfing.com/?type=hp&ts=1440311713&z=2d287578afd7e7952666009g2z0z2eec2gbg8mdgcg&from=amt&uid=WDCXWD3200BPVT-80ZEST0_WD-WXM1E11SFZS4SFZS4
  101. CHR StartupUrls: Default -> "hxxps://www.youtube.com/","hxxp://pukawka.pl//","hxxps://www.google.pl/"
  102. CHR Session Restore: Default -> [funkcja włączona]
  103. CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2017-07-16]
  104. CHR Extension: (Adblock Plus) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-07-15]
  105. CHR Extension: (Adblock dla serwisu Youtube™) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2017-06-15]
  106. CHR Extension: (World of Tanks) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hlmgjehoadlebdijggekocdhmnheljfi [2017-02-11]
  107. CHR Extension: (Proxy for Chrome) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iilpibhiihokecnbdkaminemnmecjfed [2016-12-25]
  108. CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
  109. CHR Extension: (AdF.ly Skipper ★WORKING: 7/1/2017★) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obnfifcganohemahpomajbhocfkdgmjb [2017-07-02]
  110. CHR Extension: (World of Tanks - The Crayfish Game) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpeanfgdpkkceggdcbdfjkdmbinlmgk [2017-02-11]
  111. CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-15]
  112.  
  113. ==================== Usługi (filtrowane) ====================
  114.  
  115. (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
  116.  
  117. S4 ACTION_SVC; C:\Program Files (x86)\Mirillis\Action!\action_svc.exe [16064 2014-10-25] ()
  118. S4 ADSMService; C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe [225280 2008-03-31] (ASUSTek Computer Inc.) [Brak podpisu cyfrowego]
  119. S4 AFBAgent; C:\Windows\system32\FBAgent.exe [377264 2010-09-30] (ASUSTeK Computer Inc.) [Brak podpisu cyfrowego]
  120. S4 AGSService; C:\Program Files (x86)\Common Files\Adobe\AdobeGCClient\AGSService.exe [2227312 2017-01-19] (Adobe Systems, Incorporated)
  121. S4 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1447944 2016-12-29] ()
  122. S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [245544 2016-12-26] (EasyAntiCheat Ltd)
  123. S2 FontCache; C:\Windows\system32\FntCache.dll [1133568 2010-11-02] (Microsoft Corporation) [Brak podpisu cyfrowego]
  124. S2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
  125. S4 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [Brak podpisu cyfrowego]
  126. R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
  127. R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
  128. R2 SlimService; C:\Program Files\SlimService\SlimServiceFactory.exe [252096 2016-10-25] (SlimWare Utilities, Inc.)
  129. S4 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [Brak podpisu cyfrowego]
  130. S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
  131.  
  132. ===================== Sterowniki (filtrowane) ======================
  133.  
  134. (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
  135.  
  136. S3 ampa; C:\Windows\system32\ampa.sys [38320 2016-12-25] ()
  137. S3 ampa; C:\Windows\SysWOW64\ampa.sys [38320 2016-12-25] ()
  138. S3 ATITool; C:\Windows\System32\DRIVERS\ATITool64.sys [30720 2006-11-10] () [Brak podpisu cyfrowego]
  139. S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2017-04-30] (Disc Soft Ltd)
  140. S3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2017-04-30] (Disc Soft Ltd)
  141. R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2017-02-16] (REALiX(tm))
  142. R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
  143. S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
  144. R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
  145. R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
  146. S3 ptun0901; C:\Windows\System32\DRIVERS\ptun0901.sys [27136 2016-06-15] (The OpenVPN Project)
  147. R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2012-06-22] (Corel Corporation)
  148. S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()
  149. S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16056 2017-07-16] (SlimWare Utilities, Inc.)
  150. S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [27136 2016-04-21] (The OpenVPN Project) [Brak podpisu cyfrowego]
  151. R3 VBAudioVACMME; C:\Windows\System32\DRIVERS\vbaudio_cable64_win7.sys [41192 2014-09-02] (Windows (R) Win 7 DDK provider)
  152. R3 VBAudioVMVAIOMME; C:\Windows\System32\DRIVERS\vbaudio_vmvaio64_win7.sys [41192 2016-12-03] (Windows (R) Win 7 DDK provider)
  153. S1 VBoxNetAdp; C:\Windows\System32\DRIVERS\VBoxNetAdp6.sys [131144 2017-04-28] (Oracle Corporation)
  154. S3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2016-06-15] (SplitmediaLabs Limited)
  155.  
