Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 26-12-2017 Uruchomiony przez admin (administrator) WIKA-VAIO (30-12-2017 13:40:10) Uruchomiony z C:\Users\admin\Desktop Załadowane profile: admin (Dostępne profile: admin & Wika & Gość) Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe () C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe (Bitdefender) C:\Program Files\Bitdefender Agent\ProductAgentService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Windows\System32\UI0Detect.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe (ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe (Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [518784 2011-03-29] (Conexant Systems, Inc.) HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [790688 2011-04-29] (Atheros Communications) HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [657568 2011-04-29] (Atheros Commnucations) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [226672 2011-02-17] (Alps Electric Co., Ltd.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2017-07-21] (Oracle Corporation) HKU\S-1-5-21-2766749694-852836189-2292908299-1001\...\Run: [Unified Remote V3] => C:\Program Files (x86)\Unified Remote 3\RemoteServerWin.exe [3155640 2017-05-20] (Unified Intents AB) HKU\S-1-5-21-2766749694-852836189-2292908299-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-21] (Microsoft Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\rvlkl.lnk [2017-12-25] ShortcutTarget: rvlkl.lnk -> C:\Windows\System32\rvlkl.exe (Logixoft) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{1AE9FE1C-B4F5-42A1-BF3D-FBB4D0BD31B2}: [NameServer] 89.108.195.21 89.108.202.21 Tcpip\..\Interfaces\{2C9C64A9-BCF9-42F1-AA2F-F99E58B481EC}: [NameServer] 89.108.195.21 89.108.202.21 Tcpip\..\Interfaces\{2E679D9F-026D-4B94-B38A-9A3E708F3CC7}: [NameServer] 89.108.195.21 89.108.202.21 Tcpip\..\Interfaces\{94E06A0D-5717-45A6-B1EE-B7DF9B6E9766}: [DhcpNameServer] 172.20.10.1 Tcpip\..\Interfaces\{E0CA5D7C-89BD-4479-B96D-E8CFA4F089A1}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{FE960A48-62D3-4CC8-BA54-2C843549392F}: [NameServer] 89.108.195.21 89.108.202.21 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-2766749694-852836189-2292908299-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2766749694-852836189-2292908299-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/ SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox SearchScopes: HKLM-x32 -> {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^HJ^xdm007^S05929^pl&si=CMfiraTQ0rcCFQ5d3godjk0AjQ&ptb=8DD32422-F5D3-4570-BEEE-CDA8CE9A0973&ind=2013060806&n=77fcdec6&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\S-1-5-21-2766749694-852836189-2292908299-1001 -> DefaultScope {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://www.google.com/search?ie=utf-8&oe=utf-8&rlz=1V4IPYX&q={searchTerms} SearchScopes: HKU\S-1-5-21-2766749694-852836189-2292908299-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2766749694-852836189-2292908299-1001 -> {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://www.google.com/search?ie=utf-8&oe=utf-8&rlz=1V4IPYX&q={searchTerms} SearchScopes: HKU\S-1-5-21-2766749694-852836189-2292908299-1001 -> {9259E094-5811-41E8-A50D-8B01E73F2C71} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices BHO: Portfel Bitdefender -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll => Brak pliku BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_144\bin\ssv.dll [2017-08-26] (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_144\bin\jp2ssv.dll [2017-08-26] (Oracle Corporation) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15] (Adobe Systems Incorporated) BHO-x32: Portfel Bitdefender -> {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} -> C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll => Brak pliku BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-04-29] (Atheros