Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja:12-12-2015 Uruchomiony przez User4 (administrator) USER4-PC (12-12-2015 13:48:30) Uruchomiony z C:\Documents and Settings\User4\Moje dokumenty\Downloads Załadowane profile: User4 (Dostępne profile: User4) Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) Język: Polski Internet Explorer Wersja 6 (Domyślna przeglądarka: IE) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Nero AG) C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe (Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe (Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE (Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Nero AG) C:\Program Files\Nero\Nero 7\InCD\InCD.exe (Intel Corporation) C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) C:\WINDOWS\system32\igfxpers.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Vimicro Corporation) C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe (LG Electronics) C:\Documents and Settings\User4\Bluebirds\BlueBirds.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe () C:\WINDOWS\system32\UTSCSI.EXE (TFuns LIMITED) C:\Documents and Settings\All Users\Dane aplikacji\1WdM1\WdMan.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe (Microsoft Corporation) C:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (HP) C:\WINDOWS\system32\HPZinw12.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [20065936 2012-06-06] (Realtek Semiconductor Corp.) HKLM\...\Run: [RemoteControl] => C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.) HKLM\...\Run: [LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [NeroFilterCheck] => C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [153136 2007-03-01] (Nero AG) HKLM\...\Run: [InCD] => C:\Program Files\Nero\Nero 7\InCD\InCD.exe [1057064 2007-11-26] (Nero AG) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [picon] => C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe [796696 2009-07-21] (Intel Corporation) HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2006-02-19] (Hewlett-Packard Development Company, L.P.) HKLM\...\Run: [VMonitorVMUVC] => C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe [143360 2008-08-29] (Vimicro Corporation) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [6133520 2015-11-06] (AVAST Software) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation) HKU\S-1-5-21-1644491937-2147184641-682003330-1003\...\Run: [MSMSGS] => C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation) HKU\S-1-5-21-1644491937-2147184641-682003330-1003\...\Run: [bluebirds] => C:\Documents and Settings\User4\Bluebirds\BlueBirds.exe [270336 2009-04-29] (LG Electronics) HKU\S-1-5-21-1644491937-2147184641-682003330-1003\...\MountPoints2: {1e12fa34-da3f-11e4-b730-00241d7ea322} - E:\iStudio.exe ShellIconOverlayIdentifiers: ["DropboxExt1"] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt2"] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt3"] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt4"] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt5"] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt6"] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt7"] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: ["DropboxExt8"] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\User4\Dane aplikacji\Dropbox\bin\DropboxExt.25.dll [2015-04-02] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2015-10-06] (AVAST Software) Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk [2014-04-06] ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Development Company, L.P.) Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Photosmart Premier - Szybkie uruchomienie.lnk [2014-04-06] ShortcutTarget: HP Photosmart Premier - Szybkie uruchomienie.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe (Hewlett-Packard Development Company, L.P.) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 8.8.4.4 Tcpip\..