Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja: 27-08-2016
Uruchomiony przez Ewa (administrator)  EWA-KOMPUTER (27-08-2016 20:04:39)
Uruchomiony z C:\Users\Ewa\Downloads
Załadowane profile: Ewa (Dostępne profile: Ewa)
Platform: Microsoft Windows 7 Home Premium  (X86) Język: Polski (Polska)
Internet Explorer Wersja 9 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
() C:\Program Files\RocketDock\RocketDock.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avgsvcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgcsrvx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgwdsvcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgnsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgemcx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgrsx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\Av\avgui.exe
() C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe
(AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\40.3.4\ToolbarUpdater.exe
() C:\Program Files\AVG Web TuneUp\vprot.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Ewa\Downloads\FRST (1).exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [480608 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [460088 2009-07-28] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [738616 2009-11-10] (TOSHIBA Corporation)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [C:\Windows\system32\V0400Ext.ax] => C:\Windows\system32\RegSvr32.exe /s C:\Windows\system32\V0400Ext.ax
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1425208 2012-09-20] (Logitech, Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
HKLM\...\Run: [SunJavaUpdateSched] => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
HKLM\...\Run: [AvgUi] => C:\Program Files\AVG\Framework\Common\avguirnx.exe [187152 2016-08-18] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\Av\avgui.exe [5299984 2016-07-28] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [vProt] => C:\Program Files\AVG Web TuneUp\vprot.exe [2178120 2016-08-27] ()
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\...\Run: [RocketDock] => C:\Program Files\RocketDock\RocketDock.exe [495616 2007-09-02] ()
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [718208 2010-03-16] (Microsoft Corporation)
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner.exe [6854360 2016-08-05] (Piriform Ltd)
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\...\MountPoints2: {f57762bb-1e58-11e6-9912-00037aee5ca4} - F:\AutoRun.exe
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  Brak pliku
Startup: C:\Users\Ewa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Powiadomienia monitorowania tuszu - HP DeskJet 2130 series.lnk [2016-08-27]
ShortcutTarget: Powiadomienia monitorowania tuszu - HP DeskJet 2130 series.lnk -> C:\Program Files\HP\HP DeskJet 2130 series\Bin\HPStatusBL.dll (Hewlett-Packard Development Company, LP)
CHR HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864 2010-10-07] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 62.179.1.60 62.179.1.61
Tcpip\..\Interfaces\{43E004DC-3947-45D8-96DC-D82C6C7E7203}: [DhcpNameServer] 62.179.1.60 62.179.1.61
Tcpip\..\Interfaces\{8CDAC2A0-D8C6-4428-A47D-69F1FCDC7F18}: [DhcpNameServer] 213.158.199.1 213.158.199.5

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={E20BE4CD-DBBB-4246-8437-476C18E0590F}&mid=12b8357ba28a47cf8a90d14a3c0ab557-a8f6caf071006f95fd9a7d08687481a55c5de26f&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0516piz&pr=fr&d=2016-08-27 17:31:47&v=4.3.4.122&pid=wtu&sg=&sap=hp
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = hxxp://search.babylon.com/?affID=110000&tt=120812_bandext_3212_8&babsrc=HP_ss&mntrId=aa2de55e0000000000000019d25c9322
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\Software\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = hxxp://search.babylon.com/?affID=110000&tt=120812_bandext_3212_8&babsrc=HP_ss&mntrId=aa2de55e0000000000000019d25c9322
HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.msn.com/?pc=AV01
SearchScopes: HKLM -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKLM -> Backup.Old.DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
SearchScopes: HKLM -> {30F5AB16-9F1E-4E99-93F2-ECB9ABB0EC12} URL = hxxp://www.searchya.com/?q={searchTerms}&s=1&a=foxtab&chnl=ft-100&cd=2XzuyEtN2Y1L1QzutDtD0AtD0DtCyC0ByBtCyCyB0EyDyD0EtN0D0Tzu0CtBtByDtN1L2XzutBtFtCtFtCtFtAtCtB&cr=452417718
SearchScopes: HKLM -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> BrowserMngrDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=110000&tt=120812_bandext_3212_8&babsrc=SP_ss&mntrId=aa2de55e0000000000000019d25c9322
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> {30F5AB16-9F1E-4E99-93F2-ECB9ABB0EC12} URL = hxxp://www.searchya.com/?q={searchTerms}&s=1&a=foxtab&chnl=ft-100&cd=2XzuyEtN2Y1L1QzutDtD0AtD0DtCyC0ByBtCyCyB0EyDyD0EtN0D0Tzu0CtBtByDtN1L2XzutBtFtCtFtCtFtAtCtB&cr=452417718
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = hxxp://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01
SearchScopes: HKU\S-1-5-21-1009769647-1237068701-1312969476-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={E20BE4CD-DBBB-4246-8437-476C18E0590F}&mid=12b8357ba28a47cf8a90d14a3c0ab557-a8f6caf071006f95fd9a7d08687481a55c5de26f&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0516piz&pr=fr&d=2016-08-27 17:31:47&v=4.3.4.122&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-07-20] (Oracle Corporation)
BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.3.4.122\AVG Web TuneUp.dll [2016-08-27] (AVG)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-20] (Oracle Corporation)
Toolbar: HKLM - Brak nazwy - {98889811-442D-49dd-99D7-DC866BE87DBC} -  Brak pliku
Toolbar: HKLM - Brak nazwy - {33AA308B-B565-4376-AC66-59EE9B6AD13E} -  Brak pliku
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-01-17] (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2011-11-03] (Skype Technologies)

