Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:14-12-2015
Uruchomiony przez bartek (administrator)  ASUSZENBOOK (14-12-2015 23:34:16)
Uruchomiony z C:\Users\bartek\Desktop
Załadowane profile: bartek (Dostępne profile: bartek)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(Intel Corporation) C:\Windows\SysWOW64\esif_uf.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe
(tsvr.com) C:\Users\bartek\AppData\Roaming\TSv\TSvr.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(TODO: <公司名>) C:\Program Files (x86)\SFK\SSFK.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(TFuns LIMITED) C:\ProgramData\BWdMB\WdMan.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel) C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Windows\Temp\DPTF\esif_assist.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(AVG Technologies) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
() C:\ProgramData\MobileBrServ\tray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Spotify Ltd) C:\Users\bartek\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(AdFender, Inc.) C:\Program Files (x86)\AdFender\AdFender.exe
() C:\Windows\SysWOW64\UMonit64.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusSmartGestureDetector64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSPanel.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403104 2014-07-25] (NVIDIA Corporation)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-10-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [1080992 2014-05-15] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\ASUSWSLoader.exe [63296 2014-02-25] ()
HKU\S-1-5-21-3045090937-3747617143-1340328465-1001\...\Run: [Spotify Web Helper] => C:\Users\bartek\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2345584 2015-12-08] (Spotify Ltd)
HKU\S-1-5-21-3045090937-3747617143-1340328465-1001\...\MountPoints2: {6484b3f1-9699-11e5-8264-605718b95004} - "D:\AutoRun.exe" 
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.2.301\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AdFender.lnk [2015-11-05]
ShortcutTarget: AdFender.lnk -> C:\Program Files (x86)\AdFender\AdFender.exe (AdFender, Inc.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{1857229D-50B0-4A38-8545-1342166E52D7}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{BEF92837-C774-42EC-BA57-EFBA2799605E}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{EA199CA3-E8AB-4BA8-85AA-549EC8E56C8F}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{FA01ABDD-65D7-4FF6-A17B-03D6B77408EF}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
HKU\S-1-5-21-3045090937-3747617143-1340328465-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
HKU\S-1-5-21-3045090937-3747617143-1340328465-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3045090937-3747617143-1340328465-1001 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3045090937-3747617143-1340328465-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.yoursites123.com/web/?type=ds&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.istartsurf.com/?type=sc&ts=1446485605&z=5ec90be8ca735156dc07221gcz4zbq1z6b8wec4cbw&from=cor&uid=KINGSTONXSV300S37A240G_50026B7258069507

FireFox:
========
FF ProfilePath: C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default
FF NewTab: hxxp://www.yoursites123.com/newtab/?type=nt&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
FF Homepage: hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-10] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-10] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-09-03] (Intel Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-07] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-07] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] ()
FF Extension: sidebar - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\sidebarff@gmail.com [2015-11-07] [Brak podpisu cyfrowego]
FF Extension: Default NewTab - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\default_newtabff@gmail.com [2015-12-14] [Brak podpisu cyfrowego]
FF Extension: YahooToolsProtected  - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\yahooprotected@gmail.com [2015-12-14] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Firefox\Extensions: [defsearchp@gmail.com] - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\defsearchp@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\deskCutv2@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sidebarff@gmail.com] - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\sidebarff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\default_newtabff@gmail.com
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\bartek\AppData\Roaming\Mozilla\Firefox\Profiles\j22qf7fx.default\extensions\yahooprotected@gmail.com
StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://www.yoursites123.com/?type=sc&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507
CHR StartupUrls: Default -> "hxxp://www.yoursites123.com/?type=hp&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507"
CHR Profile: C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-03]
CHR Extension: (Dokumenty Google) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-03]
CHR Extension: (Dysk Google) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-03]
CHR Extension: (YouTube) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-03]
CHR Extension: (Google Search) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-03]
CHR Extension: (Arkusze Google) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-03]
CHR Extension: (Dokumenty Google offline) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Ad.Block Pro) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\hodaonapcbcankniahofhifnakgefbkc [2015-11-05]
CHR Extension: (Shortcuts for All Google™) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf [2015-12-01]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-03]
CHR Extension: (Gmail) - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-03]
CHR HKLM\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
CHR HKLM-x32\...\Chrome\Extension: [jdiejbegdjikmehflknhkbieocmnogcf] - C:\Users\bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdiejbegdjikmehflknhkbieocmnogcf.crx [2015-11-07]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.yoursites123.com/?type=sc&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507

Opera: 
=======
StartMenuInternet: (HKLM) OperaStable - C:\Program Files (x86)\Opera\Launcher.exe hxxp://www.yoursites123.com/?type=sc&ts=1450129933&z=5ebacc3752acbc67cd44decgbzfw0e8g7oft5t5cfg&from=wpm07173&uid=KINGSTONXSV300S37A240G_50026B7258069507