\Interfaces\{AEE7E7F8-3549-4ACD-8264-8A01C70C5F56}: [DhcpNameServer] 192.168.1.254 8.8.4.4 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKU\S-1-5-21-1644491937-2147184641-682003330-1003\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.pl/ HKU\S-1-5-21-1644491937-2147184641-682003330-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449847794&z=7824e1c30f58d648bcd9fd0g6z5z7t2bazdmematfw&from=ient07021&uid=WDCXWD2500AAKS-00L9A0_WD-WMAV2E07242072420 URLSearchHook: HKU\S-1-5-21-1644491937-2147184641-682003330-1003 - Microsoft Url Search Hook - {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\shdocvw.dll (Microsoft Corporation) HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs,Tabs: "" <======= UWAGA SearchScopes: HKLM -> DefaultScope - brak wartości SearchScopes: HKU\S-1-5-21-1644491937-2147184641-682003330-1003 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-11-09] (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2015-10-06] (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-09] (Oracle Corporation) DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1391071000875 DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] () FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-09] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-09] (Oracle Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-12] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-12] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-02-28] [Brak podpisu cyfrowego] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-12-10] Chrome: ======= CHR HomePage: Default -> hxxp://google.pl/ CHR StartupUrls: Default -> "hxxp://google.pl/" CHR Session Restore: Default -> [funkcja włączona] CHR Profile: C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default CHR Extension: (Prezentacje Google) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-06] CHR Extension: (Dokumenty Google) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-06] CHR Extension: (Dysk Google) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-27] CHR Extension: (YouTube) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-06] CHR Extension: (Google Search) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27] CHR Extension: (Avast SafePrice) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2015-11-01] CHR Extension: (Dokumenty Google offline) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-12] CHR Extension: (Avast Online Security) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-11-02] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-06] CHR Extension: (Gmail) - C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-06] CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx [2015-04-03] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-04-03] StartMenuInternet: chrome.exe - C:\Program Files\ghokswa Browser\ghokswa\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1449847794&z=7824e1c30f58d648bcd9fd0g6z5z7t2bazdmematfw&from=ient07021&uid=WDCXWD2500AAKS-00L9A0_WD-WMAV2E07242072420 ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [146600 2015-10-06] (AVAST Software) S3 HP Port Resolver; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE [81920 2005-05-20] (Hewlett-Packard Company) S3 HP Status Server; C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE [73728 2004-10-16] (Hewlett-Packard Company) R2 InCDsrv; C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe [1554728 2007-11-26] (Nero AG) S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation) R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] () R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2066968 2009-07-21] (Intel Corporation) R2 UTSCSI; C:\WINDOWS\system32\UTSCSI.EXE [45056 2014-07-26] () [Brak podpisu cyfrowego] R2 WdMan; C:\Documents and Settings\All Users\Dane aplikacji\1WdM1\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego] ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative) R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24016 2015-10-06] (AVAST Software) R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [76000 2015-10-06] (AVAST Software) R1 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [55200 2015-10-06] (AVAST Software) R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49776 2015-10-06] (AVAST Software) R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [794952 2015-11-06] (AVAST Software) R1 aswSP; C:\WINDOWS\system32\drivers\aswSP.sys [435464 2015-11-06] (AVAST Software) R3 aswStmXP; C:\WINDOWS\system32\drivers\aswStmXP.sys [157888 2015-10-06] (AVAST Software) S3 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57888 2015-10-06] (AVAST Software) R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [208664 2015-10-06] (AVAST Software) S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation) R3 e1kexpress; C:\WINDOWS\System32\DRIVERS\e1k5132.sys [144480 2008-06-05] (Intel Corporation) S3 gdrv; C:\WINDOWS\gdrv.sys [16608 2014-01-30] (Windows (R) 2000 DDK provider) R4 InCDfs; C:\WINDOWS\System32\drivers\InCDFs.sys [118952 2007-11-26] (Nero AG) R1 InCDPass; C:\WINDOWS\System32\drivers\InCDPass.sys [36776 2007-11-26] (Nero AG) U1 InCDrec; C:\WINDOWS\system32\Drivers\InCDrec.sys [16040 2007-11-26] (Nero AG) R1 incdrm; C:\WINDOWS\System32\drivers\InCDRm.sys [38440 2007-11-26] (Nero AG) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-04-14] (Malwarebytes Corporation) S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.) S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation) R0 PxHelp20; C:\WINDOWS\System32\Drivers\PxHelp20.sys [46080 2005-08-19] (Sonic Solutions) [Brak podpisu cyfrowego] R3 VMUVC; C:\WINDOWS\System32\Drivers\VMUVC.sys [252416 2009-05-25] (Vimicro Corporation) R3 vvftUVC; C:\WINDOWS\System32\drivers\vvftUVC.sys [398720 2008-07-01] (Vimicro Corporation) S4 IntelIde; Brak ImagePath U1 WS2IFSL; Brak ImagePath ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-12-12 13:27 - 2015-12-12 13:48 - 00000000 ____D C:\FRST 2015-12-12 13:13 - 2015-12-12 13:13 - 00962128 _____ (Installer Soft Program ) C:\Documents and Settings\User4\Pulpit\Internet-Explorer-20403-dp.exe 2015-12-12 13:10 - 2015-12-12 13:10 - 00004072 _____ C:\Documents and Settings\User4\Pulpit\fixlist.txt 2015-12-12 12:55 - 2015-12-12 12:56 - 00000000 ____D C:\AdwCleaner 2015-12-12 12:34 - 2015-12-12 13:43 - 00001030 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2015-12-12 12:34 - 2015-12-12 13:39 - 00001034 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2015-12-12 12:23 - 2015-12-12 12:23 - 00000000 ____D C:\Avenger 2015-12-11 20:14 - 2015-12-11 20:14 - 00000001 _____ C:\WINDOWS\system32\pl.html 2015-12-11 16:31 - 2015-12-11 16:33 - 00000000 ____D C:\Documents and Settings\All Users\Dane aplikacji\1WdM1 2015-12-09 12:24 - 2015-12-10 12:23 - 19452096 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerInstaller.exe 2015-11-19 08:17 - 2015-11-19 08:17 - 00000000 ____D C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Temp ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2015-12-12 13:48 - 2014-01-30 08:34 - 00000000 ____D C:\Documents and Settings\User4\Ustawienia lokalne\Temp 2015-12-12 13:43 - 2015-04-03 21:44 - 00000362 ____H C:\WINDOWS\Tasks\avast! Emergency Update.job 2015-12-12 13:43 - 2014-04-06 17:02 - 00000000 ____D C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\ApplicationHistory 2015-12-12 13:43 - 2014-03-30 10:47 - 00000222 _____ C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job 2015-12-12 13:43 - 2014-01-30 11:01 - 00000000 ____D C:\Documents and Settings\User4\Menu Start\Programy\CyberLink DVD Suite 2015-12-12 13:43 - 2014-01-30 08:33 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-12-12 13:43 - 2014-01-29 16:10 - 00000000 ____D C:\WINDOWS 2015-12-12 13:43 - 2008-04-15 13:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl 2015-12-12 13:25 - 2014-01-30 09:35 - 00000000 ___SD C:\Documents and Settings\User4\UserData 2015-12-12 13:25 - 2014-01-30 08:34 - 00000000 ____D C:\Documents and Settings\User4 2015-12-12 13:23 - 2014-01-30 10:43 - 00000930 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-12-12 13:19 - 2015-10-06 22:33 - 00000992 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job 2015-12-12 13:14 - 2014-01-30 08:34 - 00000000 ____D C:\Documents and Settings\User4\Pulpit 2015-12-12 12:57 - 2014-01-30 08:34 - 00000292 ___SH C:\Documents and Settings\User4\ntuser.ini 2015-12-12 12:57 - 2014-01-30 08:33 - 00032600 ____N C:\WINDOWS\SchedLgU.Txt 2015-12-12 12:57 - 2014-01-29 16:29 - 00000000 __RHD C:\Documents and Settings\All Users\Dane aplikacji 2015-12-12 12:56 - 2014-01-30 08:34 - 00000000 __RHD C:\Documents and Settings\User4\Dane aplikacji 2015-12-12 12:56 - 2014-01-29 16:31 - 00000000 ___RD C:\Documents and Settings\All Users\Menu Start\Programy 2015-12-12 12:49 - 2014-01-30 08:34 - 00001119 _____ C:\Documents and Settings\User4\Menu Start\Programy\Internet Explorer.lnk 2015-12-12 12:49 - 2014-01-30 08:33 - 00000000 ____D C:\Documents and Settings\LocalService\Ustawienia lokalne\Temp 2015-12-12 12:49 - 2014-01-29 16:10 - 00000000 RSHDC C:\WINDOWS\system32\dllcache 2015-12-12 12:48 - 2014-01-29 16:10 - 00000000 ___HD C:\WINDOWS\inf 2015-12-12 12:48 - 2014-01-29 16:10 - 00000000 ____D C:\WINDOWS\Help 2015-12-12 12:47 - 2014-01-30 09:54 - 00000000 ____D C:\WINDOWS\ie8updates 2015-12-12 12:41 - 2015-10-06 22:58 - 00000000 ____D C:\Program Files\Opera 2015-12-12 12:41 - 2014-01-29 16:31 - 00000000 ____D C:\Documents and Settings\All Users\Pulpit 2015-12-12 12:39 - 2014-01-30 08:34 - 00000000 ___HD C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji 2015-12-12 12:35 - 2015-10-06 