Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:09-12-2015
Uruchomiony przez Aga (administrator)  LENOVO (11-12-2015 12:22:33)
Uruchomiony z C:\Users\Aga\Downloads
Załadowane profile: Aga (Dostępne profile: Aga)
Platform: Windows 8 (X64) Język: Polski (Polska)
Internet Explorer Wersja 10 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(TFuns LIMITED) C:\ProgramData\5WdM5\WdMan.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avast Software s.r.o.) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6339656 2013-04-10] (Realtek semiconductor)
HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2876816 2013-03-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [900704 2013-03-15] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17097200 2013-09-20] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2013-09-20] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [168464 2012-10-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5512912 2015-04-18] (Avast Software s.r.o.)
Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\...\MountPoints2: {1d9300f7-8ac7-11e3-be7a-0cd29269a81a} - "I:\SETUP.EXE" 
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2015-04-18] (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} =>  Brak pliku
ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} =>  Brak pliku
ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} =>  Brak pliku
ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} =>  Brak pliku
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{C4355A80-B496-416B-A330-66D92A0A0F5E}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516&q={searchTerms}
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516&q={searchTerms}
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
HKU\S-1-5-21-230584855-1871568997-2477479041-1001\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2015-04-18] (Avast Software s.r.o.)
BHO: Brak nazwy -> {a67b4363-a3cb-4d4b-8096-15e591237473} -> Brak pliku
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-04-18] (Avast Software s.r.o.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
Toolbar: HKLM - Brak nazwy - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Brak pliku

FireFox:
========
FF ProfilePath: C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\utcawqvy.default-1449827298530
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-10] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-11-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-11-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.0.61118.0\npctrl.dll [2011-11-17] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> F:\Programy\adobe\Reader\AIR\nppdf32.dll [2013-09-05] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-11]
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449649350&z=f0df68a003f99d2b693cad6g3z9zbt5q8z6t8c1cae&from=ient07021&uid=ST1000LM024XHN-M101MBB_S2SMJ9FD905516

