Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:09-12-2015
Uruchomiony przez Krzysiek (administrator)  KRZYSIEKK (12-12-2015 18:50:11)
Uruchomiony z C:\Users\Krzysiek\Downloads
Załadowane profile: Krzysiek & UpdatusUser (Dostępne profile: Krzysiek & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 9 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files (x86)\Web Connection\Y858\BackgroundService\ServiceManager.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
() C:\Windows\SysWOW64\PSIService.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\Web Connection\Y858\BackgroundService\ModemListener.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Windows\System32\osk.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2692520 2009-05-14] (ESET)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-07] (Intel Corporation)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-18] (ASUS)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [85160 2009-05-26] (Elaborate Bytes AG)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [3825176 2012-11-13] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [CloneDVDElbyDelay] => C:\Program Files (x86)\Elaborate Bytes\CloneDVD\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [318080 2011-12-22] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [174720 2011-10-24] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [BrMfcWnd] => C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] => C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Alcatel LINKS ModemListener] => C:\Program Files (x86)\Web Connection\Y858\BackgroundService\ModemListener.exe [159056 2014-06-06] ()
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\...\Run: [Akamai NetSession Interface] => "C:\Users\Krzysiek\AppData\Local\Akamai\netsession_win.exe"
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\...\Run: [Spybot-S&D Cleaning] => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe" /autoclean
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\...\Run: [Mobile Partner] => C:\Program Files (x86)\Huawei E5372\Huawei E5372
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\...\Run: [SpybotPostWindows10UpgradeReInstall] => "C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe"
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [266960 2013-05-08] (NVIDIA Corporation)
Startup: C:\Users\Krzysiek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Powiadomienia monitorowania tuszu - HP Deskjet 2540 series.lnk [2015-12-11]
ShortcutTarget: Powiadomienia monitorowania tuszu - HP Deskjet 2540 series.lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\..\Interfaces\{61F956BD-4116-4261-BAD7-A2CFD69EB9AE}: [NameServer] 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Tcpip\..\Interfaces\{65065782-6A71-46BA-9301-25245D89EC22}: [NameServer] 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Tcpip\..\Interfaces\{6AA8FF4B-85B4-43E8-BCB1-A625F0ED09BD}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS&q={searchTerms}
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.interia.pl/
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS&q={searchTerms}
HKU\S-1-5-21-1765370731-3468206040-3838702788-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.5.4.11.dll => Brak pliku
BHO-x32: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH)
BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll => Brak pliku
BHO-x32: DIALux 3.1 ULDBrowserHelper Class -> {69AB812A-8CE4-4BF3-B49B-3B60A9F31FB2} -> C:\Program Files (x86)\DIALux\DLXShellExtension.dll [2013-06-11] (DIAL GmbH, Germany)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO-x32: Brak nazwy -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> Brak pliku
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - "C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BingExt.dll" Brak pliku
