Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:22-05-2016 01 Uruchomiony przez Kamila (administrator) SAMSUNG (23-05-2016 19:33:29) Uruchomiony z C:\Users\Kamila\Downloads Załadowane profile: Kamila (Dostępne profile: Kamila) Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 9 (Domyślna przeglądarka: "D:\Program Files (x86)\firefox.exe" -osint -url "%1") Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunterNew\SH4Service.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe () C:\Program Files (x86)\PLAY ONLINE\PLAY ONLINE.exe (Power Software Ltd) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Mozilla Corporation) D:\Program Files (x86)\firefox.exe (Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.EXE (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-13] (ELAN Microelectronics Corp.) HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [336992 2012-12-09] (Power Software Ltd) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [7400576 2016-05-22] (AVAST Software) HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE -> HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8591272 2015-11-16] (Piriform Ltd) HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: F - F:\autorun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: G - G:\autorun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {1b41561c-0df9-11e2-bb21-90a4dee0693d} - G:\Uruchom.EXE HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {1f5b2797-38e2-11e5-bdb8-90a4dee0693d} - J:\LGAutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {2880e441-eed0-11e5-bb45-90a4dee0693d} - F:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {2880e458-eed0-11e5-bb45-90a4dee0693d} - F:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {32b57d33-9659-11e4-b347-90a4dee0693d} - F:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {32b57d45-9659-11e4-b347-90a4dee0693d} - F:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {7603ba45-34ed-11e3-808e-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {798e8f86-034a-11e3-93b2-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {798e8fa0-034a-11e3-93b2-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {7e9433a3-8836-11e3-baa1-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {7e9433ad-8836-11e3-baa1-90a4dee0693d} - F:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {d71ed3bd-41f7-11e3-bf88-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\...\MountPoints2: {d71ed3ca-41f7-11e3-bf88-90a4dee0693d} - H:\AutoRun.exe HKU\S-1-5-21-3103525249-1077354125-3941522485-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\windows\system32\PROMEDIN.SCR HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-05-21] (AVAST Software) ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2012-06-05] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2012-06-05] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2012-06-05] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2012-06-05] (GG Network S.A.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2015-12-15] ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\..\Interfaces\{47AE1583-2E2A-4264-820A-40409B18D59B}: [NameServer] 89.108.195.21 89.108.202.21 Internet Explorer: ================== HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://samsung.msn.com SearchScopes: HKLM -> DefaultScope - brak wartości SearchScopes: HKLM-x32 -> DefaultScope - brak wartości SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2012-08-16] (Microsoft Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-05-21] (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation) BHO-x32: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2012-08-16] (Microsoft Corporation) BHO-x32: IVONA Reader -> {8664889D-ED18-4713-918F-E2BB69D8452B} -> D:\Program Files (x86)\IVONA\IVONA Reader\integr\IR_iexplorer2.dll => Brak pliku BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-05-21] (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.) BHO-x32: Samsung BHO Class -> {AA609D72-8482-4076-8991-8CDAE5B93BCB} -> C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll => Brak pliku BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation) BHO-x32: QUICKfind BHO Object -> {C08DF07A-3E49-4E25-9AB0-D3882835F153} -> C:\PROGRA~2\TEXTware\QUICKF~1\PlugIns\IEHelp.dll => Brak pliku Toolbar: HKLM - IVONA Reader - {8664889D-ED18-4713-918F-E2BB69D8452B} - D:\Program Files (x86)\IVONA\IVONA Reader\integr\IR_iexplorer2_x64.dll [2009-10-14] (IVO Software Sp. z o.o.) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll [2014-03-11] (Microsoft Corporation.) Toolbar: HKLM-x32 - IVONA Reader - {8664889D-ED18-4713-918F-E2BB69D8452B} - D:\Program Files (x86)\IVONA\IVONA Reader\integr\IR_iexplorer2.dll Brak pliku Toolbar: HKLM-x32 - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll [2014-03-11] (Microsoft Corporation.) Toolbar: HKU\S-1-5-21-3103525249-1077354125-3941522485-1000 -> Brak nazwy - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - Brak pliku Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2011-11-03] (Skype Technologies) Handler-x32: textwareilluminatorbase - {CE5CD329-1650-414A-8DB0-4CBF72FAED87} - C:\windows\SysWow64\textwareilluminatorbaseProtocol.dll [2002-09-27] () FireFox: ======== FF ProfilePath: C:\Users\Kamila\AppData\Roaming\Mozilla\Firefox\Profiles\occ64tdh.default-1458596182055 FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-05-03] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-05-03] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Users\Kamila\AppData\Roaming\mozilla\plugins\np-mswmp.dll [2010-12-27] (Microsoft Corporation) FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\avg-secure-search.xml [2013-08-14] FF Extension: Google Translator for Firefox - C:\Users\Kamila\AppData\Roaming\Mozilla\Firefox\Profiles\occ64tdh.default-1458596182055\extensions\translator@zoli.bod.xpi [2016-04-27] FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2016-05-06] [Brak podpisu cyfrowego] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-05-22] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF Chrome: ======= CHR Profile: C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Prezentacje Google) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-23] CHR Extension: (Dokumenty Google) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-23] CHR Extension: (Dysk Google) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-23] CHR Extension: (YouTube) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-23] CHR Extension: (Google Search) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-23] CHR Extension: (San Francisco at Night 1680x1050) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\feenbcjmkkbpbbcohggicpenllmbfknp [2016-02-23] CHR Extension: (Arkusze Google) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-23] CHR Extension: (Dokumenty Google offline) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-15] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-05-15] CHR Extension: (Gmail) - C:\Users\Kamila\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-23] ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [243296 2016-05-21] (AVAST Software) R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [370656 2016-05-22] (AVAST Software) S3 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [Brak podpisu cyfrowego] R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () S2 KMService; C:\windows\SysWOW64\srvany.exe [8192 2013-07-31] () [Brak podpisu cyfrowego] S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [267824 2007-05-04] (Nero AG) S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2016-03-20] () R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunterNew\SH4Service.exe [770944 2015-01-30] (Enigma Software Group USA, LLC.