Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01
Ran by jarosław (administrator) on MISIA on 16-01-2015 11:02:45
Running from C:\Users\jarosław\Downloads
Loaded Profiles: jarosław (Available profiles: jarosław)
Platform: Windows 8.1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SynptSync64.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\ProgramData\0fd8dc4b-3fdb-4d7c-a6d4-ff64cff56cc4\maintainer.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9600.16384_x64__8wekyb3d8bbwe\glcnd.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Windows Mobile Device Center] => C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2774256 2013-08-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-16] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5264016 2012-08-16] (VIA)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-29] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKU\S-1-5-21-2397908092-2257794209-2186997661-1001\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2397908092-2257794209-2186997661-1001\...\MountPoints2: {198045df-8a51-11e3-be8f-50465d9a2b44} - "F:\Startme.exe" 
HKU\S-1-5-21-2397908092-2257794209-2186997661-1001\...\MountPoints2: {f479e071-d4e5-11e3-bea1-50465d9a2b44} - "F:\LGAutoRun.exe" 
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-2397908092-2257794209-2186997661-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2397908092-2257794209-2186997661-1001 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2397908092-2257794209-2186997661-1001 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2397908092-2257794209-2186997661-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\jarosław\AppData\Roaming\Mozilla\Firefox\Profiles\v706rk4w.default
FF NewTab: www.google.pl
FF Homepage: https://www.google.pl/
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF user.js: detected! => C:\Users\jarosław\AppData\Roaming\Mozilla\Firefox\Profiles\v706rk4w.default\user.js
FF Extension: NetCrawl 1.0.1 - C:\Users\jarosław\AppData\Roaming\Mozilla\Firefox\Profiles\v706rk4w.default\Extensions\{1f3b225b-960f-4327-bbd9-ee3f7a984d7d}.xpi [2014-11-30]
FF Extension: Adblock Plus - C:\Users\jarosław\AppData\Roaming\Mozilla\Firefox\Profiles\v706rk4w.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-07-07]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [118048 2014-12-04] (Elex do Brasil Participações Ltda)
R2 MaintainerSvc2.04.9173792; C:\ProgramData\0fd8dc4b-3fdb-4d7c-a6d4-ff64cff56cc4\maintainer.exe [123680 2015-01-16] ()
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2013-10-17] () [File not signed]
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-14] (VIA Technologies, Inc.)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-24] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-24] (Microsoft Corporation)
S2 Update NetCrawl; "C:\Program Files (x86)\NetCrawl\updateNetCrawl.exe" [X]
S2 Util NetCrawl; "C:\Program Files (x86)\NetCrawl\bin\utilNetCrawl.exe" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices)
S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [249000 2014-12-04] (Elex do Brasil Participações Ltda)
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [45224 2014-12-04] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [99496 2014-12-04] (Elex do Brasil Participações Ltda)
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [65704 2014-12-04] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [49320 2014-11-03] (Elex do Brasil Participações Ltda)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-24] (Microsoft Corporation)
R1 {127a069d-96fc-463f-b75f-e01a70166822}w64; C:\Windows\System32\drivers\{127a069d-96fc-463f-b75f-e01a70166822}w64.sys [48832 2014-11-29] (StdLib)
R1 {1de0dec0-675e-482f-a756-fd24c6796c8e}w64; C:\Windows\System32\drivers\{1de0dec0-675e-482f-a756-fd24c6796c8e}w64.sys [48832 2014-12-01] (StdLib)
R1 {38fc16c9-a7b4-4377-b565-cc5a76f2c89f}w64; C:\Windows\System32\drivers\{38fc16c9-a7b4-4377-b565-cc5a76f2c89f}w64.sys [48824 2014-10-11] (StdLib)
R1 {3c9eada7-386c-4a04-ab1e-4eb122397ced}w64; C:\Windows\System32\drivers\{3c9eada7-386c-4a04-ab1e-4eb122397ced}w64.sys [48824 2014-10-20] (StdLib)
R1 {44b76908-31ad-4fdd-90ce-abbdbb78f175}w64; C:\Windows\System32\drivers\{44b76908-31ad-4fdd-90ce-abbdbb78f175}w64.sys [48824 2014-10-15] (StdLib)
R1 {45df5bc0-27fc-482b-88e9-68b0812c4d00}w64; C:\Windows\System32\drivers\{45df5bc0-27fc-482b-88e9-68b0812c4d00}w64.sys [48824 2014-10-11] (StdLib)