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-18]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [343336 2015-04-18] (Avast Software s.r.o.)
R2 ETDService; C:\Program Files\Elantech\ETDService.exe [92160 2013-02-25] (ELAN Microelectronics Corp.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [161736 2013-04-15] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-11-06] (Intel Corporation)
S2 KMService; C:\WINDOWS\SysWOW64\srvany.exe [8192 2014-01-31] () [Brak podpisu cyfrowego]
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1674720 2013-09-25] ()
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] ()
R2 WdMan; C:\ProgramData\5WdM5\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-18] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-18] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-18] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-18] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-18] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-18] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-18] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-18] ()
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-03-25] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1366328 2013-03-28] (Motorola Solutions, Inc.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3265256 2012-09-20] (Broadcom Corporation)
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3341792 2013-04-25] (Intel Corporation)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8243272 2013-04-10] (Realtek Semiconductor Corp.)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [35856 2014-03-28] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [269592 2014-03-23] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
R4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
U3 fxtoapog; \??\C:\Users\Aga\AppData\Local\Temp\fxtoapog.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-11 12:17 - 2015-12-11 12:17 - 00391793 _____ C:\Users\Aga\Desktop\GMER.txt
2015-12-11 12:07 - 2015-12-11 12:07 - 00050477 _____ C:\Users\Aga\Downloads\Defogger.exe
2015-12-11 12:07 - 2015-12-11 12:07 - 00050477 _____ C:\Users\Aga\Downloads\Defogger(1).exe
2015-12-11 11:56 - 2015-12-11 11:56 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Aga\Downloads\SPTDinst-v187-x64(1).exe
2015-12-11 11:40 - 2015-12-11 11:40 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Aga\Downloads\SPTDinst-v187-x64.exe
2015-12-11 11:31 - 2015-12-11 11:31 - 00380416 _____ C:\Users\Aga\Downloads\v5cdjk4o.exe
2015-12-11 11:30 - 2015-12-11 11:30 - 00031924 _____ C:\Users\Aga\Desktop\Addition.txt
2015-12-11 11:30 - 2015-12-11 11:30 - 00024795 _____ C:\Users\Aga\Desktop\FRST.txt
2015-12-11 11:29 - 2015-12-11 11:30 - 00031924 _____ C:\Users\Aga\Downloads\Addition.txt
2015-12-11 11:27 - 2015-12-11 12:22 - 00016503 _____ C:\Users\Aga\Downloads\FRST.txt
2015-12-11 11:27 - 2015-12-11 12:22 - 00000000 ____D C:\FRST
2015-12-11 11:27 - 2015-12-11 11:27 - 02369024 _____ (Farbar) C:\Users\Aga\Downloads\FRST64.exe
2015-12-11 10:58 - 2015-12-11 10:58 - 00003220 _____ C:\WINDOWS\System32\Tasks\GridinSoft Anti-Malware
2015-12-11 10:57 - 2015-12-11 11:45 - 00000000 ____D C:\Program Files\GridinSoft Anti-Malware
2015-12-11 10:57 - 2015-12-11 10:57 - 00000000 ____D C:\ProgramData\GridinSoft
2015-12-11 10:54 - 2015-12-11 10:54 - 01104336 _____ C:\Users\Aga\Downloads\gsamNL.exe
2015-12-11 10:48 - 2015-12-11 10:48 - 00000000 ____D C:\Users\Aga\Desktop\Stare dane programu Firefox
2015-12-11 10:14 - 2015-12-11 10:14 - 00003694 _____ C:\WINDOWS\System32\Tasks\Adobe Reader and Acrobat Manager
2015-12-11 10:02 - 2015-12-11 10:34 - 00000000 ____D C:\Program Files (x86)\AVG
2015-12-11 10:01 - 2015-12-11 10:34 - 00000000 ____D C:\Users\Aga\AppData\Local\AvgSetupLog
2015-12-11 10:01 - 2015-12-11 10:04 - 00000000 ____D C:\Users\Aga\AppData\Local\Avg
2015-12-11 10:01 - 2015-12-11 10:01 - 02970424 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Aga\Downloads\AVG_PCTuneUp_704.exe
2015-12-09 11:40 - 2015-12-09 11:42 - 00229966 _____ C:\TDSSKiller.3.0.0.44_09.12.2015_11.40.39_log.txt
2015-12-09 11:39 - 2015-12-09 11:40 - 00067260 _____ C:\TDSSKiller.3.0.0.44_09.12.2015_11.39.40_log.txt
2015-12-09 11:37 - 2015-12-09 11:39 - 00135526 _____ C:\TDSSKiller.3.0.0.44_09.12.2015_11.37.20_log.txt
2015-12-09 11:37 - 2015-12-09 11:37 - 00000562 _____ C:\TDSSKiller.3.0.0.44_09.12.2015_11.37.05_log.txt
2015-12-09 10:59 - 2015-12-09 10:59 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-12-09 10:58 - 2015-12-09 10:58 - 22908888 _____ (Malwarebytes ) C:\Users\Aga\Desktop\mbam-setup-2.2.0.1024.exe
2015-12-09 10:48 - 2015-12-09 10:48 - 00007380 _____ C:\WINDOWS\system32\.crusader
2015-12-09 10:40 - 2015-12-09 10:48 - 00000000 ____D C:\ProgramData\HitmanPro
2015-12-09 09:30 - 2015-12-09 11:45 - 00000000 ____D C:\AdwCleaner
2015-12-09 09:29 - 2015-12-09 09:29 - 01738240 _____ C:\Users\Aga\Desktop\adwcleaner_5.024.exe
2015-12-09 09:24 - 2015-12-09 09:25 - 00000000 ____D C:\ProgramData\5WdM5
2015-12-09 09:24 - 2015-12-09 09:24 - 00000001 _____ C:\WINDOWS\SysWOW64\pl.html
2015-12-09 09:22 - 2015-12-09 09:23 - 00000000 ____D C:\ProgramData\FWdMF
2015-12-07 17:08 - 2015-12-07 22:29 - 00011313 _____ C:\Users\Aga\Desktop\hajsy.xlsx
2015-12-05 15:11 - 2015-12-05 15:13 - 00000000 ____D C:\Users\Aga\Desktop\Nowy folder
2015-12-03 21:46 - 2015-12-03 21:46 - 00000000 ____D C:\WINDOWS\System32\Tasks\AVAST Software
2015-12-03 21:46 - 2015-12-03 21:46 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-02 17:58 - 2015-11-16 19:32 - 00919040 _____ (Farbar) C:\WINDOWS\mod_frst.exe

