Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:31-12-2015
Uruchomiony przez STERN WEBER POLSKA (administrator)  ARTUR (04-01-2016 10:46:45)
Uruchomiony z C:\Users\STERN WEBER POLSKA\Downloads
Załadowane profile: STERN WEBER POLSKA (Dostępne profile: STERN WEBER POLSKA)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_svc.exe
(RaMMicHaeL) C:\Program Files (x86)\Unchecky\bin\unchecky_bg.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Guillaume Ryder (hxxp://utilfr42.free.fr)) C:\Program Files\Clavier+\Clavier.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Flux Software LLC) C:\Users\STERN WEBER POLSKA\AppData\Local\FluxSoftware\Flux\flux.exe
(NirSoft) C:\Users\STERN WEBER POLSKA\Downloads\volumouse_polish\volumouse.exe
(AdFender, Inc.) C:\Program Files (x86)\AdFender\AdFender.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Stardock) C:\Program Files (x86)\Stardock\ObjectDockFree\Dock64.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Synology Inc.) C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\bin\cloud-ui.exe
(Synology Inc.) C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\bin\cloud-connect.exe
(Synology Inc.) C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\bin\cloud-daemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TheBestWare Studio) C:\Users\STERN WEBER POLSKA\AppData\Local\RadioSure\RadioSure.exe
(EJIE Technology) C:\Program Files (x86)\Clover\clover.exe
(ChemTable Software) C:\Program Files (x86)\Soft Organizer\SoftOrganizer.exe
() C:\Program Files (x86)\Soft Organizer\Reg64Call.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-12] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2186856 2011-01-10] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-15] (CANON INC.)
HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [689488 2008-03-11] (CANON INC.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5595848 2015-07-08] (ESET)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [2621240 2015-11-18] (Malwarebytes Corporation)
HKU\S-1-5-19\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [Sidebar] => %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [Clock Widget (HTC Home)] => "C:\Program Files (x86)\HTC Home\HTC Home 3\Clock.exe"
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [Clavier+] => C:\Program Files\Clavier+\Clavier.exe [88576 2010-04-25] (Guillaume Ryder (hxxp://utilfr42.free.fr))
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [F.lux] => C:\Users\STERN WEBER POLSKA\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\Run: [$Volumouse$] => C:\Users\STERN WEBER POLSKA\Downloads\volumouse_polish\volumouse.exe [35328 2013-07-15] (NirSoft)
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\...\MountPoints2: {aca6064d-4599-11e1-ae06-002215a96e88} - F:\LaunchU3.exe -a
ShellIconOverlayIdentifiers: [01UnsuppModule] -> {AEB16659-2125-4ADA-A4AB-45EE21E86469} => C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\icon-overlay\13\x64\iconOverlay.dll [2015-11-17] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [02SyncingModule] -> {48AB5ADA-36B1-4137-99C9-2BD97F8788AB} => C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\icon-overlay\13\x64\iconOverlay.dll [2015-11-17] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [03SyncedModule] -> {472CE1AD-5D53-4BCF-A1FB-3982A5F55138} => C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\icon-overlay\13\x64\iconOverlay.dll [2015-11-17] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [04ReadOnlyModule] -> {A433C3E0-8B24-40EB-93C3-4B10D9959F58} => C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\icon-overlay\13\x64\iconOverlay.dll [2015-11-17] (TODO: <Company name>)
ShellIconOverlayIdentifiers: [05NoPermModule] -> {C701AD67-3DF0-47C9-89CB-DFA6207BE229} => C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation\CloudStation.app\icon-overlay\13\x64\iconOverlay.dll [2015-11-17] (TODO: <Company name>)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AdFender.lnk [2015-11-13]
ShortcutTarget: AdFender.lnk -> C:\Program Files (x86)\AdFender\AdFender.exe (AdFender, Inc.)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk [2013-02-01]
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files (x86)\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
Startup: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Synology Cloud Station.lnk [2016-01-04]
ShortcutTarget: Synology Cloud Station.lnk -> C:\Program Files (x86)\Synology\CloudStation\bin\launcher.exe (Synology Inc.)
Startup: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SynTPEnh.exe — skrót.lnk [2015-11-27]
ShortcutTarget: SynTPEnh.exe — skrót.lnk -> C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated)
Startup: C:\Users\TEMP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk [2011-04-29]
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
BootExecute: autocheck autochk *  