Commnucations) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-05-30] (Skype Technologies S.A.) BHO-x32: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.) Toolbar: HKLM - Portfel Bitdefender - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\pmbxie.dll Brak pliku Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-10-21] (Microsoft Corporation.) Toolbar: HKLM-x32 - Portfel Bitdefender - {1DAC0C53-7D23-4AB3-856A-B04D98CD982A} - C:\Program Files\Bitdefender\Bitdefender Security\Antispam32\pmbxie.dll Brak pliku Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-05-30] (Skype Technologies S.A.) FireFox: ======== FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\weyhav0z.default [2017-12-30] FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\weyhav0z.default\user.js [2016-06-22] FF Homepage: Mozilla\Firefox\Profiles\weyhav0z.default -> google.pl FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\weyhav0z.default\searchplugins\babylon.xml [2013-08-07] FF HKLM\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff => nie znaleziono FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor => nie znaleziono FF HKLM-x32\...\Firefox\Extensions: [bdwtwe@bitdefender.com] - C:\Program Files\Bitdefender\Bitdefender Security\bdwteff => nie znaleziono FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_126.dll [2017-12-13] () FF Plugin: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-26] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-26] (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_126.dll [2017-12-13] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1217157.dll [2015-02-16] (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] () FF Plugin-x32: @java.com/DTPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\dtplugin\npDeployJava1.dll [2017-08-26] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\new_plugin\npjp2.dll [Brak pliku] FF Plugin-x32: @java.com/JavaPlugin,version=11.144.2 -> C:\Program Files (x86)\Java\jre1.8.0_144\bin\plugin2\npjp2.dll [2017-08-26] (Oracle Corporation) FF Plugin-x32: @mcafee.com/SAFFPlugin -> C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll [Brak pliku] FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2011-02-18] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2011-02-18] (NVIDIA Corporation) FF Plugin-x32: @protectdisc.com/NPMPDRM -> C:\Program Files (x86)\Common Files\mpDRM\NPMPDRM.dll [2010-02-03] ( ) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-16] (Google Inc.) FF Plugin HKU\S-1-5-21-2766749694-852836189-2292908299-1001: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2012-10-11] (Skype Limited) FF Plugin HKU\S-1-5-21-2766749694-852836189-2292908299-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-03-24] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-2766749694-852836189-2292908299-1001: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2013-06-27] (Pando Networks) Chrome: ======= CHR DefaultProfile: Default CHR Profile: C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default [2017-12-30] CHR Extension: (Bitdefender Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gannpgaobkkhmpomoijebaigcapoeebl [2017-12-30] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-12-30] CHR Extension: (Chrome Media Router) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-12-30] CHR HKU\S-1-5-21-2766749694-852836189-2292908299-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [obilhkhfmlggcoildcnoeknaghkiiclj] - C:\Users\admin\AppData\Local\CRE\obilhkhfmlggcoildcnoeknaghkiiclj.crx CHR HKLM-x32\...\Chrome\Extension: [fagpjgjmoaccgkkpjeoinehnoaimnbla] - C:\Users\admin\AppData\Roaming\BabSolution\CR\hola.crx CHR HKLM-x32\...\Chrome\Extension: [gannpgaobkkhmpomoijebaigcapoeebl] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [kincjchfokkeneeofpeefomkikfkiedl] - C:\Program Files (x86)\OApps\chromeaddon.crx CHR HKLM-x32\...