Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja: 20.12.2018
Uruchomiony przez Radek (administrator)  RADEK-PC (22-12-2018 14:35:21)
Uruchomiony z C:\Users\Radek\Downloads
Załadowane profile: Radek (Dostępne profile: Radek)
Platform: Microsoft® Windows Vista™ Home Basic  Service Pack 2 (X86) Język: Polski (Polska)
Internet Explorer Wersja 9 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\AsLdrSrv.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe
(WinZip Computing, S.L.) C:\Program Files\WinZip\WZQKPICK32.EXE
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
(Foxit Software Inc.) C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
() C:\ProgramData\DatacardService\HWDeviceService.exe
() C:\Windows\System32\srvany.exe
() C:\Windows\KMService.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\HControl.exe
() C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\w32x86\3\NetFaxServer.exe
() C:\Windows\System32\spdsvc.exe
() C:\Windows\System32\SecUPDUtilSvc.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.33.23\GoogleCrashHandler.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files\ASUS\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Windows\System32\sdclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe

==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

"Path" (C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\ProgramData\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\VDownloader;D:\pulpit_2\VDownloader;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\ -> %SystemRoot%\System32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\NVIDIA Corporation\PhysX\Common;C:\ProgramData\Oracle\Java\javapath;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SystemRoot%\System32\Wbem;C:\Program Files\VDownloader;D:\pulpit_2\VDownloader;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\) <==== Repaired successfully
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation)
HKLM\...\Run: [HControlUser] => C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM\...\Run: [ConvertAd] => C:\Users\Radek\AppData\Local\ConvertAd\ConvertAd.exe
HKLM\...\Run: [AnyProtect Tray] => C:\Program Files\AnyProtectEx\AnyProtectTray.exe /scanner
HKLM\...\Run: [AnyProtect] => C:\Program Files\AnyProtectEx\AnyProtect.exe
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5089480 2015-07-08] (ESET)
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2006-11-02] (Microsoft Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2016-12-12] (Oracle Corporation)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [351968 2014-09-08] ()
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [GG] => "C:\Users\Radek\AppData\Local\GG\Application\gghub.exe"
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Radek\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [iLivid] => "C:\Users\Radek\AppData\Local\iLivid\iLivid.exe" -autorun
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6369048 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [STUISpeedLauncher] => C:\Program Files\Samsung\Stylish UI Pack\TouchBasedUI.exe [382976 2015-02-09] ()
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\Run: [CW] => [X]
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {6f4aca92-4250-11e3-a3ce-002618731b79} - G:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {91ff8161-42f0-11e3-8fca-002618731b79} - G:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {91ff816a-42f0-11e3-8fca-002618731b79} - G:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {bb81077a-a95f-11e4-8143-002618731b79} - F:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {dbcb1c09-31cd-11e3-8c30-002618731b79} - F:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {dbcb1c59-31cd-11e3-8c30-002618731b79} - G:\AutoRun.exe
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\...\MountPoints2: {dd709bdf-31ee-11e3-a785-002618731b79} - G:\AutoRun.exe
HKLM\...\Drivers32: [MSVideo8] => C:\Windows\System32\VfWWDM32.dll [56832 2008-01-18] (Microsoft Corporation)
HKLM\...\AppCertDlls: [x64] -> c:\program files\movies app\datamngr\x64\apcrtldr.dll <==== UWAGA
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk [2017-01-27]
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\NetFaxTray.exe (Samsung Electronics Co., Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WinZip Quick Pick.lnk [2013-10-18]
ShortcutTarget: WinZip Quick Pick.lnk -> C:\Program Files\WinZip\WZQKPICK32.EXE (WinZip Computing, S.L.)
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA
CHR HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 31.11.202.254 37.8.214.2
Tcpip\..\Interfaces\{AE575A4F-944D-4F6B-AD1E-1B85422D8C90}: [DhcpNameServer] 31.11.202.254 37.8.214.2

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://search.gboxapp.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-1623296816-2050834499-3398072067-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://search.gboxapp.com/
SearchScopes: HKLM -> DefaultScope - brak wartości
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1478&systemid=406&v=a14976-557&apn_uid=3075051958554133&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1623296816-2050834499-3398072067-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=1478&systemid=406&v=a14976-557&apn_uid=3075051958554133&apn_dtid=BND406&o=APN10645&apn_ptnrs=AG6&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_121\bin\ssv.dll [2017-01-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-01-26] (Oracle Corporation)
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