  156. ==================== NetSvcs (filtrowane) ===================
  157.  
  158. (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
  159.  
  160.  
  161. ==================== Jeden miesiąc - utworzone pliki i foldery ========
  162.  
  163. (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
  164.  
  165. 2017-07-16 11:57 - 2017-07-16 11:58 - 00053541 _____ C:\Users\Admin\Downloads\Addition.txt
  166. 2017-07-16 11:55 - 2017-07-16 11:58 - 00015340 _____ C:\Users\Admin\Downloads\FRST.txt
  167. 2017-07-16 11:54 - 2017-07-16 11:58 - 00000000 ____D C:\FRST
  168. 2017-07-16 11:53 - 2017-07-16 11:53 - 02435584 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
  169. 2017-07-16 11:07 - 2017-07-16 11:07 - 00000000 ____D C:\Windows\SysWOW64\SDA
  170. 2017-07-16 11:07 - 2017-07-16 11:07 - 00000000 ____D C:\Windows\LastGood
  171. 2017-07-16 11:07 - 2000-01-01 02:00 - 00203352 _____ (JMicron Technology Corporation) C:\Windows\SysWOW64\jmcricon.dll
  172. 2017-07-16 11:07 - 2000-01-01 02:00 - 00203352 _____ (JMicron Technology Corporation) C:\Windows\system32\jmcricon.dll
  173. 2017-07-16 11:07 - 2000-01-01 02:00 - 00173656 _____ (JMicron Technology Corporation) C:\Windows\system32\Drivers\jmcr.sys
  174. 2017-07-16 11:06 - 2017-07-16 11:06 - 00000000 ____D C:\Intel
  175. 2017-07-16 11:04 - 2017-07-16 11:04 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Intel Corporation
  176. 2017-07-16 11:02 - 2017-07-16 11:02 - 00000000 ____D C:\Users\Admin\Intel
  177. 2017-07-16 11:02 - 2017-07-16 11:02 - 00000000 ____D C:\ProgramData\SlimWare Utilities, Inc
  178. 2017-07-16 11:01 - 2017-07-16 11:01 - 00016056 _____ (SlimWare Utilities, Inc.) C:\Windows\system32\Drivers\SWDUMon.sys
  179. 2017-07-16 11:01 - 2017-07-16 11:01 - 00002836 _____ C:\Windows\System32\Tasks\SlimDrivers Startup
  180. 2017-07-16 11:01 - 2017-07-16 11:01 - 00002483 _____ C:\Users\Public\Desktop\SlimDrivers.lnk
  181. 2017-07-16 11:01 - 2017-07-16 11:01 - 00002465 _____ C:\Users\Public\Desktop\SlimCleaner Plus.lnk
  182. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000410 _____ C:\Windows\Tasks\SlimDrivers Startup.job
  183. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Users\Public\Documents\Downloaded Installers
  184. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Users\Admin\AppData\Local\SlimWare Utilities Inc
  185. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Users\Admin\AppData\Local\Downloaded Installers
  186. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\ProgramData\SlimWare Utilities Inc
  187. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimDrivers
  188. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimCleaner Plus
  189. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Program Files\SlimService
  190. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Program Files\SlimCleaner Plus
  191. 2017-07-16 11:01 - 2017-07-16 11:01 - 00000000 ____D C:\Program Files (x86)\SlimDrivers
  192. 2017-07-16 11:00 - 2017-07-16 11:00 - 01076800 _____ (Slimware Utilities Holdings, Inc.) C:\Users\Admin\Downloads\SlimDrivers-setup.exe
  193. 2017-07-15 10:01 - 2017-07-15 10:01 - 00001457 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
  194. 2017-07-15 09:46 - 2017-07-15 09:46 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Google
  195. 2017-07-15 09:45 - 2017-07-15 10:20 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
  196. 2017-07-15 09:45 - 2017-07-15 09:46 - 00000000 ____D C:\Program Files\CCleaner
  197. 2017-07-15 09:45 - 2017-07-15 09:45 - 00002267 _____ C:\Users\Public\Desktop\Google Chrome.lnk