\Chrome\Extension: [obilhkhfmlggcoildcnoeknaghkiiclj] - C:\Users\admin\AppData\Local\CRE\obilhkhfmlggcoildcnoeknaghkiiclj.crx StartMenuInternet: Google Chrome.GI6VBYVXEGZ24RLJK7SXJM2CKY - C:\Users\Gość\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [146592 2011-04-29] (Atheros) [Brak podpisu cyfrowego] R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [91296 2011-04-29] (Atheros Commnucations) [Brak podpisu cyfrowego] S3 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [433688 2016-02-05] (BlueStack Systems, Inc.) S3 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [413208 2016-02-05] (BlueStack Systems, Inc.) S3 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [859672 2016-02-05] (BlueStack Systems, Inc.) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2361344 2011-03-29] (Realsil Microelectronics Inc.) [Brak podpisu cyfrowego] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego] S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2012-05-07] () R2 ProductAgentService; C:\Program Files\Bitdefender Agent\ProductAgentService.exe [1254736 2017-04-11] (Bitdefender) R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation) R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.) S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation) R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) <==== UWAGA (Brak ServiceDLL) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) U5 ATHDFU; C:\Windows\System32\Drivers\ATHDFU.sys [51872 2011-04-29] (Windows (R) Win 7 DDK provider) R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [88480 2013-02-19] () R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [154680 2016-02-05] (BlueStack Systems) S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [223744 2012-05-07] (Huawei Technologies Co., Ltd.) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [46400 2013-02-19] () R3 uvhid; C:\Windows\System32\DRIVERS\uvhid.sys [27064 2017-01-03] (Windows (R) Win 7 DDK provider) S3 VBTUSB; C:\Windows\System32\Drivers\VBTUSB.sys [14848 2011-02-28] (Sony Corporation) [Brak podpisu cyfrowego] R3 VCSVADHWSer; C:\Windows\System32\DRIVERS\vcsvad.sys [21504 2008-12-26] (Avnex) S3 catchme; \??\C:\ComboFix\catchme.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-12-30 13:43 - 2017-12-30 13:43 - 100641554 _____ C:\Users\admin\Downloads\Niepotwierdzony 316244.crdownload 2017-12-30 13:40 - 2017-12-30 13:43 - 000022192 _____ C:\Users\admin\Desktop\FRST.txt 2017-12-30 13:37 - 2017-12-30 13:37 - 002391552 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe 2017-12-30 13:37 - 2017-12-30 13:37 - 002391552 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe 2017-12-30 13:35 - 2017-12-30 13:35 - 000000000 ___RD C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2017-12-30 13:35 - 2017-12-30 13:35 - 000000000 ____D C:\ProgramData\rvlkl 2017-12-30 13:29 - 2017-12-30 13:30 - 090991378 _____ C:\Users\Wika.wika-VAIO.001\Downloads\eav_nt64.exe.part 2017-12-30 13:29 - 2017-12-30 13:29 - 000000000 _____ C:\Users\Wika.wika-VAIO.001\Downloads\eav_nt64.exe 2017-12-30 13:24 - 2017-12-30 13:31 - 000000000 ____D C:\AdwCleaner 2017-12-30 13:24 - 2017-12-30 13:25 - 008198432 _____ (Malwarebytes) C:\Users\Wika.wika-VAIO.001\Downloads\adwcleaner_7.0.6.0.exe 2017-12-30 13:23 - 2017-12-30 13:24 - 008172032 _____ (Malwarebytes) C:\Users\Wika.wika-VAIO.001\Downloads\adwcleaner_7.0.5.0.exe 2017-12-30 13:19 - 2017-12-30 13:30 - 000020223 _____ C:\Users\Wika.wika-VAIO.001\Downloads\FRST.txt 2017-12-30 13:18 - 2017-12-30 13:18 - 002391552 _____ (Farbar) C:\Users\Wika.wika-VAIO.001\Downloads\FRST64.exe 2017-12-30 13:17 - 2017-12-30 13:17 - 002870984 _____ (ESET) C:\Users\Wika.wika-VAIO.001\Downloads\esetsmartinstaller_plk.exe 2017-12-30 13:16 - 2017-12-30 13:16 - 015453549 _____ C:\Users\Wika.wika-VAIO.001\Downloads\Revealer Keylogger Free_crack_registered_keygen.exe 2017-12-30 13:16 - 2017-12-30 13:16 - 000000000 ____D C:\Users\admin\AppData\Roaming\win 2017-12-30 13:11 - 2017-12-30 13:11 - 001496373 _____ C:\Users\Wika.wika-VAIO.001\Downloads\rkfree_setup_226_password_123 (1).zip 2017-12-30 13:04 - 2017-12-30 13:05 - 000000000 ___RD C:\Users\Wika.wika-VAIO.001\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2017-12-30 12:58 - 2017-12-30 13:03 - 000000000 ___HD C:\Program Files (x86)\ProKAward 2017-12-30 12:58 - 2017-12-30 13:00 - 000000046 _____ C:\Windows\SysWOW64\windows.ini 2017-12-30 12:58 - 2017-12-30 12:58 - 000000000 ___HD C:\ProgramData\kprologs 2017-12-30 12:58 - 2017-12-30 12:58 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Award Keylogger Pro 2017-12-30 12:58 - 2009-05-13 19:35 - 001706800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll 2017-12-30 12:58 - 2009-05-13 19:35 - 000050688 _____ (Stardock.Net, Inc) C:\Windows\SysWOW64\wbhelp2.dll 2017-12-30 12:58 - 2009-05-13 19:35 - 000028160 _____ (Neil Banfield) C:\Windows\SysWOW64\anim.dll 2017-12-30 12:56 - 2017-12-30 12:56 - 000021606 _____ C:\ProgramData\agent.uninstall.1514635010.bdinstall.bin 2017-12-27 18:13 - 2017-12-27 18:13 - 000000000 __SHD C:\found.003 2017-12-26 16:17 - 2017-12-26 16:17 - 000000000 ___RD C:\Users\Gość\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices 2017-12-25 16:53 - 2017-12-25 16:53 - 000541600 _____ (Logixoft) C:\Windows\system32\rvlkl.exe 2017-12-25 16:53 - 2017-12-25 16:53 - 000000000 ____D C:\Users\admin\AppData\LocalLow\Mozilla 2017-12-25 16:51 - 2017-12-25 16:52 - 000043454 _____ C:\ProgramData\cl.1514216931.3352.bin 2017-12-25 16:51 - 2017-12-25 16:52 - 000001567 _____ C:\ProgramData\cl.1514216931.4072.bin 2017-12-25 16:51 - 2017-12-25 16:51 - 000036909 _____ C:\ProgramData\dm.uninstall.1514217072.bdinstall.bin 2017-12-25 16:50 - 2017-12-25 16:50 - 003105184 _____ C:\Users\Wika.wika-VAIO.001\Downloads\BitDefender_Uninstall_Tool.exe 2017-12-25 16:50 - 2017-12-25 16:50 - 003105184 _____ C:\Users\Wika.wika-VAIO.001\Downloads\BitDefender_Uninstall_Tool (1).exe 2017-12-25 16:48 - 2017-12-25 16:51 - 000092558 _____ C:\ProgramData\cl.1514216931.10052.bin 2017-12-25 16:47 - 2017-12-25 16:47 - 001496373 _____ C:\Users\Wika.wika-VAIO.001\Downloads\rkfree_setup_226_password_123.zip 2017-12-20 18:03 - 2017-12-20 18:22 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\Desktop\moee 2017-12-05 17:47 - 2017-12-05 18:05 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\Desktop\zuz 2017-12-05 17:20 - 2017-12-06 15:40 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\Desktop\Nowy folder ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-12-30 13:38 - 2012-05-07 17:35 - 000003970 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{EC2AB381-3358-44B3-95DD-E1C912F0296D} 2017-12-30 13:36 - 2012-06-18 14:31 - 000000000 ____D C:\Users\admin\AppData\Local\Google 2017-12-30 13:34 - 2011-09-09 20:18 - 000000000 ____D C:\ProgramData\NVIDIA 2017-12-30 13:33 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2017-12-30 13:32 - 2017-04-16 18:47 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-12-30 13:32 - 2012-05-07 13:59 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-12-30 13:30 - 2012-06-03 13:23 - 000000000 ____D C:\Users\Gość 2017-12-30 13:30 - 2012-05-07 14:04 - 000000000 ____D C:\Users\admin 2017-12-30 13:28 - 2016-10-02 17:24 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Local\ChomikBox 2017-12-30 13:27 - 2016-10-02 17:25 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\.gstreamer-0.10 2017-12-30 13:19 - 2016-08-26 14:49 - 000000000 ____D C:\FRST 2017-12-30 13:15 - 2009-07-14 05:45 - 000028576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-12-30 13:15 - 2009-07-14 05:45 - 000028576 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-12-30 13:07 - 2016-11-23 19:20 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\LocalLow\Mozilla 2017-12-30 13:06 - 2016-07-25 20:42 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Roaming\Spotify 2017-12-30 13:05 - 2015-10-14 12:46 - 000003984 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{9706B86E-387F-442A-B377-876C486E468C} 