Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja:09-12-2015
Uruchomiony przez PHUFOTOSET (administrator)  FOTOSET-PC (11-12-2015 15:38:10)
Uruchomiony z C:\Users\PHUFOTOSET\Desktop
Załadowane profile: PHUFOTOSET (Dostępne profile: PHUFOTOSET)
Platform: Microsoft® Windows Vista™ Business  Service Pack 2 (X86) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(IObit) C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(pdfforge GmbH) C:\Program Files\PDF Architect 4\creator-ws.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\TeamViewer.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version9\tv_w32.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe
(Pinnacle Systems GmbH) C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS Ai Charger\AiChargerAP.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_235.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_20_0_0_235.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation)
HKLM\...\Run: [USBToolTip] => C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe [199752 2007-02-20] (Pinnacle Systems GmbH)
HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2007-11-20] (Realtek Semiconductor Corp.)
HKLM\...\Run: [ASUS Ai Charger] => C:\Program Files\ASUS\ASUS Ai Charger\AiChargerAP.exe [465536 2010-05-10] (ASUSTek Computer Inc.)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2015-08-06] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [157456 2015-09-12] (Apple Inc.)
HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-01-03] (Adobe Systems Incorporated)
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\Run: [Skype] => "C:\Program Files\Skype\Phone\Skype.exe" /regrun
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\Run: [mcuozzcu] => C:\Users\PHUFOT~1\AppData\Local\Temp\ybdepcs.exe <===== UWAGA
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\Run: [lvqhczna] => C:\Users\PHUFOT~1\AppData\Local\Temp\ueyrhgg.exe <===== UWAGA
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {11cf9b74-3041-11e5-a81c-00241d718646} - J:\AutoRun.exe
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {30bf7a53-9882-11de-9547-00241d718646} - K:\LaunchU3.exe -a
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {407f4025-8cae-11de-b549-00241d718646} - J:\LaunchU3.exe -a
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {621eacf6-8b30-11de-b981-00241d718646} - J:\LaunchU3.exe -a
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {95431495-987b-11de-bd0f-00241d718646} - K:\LaunchU3.exe -a
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\...\MountPoints2: {9e9d2090-a613-11df-b830-00241d718646} - F:\AutoRunCardDetector.exe
AppInit_DLLs: c:\progra~1\kasper~1\kasper~1.0\r3hook.dll => Brak pliku
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk [2009-08-19]
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\PHUFOTOSET\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk [2015-05-15]
ShortcutTarget: MagicDisc.lnk -> C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{70753089-83ED-4065-A44A-2FE92CD0D1AA}: [DhcpNameServer] 89.108.202.21 89.108.195.21
Tcpip\..\Interfaces\{74E0AAD5-3893-44BF-92D3-9DF798A5EC25}: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{B996D754-FEE9-4A5F-9549-289564FE3FE9}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{F21A3FF8-56AE-42FA-B1B8-D5E1ED9665D9}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130862563191920000&GUID=87B809CA-CACB-45F5-AFB5-D469BC20751F
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617911&ResetID=130862563191940000&GUID=87B809CA-CACB-45F5-AFB5-D469BC20751F
HKU\S-1-5-21-2349542156-1443959456-3792940041-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://pl.msn.com/?ocid=iehp
URLSearchHook: HKLM -> Domyślne = {74198672-5F7D-4FE9-A611-4AC1D5A66A15}
URLSearchHook: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> Domyślne = {74198672-5F7D-4FE9-A611-4AC1D5A66A15}
SearchScopes: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> DefaultScope {4C110C67-9F6F-4701-B6A6-9F8C5046DE27} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://do-search.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=ST3250318AS_6VM2PMWEXXXX6VM2PMWE&ts=1425901183&type=default&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = 
SearchScopes: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> {4C110C67-9F6F-4701-B6A6-9F8C5046DE27} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE
SearchScopes: HKU\S-1-5-21-2349542156-1443959456-3792940041-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = 
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-01-03] (Adobe Systems Incorporated)
BHO: PDF Architect 4 Helper -> {38279E1A-7019-40C1-B579-E99DFB3312E8} -> C:\Program Files\PDF Architect 4\creator-ie-helper.dll [2015-10-19] (pdfforge GmbH)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-03] (Oracle Corporation)
BHO: Pomocnik rejestrowania za pomocą identyfikatora Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll [2015-04-01] (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-03] (Oracle Corporation)
BHO: IEPluginBHO Class -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> C:\Users\PHUFOTOSET\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-07-27] (GG Network S.A.)