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) S2 btwdins; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [X] S2 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe /DisableUI [X] S2 FirebirdGuardianDefaultInstance; C:\Program Files (x86)\Firebird\Firebird_2_0\bin\fbguard.exe -s [X] S3 FirebirdServerDefaultInstance; C:\Program Files (x86)\Firebird\Firebird_2_0\bin\fbserver.exe -s [X] S2 RichVideo; "C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe" [X] ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2011-09-06] (LG Electronics Inc.) S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [35840 2011-09-06] (LG Electronics Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-05-21] (AVAST Software) R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-05-21] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [107792 2016-05-21] (AVAST Software) R3 aswNetNd6; C:\Windows\System32\DRIVERS\aswNetNd6.sys [28312 2016-05-22] (AVAST Software) R1 aswNetSec; C:\Windows\system32\drivers\aswNetSec.sys [536312 2016-05-22] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-05-21] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-05-21] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1070904 2016-05-21] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [465792 2016-05-21] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [166432 2016-05-21] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [287528 2016-05-21] (AVAST Software) R1 avgtp; C:\windows\system32\drivers\avgtpx64.sys [45856 2013-05-20] (AVG Technologies) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2016-05-20] (Enigma Software Group USA, LLC.) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-01-30] () R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [229376 2016-03-20] (Huawei Technologies Co., Ltd.) S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-01-31] (Windows (R) 2003 DDK 3790 provider) ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-05-23 19:33 - 2016-05-23 19:34 - 00020653 ____C C:\Users\Kamila\Downloads\FRST.txt 2016-05-23 19:31 - 2016-05-23 19:33 - 00000000 ___DC C:\FRST 2016-05-23 18:41 - 2016-05-23 18:41 - 02383360 ____C (Farbar) C:\Users\Kamila\Downloads\FRST64.exe 2016-05-22 22:02 - 2016-05-22 22:02 - 00125702 ____C C:\Users\Kamila\Desktop\Extras.Txt 2016-05-22 21:25 - 2016-05-22 21:25 - 00119888 ____C C:\Users\Kamila\Desktop\OTL.Txt 2016-05-22 21:21 - 2016-05-22 21:21 - 00125702 ____C C:\Users\Kamila\Downloads\Extras.Txt 2016-05-22 21:14 - 2016-05-22 21:14 - 00119888 ____C C:\Users\Kamila\Downloads\OTL.Txt 2016-05-22 20:46 - 2016-05-22 20:46 - 00001922 ____C C:\Users\Public\Desktop\Avast Premier.lnk 2016-05-22 20:46 - 2016-05-22 20:46 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2016-05-22 20:40 - 2016-05-22 20:37 - 00536312 ____C (AVAST Software) C:\windows\system32\Drivers\aswNetSec.sys 2016-05-22 20:39 - 2016-05-22 20:39 - 00601088 ____C (OldTimer Tools) C:\Users\Kamila\Downloads\OTL_3.2.70.2.exe 2016-05-22 20:38 - 2016-05-21 01:02 - 00398152 ____C (AVAST Software) C:\windows\system32\aswBoot.exe 2016-05-22 20:37 - 2016-05-22 20:37 - 00028312 ____C (AVAST Software) C:\windows\system32\Drivers\aswNetNd6.sys 2016-05-22 20:36 - 2016-05-22 20:36 - 00602112 ____C (OldTimer Tools) C:\Users\Kamila\Downloads\OTL.exe.part 2016-05-22 20:04 - 2016-05-22 20:05 - 05139680 ____C (AVAST Software) C:\Users\Kamila\Downloads\avast_premier_antivirus_setup_online.exe 