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.2.301\AsusWSWinService.exe [71680 2014-02-25] (ASUS Cloud Corporation) [Brak podpisu cyfrowego]
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [382312 2015-11-27] (Digital Wave Ltd.)
R2 esifsvc; C:\Windows\SysWOW64\esif_uf.exe [1037568 2014-09-18] (Intel Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-28] (WildTangent)
R2 Huawei E3372; C:\ProgramData\MobileBrServ\mbbservice.exe [240720 2014-03-07] ()
R2 ibtsiva.exe; C:\Program Files (x86)\Intel\Bluetooth\utilities\ibtsiva.exe [121288 2014-08-13] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-11-19] (Intel Corporation)
R2 IhPul; C:\Users\bartek\AppData\Roaming\TSv\TSvr.exe [580752 2015-12-08] (tsvr.com)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
R2 IntelUSBoverIP; C:\Program Files\Intel Corporation\USB over IP\bin\UoipService.exe [394184 2014-10-15] (Intel)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-09-03] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720608 2014-07-25] (NVIDIA Corporation)
R2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe [170144 2015-11-27] (TODO: <公司名>)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2970424 2015-06-29] (AVG Technologies)
R2 UxTuneUp; C:\Windows\System32\uxtuneup.dll [44856 2015-06-29] (AVG Technologies)
R2 UxTuneUp; C:\Windows\SysWOW64\uxtuneup.dll [36664 2015-06-29] (AVG Technologies)
R2 WdMan; C:\ProgramData\BWdMB\WdMan.exe [333312 2015-12-04] (TFuns LIMITED) [Brak podpisu cyfrowego]
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2014-05-16] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-05-16] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [69904 2014-11-21] (ASUS Corporation)
R3 dptf_cpu; C:\Windows\System32\drivers\dptf_cpu.sys [38720 2014-09-18] (Intel Corporation)
R3 dptf_pch; C:\Windows\System32\drivers\dptf_pch.sys [38208 2014-09-18] (Intel Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R3 esif_lf; C:\Windows\System32\drivers\esif_lf.sys [216360 2014-09-18] (Intel Corporation)
U5 GeneStor; C:\Windows\System32\Drivers\GeneStor.sys [110824 2014-06-11] (GenesysLogic)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [219592 2014-08-13] (Intel Corporation)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79016 2014-08-26] (Intel Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( )
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [126976 2014-09-03] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-06] (Intel Corporation)
S3 RTLUE8023-W8-64; C:\Windows\system32\DRIVERS\rtu64w8.sys [100056 2014-01-06] (Realtek                                            )
R3 SensorsAlsDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [31144 2015-06-25] (TuneUp Software)
R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [213296 2014-10-15] (Windows (R) Win 7 DDK provider)
S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [35856 2014-05-16] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [237400 2014-05-16] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2014-05-16] (Microsoft Corporation)
R1 wfdrvr_vw_1_10_0_28; C:\Windows\System32\drivers\wfdrvr_vw_1_10_0_28.sys [57712 2015-10-30] (WF)
U0 msahci; system32\drivers\msahci.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-14 23:18 - 2015-12-14 23:34 - 00023605 _____ C:\Users\bartek\Desktop\FRST.txt
2015-12-14 23:14 - 2015-12-14 23:14 - 00000001 _____ C:\Windows\SysWOW64\pl.html
2015-12-14 23:11 - 2015-12-14 23:34 - 00000000 ____D C:\FRST
2015-12-14 23:07 - 2015-12-14 23:07 - 02369536 _____ (Farbar) C:\Users\bartek\Desktop\FRST64.exe
2015-12-14 23:04 - 2015-12-14 23:04 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_LocationProvider_01_11_00.Wdf
2015-12-14 22:52 - 2015-12-14 23:15 - 00000000 ____D C:\Program Files (x86)\SFK
2015-12-14 22:52 - 2015-12-14 23:02 - 00000000 ____D C:\Program Files (x86)\WinZipper
2015-12-14 22:52 - 2015-12-14 22:53 - 00000000 ____D C:\ProgramData\BWdMB
2015-12-14 22:52 - 2015-12-14 22:52 - 00000000 ____D C:\Users\bartek\AppData\Roaming\WinZipper
2015-12-14 22:52 - 2015-12-14 22:52 - 00000000 ____D C:\Users\bartek\AppData\Roaming\TSv
2015-12-14 22:52 - 2015-12-14 22:52 - 00000000 ____D C:\ProgramData\pWdMp
2015-12-01 00:43 - 2015-12-01 00:43 - 00231260 _____ C:\Users\bartek\Desktop\podzial gp.pdf
2015-11-29 23:25 - 2015-11-29 23:25 - 00001706 _____ C:\Users\Public\Desktop\Huawei E3372.lnk
2015-11-29 23:25 - 2015-11-29 23:25 - 00000000 ____D C:\ProgramData\MobileBrServ
2015-11-29 23:25 - 2015-11-29 23:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Huawei E3372
2015-11-29 23:20 - 2015-11-29 23:20 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2015-11-26 20:57 - 2015-11-26 20:57 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2015-11-23 22:29 - 2015-11-23 22:29 - 00099102 _____ C:\Users\bartek\Desktop\Genetic_Test_Results_Alicja_Wrobel.pdf

