Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:20-12-2015
Uruchomiony przez Michal (administrator)  MICHALKOMPUTER (20-12-2015 23:22:12)
Uruchomiony z C:\Users\Michal\Downloads
Załadowane profile: Michal (Dostępne profile: Michal)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe
() C:\ProgramData\Soloeco\Soloeco.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtWLan.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Spotify Ltd) C:\Users\Michal\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\ProgramData\Soloeco\Soloeco.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Michal\Downloads\FRST64 (1).exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Run: [SpybotPostWindows10UpgradeReInstall] => C:\Program Files\Common Files\AV\Spybot - Search and Destroy\Test.exe [1011200 2015-07-28] (Safer-Networking Ltd.)
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Run: [Spotify Web Helper] => C:\Users\Michal\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2008632 2015-08-30] (Spotify Ltd)
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Run: [BigFatVoiceSystem] => C:\Users\Michal\Desktop\BOL\BoL+Studio\BoL+Studio\Scripts\BigFatVoiceSystem.exe
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\Policies\Explorer: [NoCDBurning] 1
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\...\MountPoints2: {cc7e7ade-a25c-11e5-b0f3-001822dd3b0e} - F:\LGAutoRun.exe
HKU\S-1-5-18\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoInternetOpenWith] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoCDBurning] 1
AppInit_DLLs: C:\ProgramData\Soloeco\Vilastring.dll => C:\ProgramData\Soloeco\Vilastring.dll [883200 2015-10-01] ()
AppInit_DLLs-x32: C:\ProgramData\Soloeco\Freshdom.dll => C:\ProgramData\Soloeco\Freshdom.dll [738816 2015-10-01] ()
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

ProxyServer: [S-1-5-21-2837671372-3707443137-3094779737-1001] => http=;ftp=;https=;
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{4C93ED57-375B-4A66-8BDD-A1AD2ABA2466}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{76BD22BB-1DD8-442D-BB38-83B2C215E217}: [DhcpNameServer] 8.8.8.8 8.8.4.4

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\.DEFAULT\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnkdYvIvvwfEYzwmkwM3HPmqx6qf2uqUBUFjZB9empTuO0A9QFOmvLgK8s60vUDDNmY8SZarkaINFbPy403_eakWboU-JGA2BZtCAAZFKjD5s7HKIc64sDnSiWUADMhQtls7viM8HDyeVxynM6h7ckS2Mwbc6y-qClD1L&q={searchTerms}
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnkdYvIvvwfEYzwmkwM3HPmqx6qf2uqUBUFjZB9empTuO0A9QFOmvLgK8s60vUDDNmY8SZarkaINFbPy403_eakWboU-JGA2BZtCAAZFKjD5s7HKIc64sDnSiWUADMhQtls7viM8HDyeVxynM6h7ckS2Mwbc6y-qClD1L&q={searchTerms}
HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBFnkdYvIvvwfEYzwmkwM3HPmqx6qf2uqUBUFjZB9empTuO0A9QFOmvLgK8s60vUDDNmY8SZarkaINFbPy403_eakWboU-JGA2BZtCAAZFKjD5s7HKIc64sDnSiWUADMhQtls7viM8HDyeVxynM6h7ckS2Mwbc6y-qClD1L&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {ielnksrch} URL = 
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {637D6E3C-DF93-48A5-8362-159A8AC56B11} URL = hxxp://www.google.com/search?hl=en&q={searchTerms}&meta=
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2015-10-21] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-21] (Oracle Corporation)
IE Session Restore: HKU\S-1-5-21-2837671372-3707443137-3094779737-1001 -> [funkcja włączona]