FireFox:
========
FF ProfilePath: C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default [2018-12-22]
FF Homepage: Mozilla\Firefox\Profiles\fyrtjylw.default -> hxxp://www.google.pl/
FF NetworkProxy: Mozilla\Firefox\Profiles\fyrtjylw.default -> type", 4
FF Extension: (Polski słownik poprawnej pisowni) - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default\Extensions\pl@dictionaries.addons.mozilla.org [2017-07-09] [Przestarzałe]
FF Extension: (Movies Search App (Dist. by Bandoo Media, Inc.)) - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default\Extensions\{c0caa5fe-7c9c-4dca-a265-63cf55379d1a} [2014-12-11] [Przestarzałe] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default\searchplugins\Ask.xml [2014-12-16]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: (Microsoft .NET Framework Assistant) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-10-29] [Przestarzałe] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [support@vdownloader.com] - D:\pulpit_2\VDownloader\Addons\FireFox
FF Extension: (VDownloader) - D:\pulpit_2\VDownloader\Addons\FireFox [2013-10-18] [Przestarzałe] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default\extensions\faststartff@gmail.com => nie znaleziono
FF HKLM\...\Firefox\Extensions: [shortcutff@gmail.com] - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\fyrtjylw.default\extensions\shortcutff@gmail.com => nie znaleziono
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_32_0_0_101.dll [2018-12-05] ()
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2013-07-03] (Foxit Corporation)
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @nullsoft.com/winampDetector;version=1 -> C:\Program Files\Winamp Detect\npwachk.dll [2013-07-23] (Nullsoft, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.23\npGoogleUpdate3.dll [2018-12-19] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1623296816-2050834499-3398072067-1000: vitzo.com/VDownloader -> D:\pulpit_2\VDownloader\Addons\npVDownloader.dll [2011-08-18] (Vitzo)

Chrome: 
=======
CHR Profile: C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default [2018-12-22]
CHR Extension: (Prezentacje) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-20]
CHR Extension: (Dokumenty) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-20]
CHR Extension: (Dysk Google) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-10-17]
CHR Extension: (YouTube) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-28]
CHR Extension: (Google Search) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-01]
CHR Extension: (Arkusze) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-20]
CHR Extension: (Dokumenty Google offline) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-08-24]
CHR Extension: (DBase for YouTube) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\goiphmnklmimloihgcngnmckkmhfmlno [2017-12-27]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-04-03]
CHR Extension: (Gmail) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-08-27]
CHR HKLM\...\Chrome\Extension: [eoccbpoodnckjdnackiffhjfkogfhnhh] - D:\pulpit_2\VDownloader\Addons\Chrome.crx [2013-10-18]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 AdobeFlashPlayerUpdateSvc; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [335872 2018-12-05] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
R2 ASLDRService; C:\Program Files\ASUS\ATK Hotkey\ASLDRSrv.exe [84536 2009-06-15] (ASUS)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1353720 2015-07-08] (ESET)
R2 FoxitCloudUpdateService; C:\Program Files\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [243880 2015-01-16] (Foxit Software Inc.)
R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
R2 KMService; C:\Windows\system32\srvany.exe [8192 2013-10-30] () [Brak podpisu cyfrowego]
S2 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [655744 2012-09-22] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2008-07-18] (Hewlett-Packard) [Brak podpisu cyfrowego]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-07-18] (Hewlett-Packard) [Brak podpisu cyfrowego]
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [463040 2015-03-13] (Samsung Electronics Co., Ltd.)
R2 Samsung Printer Dianostics Service; C:\Windows\system32\\spdsvc.exe [506680 2017-01-19] ()
R2 SamsungUPDUtilSvc; C:\Windows\system32\SecUPDUtilSvc.exe [143664 2017-07-02] ()