  198. 2017-07-15 09:45 - 2017-07-15 09:45 - 00000824 _____ C:\Users\Public\Desktop\CCleaner.lnk
  199. 2017-07-15 09:45 - 2017-07-15 09:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
  200. 2017-07-15 09:42 - 2017-07-15 09:43 - 09749016 _____ (Piriform Ltd) C:\Users\Admin\Downloads\ccsetup532pro.exe
  201. 2017-07-14 16:36 - 2017-07-14 16:36 - 00000000 ____D C:\Users\Admin\AppData\Local\Macromedia
  202. 2017-07-14 15:22 - 2017-07-14 15:22 - 00000000 ____D C:\ProgramData\AomeiBR
  203. 2017-07-14 12:20 - 2017-07-14 12:20 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
  204. 2017-07-14 12:20 - 2017-07-14 12:20 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
  205. 2017-07-14 12:19 - 2017-07-14 12:19 - 00000000 ____D C:\Users\Admin\AppData\Roaming\RenPy
  206. 2017-07-14 11:51 - 2017-07-14 11:53 - 65033984 _____ (Malwarebytes ) C:\Users\Admin\Downloads\mb3-setup-consumer-3.1.2.1733-1.0.160-1.0.2251.exe
  207. 2017-07-14 11:48 - 2017-07-16 11:45 - 00000000 ____D C:\Users\Admin\AppData\LocalLow\Mozilla
  208. 2017-07-14 11:38 - 2017-05-08 03:07 - 00035792 _____ (Glarysoft Ltd) C:\Windows\system32\RegBootDefrag.exe
  209. 2017-07-14 10:06 - 2017-07-14 10:06 - 00000000 ___HD C:\Users\Public\Documents\AdobeGC
  210. 2017-07-13 08:54 - 2017-07-13 08:55 - 11181022 _____ C:\Users\Admin\Downloads\Medusa-0.4.8.rar
  211. 2017-07-13 08:54 - 2017-07-13 08:54 - 00096866 _____ C:\Users\Admin\Downloads\Fonts.rar
  212. 2017-07-13 08:47 - 2017-07-13 08:48 - 20985335 _____ C:\Users\Admin\Downloads\ylamjb.rar
  213. 2017-07-12 20:26 - 2017-07-15 09:51 - 00004426 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
  214. 2017-07-12 20:26 - 2017-07-12 20:26 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
  215. 2017-07-12 20:26 - 2017-07-12 20:26 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
  216. 2017-07-12 20:26 - 2017-07-12 20:26 - 00000000 ____D C:\Windows\system32\Macromed
  217. 2017-07-12 20:16 - 2017-07-12 20:16 - 00407844 _____ C:\Users\Admin\Downloads\Jigsaw-Installer-1.8.8.jar
  218. 2017-07-12 16:09 - 2017-07-12 16:13 - 00000000 ____D C:\AdwCleaner
  219. 2017-07-12 16:09 - 2017-07-12 16:09 - 04110280 _____ C:\Users\Admin\Downloads\adwcleaner_6.047.exe
  220. 2017-07-12 13:49 - 2017-07-12 13:49 - 00946963 _____ C:\Users\Admin\Downloads\HYPERs MEGA FPS Boost Config For CSGO!!#2016.rar
  221. 2017-07-12 09:32 - 2017-07-12 09:34 - 05420457 _____ C:\Users\Admin\Downloads\MONEY4YOu.mp4
  222. 2017-07-12 09:08 - 2017-07-12 09:08 - 00012112 _____ C:\Users\Admin\AppData\Local\recently-used.xbel
  223. 2017-07-11 20:23 - 2017-07-11 20:23 - 00000000 ____D C:\Users\Public\Documents\Adobe
  224. 2017-07-11 17:42 - 2017-07-11 17:43 - 13531597 _____ C:\Users\Admin\Downloads\NebulaB68.rar
  225. 2017-07-11 12:03 - 2012-06-22 03:01 - 00056336 ____N (Corel Corporation) C:\Windows\system32\Drivers\PxHlpa64.sys
  226. 2017-07-11 12:03 - 2012-04-24 03:01 - 00011376 ____N (Corel Corporation) C:\Windows\system32\Drivers\cdralw2k.sys
  227. 2017-07-11 12:03 - 2012-04-24 03:01 - 00010864 ____N (Corel Corporation) C:\Windows\system32\Drivers\cdr4_xp.sys
  228. 2017-07-10 20:10 - 2017-07-10 20:10 - 00000000 ___RD C:\Users\Admin\Documents\MEGAsync
  229. 2017-07-10 20:09 - 2017-07-10 20:09 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MEGAsync
  230. 2017-07-10 20:09 - 2017-07-10 20:09 - 00000000 ____D C:\Users\Admin\AppData\Local\MEGAsync
  231. 2017-07-10 20:08 - 2017-07-10 20:08 - 13314392 _____ (MEGA Limited) C:\Users\Admin\Downloads\MEGAsyncSetup.exe
  232. 2017-07-10 14:42 - 2017-07-10 14:42 - 11995493 _____ C:\Users\Admin\Downloads\audacity-win-2.1.3.zip