FireFox:
========
FF ProfilePath: C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default
FF DefaultSearchUrl: hxxp://www.bing.com/search
FF SearchEngineOrder.1: Microsoft (Bing)
FF Homepage: hxxp://www.wp.pl/
FF Keyword.URL: hxxp://www.bing.com/search
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-12] ()
FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\40.3.4\\npsitesafety.dll [Brak pliku]
FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-20] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [2014-02-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-28] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2016-07-09] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2016-07-09] (Apple Inc.)
FF SearchPlugin: C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default\searchplugins\avg-secure-search.xml [2016-08-27]
FF SearchPlugin: C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default\searchplugins\bing-avast.xml [2014-05-09]
FF SearchPlugin: C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default\searchplugins\Search.xml [2012-08-12]
FF Extension: (AVG Web TuneUp) - C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default\Extensions\avg@toolbar.xpi [2016-08-27]
FF Extension: (Polski słownik poprawnej pisowni) - C:\Users\Ewa\AppData\Roaming\Mozilla\Firefox\Profiles\grbrgg7s.default\Extensions\pl@dictionaries.addons.mozilla.org [2016-02-29]
FF Extension: (Skype Click to Call) - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2016-08-27] [Brak podpisu cyfrowego]

Chrome: 
=======
CHR HomePage: Profile 1 -> mysearch.avg.com/?rvt=1
CHR DefaultSearchURL: Profile 1 -> hxxps://mysearch.avg.com/search?rvt=1&sap=dsp&q={searchTerms}
CHR DefaultSearchKeyword: Profile 1 -> https://mysearch.avg.com
CHR DefaultSuggestURL: Profile 1 -> hxxps://toolbar.avg.com/acp?q={searchTerms}&o=1
CHR Profile: C:\Users\Ewa\AppData\Local\Google\Chrome\User Data\Default
CHR Profile: C:\Users\Ewa\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Dokumenty Google) - C:\Users\Ewa\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-16]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Ewa\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-27]
CHR Extension: (Chrome Media Router) - C:\Users\Ewa\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-27]
CHR HKLM\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-1009769647-1237068701-1312969476-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [chfdnecihphmhljaaejmgoiahnihplgn] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 AvgAMPS; C:\Program Files\AVG\Av\avgamps.exe [674552 2016-07-28] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files\AVG\Av\avgidsagent.exe [4097280 2016-07-28] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files\AVG\Framework\Common\avgsvcx.exe [911120 2016-08-18] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files\AVG\Av\avgwdsvcx.exe [632632 2016-07-28] (AVG Technologies CZ, s.r.o.)
S2 KMService; C:\Windows\system32\srvany.exe [8192 2012-01-22] () [Brak podpisu cyfrowego]
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [6487408 2016-08-18] (Reimage®)
R2 vToolbarUpdater40.3.4; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\40.3.4\ToolbarUpdater.exe [1347144 2016-08-27] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files\AVG Web TuneUp\WtuSystemSupport.exe [980040 2016-08-27] ()