23:39 - 00001819 _____ C:\Documents and Settings\All Users\Pulpit\Google Chrome.lnk 2015-12-12 12:35 - 2014-02-26 00:39 - 00000000 ____D C:\Program Files\Google 2015-12-12 12:33 - 2014-02-26 00:39 - 00000000 ____D C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\Deployment 2015-12-12 12:23 - 2014-01-30 09:57 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2862335$ 2015-12-11 20:29 - 2015-10-09 16:08 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2015-12-11 16:30 - 2014-01-30 10:42 - 00001113 _____ C:\Documents and Settings\User4\Pulpit\Internet Explorer.lnk 2015-12-10 12:23 - 2014-01-30 10:43 - 00796864 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-12-10 12:23 - 2014-01-30 10:43 - 00142528 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-12-09 12:14 - 2014-03-30 10:47 - 00000216 _____ C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job 2015-11-25 09:40 - 2014-12-26 12:52 - 00000000 ____D C:\Documents and Settings\User4\Dane aplikacji\Skype 2015-11-25 08:16 - 2015-09-23 15:59 - 00002267 _____ C:\Documents and Settings\All Users\Pulpit\Skype.lnk 2015-11-19 08:17 - 2014-01-30 08:33 - 00000000 ___HD C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-05-05 12:53 - 2015-05-05 12:53 - 0000516 _____ () C:\Program Files\Skrót do IMG_2406.jpg.lnk 2015-01-28 18:13 - 2015-11-09 20:24 - 0006144 _____ () C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-04-06 17:02 - 2014-04-06 17:02 - 0000130 _____ () C:\Documents and Settings\User4\Ustawienia lokalne\Dane aplikacji\fusioncache.dat Niektóre pliki w TEMP: ==================== C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-19839d13.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-1e1fdc48.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-20496257.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-2ad3c265.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-2cb607ea.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-40bc74db.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-464a992e.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-535e0163.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-5b562dd7.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-5c80f398.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-603246b2.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-61272d80.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-61b6293f.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-6b0fa030.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-6c83d8ef.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-6ed7b353.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-71ea8e22.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-736c5667.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-7438fcae.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-88e41b7.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-893cb1e.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-89e76654.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-8e4cd77a.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-9671fcd4.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-b01940ed.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-e4d5679a.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-ed068d2e.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-ef0d4015.exe C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temp\mpam-f43418a2.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\bzwkmkoh.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\jre-8u40-windows-au.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\jre-8u51-windows-au.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\jre-8u65-windows-au.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OFS1DD.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OFS1DF.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OFS1E1.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OLK1DE.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OUO1E2.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\OWA1DC.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\rbSolnUpdatePLK.3.3.0.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\SkypeSetup.exe C:\Documents and Settings\User4\Ustawienia lokalne\Temp\sqlite3.dll C:\Documents and Settings\User4\Ustawienia lokalne\Temp\{30DD0119-AE7D-43D7-ADBC-A6E8C1EADFD3}-42.0.2311.152_chrome_installer.exe ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo ==================== Koniec FRST.txt ============================