  233. 2017-07-08 19:11 - 2017-07-08 19:11 - 00680356 _____ C:\Users\Admin\Downloads\CpuCoreParking3.zip
  234. 2017-07-08 18:59 - 2017-07-08 19:00 - 00668089 _____ C:\Users\Admin\Downloads\TeamSpeak-KittyChat.zip
  235. 2017-07-08 14:07 - 2017-07-09 16:57 - 00000219 _____ C:\Users\Admin\Desktop\Counter-Strike Global Offensive.url
  236. 2017-07-07 16:30 - 2017-07-07 16:30 - 00000000 ____D C:\Program Files (x86)\MPMissions
  237. 2017-07-07 16:27 - 2017-07-07 16:29 - 24945510 _____ C:\Users\Admin\Downloads\Setup_ZDay_arma-cwa.ru.zip
  238. 2017-07-07 08:58 - 2017-07-07 08:58 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OFP & CWA mods
  239. 2017-07-07 08:42 - 2017-07-07 08:56 - 356908829 _____ (kenoxite ) C:\Users\Admin\Downloads\WW4_Extended_v1.1_Setup.exe
  240. 2017-07-07 08:35 - 2017-07-07 08:39 - 148063107 _____ C:\Users\Admin\Downloads\CWA_update.22112011-combinedALL.7z
  241.  
  242. ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========
  243.  
  244. (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
  245.  
  246. 2017-07-16 11:11 - 2017-05-21 16:08 - 00000000 ____D C:\Program Files (x86)\Steam
  247. 2017-07-16 11:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
  248. 2017-07-16 11:03 - 2016-11-10 03:23 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel
  249. 2017-07-16 11:02 - 2016-11-09 03:12 - 00000000 ____D C:\Users\Admin
  250. 2017-07-16 10:44 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
  251. 2017-07-16 10:44 - 2009-07-14 06:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
  252. 2017-07-16 10:36 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
  253. 2017-07-16 09:34 - 2017-04-15 15:52 - 00000000 ____D C:\Users\Admin\AppData\Roaming\.minecraft
  254. 2017-07-15 10:32 - 2016-12-26 15:36 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
  255. 2017-07-15 10:21 - 2016-12-20 17:07 - 00000000 ____D C:\ProgramData\GlarySoft
  256. 2017-07-15 10:21 - 2016-11-20 13:33 - 00000000 ____D C:\Users\Admin\AppData\Roaming\GlarySoft
  257. 2017-07-15 10:01 - 2016-11-09 03:14 - 00001423 _____ C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
  258. 2017-07-15 09:55 - 2017-02-26 15:35 - 00003620 _____ C:\Windows\System32\Tasks\HPCustParticipation HP Deskjet 1510 series
  259. 2017-07-15 09:55 - 2016-11-09 03:34 - 00003894 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1478655255
  260. 2017-07-15 09:54 - 2011-01-12 16:33 - 00003482 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
  261. 2017-07-15 09:52 - 2017-05-15 16:59 - 00003782 _____ C:\Windows\System32\Tasks\GlaryOneClickOptimizer 5
  262. 2017-07-15 09:52 - 2017-04-21 13:38 - 00003316 _____ C:\Windows\System32\Tasks\GlaryInitialize 5
  263. 2017-07-15 09:52 - 2011-01-12 16:33 - 00003354 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
  264. 2017-07-15 09:50 - 2016-11-11 11:57 - 00000000 ____D C:\Users\Admin\AppData\Roaming\TS3Client
  265. 2017-07-15 09:49 - 2016-12-30 18:09 - 00000000 ____D C:\Users\Admin\AppData\Local\CrashDumps
  266. 2017-07-15 09:45 - 2011-01-12 16:33 - 00002279 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
  267. 2017-07-15 09:45 - 2011-01-12 16:33 - 00000000 ____D C:\Program Files (x86)\Google
  268. 2017-07-15 09:44 - 2016-11-09 03:20 - 00000000 ____D C:\Users\Admin\AppData\Local\Google
  269. 2017-07-14 19:17 - 2017-02-11 20:03 - 00000000 ____D C:\Program Files\Common Files\Adobe
  270. 2017-07-14 19:15 - 2017-02-12 13:24 - 00000000 ____D C:\Program Files (x86)\Adobe
  271. 2017-07-14 19:15 - 2017-02-11 20:04 - 00000000 ____D C:\Program Files\Adobe
