Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-11-2014
Ran by Szkola (administrator) on SZKOLA-KOMPUTER on 25-11-2014 10:26:18
Running from C:\Users\Szkola\Downloads
Loaded Profile: Szkola (Available profiles: Szkola)
Platform: Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: Polski (Polska)
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Users\Szkola\AppData\Local\winlogon.exe
() C:\Users\Szkola\AppData\Local\services.exe
() C:\Users\Szkola\AppData\Local\lsass.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Bron-Spizaetus] => C:\Windows\ShellNew\bronstab.exe [47697 2010-08-13] ()
HKLM\...\Winlogon: [Shell] Explorer.exe "C:\Windows\eksplorasi.exe" [x ] ()
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\...\Run: [Tok-Cirrhatus] => C:\Users\Szkola\AppData\Local\smss.exe [47697 2010-08-13] ()
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\...\Policies\system: [DisableRegistryTools] 1
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\...\Policies\system: [DisableCMD] 0
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\...\Policies\Explorer: [NoFolderOptions] 1
Startup: C:\Users\Szkola\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Empty.pif ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2181966677-460633389-2470704602-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13-comm.msn.com
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://dell13-comm.msn.com
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8AF3EA6A8108D001
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
HKU\S-1-5-21-2181966677-460633389-2470704602-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = pl-PL
SearchScopes: HKLM -> DefaultScope {38C8F117-18A0-4921-8814-69158DBC5A52} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDRJS
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {38C8F117-18A0-4921-8814-69158DBC5A52} URL = http://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MDDRJS
SearchScopes: HKU\S-1-5-21-2181966677-460633389-2470704602-1000 -> DefaultScope {B224AA02-F7C8-3A2B-859F-560B80767E4A} URL = http://kl.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=876&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.5.0&install_country=PL&install_date=20130410&user_guid=F8119AAAEE254BDB8BCF5A34C9BA0A4D&machine_id=d33ffeb22ac337a48bdb644c92cb162a&browser=IE&os=win&os_version=6.1-x86-SP1&iesrc={referrer:source}
SearchScopes: HKU\S-1-5-21-2181966677-460633389-2470704602-1000 -> {B224AA02-F7C8-3A2B-859F-560B80767E4A} URL = http://kl.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=876&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.5.0&install_country=PL&install_date=20130410&user_guid=F8119AAAEE254BDB8BCF5A34C9BA0A4D&machine_id=d33ffeb22ac337a48bdb644c92cb162a&browser=IE&os=win&os_version=6.1-x86-SP1&iesrc={referrer:source}
BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 194.204.159.1 194.204.152.34

FireFox:
========
FF ProfilePath: C:\Users\Szkola\AppData\Roaming\Mozilla\Firefox\Profiles\wx5layx4.default-1409560700453
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.65\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.65\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.65\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Profile: C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-13]
CHR Extension: (Dysk Google) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-13]
CHR Extension: (YouTube) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-13]
CHR Extension: (Szukaj w Google) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-13]
CHR Extension: (Google Wallet) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-13]
CHR Extension: (Gmail) - C:\Users\Szkola\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-13]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [276248 2012-02-08] (Intel Corporation)
S2 Intel(R) Capability Licensing Service Interface; c:\Program Files\Intel\iCLS Client\HeciServer.exe [458464 2012-02-02] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-29] (Intel Corporation)
S2 SAService; C:\Windows\system32\SAsrv.exe [446592 2010-11-19] (Conexant Systems, Inc.)