2016-05-22 19:41 - 2016-05-20 21:31 - 00285747 ____C C:\shldr 2016-05-22 19:41 - 2016-05-20 21:31 - 00008192 ____C C:\shldr.mbr 2016-05-22 18:54 - 2016-05-22 18:54 - 00001054 ____C C:\Users\Kamila\Desktop\pytanie na forum.txt 2016-05-22 10:56 - 2016-05-22 10:56 - 00000000 ___DC C:\ProgramData\Kaspersky Lab Setup Files 2016-05-22 10:46 - 2016-05-22 10:49 - 161364680 ____C (Kaspersky Lab) C:\Users\Kamila\Downloads\kav16.0.0.614pl-pl.exe 2016-05-22 10:26 - 2016-05-22 10:29 - 00002994 ____C C:\RannohDecryptor.1.9.1.1_22.05.2016_10.26.04_log.txt 2016-05-22 10:26 - 2016-05-22 10:28 - 00000000 ___DC C:\Users\Kamila\Downloads\sample-pics 2016-05-22 10:25 - 2016-05-22 10:25 - 05812288 ____C C:\Users\Kamila\Downloads\sample-pics.zip 2016-05-22 10:22 - 2016-05-22 10:25 - 00002652 ____C C:\RannohDecryptor.1.9.1.1_22.05.2016_10.22.38_log.txt 2016-05-22 10:22 - 2016-05-22 10:22 - 00648344 ____C (Kaspersky Lab ZAO) C:\Users\Kamila\Downloads\rannohdecryptor(1).exe 2016-05-22 10:11 - 2016-05-22 10:12 - 00002598 ____C C:\ScatterDecryptor.2.0.0.1_22.05.2016_10.11.17_log.txt 2016-05-22 10:11 - 2016-05-22 10:11 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\gnupg 2016-05-22 10:10 - 2016-05-22 10:10 - 01500817 ____C C:\Users\Kamila\Downloads\ScatterDecryptor.zip 2016-05-22 10:08 - 2016-05-22 10:09 - 00002458 ____C C:\RannohDecryptor.1.9.1.1_22.05.2016_10.08.00_log.txt 2016-05-22 10:07 - 2016-05-22 10:07 - 00648344 ____C (Kaspersky Lab ZAO) C:\Users\Kamila\Downloads\rannohdecryptor.exe 2016-05-22 09:50 - 2016-05-22 09:51 - 00452424 ____C (Bleeping Computer, LLC) C:\Users\Kamila\Downloads\ListCWall.exe 2016-05-21 11:36 - 2016-05-21 11:36 - 00001072 ____C C:\Users\Kamila\Desktop\SpyHunter4.lnk 2016-05-21 11:36 - 2016-05-21 11:36 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpyHunter4 2016-05-21 11:36 - 2015-01-30 17:12 - 00019984 ____C C:\windows\system32\Drivers\EsgScanner.sys 2016-05-21 04:05 - 2016-05-22 20:46 - 00003948 ____C C:\windows\System32\Tasks\SafeZone scheduled Autoupdate 1463796243 2016-05-21 04:05 - 2016-05-21 04:05 - 00001037 ____C C:\Users\Public\Desktop\Avast SafeZone Browser.lnk 2016-05-21 04:05 - 2016-05-21 04:05 - 00001037 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast SafeZone Browser.lnk 2016-05-21 03:28 - 2016-05-21 03:28 - 00002201 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-05-21 03:28 - 2016-05-21 03:28 - 00002189 ____C C:\Users\Public\Desktop\Google Chrome.lnk 2016-05-21 03:24 - 2016-05-21 03:24 - 00000000 ____C C:\Users\Kamila\AppData\Local\{5898D33D-12F7-4D42-A119-E0FAEBCBF04B} 2016-05-21 01:28 - 2016-05-21 01:27 - 00037144 ____C (AVAST Software) C:\windows\system32\Drivers\aswKbd.sys 2016-05-21 01:14 - 2016-05-21 01:14 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\AVAST Software 2016-05-21 01:05 - 2016-05-22 20:40 - 00003924 ____C C:\windows\System32\Tasks\avast! Emergency Update 2016-05-21 01:05 - 2016-05-21 01:02 - 01070904 ____C (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00465792 ____C (AVAST Software) C:\windows\system32\Drivers\aswSP.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00287528 ____C (AVAST Software) C:\windows\system32\Drivers\aswVmm.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00166432 ____C (AVAST Software) C:\windows\system32\Drivers\aswStm.