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-11 12:22 - 2014-01-25 15:25 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-230584855-1871568997-2477479041-1001
2015-12-11 12:06 - 2015-10-21 06:12 - 00000930 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-12-11 12:05 - 2015-04-18 09:46 - 00004182 _____ C:\WINDOWS\System32\Tasks\avast! Emergency Update
2015-12-11 11:57 - 2012-07-26 08:22 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-12-11 11:53 - 2013-09-20 18:00 - 00795984 _____ C:\WINDOWS\system32\perfh015.dat
2015-12-11 11:53 - 2013-09-20 18:00 - 00160066 _____ C:\WINDOWS\system32\perfc015.dat
2015-12-11 11:53 - 2012-07-26 08:28 - 01796820 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-12-11 11:53 - 2012-07-26 06:37 - 00000000 ____D C:\WINDOWS\Inf
2015-12-11 11:29 - 2012-07-26 06:37 - 00000000 ____D C:\Windows
2015-12-11 10:34 - 2014-03-02 16:31 - 00000000 ____D C:\ProgramData\AVG
2015-12-11 10:28 - 2014-01-28 22:15 - 02170368 ___SH C:\Users\Aga\Desktop\Thumbs.db
2015-12-11 10:13 - 2013-09-20 08:54 - 00000000 ____D C:\ProgramData\Temp
2015-12-11 10:13 - 2013-03-25 23:01 - 00000000 ____D C:\WINDOWS\Panther
2015-12-11 09:32 - 2013-09-20 08:57 - 00000000 ____D C:\WINDOWS\System32\Tasks\Lenovo
2015-12-11 09:32 - 2013-09-20 08:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-12-10 00:06 - 2015-10-21 06:12 - 00003818 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-12-09 13:09 - 2012-07-26 09:12 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-09 13:09 - 2012-07-26 09:12 - 00000000 ____D C:\WINDOWS\AUInstallAgent
2015-12-09 11:26 - 2012-07-26 09:12 - 00000000 ____D C:\WINDOWS\security
2015-12-09 11:17 - 2015-04-16 20:47 - 00000000 ____D C:\Program Files (x86)\Kippt
2015-12-09 10:11 - 2015-06-24 13:32 - 00000000 ____D C:\Users\Aga\Desktop\all
2015-12-09 09:34 - 2012-07-26 06:26 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-12-09 09:22 - 2014-01-25 16:03 - 00001378 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-09 09:22 - 2014-01-25 16:03 - 00001366 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-12-09 09:22 - 2014-01-25 14:53 - 00001310 _____ C:\Users\Aga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-05 16:12 - 2012-07-26 09:12 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-12-05 16:01 - 2015-11-07 10:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-05 16:01 - 2014-01-25 16:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-11-21 21:26 - 2015-03-10 22:10 - 00000000 ____D C:\Users\Aga\Desktop\potwierdzenia
2015-11-17 06:28 - 2015-10-28 10:12 - 00000000 ____D C:\Users\Aga\AppData\Local\Downloaded Installations

==================== Pliki w katalogu głównym wybranych folderów =======

2014-02-02 10:41 - 2014-02-02 10:41 - 0002637 _____ () C:\Users\Aga\AppData\Local\recently-used.xbel
2013-09-20 08:34 - 2013-09-20 08:34 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Niektóre pliki w TEMP:
====================
C:\Users\Aga\AppData\Local\Temp\genteert.dll
C:\Users\Aga\AppData\Local\Temp\HitmanPro.exe
C:\Users\Aga\AppData\Local\Temp\htmlayout.dll
C:\Users\Aga\AppData\Local\Temp\ipl8126.tmp.exe
C:\Users\Aga\AppData\Local\Temp\ose00000.exe
C:\Users\Aga\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Aga\AppData\Local\Temp\sqlite3.dll
C:\Users\Aga\AppData\Local\Temp\TS3EP03.exe
C:\Users\Aga\AppData\Local\Temp\TSLHost.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-03 10:14

==================== Koniec  FRST.txt ============================