Toolbar: HKLM - PDF Architect 4 Toolbar - {23FD9C33-A9E1-48A1-8404-E5925CF1C8E1} - C:\Program Files\PDF Architect 4\creator-ie-plugin.dll [2015-10-19] (pdfforge GmbH)
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.yoursearching.com/?type=sc&ts=1448872916&z=f7e2bbe9f6566c789bf6151gdzdzcbebfmboct4q7z&from=cor&uid=ST3250318AS_6VM2PMWEXXXX6VM2PMWE

FireFox:
========
FF ProfilePath: C:\Users\PHUFOTOSET\AppData\Roaming\Mozilla\Firefox\Profiles\sfvaesjz.default-1449744940326
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-08] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll [2013-04-03] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2015-09-04] ()
FF Plugin: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll [Brak pliku]
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-03] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-03] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku]
FF Plugin: @real.com/nppl3260;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll [2009-10-09] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll [2009-10-09] (RealNetworks, Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll [2012-01-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2012-01-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2015-10-19] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2015-10-19] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2015-10-19] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2015-10-19] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2015-10-19] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll [2010-01-13] (Nullsoft, Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\wtu-secure-search.xml [2015-03-13]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\PHUFOTOSET\AppData\Roaming\Mozilla\Firefox\Profiles\sfvaesjz.default-1449744940326\Extensions\iobitascsurfingprotection@iobit.com [2015-12-10] [Brak podpisu cyfrowego]
FF Extension: Adblock Plus - C:\Users\PHUFOTOSET\AppData\Roaming\Mozilla\Firefox\Profiles\sfvaesjz.default-1449744940326\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-17] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [pdf_architect_4_conv@pdfarchitect.org] - C:\Program Files\PDF Architect 4\resources\pdfarchitect4firefoxextension
FF Extension: PDF Architect 4 Creator - C:\Program Files\PDF Architect 4\resources\pdfarchitect4firefoxextension [2015-11-30] [Brak podpisu cyfrowego]
FF ExtraCheck: C:\Program Files\mozilla firefox\defaults\pref\itms.js [2015-09-09]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [116104 2010-04-05] ()
R2 IMFservice; C:\Program Files\IObit\IObit Malware Fighter\IMFsrv.EXE [878912 2015-04-02] (IObit)
R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-02-26] (Hewlett-Packard Company) [Brak podpisu cyfrowego]
S2 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2585408 2015-04-02] (IObit)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [237424 2014-03-31] () [Brak podpisu cyfrowego]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-14] (Hewlett-Packard) [Brak podpisu cyfrowego]
S3 PDF Architect 4; C:\Program Files\PDF Architect 4\ws.exe [2220768 2015-10-19] (pdfforge GmbH)
S3 PDF Architect 4 CrashHandler; C:\Program Files\PDF Architect 4\crash-handler-ws.exe [970464 2015-10-19] (pdfforge GmbH)
R2 PDF Architect 4 Creator; C:\Program Files\PDF Architect 4\creator-ws.exe [772832 2015-10-19] (pdfforge GmbH)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-14] (Hewlett-Packard) [Brak podpisu cyfrowego]
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [327064 2010-05-18] (Enigma Software Group USA, LLC.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)
S3 WLSetupSvc; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [266240 2007-10-25] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 AiCharger; C:\Windows\System32\DRIVERS\AiCharger.sys [13224 2010-05-05] (ASUSTek Computer Inc.)