2017-12-30 12:16 - 2016-07-25 20:53 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Local\Spotify 2017-12-29 14:28 - 2017-01-18 14:21 - 000000000 ____D C:\ProgramData\Unified Remote 2017-12-26 16:17 - 2012-06-03 13:24 - 000000000 ____D C:\Users\Gość\Documents\Bluetooth Folder 2017-12-25 18:01 - 2012-07-22 17:17 - 000807596 _____ C:\test.xml 2017-12-25 17:51 - 2016-02-05 16:34 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Roaming\uTorrent 2017-12-25 16:53 - 2012-05-12 07:24 - 000000000 ____D C:\Users\admin\AppData\Roaming\Mozilla 2017-12-25 16:52 - 2017-08-27 12:46 - 000105332 _____ C:\bdlog.txt 2017-12-25 16:51 - 2017-08-27 11:16 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bitdefender Security 2017-12-25 16:37 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\system32\NDF 2017-12-17 12:51 - 2016-04-11 11:00 - 000002195 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-12-17 12:51 - 2016-04-11 11:00 - 000002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-12-17 12:41 - 2016-07-28 13:00 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\Desktop\xd 2017-12-13 16:33 - 2013-08-14 16:22 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-12-13 16:33 - 2013-08-14 16:22 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-12-13 16:33 - 2013-08-14 16:22 - 000004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-12-13 16:33 - 2013-08-14 16:22 - 000000000 ____D C:\Windows\system32\Macromed 2017-12-13 16:33 - 2011-09-09 20:37 - 000000000 ____D C:\Windows\SysWOW64\Macromed 2017-12-05 17:23 - 2011-02-14 21:50 - 000741124 _____ C:\Windows\system32\perfh015.dat 2017-12-05 17:23 - 2011-02-14 21:50 - 000156408 _____ C:\Windows\system32\perfc015.dat 2017-12-05 17:23 - 2009-07-14 06:13 - 001672134 _____ C:\Windows\system32\PerfStringBackup.INI 2017-12-05 17:22 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf 2017-12-05 17:17 - 2016-08-09 12:13 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Roaming\GG 2017-12-05 17:11 - 2016-08-09 12:13 - 000000000 ____D C:\Users\Wika.wika-VAIO.001\AppData\Local\GG 2017-12-01 20:53 - 2017-10-11 15:03 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe 2017-12-01 20:53 - 2013-08-10 19:28 - 000000000 ____D C:\Windows\system32\MRT 2017-12-01 20:53 - 2012-05-12 08:40 - 127017032 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe ==================== Pliki w katalogu głównym wybranych folderów ======= 2014-12-07 16:08 - 2014-12-07 16:04 - 011306727 _____ () C:\Program Files\Pou hack (1).apk 2016-03-05 13:34 - 2016-03-05 13:34 - 000030764 _____ () C:\Users\admin\AppData\Roaming\ICSW_1Q1F1S1C1P1E1C1F1N1C1T1H2UtF1E1ItJ1V0P1C1L1R1P0F1F2Y1G2Z1T1L1G.txt Niektóre pliki w TEMP: ==================== 2014-07-16 19:47 - 2014-07-16 19:48 - 000065536 _____ (Sony DADC Austria AG) C:\Users\Gość\AppData\Local\Temp\drm_dialogs.dll 2014-07-16 19:47 - 2014-07-16 19:48 - 000204800 _____ (Sony DADC Austria AG) C:\Users\Gość\AppData\Local\Temp\drm_dyndata_7370007.dll 2017-12-30 12:57 - 2017-12-30 12:59 - 000009728 _____ () C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\bassmod.dll 2017-01-19 18:10 - 2017-01-19 18:10 - 000065536 _____ (Sony DADC Austria AG) C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\drm_dialogs.dll 2017-01-19 18:10 - 2017-01-19 18:10 - 000204800 _____ (Sony DADC Austria AG) C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\drm_dyndata_7370007.dll 2017-08-26 11:43 - 2017-08-26 11:43 - 001542901 _____ ( ) C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\ICReinstall_Minecraft 1.12.1_1062600752.exe 2016-06-17 10:54 - 2016-10-14 15:51 - 004211112 _____ () C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\npp.6.9.2.Installer.exe 2017-07-18 18:51 - 2017-07-18 18:52 - 003051288 _____ () C:\Users\Wika.wika-VAIO.001\AppData\Local\Temp\npp.7.4.2.Installer.exe ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-12-29 15:07 ==================== Koniec FRST.txt ============================