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [202704 2015-07-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [144536 2015-07-14] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [132152 2015-07-14] (ESET)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [21960 2018-01-16] ()
R0 EPMVolFlt; C:\Windows\System32\drivers\EPMVolFlt.sys [17992 2018-07-20] (Windows (R) Codename Longhorn DDK provider)
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [10208 2016-07-11] () [Brak podpisu cyfrowego]
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [96000 2012-08-20] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [69760 2012-08-20] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-08-20] (Huawei Technologies Co., Ltd.)
R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [48640 2009-08-05] (Atheros Communications, Inc.)
R3 MTsensor; C:\Windows\System32\DRIVERS\ATKACPI.sys [7680 2007-07-31] (ATK0100)
R2 npf; C:\Windows\System32\drivers\npf.sys [50704 2010-01-27] (CACE Technologies, Inc.)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2015-12-30] (Samsung Electronics) [Brak podpisu cyfrowego]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [249472 2012-04-20] (Huawei Technologies Co., Ltd.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-12-22 14:35 - 2018-12-22 14:36 - 000019925 _____ C:\Users\Radek\Downloads\FRST.txt
2018-12-22 14:34 - 2018-12-22 14:35 - 000000000 ____D C:\FRST
2018-12-22 14:33 - 2018-12-22 14:34 - 001778176 _____ (Farbar) C:\Users\Radek\Downloads\FRST.exe
2018-12-19 11:30 - 2018-12-19 11:30 - 000031678 _____ C:\Users\Radek\Downloads\bilet_7176522547293.pdf
2018-12-06 21:24 - 2018-12-06 21:24 - 000000000 ____D C:\Users\Radek\AppData\Local\Microsoft Corporation
2018-12-06 21:22 - 2018-12-06 21:22 - 000001956 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Doradca uaktualnienia systemu Windows 7.lnk
2018-12-06 21:22 - 2018-12-06 21:22 - 000001944 _____ C:\Users\Public\Desktop\Doradca uaktualnienia systemu Windows 7.lnk
2018-12-06 21:22 - 2018-12-06 21:22 - 000000000 ____D C:\Program Files\Microsoft Windows 7 Upgrade Advisor
2018-12-06 17:23 - 2018-12-06 17:23 - 000250288 _____ C:\Users\Radek\Downloads\KID MaxiKapital 20181201.pdf
2018-12-06 17:23 - 2018-12-06 17:23 - 000250288 _____ C:\Users\Radek\Downloads\KID MaxiKapital 20181201 (1).pdf

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2018-12-22 12:52 - 2013-10-10 21:55 - 000065536 _____ C:\Windows\system32\Ikeext.etl
2018-12-22 12:52 - 2006-11-02 13:58 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-12-22 12:52 - 2006-11-02 13:45 - 000004048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2018-12-22 12:52 - 2006-11-02 13:45 - 000004048 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2018-12-21 19:55 - 2006-11-02 13:58 - 000032530 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-12-19 14:50 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\tracing
2018-12-17 23:12 - 2013-08-26 16:29 - 000000000 ____D C:\Users\Radek
2018-12-14 12:42 - 2013-08-28 10:32 - 000000000 ____D C:\Users\Radek\AppData\Local\GG
2018-12-14 12:41 - 2013-08-28 10:32 - 000000000 ____D C:\Users\Radek\AppData\Roaming\GG
2018-12-06 17:39 - 2006-12-05 06:19 - 000731256 _____ C:\Windows\system32\perfh015.dat
2018-12-06 17:39 - 2006-12-05 06:19 - 000160008 _____ C:\Windows\system32\perfc015.dat
2018-12-06 17:39 - 2006-11-02 12:18 - 000000000 ____D C:\Windows\inf
2018-12-06 17:39 - 2006-11-02 11:33 - 001662468 _____ C:\Windows\system32\PerfStringBackup.INI
2018-12-05 13:22 - 2013-08-26 18:08 - 000842240 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2018-12-05 13:22 - 2013-08-26 18:08 - 000175104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2018-12-05 13:22 - 2013-08-26 18:08 - 000000000 ____D C:\Windows\system32\Macromed
2018-12-02 03:02 - 2015-03-10 09:29 - 000000000 ____D C:\Users\Radek\Documents\Pliki programu Outlook

==================== Pliki w katalogu głównym wybranych folderów =======

2015-05-30 08:57 - 2015-05-30 08:57 - 000000079 _____ () C:\Program Files\prefs.js
2013-10-18 17:05 - 2010-01-26 09:11 - 000444283 _____ () C:\Program Files\Common Files\WinPcapNmap.exe
2015-05-28 21:22 - 2015-08-27 08:57 - 000000024 _____ () C:\Users\Radek\AppData\Roaming\appdataFr25.bin
2013-08-26 16:29 - 2013-09-29 19:29 - 000000680 _____ () C:\Users\Radek\AppData\Local\d3d9caps.dat
2013-08-28 20:13 - 2013-09-12 19:06 - 000016896 _____ () C:\Users\Radek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-07 06:03 - 2013-09-07 06:03 - 000833992 _____ (AnyProtect.com) C:\Users\Radek\AppData\Local\nsn363F.tmp.exe
2015-05-24 11:55 - 2015-05-24 11:55 - 000000000 _____ () C:\Users\Radek\AppData\Local\Temp.dat

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2018-12-22 12:59

==================== Koniec  FRST.txt ============================