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll [2015-12-15] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll [2015-12-15] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-21] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-14] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-09-30] (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Profile 2 -> gazeta.allplayer.org/
CHR StartupUrls: Profile 2 -> "","hxxp://www.gazeta.pl/0,0.html?p=154"
CHR Session Restore: Profile 2 -> [funkcja włączona]
CHR Profile: C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Przelewy24) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\adlghgifgkapabijdmenlghpcjhaojnp [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Dokumenty Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Dysk Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-07-17] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (YouTube) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Adblock Plus) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-07-15] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Google Search) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-07]
CHR Extension: (Tampermonkey) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Christmas Lights Theme) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\dojhihmbofgblnnjkgilnggdbkabdpbf [2015-07-07]
CHR Extension: (Grepolis Report Converter Revolution Tools) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\eediamimojgbnjfaalcnlonenfdcogop [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (AdBlock) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-07-16] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (IE Tab) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (ProxMate) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (2048) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcjbnkncddbeomhaacaeokhfnefibpde [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (PDF to Word Converter App) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\jclipofobaadknkadkpgggmjkebddjam [2015-07-07]
CHR Extension: (Evernote Web) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol [2015-07-07] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-07-24] [UpdateUrl: hxxps://mynamedomain.koko/00service/update2/crx] <==== UWAGA
CHR Extension: (Gmail) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-07]
CHR Profile: C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Prezentacje Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-09-30]
CHR Extension: (Dokumenty Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2015-09-30]
CHR Extension: (Dysk Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-23]
CHR Extension: (YouTube) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-30]
CHR Extension: (Adblock Plus) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-10-01]
CHR Extension: (Google Search) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-29]
CHR Extension: (Gazeta.pl) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\efhdjkbfpoohkmfaldijcpbnmbpefpkb [2015-09-30]
CHR Extension: (Arkusze Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-09-30]
CHR Extension: (Dokumenty Google offline) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-10-01]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-01]
CHR Extension: (Gmail) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-09-30]
CHR Profile: C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2
CHR Extension: (Prezentacje Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-10-30]
CHR Extension: (Przelewy24) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\adlghgifgkapabijdmenlghpcjhaojnp [2015-10-30]
CHR Extension: (Dokumenty Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\aohghmighlieiainnegkcijnfilokake [2015-10-30]
CHR Extension: (Dysk Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-30]
CHR Extension: (YouTube) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-10-30]
CHR Extension: (Adblock Plus) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-12-14]
CHR Extension: (Google Search) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-30]
CHR Extension: (Tampermonkey) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2015-12-18]
CHR Extension: (Christmas Lights Theme) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\dojhihmbofgblnnjkgilnggdbkabdpbf [2015-10-30]
CHR Extension: (Arkusze Google) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-10-30]
CHR Extension: (Dokumenty Google offline) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-14]
CHR Extension: (AdBlock) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-12-14]
CHR Extension: (IE Tab) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\hehijbfgiekmjfkfjpbkbammjbdenadd [2015-12-14]
CHR Extension: (Proxmate) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki [2015-12-18]
CHR Extension: (PDF to Word Converter App) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\jclipofobaadknkadkpgggmjkebddjam [2015-10-30]
CHR Extension: (Evernote Web) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\lbfehkoinhhcknnbdgnnmjhiladcgbol [2015-10-30]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-10-30]
CHR Extension: (Gmail) - C:\Users\Michal\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-10-30]
CHR HKU\S-1-5-21-2837671372-3707443137-3094779737-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [efhdjkbfpoohkmfaldijcpbnmbpefpkb] - C:\Program Files (x86)\ALLPlayer\AllPlayer.crx [2015-07-09]
CHR HKLM-x32\...\Chrome\Extension: [efhdjkbfpoohkmfaldijcpbnmbpefpkb] - C:\Program Files (x86)\ALLPlayer\AllPlayer.crx [2015-07-09]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 RealtekCU; C:\Program Files (x86)\REALTEK\USB Wireless LAN Utility\RtlService.exe [36864 2012-05-10] (Realtek Semiconductor Corp.) [Brak podpisu cyfrowego]
R2 Soloeco; C:\ProgramData\\Soloeco\\Soloeco.exe [441856 2015-09-20] () [Brak podpisu cyfrowego]
R2 Themes; C:\Windows\system32\themeservice.dll [44544 2014-06-05] (Microsoft Corporation) [Brak podpisu cyfrowego]
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2014-05-15] (Microsoft Corporation)
S2 WajInterEnhancer Service; C:\Program Files (x86)\WajInterEnhancer\WajInterEnhancer Internet Enhancer\InternetEnhancerService.exe [X]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-07-07] (REALiX(tm))
R3 RtlWlanu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1525904 2012-11-07] (Realtek Semiconductor Corporation                           )