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [134912 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [259328 2016-06-30] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [201472 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [31664 2015-11-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [212736 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [287008 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [201472 2016-07-19] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [47360 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [231168 2016-07-12] (AVG Technologies CZ, s.r.o.)
R0 avgunivx; C:\Windows\System32\DRIVERS\avgunivx.sys [65280 2016-06-20] (AVG Technologies CZ, s.r.o.)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [65896 2014-01-14] (FTDI Ltd.)
S3 TosRfSnd; C:\Windows\System32\drivers\tosrfsnd.sys [53760 2010-04-26] (TOSHIBA Corporation) [Brak podpisu cyfrowego]
S3 VF0400Vid; C:\Windows\System32\DRIVERS\V0400Vid.sys [192096 2010-01-04] (Creative Technology Ltd.)
U0 aswVmm; Brak ImagePath
S3 cpuz134; \??\C:\Users\Ewa\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-27 20:04 - 2016-08-27 20:11 - 00020779 ____C C:\Users\Ewa\Downloads\FRST.txt
2016-08-27 20:01 - 2016-08-27 20:04 - 00000000 ___DC C:\FRST
2016-08-27 19:58 - 2016-08-27 19:58 - 00380928 ____C C:\Users\Ewa\Downloads\uwdnr5t6.exe
2016-08-27 19:57 - 2016-08-27 19:57 - 01746944 ____C (Farbar) C:\Users\Ewa\Downloads\FRST (1).exe
2016-08-27 19:55 - 2016-08-27 19:57 - 01746944 ____C (Farbar) C:\Users\Ewa\Downloads\FRST.exe
2016-08-27 19:32 - 2016-08-27 19:32 - 00000000 ___DC C:\Users\Ewa\AppData\Local\AVG Web TuneUp
2016-08-27 19:31 - 2016-08-27 19:32 - 00000000 ___DC C:\ProgramData\AVG Web TuneUp
2016-08-27 19:31 - 2016-08-27 19:31 - 00000000 ___DC C:\Program Files\Common Files\AVG Secure Search
2016-08-27 19:31 - 2016-08-27 19:31 - 00000000 ___DC C:\Program Files\AVG Web TuneUp
2016-08-27 19:28 - 2016-08-27 19:28 - 00000000 ___DC C:\ProgramData\Avg_Update_0516piz
2016-08-27 19:19 - 2016-08-27 19:19 - 00000000 ___DC C:\Users\Ewa\AppData\Roaming\AVG
2016-08-27 19:15 - 2016-08-27 19:15 - 00000000 ___DC C:\Users\Ewa\AppData\Roaming\TuneUp Software
2016-08-27 19:15 - 2016-08-27 19:15 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2016-08-27 19:13 - 2016-08-27 19:13 - 00000000 __HDC C:\$AVG
2016-08-27 19:08 - 2016-08-27 19:25 - 00000000 ___DC C:\ProgramData\MFAData
2016-08-27 19:08 - 2016-08-27 19:08 - 00000000 ___DC C:\Users\Ewa\AppData\Local\MFAData
2016-08-27 19:06 - 2016-08-27 19:06 - 00002183 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-27 19:06 - 2016-08-27 19:06 - 00002171 ____C C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-27 19:06 - 2016-08-27 19:06 - 00000954 ____C C:\Users\Public\Desktop\AVG.lnk
2016-08-27 19:06 - 2016-08-27 19:06 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2016-08-27 19:02 - 2016-08-27 19:11 - 00000000 ___DC C:\Program Files\AVG
2016-08-27 19:00 - 2016-08-27 19:19 - 00000000 ___DC C:\Users\Ewa\AppData\Local\Avg
2016-08-27 19:00 - 2016-08-27 19:13 - 00000000 ___DC C:\ProgramData\Avg
2016-08-27 19:00 - 2016-08-27 19:08 - 00000000 ___DC C:\Users\Ewa\AppData\Local\AvgSetupLog
2016-08-27 19:00 - 2016-08-27 19:00 - 01065376 ____C (Google Inc.) C:\Users\Ewa\Downloads\ChromeSetup.exe
2016-08-27 18:55 - 2016-08-27 18:55 - 00086390 ____C C:\Users\Ewa\Desktop\cc_20160827_185522.reg
2016-08-27 18:44 - 2016-08-27 18:44 - 00000929 ____C C:\Users\Public\Desktop\CCleaner.lnk
2016-08-27 18:44 - 2016-08-27 18:44 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-08-27 18:43 - 2016-08-27 18:44 - 00000000 ___DC C:\Program Files\CCleaner
2016-08-27 18:31 - 2016-08-27 19:32 - 00000000 ___DC C:\Program Files\Mozilla Firefox
2016-08-27 18:23 - 2016-08-27 18:23 - 00024963 ____C C:\Windows\system32\servers.def.lkg
2016-08-27 18:23 - 2016-08-27 18:23 - 00024963 ____C C:\Windows\system32\servers.def
2016-08-27 18:23 - 2016-08-27 18:23 - 00002869 ____C C:\Windows\system32\servers.def.vpx
2016-08-27 18:23 - 2016-08-27 18:23 - 00002798 ____C C:\Windows\system32\uat.vpx
2016-08-27 18:23 - 2016-08-27 18:23 - 00002264 ____C C:\Windows\system32\.tmp
2016-08-27 18:23 - 2016-08-27 18:23 - 00000451 ____C C:\Windows\system32\prod-vps.vpx
2016-08-27 18:23 - 2016-08-27 18:23 - 00000446 ____C C:\Windows\system32\prod-pgm.vpx
2016-08-27 18:21 - 2016-08-27 18:21 - 00000000 ___DC C:\Users\Ewa\Downloads\SafeZone Installer
2016-08-27 18:18 - 2016-08-27 18:18 - 08227032 ____C (Piriform Ltd) C:\Users\Ewa\Downloads\ccsetup521.exe
2016-08-27 18:16 - 2016-08-27 18:16 - 02895464 ____C (AVG Technologies) C:\Users\Ewa\Downloads\AVG_Protection_Free_1144.exe
2016-08-15 17:50 - 2016-08-15 17:50 - 05588968 ____C (P.U.K. MARCOM ) C:\Users\Ewa\Downloads\faktur221.438(3).exe
2016-08-10 21:32 - 2016-08-10 21:32 - 00648282 ____C C:\Users\Ewa\Documents\Faktura F0008-08-16.pdf
2016-08-10 20:44 - 2016-08-10 20:44 - 00630733 ____C C:\Users\Ewa\Documents\Faktura F0007-08-16.pdf
2016-08-09 22:17 - 2016-08-09 22:17 - 00628357 ____C C:\Users\Ewa\Documents\Faktura F0006-08-16.pdf
2016-08-09 20:52 - 2016-08-09 20:52 - 00710569 ____C C:\Users\Ewa\Documents\Faktura F0005-08-16.pdf
2016-08-08 10:13 - 2016-08-08 10:13 - 00666931 ____C C:\Users\Ewa\Documents\Faktura F0004-08-16.pdf
2016-08-03 21:37 - 2016-08-03 21:37 - 00607211 ____C C:\Users\Ewa\Documents\Faktura F0003-08-16.pdf
2016-08-03 21:28 - 2016-08-03 21:30 - 00606390 ____C C:\Users\Ewa\Documents\Faktura F0002-08-16.pdf
2016-08-02 20:38 - 2016-08-02 20:38 - 00612951 ____C C:\Users\Ewa\Documents\Faktura F0001-08-16.pdf
2016-07-29 00:02 - 2016-08-03 21:10 - 00613394 ____C C:\Users\Ewa\Documents\Faktura F0006-07-16.pdf