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00107792 ____C (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00103064 ____C (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00074544 ____C (AVAST Software) C:\windows\system32\Drivers\aswRvrt.sys 2016-05-21 01:05 - 2016-05-21 01:02 - 00037656 ____C (AVAST Software) C:\windows\system32\Drivers\aswHwid.sys 2016-05-21 01:02 - 2016-05-21 01:02 - 00052184 ____C (AVAST Software) C:\windows\avastSS.scr 2016-05-21 00:53 - 2016-05-21 01:27 - 00000000 ___DC C:\Program Files\AVAST Software 2016-05-21 00:28 - 2016-05-21 00:28 - 05139680 ____C (AVAST Software) C:\Users\Public\Desktop\avast_premier_antivirus_setup_online.exe 2016-05-21 00:15 - 2016-05-21 00:15 - 00168328 ____C C:\Users\Kamila\AppData\Local\GDIPFONTCACHEV1.DAT 2016-05-21 00:00 - 2016-05-22 13:12 - 00705046 ____C C:\windows\ntbtlog.txt 2016-05-21 00:00 - 2016-05-21 00:00 - 00530192 ____C C:\windows\system32\FNTCACHE.DAT 2016-05-20 22:48 - 2016-05-20 22:52 - 00010846 ____C C:\Users\Kamila\Documents\cc_20160520_222644.reg 2016-05-20 21:33 - 2016-05-20 21:33 - 00000000 ____C C:\autoexec.bat 2016-05-20 21:32 - 2016-05-20 21:32 - 00001087 ____C C:\Users\Kamila\Desktop\SpyHunter.lnk 2016-05-20 21:32 - 2016-05-20 21:32 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\Enigma Software Group 2016-05-20 21:31 - 2016-05-20 21:31 - 00000000 ____D C:\sh4ldr 2016-05-20 21:29 - 2016-05-21 11:36 - 00000000 ___DC C:\Program Files\Enigma Software Group 2016-05-20 17:15 - 2016-05-20 17:15 - 00000664 ____C C:\Users\Public\Desktop\Mozilla Firefox.lnk 2016-05-20 17:15 - 2016-05-20 17:15 - 00000664 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2016-05-06 09:12 - 2016-05-20 17:12 - 00000000 ___DC C:\Program Files (x86)\Mozilla Firefox 2016-04-26 22:14 - 2016-04-26 22:14 - 00000000 ___DC C:\Users\Kamila\Documents\CyberLink ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-05-23 17:27 - 2012-11-26 14:40 - 00003966 _____ C:\windows\System32\Tasks\User_Feed_Synchronization-{3E4A6B67-CF05-4504-830A-6E4FEB166EF9} 2016-05-23 17:21 - 2009-07-14 06:45 - 00021200 ___HC C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-05-23 17:21 - 2009-07-14 06:45 - 00021200 ___HC C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-05-23 17:11 - 2013-06-07 21:25 - 00000350 ____C C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job 2016-05-23 17:11 - 2013-06-03 13:32 - 00000350 ____C C:\windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2016-05-23 17:11 - 2009-07-14 07:08 - 00000006 ___HC C:\windows\Tasks\SA.DAT 2016-05-23 07:19 - 2012-12-22 19:36 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\GG 2016-05-23 06:35 - 2012-01-12 18:55 - 00697912 ____C C:\windows\system32\perfh015.dat 2016-05-23 06:35 - 2012-01-12 18:55 - 00134990 ____C C:\windows\system32\perfc015.dat 2016-05-23 06:35 - 2009-07-14 07:13 - 01549696 ____C C:\windows\system32\PerfStringBackup.INI 2016-05-23 06:35 - 2009-07-14 05:20 - 00000000 ___DC C:\windows\inf 2016-05-23 05:28 - 2012-10-03 15:05 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Urządzenia interfejsu Bluetooth 2016-05-22 21:43 - 2012-01-12 03:10 - 00000000 ___DC C:\Program Files\Samsung AnyWeb Print 2016-05-21 19:55 - 2013-03-14 23:54 - 00003108 _____ C:\windows\System32\Tasks\{5C18285F-D44B-4AFD-94C4-DDC0C54167C8} 2016-05-21 16:09 - 2014-08-27 00:40 - 00001279 ____C C:\Users\Public\Desktop\FLV and Media Player.lnk 2016-05-21 16:09 - 2013-03-14 23:46 - 00001145 ____C C:\Users\Public\Desktop\Mistrz Wizażu 2.lnk 2016-05-21 15:45 - 2012-12-22 19:36 - 00001151 ____C C:\Users\Kamila\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GG.lnk 2016-05-21 14:40 - 2012-01-12 04:16 - 00001374 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk 2016-05-21 14:40 - 2012-01-12 04:16 - 00001305 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk 2016-05-21 14:40 - 2012-01-12 04:13 - 00001458 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2016-05-21 14:40 - 2012-01-12 04:11 - 00002486 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk 2016-05-21 14:38 - 2012-10-04 17:11 - 00001134 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wielki