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

ProxyServer: [S-1-5-21-3412699975-1278123406-526146009-1000] => 10.0.5.99:80
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 217.17.34.10 194.204.152.34
Tcpip\..\Interfaces\{30EFFC42-6F8C-4C84-A1CB-28A5D8C904BA}: [DhcpNameServer] 217.17.34.10 194.204.152.34
Tcpip\..\Interfaces\{FB8D0857-C5DE-4796-B3AE-374A98636912}: [NameServer] 8.8.8.8

Internet Explorer:
==================
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.onet.pl/
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
HKU\S-1-5-21-3412699975-1278123406-526146009-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://toshiba.eu/places?touch=4&cat=1
SearchScopes: HKLM -> DefaultScope {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> DefaultScope {10B53F7E-4073-4EDC-9C63-1BD31FE82E8D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {10B53F7E-4073-4EDC-9C63-1BD31FE82E8D} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {4040FF30-82A0-4C87-BD1D-D8FB4606EB39} URL = 
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {8AEAAB84-AE06-42E7-B5F9-B5A0858F7B18} URL = hxxp://rover.ebay.com/rover/1/4908-44618-9400-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-3412699975-1278123406-526146009-1000 -> {CE15DBA0-8A15-432B-A35F-D6BF56EABB7F} URL = hxxp://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO: ExplorerWatcher Class -> {F8A6CAA2-533D-4AED-9E05-8EB19A4021AB} -> C:\Program Files (x86)\Clover\TabHelper64.dll [2013-03-21] (EJIE Technology)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\ssv.dll [2015-11-26] (Oracle Corporation)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office_2010\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-26] (Oracle Corporation)
Handler: http - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: http - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: https - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: https - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: ipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: msdaipp - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku
Handler: msdaipp - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} -  Brak pliku

FireFox:
========
FF ProfilePath: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default
FF SelectedSearchEngine: DuckDuckGo
FF Homepage: onet.pl
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_267.dll [2016-01-01] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\PROGRA~1\TRACKE~1\PDFVIE~1\npPDFXCviewNPPlugin.dll [Brak pliku]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_267.dll [2016-01-01] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL [2011-04-21] (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files (x86)\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-26] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41105.0\npctrl.dll [2015-11-04] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\OFFICE~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\OFFICE~1\Office14\NPSPWRAP.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2012-03-08] (Microsoft Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\PROGRA~1\TRACKE~1\PDFVIE~1\Win32\npPDFXCviewNPPlugin.dll [Brak pliku]
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-01-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-01-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-01-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-01-16] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-01-16] (Apple Inc.)
FF SearchPlugin: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\searchplugins\duckduckgo.xml [2015-11-05]
FF SearchPlugin: C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\searchplugins\torrent-metasearch.xml [2016-01-04]
FF Extension: I don't care about cookies - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\jid1-KKzOGWgsW3Ao4Q@jetpack.xpi [2015-12-20]
FF Extension: uBlock - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{2b10c1c8-a11f-4bad-fe9c-1c11e82cac42}.xpi [2015-12-04]
FF Extension: FireFTP - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-11-28]
FF Extension: Video DownloadHelper - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-11-18]
FF Extension: Adblock Plus - C:\Users\STERN WEBER POLSKA\AppData\Roaming\Mozilla\Firefox\Profiles\ltk5326a.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-12-16]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => nie znaleziono
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird => nie znaleziono