R3 Dot4Scan; C:\Windows\System32\DRIVERS\Dot4Scan.sys [10752 2008-01-21] (Microsoft Corporation)
S3 gdrv; C:\Windows\gdrv.sys [16608 2009-01-29] (Windows (R) 2000 DDK provider)
R3 MarvinBus; C:\Windows\System32\DRIVERS\MarvinBus.sys [171520 2005-09-23] (Pinnacle Systems GmbH)
R3 mcdbus; C:\Windows\System32\DRIVERS\mcdbus.sys [116736 2009-02-24] (MagicISO, Inc.) [Brak podpisu cyfrowego]
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2010-01-20] () [Brak podpisu cyfrowego]
S4 FileMonitor; \??\C:\Program Files\IObit\IObit Malware Fighter\Drivers\wlh_x86\FileMonitor.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 RegFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wlh_x86\regfilter.sys [X]
S3 UrlFilter; \??\C:\Program Files\IObit\IObit Malware Fighter\drivers\wlh_x86\UrlFilter.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-11 15:38 - 2015-12-11 15:38 - 00018047 _____ C:\Users\PHUFOTOSET\Desktop\FRST.txt
2015-12-11 10:27 - 2015-12-11 10:27 - 00000000 ____D C:\Users\PHUFOTOSET\Desktop\huhu
2015-12-10 13:49 - 2015-12-10 13:49 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\ProductData
2015-12-10 13:47 - 2015-12-10 13:49 - 00000000 ____D C:\ProgramData\IObit
2015-12-10 13:47 - 2015-12-10 13:48 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\IObit
2015-12-10 13:47 - 2015-12-10 13:48 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\LocalLow\IObit
2015-12-10 13:47 - 2015-12-10 13:48 - 00000000 ____D C:\Program Files\IObit
2015-12-10 13:47 - 2015-12-10 13:47 - 00000972 _____ C:\Users\Public\Desktop\IObit Malware Fighter.lnk
2015-12-10 13:47 - 2015-12-10 13:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IObit Malware Fighter
2015-12-10 13:29 - 2015-12-10 13:29 - 00000864 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-10 12:07 - 2015-12-10 12:08 - 47734975 _____ C:\Users\PHUFOTOSET\Downloads\Foldify Create Print Fold [Pixle] (v1.7.8 iPad LP os80)-Widow@ipahub.com.rc330_902.ipa
2015-12-09 16:56 - 2015-11-06 18:05 - 00627712 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2015-12-09 16:56 - 2015-11-06 17:32 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2015-12-09 16:56 - 2015-11-06 17:32 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2015-12-09 16:56 - 2015-11-06 17:32 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2015-12-09 16:56 - 2015-11-06 17:32 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2015-12-09 16:56 - 2015-11-06 16:27 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-12-09 16:56 - 2015-11-06 16:26 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2015-12-09 16:56 - 2015-11-06 16:24 - 02068480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-12-09 16:56 - 2015-11-06 16:20 - 01073152 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-12-09 16:56 - 2015-11-06 16:20 - 00682496 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2015-12-09 16:56 - 2015-11-06 16:19 - 00802304 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-12-09 16:54 - 2015-11-02 18:04 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\els.dll
2015-12-09 16:52 - 2015-11-10 18:03 - 01208832 _____ (Microsoft Corporation) C:\Windows\system32\comsvcs.dll
2015-12-09 16:52 - 2015-11-10 18:03 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\catsrvut.dll
2015-12-09 16:52 - 2015-11-05 08:26 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2015-12-09 16:51 - 2015-11-05 08:34 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rmcast.sys
2015-12-09 13:20 - 2015-11-10 12:47 - 00423936 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-12-09 13:20 - 2015-11-10 12:43 - 06012416 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-12-09 13:20 - 2015-11-10 12:41 - 11086848 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-12-09 13:19 - 2015-11-10 12:48 - 00916992 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-12-09 13:19 - 2015-11-10 12:47 - 01214976 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-12-09 13:19 - 2015-11-10 12:47 - 00236544 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-12-09 13:19 - 2015-11-10 12:47 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-12-09 13:19 - 2015-11-10 12:45 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-12-09 13:19 - 2015-11-10 12:43 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2015-12-09 13:19 - 2015-11-10 12:43 - 00630272 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-12-09 13:19 - 2015-11-10 12:43 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-12-09 13:19 - 2015-11-10 12:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-12-09 13:19 - 2015-11-10 12:43 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-12-09 13:19 - 2015-11-10 12:42 - 01469440 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-12-09 13:19 - 2015-11-10 12:42 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-12-09 