  272. 2017-07-14 19:15 - 2017-01-18 13:06 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Adobe
  273. 2017-07-14 17:45 - 2016-11-11 12:29 - 00000000 ____D C:\Users\Admin\.gimp-2.8
  274. 2017-07-14 16:28 - 2016-11-09 03:32 - 00000000 ____D C:\Program Files (x86)\Opera
  275. 2017-07-14 16:25 - 2017-02-12 19:57 - 00000000 ____D C:\Users\Admin\Desktop\Inne
  276. 2017-07-14 15:19 - 2017-05-28 17:25 - 00001024 ____H C:\AMTAG.BIN
  277. 2017-07-14 15:19 - 2017-05-28 17:25 - 00000000 ____D C:\Program Files (x86)\AOMEI Partition Assistant Standard Edition 6.3
  278. 2017-07-14 11:48 - 2017-05-03 14:20 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Mozilla
  279. 2017-07-14 11:42 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
  280. 2017-07-14 11:39 - 2009-07-14 04:34 - 65798144 _____ C:\Windows\system32\config\SOFTWARE.gu.bak
  281. 2017-07-14 11:39 - 2009-07-14 04:34 - 19922944 _____ C:\Windows\system32\config\SYSTEM.gu.bak
  282. 2017-07-14 11:39 - 2009-07-14 04:34 - 00524288 _____ C:\Windows\system32\config\DEFAULT.gu.bak
  283. 2017-07-14 11:39 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SECURITY.gu.bak
  284. 2017-07-14 11:39 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\SAM.gu.bak
  285. 2017-07-14 11:37 - 2017-05-05 19:30 - 00000000 ____D C:\Users\Admin\Documents\DAVAProject
  286. 2017-07-14 11:37 - 2017-05-05 18:56 - 00000000 ____D C:\Users\Admin\Documents\Camtasia Studio
  287. 2017-07-14 11:37 - 2017-05-03 14:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
  288. 2017-07-14 11:37 - 2017-04-24 19:40 - 00000000 ____D C:\Users\Admin\AppData\Roaming\SmartSteamEmu
  289. 2017-07-14 11:37 - 2017-04-22 13:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
  290. 2017-07-14 11:37 - 2017-04-19 20:20 - 00000000 ____D C:\ProgramData\Avg
  291. 2017-07-14 11:37 - 2017-02-20 17:50 - 00000000 ____D C:\Users\Admin\AppData\Roaming\VEGAS
  292. 2017-07-14 11:37 - 2017-02-11 20:00 - 00000000 ____D C:\ProgramData\Adobe
  293. 2017-07-14 11:37 - 2017-01-21 17:16 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Audacity
  294. 2017-07-14 11:37 - 2016-12-03 19:56 - 00000000 ____D C:\Users\Admin\AppData\Roaming\foobar2000
  295. 2017-07-14 11:37 - 2011-01-12 16:33 - 00000000 ____D C:\ProgramData\Nuance
  296. 2017-07-14 10:23 - 2017-05-04 17:34 - 00000000 ____D C:\Program Files (x86)\Penumbra
  297. 2017-07-14 10:07 - 2017-02-11 20:00 - 00000000 ____D C:\Users\Admin\AppData\Local\Adobe
  298. 2017-07-13 13:41 - 2016-11-09 03:14 - 00069264 _____ C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
  299. 2017-07-13 13:41 - 2009-07-14 06:45 - 04988656 _____ C:\Windows\system32\FNTCACHE.DAT
  300. 2017-07-12 20:27 - 2011-01-12 16:44 - 00000000 ____D C:\Windows\SysWOW64\Macromed
  301. 2017-07-12 10:07 - 2017-02-12 16:18 - 00000000 ____D C:\Windows\system32\MRT
  302. 2017-07-12 10:04 - 2017-02-12 16:17 - 135225752 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
  303. 2017-07-12 09:08 - 2017-04-26 21:18 - 00000000 ____D C:\Users\Admin\AppData\Local\gtk-2.0
  304. 2017-07-10 20:26 - 2017-05-14 16:06 - 00000000 ____D C:\Users\Admin\Documents\MEGAsync Downloads
  305. 2017-07-10 17:07 - 2016-12-28 12:08 - 00000000 ___HD C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup-Disabled
  306. 2017-07-08 14:00 - 2017-05-04 17:10 - 00000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Penumbra
  307. 2017-07-04 19:10 - 2017-05-03 14:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
  308. 2017-06-16 07:55 - 2016-11-09 04:01 - 00068064 _____ C:\Users\ROOT\AppData\Local\GDIPFONTCACHEV1.DAT
  309.  