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: dialux - {8352FA4C-39C6-11D3-ADBA-00A0244FB1A2} - C:\Program Files (x86)\DIALux\DLXToolBox.dll [2013-06-11] (DIAL GmbH, Germany)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1446576877&z=2818ad731409dc09cb63051gfz1z0q4wdm4q5q5e7g&from=cor&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS

FireFox:
========
FF ProfilePath: C:\Users\Krzysiek\AppData\Roaming\Mozilla\Firefox\Profiles\adxfqron.default-1449873658836
FF Homepage: hxxp://www.interia.pl/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [Brak pliku]
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [Brak pliku]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-05-07] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-05-07] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [Brak pliku]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013-10-03] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\Krzysiek\AppData\Roaming\Mozilla\Firefox\Profiles\6icqkcxr.default\extensions\default_newtabff@gmail.com
FF Extension: Brak nazwy - C:\Users\Krzysiek\AppData\Roaming\Mozilla\Firefox\Profiles\6icqkcxr.default\extensions\default_newtabff@gmail.com [2015-12-10] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: Eset Plugin - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2013-02-13] [Brak podpisu cyfrowego]
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1449713510&z=8851b9d48d80fdceb415b26gfz3zat4mbg8c4wde9z&from=ient07021&uid=TOSHIBAXMQ01ABD050_82CBSETRSXX82CBSETRS

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Alcatel LINKS Modem Device Helper; C:\Program Files (x86)\Web Connection\Y858\BackgroundService\ServiceManager.exe [76624 2014-09-17] ()
S3 DialComService; C:\Program Files (x86)\DIAL GmbH\DIAL Communication Framework\DialComService.exe [1934608 2013-05-22] (DIAL GmbH)
S3 EhttpSrv; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [23296 2009-05-14] (ESET)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [731840 2009-05-14] (ESET)
S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [520416 2013-11-21] (Futuremark)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-04-10] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-21] (Intel Corporation)
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2013-05-09] () [Brak podpisu cyfrowego]
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
S2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 ProtexisLicensing; C:\Windows\SysWOW64\PSIService.exe [174656 2006-11-02] () [Brak podpisu cyfrowego]
S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) [Brak podpisu cyfrowego]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 .EsetTrialReset; C:\Windows\system32\regedt32.exe /s C:\Windows\esettrialreset.reg
S2 AdobeARMservice; "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe" [X]
S2 BBSvc; C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\BBSvc.exe [X]
S3 BBUpdate; C:\Program Files (x86)\Microsoft\BingBar\7.1.355.0\SeaPort.exe [X]
S3 BITCOMET_HELPER_SERVICE; C:\Program Files (x86)\BitComet\tools\BitCometService.exe -service [X]
S2 IhPul; C:\Users\Krzysiek\AppData\Roaming\TSv\TSvr.exe [X]
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [X]
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [X]
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [X]
S2 SpyHunter 4 Service; C:\PROGRA~2\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [X]
S2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe -s [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 eamon; C:\Windows\System32\DRIVERS\eamon.sys [142776 2009-05-14] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [134024 2009-05-14] (ESET)
R2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [9728 2003-09-15] (Elaborate Bytes AG) [Brak podpisu cyfrowego]