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-27 20:01 - 2016-05-22 19:01 - 00000238 ____C C:\Windows\Tasks\Booking_helper.job
2016-08-27 19:59 - 2012-03-31 09:11 - 00000930 ____C C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-08-27 19:59 - 2009-07-14 06:34 - 00014608 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-27 19:59 - 2009-07-14 06:34 - 00014608 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-27 19:31 - 2012-08-12 22:34 - 00001036 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-27 19:22 - 2016-05-22 19:01 - 00000000 ___DC C:\Program Files\Booking.com
2016-08-27 19:17 - 2015-12-03 15:08 - 00000000 ___DC C:\Program Files\Common Files\AV
2016-08-27 19:14 - 2009-07-14 04:37 - 00000000 ___DC C:\Windows\inf
2016-08-27 18:49 - 2012-01-23 22:16 - 00000000 ___DC C:\Users\Ewa\AppData\Roaming\Skype
2016-08-27 18:46 - 2011-08-07 22:22 - 00000000 ___DC C:\Windows\Minidump
2016-08-27 18:46 - 2011-05-31 14:09 - 00000000 ___DC C:\Windows\Panther
2016-08-27 18:33 - 2014-02-15 15:03 - 00000000 ___DC C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-08-27 18:32 - 2012-10-02 12:17 - 00000000 ___DC C:\Program Files\Mozilla Maintenance Service
2016-08-27 18:27 - 2012-08-12 22:34 - 00001032 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-27 18:27 - 2012-08-12 22:32 - 00000000 ___DC C:\ProgramData\AVAST Software
2016-08-27 18:27 - 2009-07-14 06:53 - 00000006 ___HC C:\Windows\Tasks\SA.DAT
2016-08-27 18:14 - 2016-05-22 19:17 - 00000150 ____C C:\Windows\Reimage.ini
2016-08-15 18:10 - 2015-10-26 01:06 - 50863768 ____C C:\Users\Ewa\Downloads\Kordoba 3, Lanjaron.eml
2016-08-15 18:09 - 2011-05-31 13:20 - 01669916 ____C C:\Windows\system32\PerfStringBackup.INI
2016-08-15 18:09 - 2009-07-14 10:07 - 00740828 ____C C:\Windows\system32\perfh015.dat
2016-08-15 18:09 - 2009-07-14 10:07 - 00155392 ____C C:\Windows\system32\perfc015.dat
2016-08-15 18:08 - 2011-05-31 22:10 - 00000000 ___DC C:\Users\Ewa\Documents\Pliki programu Outlook
2016-08-04 01:50 - 2016-01-24 11:10 - 00002441 ____C C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-03 21:09 - 2016-07-27 11:47 - 00599382 ____C C:\Users\Ewa\Documents\Faktura F0005-07-16.pdf
2016-08-03 21:09 - 2016-07-27 11:40 - 00663819 ____C C:\Users\Ewa\Documents\Faktura F0004-07-16.pdf
2016-08-03 21:09 - 2016-07-25 14:47 - 00581350 ____C C:\Users\Ewa\Documents\Faktura F0003-07-16.pdf
2016-08-03 21:09 - 2016-07-15 16:46 - 00560648 ____C C:\Users\Ewa\Documents\Faktura F0002-07-16.pdf
2016-08-03 21:08 - 2016-07-11 13:49 - 00593083 ____C C:\Users\Ewa\Documents\Faktura F0001-07-16.pdf