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-14 23:33 - 2015-10-17 13:17 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3045090937-3747617143-1340328465-1001
2015-12-14 23:31 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-14 23:29 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2015-12-14 23:21 - 2014-05-16 02:05 - 00808596 _____ C:\Windows\system32\perfh015.dat
2015-12-14 23:21 - 2014-05-16 02:05 - 00163898 _____ C:\Windows\system32\perfc015.dat
2015-12-14 23:21 - 2014-03-18 16:26 - 01825074 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-14 23:21 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2015-12-14 23:19 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp
2015-12-14 23:19 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2015-12-14 23:14 - 2015-10-29 01:46 - 00001076 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-14 23:14 - 2015-10-17 13:12 - 00001543 _____ C:\Users\bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AsusSmartGestureDetector.lnk
2015-12-14 23:14 - 2015-10-17 13:12 - 00000125 _____ C:\Users\bartek\AppData\Roaming\sp_data.sys
2015-12-14 23:13 - 2015-10-29 01:46 - 00000992 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2015-12-14 23:13 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-14 23:13 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-12-14 23:10 - 2015-10-22 21:28 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-14 23:02 - 2015-10-29 01:46 - 00001080 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-14 22:52 - 2015-11-02 18:34 - 00000074 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-12-14 22:52 - 2015-11-02 18:34 - 00000000 ____D C:\ProgramData\UWMiniProU
2015-12-14 22:52 - 2015-10-29 01:46 - 00002519 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-14 22:52 - 2015-10-29 01:43 - 00001437 _____ C:\Users\Public\Desktop\Opera.lnk
2015-12-14 22:52 - 2015-10-29 01:43 - 00001373 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-12-14 22:52 - 2015-10-17 13:24 - 00001485 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-12-14 22:52 - 2015-10-17 13:24 - 00001473 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-12-14 22:52 - 2015-10-17 13:11 - 00001764 _____ C:\Users\bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-12-14 22:11 - 2015-10-17 13:18 - 00004000 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{4B44EEED-B71B-46B4-A297-E4D97FD19FF9}
2015-12-14 22:11 - 2015-10-17 13:18 - 00003474 _____ C:\Windows\System32\Tasks\ASUS Live Update1
2015-12-14 22:11 - 2015-10-17 13:18 - 00003464 _____ C:\Windows\System32\Tasks\ASUS Live Update2
2015-12-11 12:10 - 2015-10-29 01:46 - 00003964 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2015-12-11 12:10 - 2015-10-22 21:28 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-11 11:49 - 2015-11-05 01:03 - 00000000 ____D C:\Users\bartek\AppData\Local\AdFender
2015-12-11 11:47 - 2015-10-29 01:43 - 00003894 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1446079381
2015-12-11 11:47 - 2015-10-29 01:42 - 00000000 ____D C:\Program Files (x86)\Opera
2015-12-09 04:39 - 2015-10-19 19:52 - 00301728 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-12-08 07:19 - 2015-11-07 00:25 - 00000000 ____D C:\Users\bartek\AppData\Local\Spotify
2015-12-08 07:15 - 2015-11-07 00:25 - 00000000 ____D C:\Users\bartek\AppData\Roaming\Spotify
2015-12-08 07:06 - 2015-11-02 19:21 - 00000000 ____D C:\Users\bartek\Desktop\muzyka youtube
2015-12-08 06:26 - 2015-11-02 18:36 - 00000000 ____D C:\Users\bartek\AppData\Roaming\DVDVideoSoft
2015-12-07 10:57 - 2015-10-29 01:46 - 00004052 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-07 10:57 - 2015-10-29 01:46 - 00003816 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-01 00:11 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\NDF
2015-11-30 18:01 - 2015-11-02 18:36 - 00001420 _____ C:\Users\Public\Desktop\Free YouTube To MP3 Converter.lnk
2015-11-30 18:01 - 2015-11-02 18:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2015-11-30 18:01 - 2015-11-02 18:36 - 00000000 ____D C:\Program Files (x86)\DVDVideoSoft
2015-11-27 00:06 - 2015-10-21 10:48 - 00000000 ____D C:\Users\bartek\AppData\Roaming\Skype
2015-11-19 10:37 - 2015-10-21 10:48 - 00000000 ____D C:\ProgramData\Skype

==================== Pliki w katalogu głównym wybranych folderów =======

2015-10-17 13:12 - 2015-12-14 23:14 - 0000125 _____ () C:\Users\bartek\AppData\Roaming\sp_data.sys
2014-05-15 18:14 - 2012-09-07 12:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-05-15 18:14 - 2009-07-22 11:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-05-15 18:14 - 2012-09-07 12:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS
2015-11-02 18:34 - 2015-12-14 22:52 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-08 07:32

==================== Koniec  FRST.txt ============================