13:19 - 2015-11-10 12:42 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-12-09 13:19 - 2015-11-10 12:42 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 02006016 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00387584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00164352 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-12-09 13:19 - 2015-11-10 12:41 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-12-09 13:19 - 2015-11-10 12:40 - 00348160 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-12-09 13:19 - 2015-11-10 12:40 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-12-09 13:19 - 2015-11-10 12:40 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2015-12-09 13:19 - 2015-11-10 10:56 - 00385024 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-12-09 13:19 - 2015-11-10 09:16 - 00133632 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-12-09 13:19 - 2015-11-10 09:15 - 00174080 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-12-09 13:19 - 2015-11-10 09:13 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-12-09 13:19 - 2015-11-10 09:12 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-12-01 14:02 - 2015-12-10 12:39 - 00000012 _____ C:\spyhunter.fix
2015-12-01 12:05 - 2015-12-11 15:38 - 00000000 ____D C:\FRST
2015-12-01 12:05 - 2015-12-10 13:05 - 01720320 _____ (Farbar) C:\Users\PHUFOTOSET\Desktop\FRST.exe
2015-12-01 11:30 - 2015-12-01 11:32 - 00002093 _____ C:\Users\PHUFOTOSET\Desktop\SpyHunter.lnk
2015-12-01 11:30 - 2015-12-01 11:30 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2015-12-01 11:30 - 2015-12-01 11:30 - 00000000 ____D C:\sh4ldr
2015-12-01 11:30 - 2015-12-01 11:30 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-12-01 11:29 - 2015-12-01 11:30 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2015-12-01 11:29 - 2015-12-01 11:29 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2015-12-01 11:28 - 2015-12-01 11:28 - 00000000 ____D C:\Users\PHUFOTOSET\Desktop\S_yH_nter 4
2015-11-30 10:22 - 2015-12-03 16:11 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Local\PDFCreator
2015-11-30 10:13 - 2015-11-30 10:13 - 00000798 _____ C:\Users\Public\Desktop\PDF Architect 4.lnk
2015-11-30 10:12 - 2015-11-30 10:23 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\PDF Architect 4
2015-11-30 10:12 - 2015-11-30 10:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 4
2015-11-30 10:11 - 2015-11-30 10:13 - 00000000 ____D C:\Program Files\PDF Architect 4
2015-11-30 10:11 - 2015-11-30 10:11 - 00000000 ____D C:\Users\PHUFOTOSET\Documents\PDF Architect
2015-11-30 10:11 - 2015-11-30 10:11 - 00000000 ____D C:\Program Files\Common Files\PDF Software
2015-11-30 10:09 - 2015-11-30 10:13 - 00000000 ____D C:\ProgramData\PDF Architect 4
2015-11-30 10:09 - 2015-11-30 10:09 - 00101256 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2015-11-30 10:09 - 2015-11-30 10:09 - 00000834 _____ C:\Users\Public\Desktop\PDFCreator.lnk
2015-11-30 10:09 - 2015-11-30 10:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2015-11-30 09:43 - 2015-11-30 09:43 - 00001893 _____ C:\Users\Public\Desktop\Adobe Reader 9.lnk
2015-11-30 09:43 - 2015-11-30 09:43 - 00001804 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader 9.lnk
2015-11-30 09:42 - 2015-11-30 09:46 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Local\SeductivenessEmpathy
2015-11-30 09:42 - 2015-11-30 09:43 - 00000000 ____D C:\ProgramData\lWMiniProl
2015-11-18 12:14 - 2015-11-18 12:14 - 00000000 ____D C:\Users\PHUFOTOSET\Desktop\iso2god_v1.3.6-360h
2015-11-13 10:35 - 2015-12-01 12:55 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\dmst101b
2015-11-11 03:10 - 2015-10-13 15:31 - 00273408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2015-11-11 03:10 - 2015-10-13 15:31 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2015-11-11 03:09 - 2015-10-17 17:01 - 00501248 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-11-11 03:08 - 2015-10-14 21:22 - 01206192 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-11-11 03:08 - 2015-10-14 17:01 - 03606464 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-11-11 03:08 - 2015-10-14 17:01 - 03554752 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-11-11 03:05 - 2015-10-10 17:02 - 00526272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2015-11-11 03:01 - 2015-09-26 17:05 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-11-11 03:01 - 2015-09-26 17:04 - 00206336 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-11-11 03:01 - 2015-09-26 14:21 - 00274432 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2015-11-11 03:01 - 2015-09-22 14:11 - 00440768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-11 15:18 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-11 15:18 - 2006-11-02 13:47 - 00004480 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-11 15:18 - 2006-11-02 13:47 - 00004480 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-11 15:16 - 2006-11-02 14:01 - 00032596 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-12-11 15:05 - 2009-08-17 15:30 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\Programer