S2 WebCake Desktop Updater; C:\Program Files\WBDesktop.Updater.1.0.0.16.exe [51992 2013-08-29] (cake bake)
S2 Updater Service for StartNow Toolbar; C:\Program Files\StartNow Toolbar\ToolbarUpdaterService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [46080 2011-11-10] (Intel Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-25 10:26 - 2014-11-25 10:26 - 00010206 _____ () C:\Users\Szkola\Downloads\FRST.txt
2014-11-25 10:25 - 2014-11-25 10:26 - 00000000 ____D () C:\FRST
2014-11-25 10:25 - 2014-11-25 10:25 - 01110016 _____ (Farbar) C:\Users\Szkola\Downloads\FRST.exe
2014-11-25 10:24 - 2014-11-25 10:24 - 00027496 _____ () C:\Users\Szkola\AppData\Local\Update.10.Bron.Tok.bin
2014-11-25 09:52 - 2014-11-25 10:18 - 00019988 _____ () C:\Users\Szkola\Desktop\gmer.txt
2014-11-25 09:43 - 2014-11-25 09:44 - 00009017 _____ () C:\Users\Szkola\Desktop\gmer.log
2014-11-25 09:43 - 2014-11-25 09:43 - 00027496 _____ () C:\Users\Szkola\AppData\Local\Bron.tok.A10.em.bin
2014-11-25 09:35 - 2014-11-25 09:35 - 00380416 _____ () C:\Users\Szkola\Downloads\j2663huy.exe
2014-11-25 09:31 - 2014-11-25 09:31 - 00060536 _____ () C:\Users\Szkola\Downloads\OTL (1).Txt
2014-11-25 09:23 - 2014-11-25 09:24 - 02118144 _____ (Farbar) C:\Users\Szkola\Downloads\FRST64.exe
2014-11-25 09:23 - 2014-11-25 09:24 - 00380416 _____ () C:\Users\Szkola\Downloads\pjmmddow.exe
2014-11-25 09:21 - 2014-11-25 09:24 - 12299649 _____ () C:\Users\Szkola\Downloads\Niepotwierdzony 693705.crdownload
2014-11-25 09:13 - 2014-11-25 09:14 - 00000000 ____D () C:\32788R22FWJFW
2014-11-25 09:13 - 2014-11-25 09:13 - 00000000 ____D () C:\Windows\erdnt
2014-11-25 09:12 - 2014-11-25 09:13 - 05598874 ____R (Swearware) C:\Users\Szkola\Downloads\ComboFix.exe
2014-11-25 09:10 - 2014-11-25 09:10 - 00000000 ____D () C:\_OTL
2014-11-25 09:09 - 2014-11-25 09:09 - 00060536 _____ () C:\Users\Szkola\Desktop\OTL.Txt
2014-11-25 09:08 - 2014-11-25 09:08 - 00038676 _____ () C:\Users\Szkola\Desktop\Extras.Txt
2014-11-25 09:06 - 2014-11-25 09:07 - 00000000 ____D () C:\AdwCleaner
2014-11-25 09:05 - 2014-11-25 09:06 - 02140160 _____ () C:\Users\Szkola\Downloads\AdwCleaner_4.exe
2014-11-25 09:02 - 2014-11-25 09:08 - 00060536 _____ () C:\Users\Szkola\Downloads\OTL.Txt
2014-11-25 09:02 - 2014-11-25 09:08 - 00038676 _____ () C:\Users\Szkola\Downloads\Extras.Txt
2014-11-25 08:57 - 2014-11-25 08:57 - 00602112 _____ (OldTimer Tools) C:\Users\Szkola\Downloads\OTL.exe
2014-11-25 08:48 - 2014-11-25 08:48 - 00000226 _____ () C:\Users\Szkola\Desktop\sdffsdf.bat
2014-11-25 08:44 - 2014-11-25 08:47 - 00000226 _____ () C:\Users\Szkola\Desktop\sdfsdf.txt
2014-11-25 08:31 - 2014-11-25 08:31 - 00208288 _____ (Tagès SA) C:\Users\Szkola\Downloads\TagesSetup.exe
2014-11-25 08:24 - 2014-11-25 08:24 - 00000000 ____D () C:\Windows\pss
2014-11-25 07:51 - 2014-11-25 07:51 - 00000000 ____D () C:\Users\Szkola\AppData\Local\Bron.tok-10-25
2014-11-24 08:00 - 2014-11-25 09:48 - 00000000 ____D () C:\Users\Szkola\AppData\Local\Loc.Mail.Bron.Tok
2014-11-24 08:00 - 2014-11-24 08:00 - 00000051 _____ () C:\Users\Szkola\AppData\Local\Kosong.Bron.Tok.txt
2014-11-24 07:59 - 2014-11-24 07:59 - 00000000 ____D () C:\Users\Szkola\AppData\Local\Ok-SendMail-Bron-tok