S3 ElbyDelay; C:\Windows\SysWOW64\Drivers\ElbyDelay.sys [3840 2003-03-28] (Elaborate Bytes) [Brak podpisu cyfrowego]
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [121152 2009-05-14] (ESET)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [164864 2015-07-28] (ITE                      )
R3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [123776 2013-06-18] (TCT International Mobile Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]
S3 esgiguard; \??\C:\Program Files (x86)\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-12 18:50 - 2015-12-12 18:50 - 00020041 _____ C:\Users\Krzysiek\Downloads\FRST.txt
2015-12-11 19:43 - 2015-12-11 19:43 - 00000000 ____D C:\Device
2015-12-11 19:35 - 2015-12-11 19:36 - 00294760 _____ C:\Windows\Minidump\121115-27846-01.dmp
2015-12-11 19:21 - 2015-12-12 18:50 - 00000000 ____D C:\FRST
2015-12-11 19:19 - 2015-12-11 19:20 - 02369024 _____ (Farbar) C:\Users\Krzysiek\Downloads\FRST64.exe
2015-12-11 19:07 - 2015-12-11 19:24 - 00080779 _____ C:\Users\Krzysiek\Downloads\Shortcut.txt
2015-12-11 18:33 - 2015-12-11 23:32 - 00000000 ____D C:\Program Files\Common Files\AV
2015-12-11 18:32 - 2015-12-11 18:32 - 00000000 ____D C:\Users\Krzysiek\Documents\ProcAlyzer Dumps
2015-12-04 18:46 - 2015-12-04 18:46 - 00002037 _____ C:\Users\Public\Desktop\Web Connection.lnk
2015-12-04 18:46 - 2015-12-04 18:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Web Connection
2015-12-04 18:46 - 2013-06-18 11:33 - 00123776 _____ (TCT International Mobile Ltd.) C:\Windows\system32\Drivers\jrdusbser.sys
2015-12-04 18:45 - 2015-12-04 18:45 - 00000000 ____D C:\Program Files (x86)\Web Connection
2015-12-03 19:19 - 2015-12-11 23:32 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-01 21:34 - 2015-12-01 21:35 - 02489965 _____ C:\Users\Krzysiek\Downloads\whitetiger_HWNq69rP.apk
2015-11-24 16:57 - 2015-11-24 16:57 - 00104166 _____ C:\Users\Krzysiek\Documents\Scan_9.pdf
2015-11-24 16:56 - 2015-11-24 16:56 - 00549348 _____ C:\Users\Krzysiek\Documents\Scan_8.pdf
2015-11-24 16:56 - 2015-11-24 16:56 - 00426960 _____ C:\Users\Krzysiek\Documents\Scan_7.pdf
2015-11-24 16:54 - 2015-11-24 16:54 - 00558136 _____ C:\Users\Krzysiek\Documents\Scan_6.pdf
2015-11-19 18:19 - 2015-11-19 18:19 - 00426257 _____ C:\Users\Krzysiek\Documents\Scan_5.pdf
2015-11-19 18:18 - 2015-11-19 18:18 - 00431228 _____ C:\Users\Krzysiek\Documents\Scan_4.pdf
2015-11-19 18:18 - 2015-11-19 18:18 - 00426764 _____ C:\Users\Krzysiek\Documents\Scan_3.pdf
2015-11-19 18:16 - 2015-11-19 18:16 - 00429314 _____ C:\Users\Krzysiek\Documents\Scan_2.pdf
2015-11-19 18:14 - 2015-11-19 18:15 - 00429291 _____ C:\Users\Krzysiek\Documents\Scan_1.pdf
2015-11-17 11:49 - 2015-11-23 21:09 - 00001040 _____ C:\Users\Krzysiek\Desktop\Guild Wars 2 NewAuth.lnk
2015-11-15 21:07 - 2015-11-15 21:09 - 00000000 ____D C:\Users\Krzysiek\AppData\Roaming\Guild Wars 2
2015-11-15 20:46 - 2015-11-15 20:58 - 00024064 ___SH C:\Users\Krzysiek\Thumbs.db

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-12 18:49 - 2011-04-12 14:21 - 00741366 _____ C:\Windows\system32\perfh015.dat
2015-12-12 18:49 - 2011-04-12 14:21 - 00155930 _____ C:\Windows\system32\perfc015.dat
2015-12-12 18:49 - 2009-07-14 06:13 - 01671400 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-12 18:49 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2015-12-12 18:47 - 2014-03-13 17:47 - 00000000 ____D C:\Users\Krzysiek\Documents\Pliki programu Outlook
2015-12-11 23:45 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2015-12-11 23:44 - 2009-07-14 05:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-11 23:44 - 2009-07-14 05:45 - 00021888 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-11 23:41 - 2013-02-24 17:04 - 00000000 ____D C:\Users\Krzysiek\Desktop\Stare dane programu Firefox