2015-12-11 14:48 - 2013-07-19 09:08 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-11 14:32 - 2008-01-21 07:23 - 01624842 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-11 14:32 - 2008-01-21 07:22 - 00718030 _____ C:\Windows\system32\perfh015.dat
2015-12-11 14:32 - 2008-01-21 07:22 - 00152810 _____ C:\Windows\system32\perfc015.dat
2015-12-11 14:32 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\inf
2015-12-11 11:39 - 2009-08-19 16:41 - 00000468 ____H C:\Windows\Tasks\User_Feed_Synchronization-{EB7AB736-522D-4A16-83A9-0133985CBDC3}.job
2015-12-10 15:29 - 2009-08-19 10:25 - 00000000 ____D C:\ProgramData\Adobe
2015-12-10 15:29 - 2009-08-17 13:02 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Roaming\Adobe
2015-12-10 13:30 - 2015-11-09 10:14 - 00000000 ____D C:\Program Files\Mozilla Firefox
2015-12-10 13:29 - 2012-04-26 08:52 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2015-12-10 03:35 - 2006-11-02 12:18 - 00000000 ____D C:\Windows\rescache
2015-12-10 03:19 - 2006-11-02 13:47 - 00469472 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-10 03:17 - 2009-08-19 13:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-10 03:15 - 2006-11-02 13:37 - 00000000 ____D C:\Windows\system32\XPSViewer
2015-12-09 17:00 - 2009-01-29 16:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-12-09 16:59 - 2010-06-05 02:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-09 16:50 - 2013-08-14 02:10 - 00000000 ____D C:\Windows\system32\MRT
2015-12-09 16:45 - 2006-11-02 11:24 - 137798368 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-12-09 14:07 - 2011-01-04 15:32 - 00000000 ____D C:\Programer_archiwa
2015-12-08 22:48 - 2013-06-04 10:24 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-12-08 22:48 - 2013-06-04 10:24 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-12-02 13:23 - 2012-03-07 13:51 - 00009013 _____ C:\Users\PHUFOTOSET\Desktop\Nowy dokument tekstowy (2).txt
2015-12-01 12:06 - 2006-11-02 12:18 - 00000000 ____D C:\Windows
2015-11-30 10:14 - 2011-07-28 11:17 - 00000000 ____D C:\Program Files\PDFCreator
2015-11-30 09:45 - 2014-08-06 14:09 - 00001967 _____ C:\Users\PHUFOTOSET\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ALLPlayer.TV.lnk
2015-11-30 09:45 - 2009-08-17 11:36 - 00001005 _____ C:\Users\PHUFOTOSET\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-11-30 09:44 - 2014-08-28 10:37 - 00000000 ____D C:\Users\PHUFOTOSET\AppData\Local\Adobe
2015-11-30 09:43 - 2009-08-19 10:25 - 00000000 ____D C:\Program Files\Common Files\Adobe
2015-11-30 09:43 - 2009-08-19 10:25 - 00000000 ____D C:\Program Files\Adobe
2015-11-30 09:15 - 2015-05-19 10:46 - 00000000 ____D C:\Program Files\PDFCreator2
2015-11-27 15:25 - 2010-11-16 10:15 - 00000000 ____D C:\Users\PHUFOTOSET\Desktop\Skanowane dokumenty
2015-11-11 03:33 - 2006-11-02 13:37 - 00000000 ____D C:\Program Files\Windows Journal

==================== Pliki w katalogu głównym wybranych folderów =======

2014-06-04 12:52 - 2014-06-04 12:52 - 0000080 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\Camdata.ini
2014-06-04 12:52 - 2014-06-04 12:52 - 0000408 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\CamLayout.ini
2014-06-04 12:52 - 2014-06-04 12:52 - 0000408 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\CamShapes.ini
2014-06-04 12:52 - 2014-06-04 12:52 - 0004548 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\CamStudio.cfg
2013-10-15 15:25 - 2014-02-07 14:49 - 0001942 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\FOTOSET-PC.MTBF.txt
2014-06-04 12:44 - 2014-06-04 12:44 - 0000096 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\version2.xml
2010-01-06 10:48 - 2015-02-02 15:14 - 0000600 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\winscp.rnd
2013-10-15 15:25 - 2014-02-07 14:51 - 0000678 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\__AvidCloudManager.log
2013-10-15 15:25 - 2013-10-30 10:51 - 0000678 _____ () C:\Users\PHUFOTOSET\AppData\Roaming\__AvidCloudManagerPrevious.log
2010-12-23 10:38 - 2011-12-23 12:51 - 0000680 _____ () C:\Users\PHUFOTOSET\AppData\Local\d3d9caps.dat
2009-08-19 12:32 - 2015-11-02 12:26 - 0057344 _____ () C:\Users\PHUFOTOSET\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-08-17 10:07 - 2010-08-17 10:20 - 0000600 _____ () C:\Users\PHUFOTOSET\AppData\Local\PUTTY.RND
2011-10-03 10:35 - 2011-10-03 10:35 - 0017408 _____ () C:\Users\PHUFOTOSET\AppData\Local\WebpageIcons.db

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-11 15:30

==================== Koniec  FRST.txt ============================