==================== Pliki w katalogu głównym wybranych folderów =======

2014-01-16 23:12 - 2014-01-16 23:12 - 50063360 ____C () C:\Program Files\GUT866E.tmp
2016-05-22 23:06 - 2016-05-22 23:07 - 0000096 ____C () C:\Users\Ewa\AppData\Roaming\mFaktura 7, Stand
2011-05-31 23:20 - 2011-05-31 23:29 - 0022020 ____C () C:\Users\Ewa\AppData\Roaming\Wartości oddzielone przecinkami (DOS).ADR
2012-04-19 13:09 - 2012-04-19 13:09 - 0004096 ___HC () C:\Users\Ewa\AppData\Local\keyfile3.drm
2014-06-19 20:14 - 2014-06-19 20:14 - 0000017 ____C () C:\Users\Ewa\AppData\Local\resmon.resmoncfg
2012-08-12 19:00 - 2012-08-12 19:00 - 0384835 ____C () C:\Users\Ewa\AppData\Local\speeddial.crx
2015-11-04 16:48 - 2015-11-04 16:48 - 0000000 ____C () C:\Users\Ewa\AppData\Local\{37302ADB-60CB-4C18-9083-AFEAE9371947}
2016-06-07 19:02 - 2016-06-07 19:02 - 0000057 ____C () C:\ProgramData\Ament.ini

==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-08-10 14:59

==================== Koniec  FRST.txt ============================