2015-12-11 23:39 - 2014-03-10 16:24 - 00000000 ____D C:\Users\UpdatusUser
2015-12-11 23:36 - 2014-03-10 16:24 - 00000000 ____D C:\ProgramData\NVIDIA
2015-12-11 23:36 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-11 23:35 - 2013-02-11 00:09 - 07311360 _____ C:\Users\Krzysiek\NTUSER.bak
2015-12-11 23:35 - 2009-07-14 03:34 - 70742016 _____ C:\Windows\system32\config\SOFTWARE.bak
2015-12-11 23:35 - 2009-07-14 03:34 - 18874368 _____ C:\Windows\system32\config\SYSTEM.bak
2015-12-11 23:35 - 2009-07-14 03:34 - 00970752 _____ C:\Windows\system32\config\DEFAULT.bak
2015-12-11 23:35 - 2009-07-14 03:34 - 00061440 _____ C:\Windows\system32\config\SAM.bak
2015-12-11 23:35 - 2009-07-14 03:34 - 00028672 _____ C:\Windows\system32\config\SECURITY.bak
2015-12-11 23:33 - 2014-01-30 11:06 - 00000000 ____D C:\Users\Krzysiek\AppData\LocalLow\Temp
2015-12-11 23:32 - 2013-02-24 17:27 - 00001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-11 23:32 - 2013-02-24 17:27 - 00001053 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-12-11 23:32 - 2013-02-13 11:48 - 00001282 _____ C:\Users\Public\Desktop\The Elder Scrolls V - Skyrim.lnk
2015-12-11 23:32 - 2013-02-11 00:09 - 00001190 _____ C:\Users\Krzysiek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-11 23:32 - 2013-02-11 00:09 - 00001160 _____ C:\Users\Krzysiek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2015-12-11 23:30 - 2015-11-04 14:48 - 00000000 ____D C:\Windows\4FC9DA9DF608454E8191D7EFFDCC5726.TMP
2015-12-11 23:29 - 2013-03-13 19:37 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-12-11 23:25 - 2013-02-21 15:19 - 00000000 ____D C:\Program Files (x86)\BitComet
2015-12-11 20:01 - 2009-07-14 03:34 - 43921408 _____ C:\Windows\system32\config\COMPONENTS.bak
2015-12-11 19:50 - 2013-02-11 00:09 - 00000000 ____D C:\Users\Krzysiek
2015-12-11 19:45 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-12-11 19:36 - 2013-02-13 09:29 - 00001908 _____ C:\Windows\system32\AutoRunFilter.ini
2015-12-11 19:35 - 2014-04-08 05:22 - 367963999 _____ C:\Windows\MEMORY.DMP
2015-12-11 19:35 - 2013-05-23 18:28 - 00000000 ____D C:\Windows\Minidump
2015-12-11 19:33 - 2013-04-18 17:04 - 00000095 _____ C:\Windows\winamp.ini
2015-12-11 18:33 - 2013-03-13 19:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-12-10 14:55 - 2015-11-03 19:55 - 00000000 ____D C:\Program Files (x86)\Android Data Recovery
2015-12-10 12:52 - 2013-02-21 15:19 - 00000000 ____D C:\Users\Krzysiek\AppData\Roaming\BitComet
2015-12-10 12:27 - 2013-02-13 09:29 - 00001944 _____ C:\Windows\system32\ServiceFilter.ini
2015-12-10 12:26 - 2013-02-24 17:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-10 11:37 - 2015-06-25 19:50 - 00000000 ____D C:\Sonergy
2015-12-02 17:27 - 2015-07-27 18:25 - 00004608 _____ C:\6XSourceFilter.grf
2015-11-17 07:59 - 2013-03-11 11:19 - 00000000 ____D C:\Users\Krzysiek\Games
2015-11-17 07:43 - 2014-11-15 10:07 - 00000000 ____D C:\Games
2015-11-16 09:27 - 2014-08-12 17:17 - 00000000 ____D C:\Users\Krzysiek\Documents\Moje pliki PSP
2015-11-16 09:27 - 2014-08-12 17:07 - 00002984 ___SH C:\Windows\SysWOW64\KGyGaAvL.sys
2015-11-16 09:27 - 2014-08-12 17:07 - 00000088 __RSH C:\Windows\SysWOW64\DBB162062E.sys
2015-11-15 20:52 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2015-11-15 20:51 - 2013-02-18 12:00 - 00000000 ____D C:\Users\Krzysiek\AppData\Local\ElevatedDiagnostics

==================== Pliki w katalogu głównym wybranych folderów =======

2013-02-13 08:57 - 2015-09-11 18:13 - 0007601 _____ () C:\Users\Krzysiek\AppData\Local\Resmon.ResmonCfg
2013-02-13 09:21 - 2013-02-13 09:21 - 0002111 _____ () C:\Users\Krzysiek\AppData\Local\WiDiSetupLog.20130213.092131.txt
2014-01-27 08:37 - 2014-01-27 08:37 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-11 00:29

==================== Koniec  FRST.txt ============================