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1353720 2015-07-08] (ESET)
S4 GFNEXSrv; C:\Windows\System32\GFNEXSrv.exe [162824 2010-09-09] ()
S4 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Brak podpisu cyfrowego]
R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [739640 2015-11-18] (Malwarebytes Corporation)
S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2013-01-17] (Puran Software) [Brak podpisu cyfrowego]
S4 Soda PDF 5 Helper Service; C:\Program Files (x86)\Soda PDF 5\HelperService.exe [1069408 2013-01-29] (LULU Software)
S4 Soda PDF 5 Service; C:\Program Files (x86)\Soda PDF 5\ConversionService.exe [794464 2013-01-29] (LULU Software)
R2 Unchecky; C:\Program Files (x86)\Unchecky\bin\Unchecky_svc.exe [163576 2015-08-05] (RaMMicHaeL)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [255240 2015-07-14] (ESET)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [251632 2015-07-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [178520 2015-07-14] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [231520 2015-07-14] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [53360 2015-07-14] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [72400 2015-07-14] (ESET)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2012-12-21] () [Brak podpisu cyfrowego]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14920 2012-12-21] () [Brak podpisu cyfrowego]
R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [63064 2015-11-18] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2012-12-21] () [Brak podpisu cyfrowego]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2012-12-21] () [Brak podpisu cyfrowego]
R1 GUBootStartup; C:\Windows\System32\drivers\GUBootStartup.sys [20160 2015-11-16] (Glarysoft Ltd)
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-04 10:46 - 2016-01-04 10:48 - 00021292 _____ C:\Users\STERN WEBER POLSKA\Downloads\FRST.txt
2016-01-04 10:46 - 2016-01-04 10:46 - 00000000 ____D C:\FRST
2016-01-04 10:45 - 2016-01-04 10:45 - 02370560 _____ (Farbar) C:\Users\STERN WEBER POLSKA\Downloads\FRST64.exe
2016-01-02 13:26 - 2016-01-02 13:26 - 00025005 _____ C:\Users\STERN WEBER POLSKA\Downloads\absolutely.anything.(2015).pol.1cd.(6436215).zip
2015-12-31 11:15 - 2015-12-31 11:15 - 00108088 _____ C:\Users\STERN WEBER POLSKA\AppData\Local\GDIPFONTCACHEV1.DAT
2015-12-31 11:13 - 2015-12-31 11:14 - 00432384 _____ C:\Windows\system32\FNTCACHE.DAT
2015-12-17 14:48 - 2015-12-17 14:48 - 06801752 _____ (Piriform Ltd) C:\Users\STERN WEBER POLSKA\Downloads\ccsetup512.exe
2015-12-17 13:26 - 2015-12-17 13:26 - 00064463 _____ C:\Users\STERN WEBER POLSKA\Downloads\AUTO TRANSLATED - es - 1988.Hawks.[Robert Ellis Miller].dutch.25.fps.srt
2015-12-17 12:45 - 2015-12-17 12:45 - 00051630 _____ C:\Users\STERN WEBER POLSKA\Downloads\Absolutely.Anything.2015.1080p.BluRay.x264-ROVERS.txt
2015-12-17 11:18 - 2015-12-17 11:18 - 00033241 _____ C:\Users\STERN WEBER POLSKA\Downloads\absolutely.anything.(2015).pol.1cd.(6413606).zip
2015-12-16 11:23 - 2015-12-16 11:23 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\{2C805F11-CF5E-40ED-8D04-5045D70C6DD1}
2015-12-09 10:54 - 2015-12-09 10:54 - 00000000 ____D C:\CM_VAULT
2015-12-09 10:45 - 2015-12-09 10:45 - 00281926 ____H C:\Users\)klsjtmjklwkxesuikidyq\AAODFupunbaklsjtmjklwkxeme.bmp
2015-12-09 10:45 - 2015-12-09 10:45 - 00006200 ____H C:\Users\)klsjtmjklwkxesuikidyq\^klsjtmjklwkxeguymvykp.tiff
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\Users\STERN WEBER POLSKA\Downloads\^mezklsjtmjklwkxewhnmw
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\Users\STERN WEBER POLSKA\Documents\!jklsjtmjklwkxecdzcetp
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\Users\STERN WEBER POLSKA\Desktop\&uiklsjtmjklwkxehywcsa
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\Users\STERN WEBER POLSKA\AAODFklsjtmjklwkxesuikidyq
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\Users\)klsjtmjklwkxesuikidyq
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\%ofupcgklsjtmjklwkxere
2015-12-09 10:45 - 2015-12-09 10:45 - 00000000 ___HD C:\!thmfcklsjtmjklwkxejos
2015-12-09 10:39 - 2015-12-09 10:39 - 00000000 __SHD C:\Windows\SysWOW64\AI_RecycleBin
2015-12-09 10:39 - 2015-12-09 10:39 - 00000000 ____D C:\Program Files\EasySync Solutions
2015-12-09 10:37 - 2015-12-09 10:37 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\EasySync Solutions
2015-12-09 00:07 - 2015-12-09 11:19 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\Downloaded Installations
2015-12-09 00:07 - 2015-12-09 11:19 - 00000000 ____D C:\ProgramData\BinaryNow