słownik PWN-OXFORD.lnk 2016-05-21 14:23 - 2014-07-11 15:35 - 00001023 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk 2016-05-21 08:41 - 2013-04-19 16:15 - 00000000 ___DC C:\Program Files (x86)\Google 2016-05-21 01:27 - 2012-12-21 12:45 - 00000000 ___DC C:\ProgramData\AVAST Software 2016-05-21 00:14 - 2014-09-08 19:50 - 00192216 ____C (Malwarebytes) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2016-05-20 21:32 - 2012-10-02 18:50 - 00000000 ___DC C:\Users\Kamila 2016-05-20 21:05 - 2014-08-27 08:27 - 00000000 ___DC C:\Users\Kamila\dwhelper 2016-05-20 21:05 - 2013-11-13 09:51 - 00000000 ___DC C:\_TransEN-kompas-4 2016-05-20 21:05 - 2012-12-22 19:38 - 00000000 ___DC C:\Users\Kamila\GG dysk 2016-05-20 20:44 - 2015-06-15 16:03 - 00000000 ___DC C:\Users\Kamila\Documents\Anki 2016-05-20 20:42 - 2013-11-13 09:51 - 00000000 ___DC C:\TĹ‚umacz i SĹ‚ownik JÄ™zyka Angielskiego 4 KOMPAS 2016-05-20 20:42 - 2012-10-29 01:18 - 00000000 ___DC C:\Users\Kamila\.FBReader 2016-05-20 20:36 - 2013-10-31 13:54 - 00000000 ___DC C:\AdwCleaner 2016-05-20 09:41 - 2014-09-08 19:50 - 00000781 ____C C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2016-05-20 09:41 - 2014-09-08 19:50 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2016-05-20 09:32 - 2015-07-02 02:36 - 00002441 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2016-05-17 19:35 - 2012-12-28 21:35 - 00000000 ___DC C:\Program Files (x86)\Java 2016-05-16 19:36 - 2014-12-06 13:02 - 00000000 ___DC C:\Users\Kamila\Documents\Pliki programu Outlook 2016-05-12 22:45 - 2009-07-14 05:20 - 00000000 ___DC C:\windows\system32\NDF 2016-05-10 21:29 - 2015-05-13 09:11 - 00003886 ____C C:\windows\System32\Tasks\Adobe Acrobat Update Task 2016-04-26 22:14 - 2012-11-07 13:56 - 00000000 ___DC C:\Users\Kamila\AppData\Roaming\CyberLink 2016-04-26 22:14 - 2012-01-12 02:44 - 00000000 ___DC C:\ProgramData\CyberLink 2016-04-25 09:07 - 2009-07-14 07:08 - 00032604 _____ C:\windows\Tasks\SCHEDLGU.TXT ==================== Pliki w katalogu głównym wybranych folderów ======= 2013-06-27 23:29 - 2013-08-14 19:03 - 0003717 ____C () C:\Program Files (x86)\Mozilla Firefoxavg-secure-search.xml 2013-08-01 17:28 - 2015-12-13 20:20 - 0000081 ____C () C:\Users\Kamila\AppData\Roaming\WB.CFG 2013-06-16 15:01 - 2013-08-17 15:56 - 0000005 ____C () C:\Users\Kamila\AppData\Roaming\WBPU-TTL.DAT 2016-05-21 03:24 - 2016-05-21 03:24 - 0000000 ____C () C:\Users\Kamila\AppData\Local\{5898D33D-12F7-4D42-A119-E0FAEBCBF04B} 2012-01-12 02:59 - 2012-01-12 03:00 - 0000109 ____C () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log 2012-01-12 02:44 - 2012-01-12 02:45 - 0000113 ____C () C:\ProgramData\{34FBC7C4-CD31-4D93-A428-0E524EAC4586}.log 2012-01-12 02:54 - 2012-01-12 02:55 - 0000105 ____C () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log 2012-01-12 02:46 - 2012-01-12 02:54 - 0000106 ____C () C:\ProgramData\{80E158EA-7181-40FE-A701-301CE6BE64AB}.log 2012-01-12 02:55 - 2012-01-12 02:59 - 0000110 ____C () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\windows\system32\wininit.exe => Plik podpisany cyfrowo C:\windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\windows\explorer.exe => Plik podpisany cyfrowo C:\windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\windows\system32\svchost.exe => Plik podpisany cyfrowo C:\windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\windows\system32\services.exe => Plik podpisany cyfrowo C:\windows\system32\User32.dll => Plik podpisany cyfrowo C:\windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\windows\system32\userinit.exe => Plik podpisany cyfrowo C:\windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-05-15 22:18 ==================== Koniec FRST.txt ============================