R1 {58ff284e-6a3e-41bc-8147-d768e1c0e4a3}w64; C:\Windows\System32\drivers\{58ff284e-6a3e-41bc-8147-d768e1c0e4a3}w64.sys [48824 2014-10-21] (StdLib)
R1 {6191cc23-5db4-4079-aaac-546c45b08af1}w64; C:\Windows\System32\drivers\{6191cc23-5db4-4079-aaac-546c45b08af1}w64.sys [48824 2014-10-27] (StdLib)
R1 {6fcd6092-9615-4f7f-8898-8df53980e5d2}w64; C:\Windows\System32\drivers\{6fcd6092-9615-4f7f-8898-8df53980e5d2}w64.sys [61624 2014-08-06] (StdLib)
R1 {6fd9ae77-e80c-4df0-b53d-23fcb52b001a}w64; C:\Windows\System32\drivers\{6fd9ae77-e80c-4df0-b53d-23fcb52b001a}w64.sys [48824 2014-10-21] (StdLib)
R1 {75d07d19-b619-45eb-aba7-fd8d77feb6b6}w64; C:\Windows\System32\drivers\{75d07d19-b619-45eb-aba7-fd8d77feb6b6}w64.sys [48824 2014-10-13] (StdLib)
R1 {8c345751-8420-408b-b348-58a70dc555b2}w64; C:\Windows\System32\drivers\{8c345751-8420-408b-b348-58a70dc555b2}w64.sys [48824 2014-10-18] (StdLib)
R1 {9a9b956a-1677-4d20-830c-6c34a0594e62}w64; C:\Windows\System32\drivers\{9a9b956a-1677-4d20-830c-6c34a0594e62}w64.sys [48832 2014-11-30] (StdLib)
R1 {9cdb10b4-16db-41f0-b75d-2e3cfff0fbde}w64; C:\Windows\System32\drivers\{9cdb10b4-16db-41f0-b75d-2e3cfff0fbde}w64.sys [48824 2014-10-17] (StdLib)
R1 {a00759f4-8f6e-4f04-880d-18a7306588c3}w64; C:\Windows\System32\drivers\{a00759f4-8f6e-4f04-880d-18a7306588c3}w64.sys [48824 2014-10-13] (StdLib)
R1 {b7f87806-4a32-46e7-ad9b-12f73fb810a9}w64; C:\Windows\System32\drivers\{b7f87806-4a32-46e7-ad9b-12f73fb810a9}w64.sys [48832 2014-11-29] (StdLib)
R1 {cb987b80-b481-4623-9e86-1b830e33479a}w64; C:\Windows\System32\drivers\{cb987b80-b481-4623-9e86-1b830e33479a}w64.sys [48832 2014-11-26] (StdLib)
R1 {eb00a2af-f43a-4114-8049-3fd98517b465}w64; C:\Windows\System32\drivers\{eb00a2af-f43a-4114-8049-3fd98517b465}w64.sys [48824 2014-10-14] (StdLib)
R1 {f916f162-d4e9-413b-95d2-589769dc98ff}w64; C:\Windows\System32\drivers\{f916f162-d4e9-413b-95d2-589769dc98ff}w64.sys [48824 2014-10-15] (StdLib)
R1 {fe0c5df8-6353-4020-a876-2550aa3760cf}w64; C:\Windows\System32\drivers\{fe0c5df8-6353-4020-a876-2550aa3760cf}w64.sys [48824 2014-10-19] (StdLib)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 11:02 - 2015-01-16 11:03 - 00014082 _____ () C:\Users\jarosław\Downloads\FRST.txt
2015-01-16 11:01 - 2015-01-16 11:02 - 00000000 ____D () C:\FRST
2015-01-16 11:01 - 2015-01-16 11:01 - 02125312 _____ (Farbar) C:\Users\jarosław\Downloads\FRST64.exe
2015-01-16 10:36 - 2015-01-16 10:37 - 00000000 ____D () C:\Users\jarosław\Desktop\Raport
2015-01-13 11:13 - 2015-01-13 16:50 - 00075229 _____ () C:\Users\jarosław\Desktop\urlopy.xlsx
2015-01-10 15:10 - 2015-01-10 15:10 - 00009998 _____ () C:\WINDOWS\PFRO.log
2015-01-02 18:58 - 2015-01-15 20:39 - 01846885 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-02 16:05 - 2015-01-02 16:05 - 00000000 ____D () C:\Users\jarosław\Desktop\Jasełka 6 latki
2015-01-02 16:03 - 2015-01-02 16:03 - 00000786 _____ () C:\WINDOWS\setupact.log
2015-01-02 16:03 - 2015-01-02 16:03 - 00000000 _____ () C:\WINDOWS\setuperr.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-16 11:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-16 09:06 - 2014-10-31 18:36 - 00000000 ____D () C:\ProgramData\0fd8dc4b-3fdb-4d7c-a6d4-ff64cff56cc4
2015-01-16 07:26 - 2014-01-09 17:54 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2397908092-2257794209-2186997661-1001
2015-01-16 07:21 - 2014-05-02 20:35 - 00000000 ___RD () C:\Users\jarosław\OneDrive
2015-01-15 18:58 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-14 16:32 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-14 16:31 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-12 17:25 - 2014-05-11 06:39 - 00000000 ____D () C:\Users\jarosław\Desktop\ZDJĘCIA FILMY KAMERA
2015-01-02 16:05 - 2013-11-14 08:33 - 01825074 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-02 16:05 - 2013-11-14 08:13 - 00807160 _____ () C:\WINDOWS\system32\perfh015.dat
2015-01-02 16:05 - 2013-11-14 08:13 - 00163478 _____ () C:\WINDOWS\system32\perfc015.dat
2015-01-01 18:36 - 2012-07-26 06:26 - 00000301 _____ () C:\WINDOWS\win.ini
2014-12-31 12:14 - 2014-01-31 09:22 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2014-12-18 06:38 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\NDF

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-14 13:44

==================== End Of Log ============================