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-04 10:46 - 2009-07-14 04:20 - 00000000 ____D C:\Windows
2016-01-04 10:04 - 2009-07-14 05:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-01-04 10:04 - 2009-07-14 05:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-01-04 09:56 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-01-04 09:12 - 2015-02-06 10:20 - 00000000 ____D C:\ProgramData\Malwarebytes Anti-Exploit
2016-01-04 09:00 - 2013-02-17 21:54 - 00000000 ____D C:\ProgramData\TEMP
2016-01-02 14:36 - 2013-05-16 23:31 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\uTorrent
2016-01-02 00:52 - 2014-02-03 01:14 - 00000000 ____D C:\ProgramData\CanonIJPLM
2016-01-02 00:42 - 2015-04-13 13:50 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\MPC-HC
2016-01-01 18:06 - 2013-02-01 00:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HTC Home
2016-01-01 17:55 - 2013-03-27 23:11 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\TeraCopy
2016-01-01 17:54 - 2013-02-16 12:43 - 00000000 ____D C:\Users\STERN WEBER POLSKA\Downloads\Instalki
2016-01-01 17:54 - 2013-01-31 20:16 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\AdFender
2016-01-01 17:52 - 2015-12-04 16:26 - 00796864 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-01-01 17:52 - 2015-12-04 16:26 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-12-31 13:57 - 2013-02-16 23:31 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\ElevatedDiagnostics
2015-12-29 10:05 - 2014-03-10 16:33 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-12-29 10:05 - 2014-03-10 16:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-12-29 09:28 - 2014-03-10 16:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-12-18 22:18 - 2011-02-14 10:01 - 00738208 _____ C:\Windows\system32\perfh015.dat
2015-12-18 22:18 - 2011-02-14 10:01 - 00154864 _____ C:\Windows\system32\perfc015.dat
2015-12-18 22:18 - 2009-07-14 06:13 - 01663484 _____ C:\Windows\system32\PerfStringBackup.INI
2015-12-18 22:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2015-12-18 22:14 - 2013-03-24 21:06 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\AVI ReComp
2015-12-17 14:49 - 2015-05-14 22:50 - 00000000 ____D C:\ProgramData\Unchecky
2015-12-17 14:44 - 2014-06-25 09:05 - 00000000 ____D C:\Program Files (x86)\Glary Utilities 5
2015-12-17 13:15 - 2013-02-17 23:00 - 00000000 ____D C:\Users\STERN WEBER POLSKA\dwhelper
2015-12-17 12:50 - 2013-02-03 19:58 - 00000000 ____D C:\Program Files (x86)\Narzędzia
2015-12-09 11:20 - 2011-10-19 16:26 - 00000000 ____D C:\Users\STERN WEBER POLSKA
2015-12-09 11:19 - 2015-09-17 08:52 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\CloudStation
2015-12-09 11:19 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\registration
2015-12-05 13:14 - 2011-10-19 16:26 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Roaming\Macromedia
2015-12-05 13:13 - 2015-03-05 20:08 - 00000000 ____D C:\Users\STERN WEBER POLSKA\AppData\Local\Adobe

==================== Pliki w katalogu głównym wybranych folderów =======

2013-02-16 12:26 - 2013-01-29 11:21 - 0654936 _____ (Sysinternals - www.sysinternals.com) C:\Program Files\autoruns.exe
2013-02-08 21:03 - 2013-02-08 21:36 - 1090153 _____ () C:\Program Files\Autoruns.zip
2013-02-09 14:32 - 2013-02-06 01:33 - 1252424 _____ (Wieldraaijer) C:\Program Files\CheckDiskGUI.exe
2013-02-09 14:33 - 2013-02-09 14:33 - 0000928 _____ () C:\Program Files\CheckDiskGUI.ini
2013-02-02 00:12 - 2011-04-28 14:10 - 0446464 _____ (OldTimer Tools) C:\Program Files\TFC.exe
2013-02-04 00:44 - 2014-03-18 16:24 - 0000339 _____ () C:\Users\STERN WEBER POLSKA\AppData\Roaming\prio.ini
2014-03-12 15:09 - 2014-03-12 15:18 - 0004608 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-01 13:21 - 2013-10-01 13:21 - 0000781 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\recently-used.xbel
2013-02-02 01:25 - 2014-05-25 16:40 - 0007648 _____ () C:\Users\STERN WEBER POLSKA\AppData\Local\Resmon.ResmonCfg
2013-03-24 01:40 - 2013-03-24 01:40 - 0005009 _____ () C:\ProgramData\surkpqid.bdr

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-12-30 00:07

==================== Koniec  FRST.txt ============================