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-20 23:20 - 2015-12-20 23:20 - 02370560 _____ (Farbar) C:\Users\Michal\Downloads\FRST64 (1).exe
2015-12-20 23:20 - 2015-12-20 23:20 - 00380416 _____ C:\Users\Michal\Downloads\rnh2leri.exe
2015-12-19 02:43 - 2015-12-19 02:43 - 00149908 _____ C:\Users\Michal\Downloads\BES-kol1-2015L.pdf
2015-12-19 02:26 - 2015-12-19 02:28 - 00005622 _____ C:\Users\Michal\Desktop\Rkill.txt
2015-12-19 02:26 - 2015-12-19 02:26 - 02032072 _____ (Bleeping Computer, LLC) C:\Users\Michal\Downloads\rkill.exe
2015-12-19 02:13 - 2015-12-19 02:15 - 00000000 ____D C:\AdwCleaner
2015-12-19 02:05 - 2015-12-19 02:05 - 01740288 _____ C:\Users\Michal\Downloads\AdwCleaner.exe
2015-12-16 20:58 - 2015-12-16 20:58 - 00000000 ____D C:\Users\Michal\Desktop\Sesja Zimowa 2015_2016
2015-12-04 11:00 - 2015-12-15 20:41 - 00000000 ____D C:\Users\Michal\Desktop\Nowy folder

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-12-20 23:22 - 2015-08-14 14:16 - 00020131 _____ C:\Users\Michal\Downloads\FRST.txt
2015-12-20 23:22 - 2015-08-14 14:15 - 00000000 ____D C:\FRST
2015-12-20 23:14 - 2015-10-01 11:03 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-20 23:04 - 2015-08-16 16:52 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-20 23:04 - 2009-07-14 05:45 - 00016656 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-12-20 23:04 - 2009-07-14 05:45 - 00016656 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-12-20 17:50 - 2015-10-01 11:03 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-20 17:50 - 2015-10-01 10:01 - 00000000 ____D C:\ProgramData\Soloeco
2015-12-20 17:50 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-19 20:04 - 2015-07-09 20:40 - 00000000 ____D C:\Users\Michal\AppData\Roaming\uTorrent
2015-12-19 01:51 - 2011-04-12 14:21 - 00718222 _____ C:\Windows\system32\perfh015.dat
2015-12-19 01:51 - 2011-04-12 14:21 - 00147048 _____ C:\Windows\system32\perfc015.dat
2015-12-19 01:51 - 2009-07-14 06:13 - 01609580 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-19 01:51 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2015-12-17 06:22 - 2015-10-01 11:04 - 00002199 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-12-15 13:31 - 2015-08-16 16:52 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-12-15 13:31 - 2015-08-16 16:52 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-15 13:31 - 2015-08-16 16:52 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-14 13:32 - 2015-09-14 15:39 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-12-14 12:08 - 2015-10-01 11:03 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-14 12:08 - 2015-10-01 11:03 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-07 21:05 - 2015-07-22 20:02 - 00000000 ____D C:\Users\Michal\AppData\Local\ElevatedDiagnostics
2015-12-07 21:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2015-12-06 11:01 - 2015-10-01 10:00 - 00003878 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1443690007
2015-12-06 11:01 - 2015-10-01 09:58 - 00000000 ____D C:\Program Files (x86)\Opera
2015-12-04 14:18 - 2015-07-06 23:10 - 00000000 ____D C:\Users\Michal\Desktop\ZDJECIA

==================== Pliki w katalogu głównym wybranych folderów =======

2015-09-07 21:23 - 2015-09-07 21:23 - 1000448 ____H () C:\Users\Michal\AppData\Local\FL6FSOXUY0.dll

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\Michal\Volumeid.exe


Niektóre pliki w TEMP:
====================
C:\Users\Michal\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\Michal\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll
[2010-11-21 04:24] - [2010-11-21 04:24] - 1008640 ____A (Microsoft Corporation) E573BD9AB55C8E333C202B9E255F972E

C:\Windows\SysWOW64\User32.dll
[2015-08-13 14:14] - [2015-08-13 14:14] - 0833024 ____A (Microsoft Corporation) 2C9CC9F492CA596B1B9FC1AE5E916356

C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-20 04:13

==================== Koniec  FRST.txt ============================