  310. ==================== Pliki w katalogu głównym wybranych folderów =======
  311.  
  312. 2007-06-12 19:34 - 2007-06-12 19:34 - 0035822 _____ () C:\Program Files (x86)\Common Files\ASPG_icon.ico
  313. 2008-05-22 18:35 - 2008-05-22 18:35 - 0051962 _____ () C:\Program Files (x86)\Common Files\banner.jpg
  314. 2009-04-08 20:31 - 2009-04-08 20:31 - 0106496 _____ () C:\Program Files (x86)\Common Files\CPInstallAction.dll
  315. 2008-08-12 07:45 - 2008-08-12 07:45 - 0155648 _____ (ASUS) C:\Program Files (x86)\Common Files\MSIactionall.dll
  316. 2017-02-11 20:06 - 2017-02-11 20:07 - 318912029 _____ () C:\Users\Admin\AppData\Local\ACCCx3_9_5_353.zip.aamdownload
  317. 2017-02-11 20:06 - 2017-02-11 20:07 - 0003560 _____ () C:\Users\Admin\AppData\Local\ACCCx3_9_5_353.zip.aamdownload.aamd
  318. 2017-07-12 09:08 - 2017-07-12 09:08 - 0012112 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
  319. 2017-04-12 20:03 - 2017-04-12 20:03 - 0007605 _____ () C:\Users\Admin\AppData\Local\Resmon.ResmonCfg
  320. 2017-02-26 15:33 - 2017-02-26 15:33 - 0000057 _____ () C:\ProgramData\Ament.ini
  321. 2011-01-12 16:44 - 2010-07-07 02:10 - 0131472 _____ () C:\ProgramData\FullRemove.exe
  322. 2011-01-12 16:32 - 2011-01-12 16:32 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
  323. 2011-01-12 16:32 - 2011-01-12 16:32 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
  324.  
  325. Niektóre pliki w TEMP:
  326. ====================
  327. 2017-07-16 11:00 - 2017-07-16 11:00 - 0225472 _____ (SlimWare Utilities, Inc.) C:\Users\Admin\AppData\Local\Temp\scp7DD.tmp.exe
  328. 2017-02-17 14:52 - 2017-02-17 14:52 - 1498624 _____ (Opera Software) C:\Users\ROOT\AppData\Local\Temp\Opera_installer_2017217525351.dll
  329. 2017-02-17 14:52 - 2017-02-17 14:52 - 1498624 _____ (Opera Software) C:\Users\ROOT\AppData\Local\Temp\Opera_installer_20172175254112.dll
  330.  
  331. ==================== Bamital & volsnap ======================
  332.  
  333. (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)
  334.  
  335. C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
  336. C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
  337. C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
  338. C:\Windows\explorer.exe => Plik podpisany cyfrowo
  339. C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
  340. C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
  341. C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
  342. C:\Windows\system32\services.exe => Plik podpisany cyfrowo
  343. C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
  344. C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
  345. C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
  346. C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
  347. C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
  348. C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
  349. C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
  350. C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo
  351.  
  352. LastRegBack: 2017-07-14 11:33
  353.  
  354. ==================== Koniec FRST.txt ============================
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!