2014-11-24 07:54 - 2014-11-24 07:54 - 00027509 _____ () C:\Users\Szkola\AppData\Local\ListHost10.txt
2014-11-24 07:54 - 2014-11-24 07:54 - 00000000 ____D () C:\Users\Szkola\AppData\Local\Bron.tok-10-24
2014-11-12 09:17 - 2014-11-12 09:17 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-11-03 09:01 - 2014-11-03 09:01 - 00001046 _____ () C:\Users\Szkola\Desktop\Attack on Pearl Harbor.lnk
2014-11-03 09:01 - 2014-11-03 09:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Attack on Pearl Harbor
2014-11-03 09:00 - 2014-11-03 09:02 - 00000000 ____D () C:\Program Files\Attack on Pearl Harbor

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-25 10:23 - 2009-07-14 03:04 - 00000007 ___SH () C:\autoexec.bat
2014-11-25 09:38 - 2010-11-21 03:32 - 04212256 _____ () C:\Windows\system32\perfh015.dat
2014-11-25 09:38 - 2010-11-21 03:32 - 01332104 _____ () C:\Windows\system32\perfc015.dat
2014-11-25 09:38 - 2010-11-20 22:01 - 00006436 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-25 09:32 - 2012-11-21 16:22 - 01359591 _____ () C:\Windows\WindowsUpdate.log
2014-11-25 09:32 - 2009-07-14 05:34 - 00021312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-25 09:32 - 2009-07-14 05:34 - 00021312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-25 09:27 - 2013-09-13 09:51 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-25 09:27 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-25 09:27 - 2009-07-14 05:39 - 00051311 _____ () C:\Windows\setupact.log
2014-11-25 09:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\LogFiles
2014-11-25 08:59 - 2012-11-21 16:24 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-25 08:56 - 2010-11-20 22:48 - 00094552 _____ () C:\Windows\PFRO.log
2014-11-25 08:42 - 2013-09-13 09:51 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-25 08:33 - 2014-05-05 09:03 - 00000000 ____D () C:\Users\Szkola\AppData\Roaming\Systweak
2014-11-24 08:45 - 2013-09-13 09:52 - 00002137 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-24 07:54 - 2012-11-22 01:04 - 00000000 ____D () C:\Windows\ShellNew
2014-11-24 07:47 - 2014-03-03 10:14 - 00000000 ____D () C:\Program Files\Steam
2014-11-20 07:50 - 2012-11-21 16:39 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-11-19 09:45 - 2012-11-21 16:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-11-14 07:53 - 2013-04-10 10:57 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-11-12 07:59 - 2012-11-21 16:24 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-11-12 07:59 - 2012-11-21 16:24 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-11-10 12:23 - 2013-06-06 10:20 - 00014207 _____ () C:\Users\Szkola\Desktop\tabela sieciowa.ods
2014-10-31 10:28 - 2013-12-02 10:32 - 00000000 ____D () C:\Users\Szkola\AppData\Local\Wings of Prey
2014-10-30 09:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\NDF

Some content of TEMP:
====================
C:\Users\Szkola\AppData\Local\Temp\Quarantine.exe
C:\Users\Szkola\AppData\Local\Temp\sqlite3.dll
C:\Users\Szkola\AppData\Local\Temp\yupdate0.7.29.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-17 08:22

==================== End Of Log ============================