Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja:31-12-2015
Uruchomiony przez user (administrator)  DOM-E0E53E84451 (03-01-2016 13:47:38)
Uruchomiony z C:\Documents and Settings\TEMP.DOM-E0E53E84451\Moje dokumenty\Downloads
Załadowane profile: user (Dostępne profile: user & Daniel)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) Język: Polski
Internet Explorer Wersja 8 (Domyślna przeglądarka: IE)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Windows (R) Codename Longhorn DDK provider) C:\Program Files\UPHClean\uphclean.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [16844800 2007-10-17] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Alcmtr] => C:\WINDOWS\ALCMTR.EXE [69632 2007-10-17] (Realtek Semiconductor Corp.)
HKLM\...\Run: [VMonitorVMUVC] => C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe [135168 2008-03-26] (Vimicro Corporation)
HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM\...\RunOnce: [*EmptyTemp] => cmd /c rd /q/s C:\FRST\Temp
HKLM\...\Policies\Explorer: [NoRemoteRecursiveEvents] 1
HKU\S-1-5-19\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-19\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoStartBanner] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-19\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-20\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-20\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoStartBanner] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-18\...\RunOnce: [TSClientMSIUninstaller] => cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs"
HKU\S-1-5-18\...\Policies\Explorer: [NoSMMyPictures] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoStartBanner] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMHelp] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Brak pliku
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Asystent menedżera zawartości dla PlayStation(R).lnk [2014-02-06]
ShortcutTarget: Asystent menedżera zawartości dla PlayStation(R).lnk -> C:\Program Files\Sony\Content Manager Assistant\CMA.exe (Sony Computer Entertainment Inc.)
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk [2012-04-25]
ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Winsock: Catalog5 04 C:\Program Files\Bonjour\mdnsNSP.dll [121704 2011-08-30] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.1
Tcpip\..\Interfaces\{CBFFCFB3-A440-4D0A-B675-D40533BF1B69}: [DhcpNameServer] 10.0.0.1

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-19\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-20\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: [S-1-5-21-682003330-162531612-725345543-1003] UWAGA => Brak domyślnego URLSearchHook
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1367863262828
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1367874209312
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Brak pliku

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll [2013-11-01] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll [2011-06-10] (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-07-12] (Google)
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2013-10-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-10-08] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll [Brak pliku]
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=6.0.11.2571 -> C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin: @real.com/nprpjplug;version=6.0.12.1739 -> C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2016-01-03] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2016-01-03] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL [2003-07-15] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll [2006-10-07] (RealNetworks, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpjplug.dll [2006-10-07] (RealNetworks, Inc.)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-04-29] [Brak podpisu cyfrowego]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-12-16] [Brak podpisu cyfrowego]

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Documents and Settings\TEMP.DOM-E0E53E84451\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default
CHR Extension: (Search the Web) - C:\Documents and Settings\TEMP.DOM-E0E53E84451\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mjenhgehkhlmnlckienafbhokdjoanbl [2016-01-03]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Documents and Settings\TEMP.DOM-E0E53E84451\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-01-03]
CHR HKLM\...\Chrome\Extension: [dkeljihlppefdhahpnoiddebhadhngaa] - C:\Documents and Settings\All Users\Dane aplikacji\wxDfast\dkeljihlppefdhahpnoiddebhadhngaa.crx <nie znaleziono>
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx <nie znaleziono>

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2013-10-08] (Oracle Corporation)
R2 UPHClean; C:\Program Files\UPHClean\uphclean.exe [399872 2010-09-13] (Windows (R) Codename Longhorn DDK provider) [Brak podpisu cyfrowego]

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 AR5211; C:\WINDOWS\System32\DRIVERS\ar5211.sys [546976 2007-05-02] (Atheros Communications, Inc.)
R3 btaudio; C:\WINDOWS\System32\drivers\btaudio.sys [539072 2007-03-24] (Broadcom Corporation.)
R3 BTDriver; C:\WINDOWS\System32\DRIVERS\btport.sys [37424 2007-03-24] (Broadcom Corporation.)
R3 BTKRNL; C:\WINDOWS\System32\DRIVERS\btkrnl.sys [876384 2007-04-01] (Broadcom Corporation.)
S3 BTWDNDIS; C:\WINDOWS\System32\DRIVERS\btwdndis.sys [149123 2007-03-24] (Broadcom Corporation.)
S3 btwhid; C:\WINDOWS\System32\DRIVERS\btwhid.sys [55352 2007-04-01] (Broadcom Corporation.)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation)
R3 HDAudBus; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [138752 2007-10-16] (Windows (R) Server 2003 DDK provider) [Brak podpisu cyfrowego]
R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [209664 2006-12-23] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [988800 2006-12-23] (Conexant Systems, Inc.)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
R3 Rasirda; C:\WINDOWS\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
R2 rspndr; C:\WINDOWS\System32\DRIVERS\rspndr.sys [62336 2006-11-08] (Microsoft Corporation) [Brak podpisu cyfrowego]
R0 sfsync04; C:\WINDOWS\System32\drivers\sfsync04.sys [49664 2005-12-12] (Protection Technology) [Brak podpisu cyfrowego]
S3 VMUVC; C:\WINDOWS\System32\Drivers\VMUVC.sys [250752 2008-07-01] (Vimicro Corporation) [Brak podpisu cyfrowego]
S3 vvftUVC; C:\WINDOWS\System32\drivers\vvftUVC.sys [398720 2008-07-01] (Vimicro Corporation) [Brak podpisu cyfrowego]
U4 CiSvc; Brak ImagePath
S4 IntelIde; Brak ImagePath
U4 Messenger; Brak ImagePath
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U1 WS2IFSL; Brak ImagePath

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-03 13:34 - 2016-01-03 13:34 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Dane aplikacji\Adobe
2016-01-03 13:33 - 2016-01-03 13:36 - 00000000 ____D C:\AdwCleaner
2016-01-03 13:15 - 2016-01-03 13:34 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Dane aplikacji
2016-01-03 13:11 - 2016-01-03 13:46 - 00001032 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore1d1461fef82e61e.job
2016-01-03 13:10 - 2016-01-03 13:47 - 00000000 ____D C:\FRST
2016-01-02 13:36 - 2016-01-03 13:06 - 00000000 ___RD C:\Documents and Settings\TEMP.DOM-E0E53E84451\Moje dokumenty
2015-12-28 09:43 - 2016-01-03 13:34 - 00000000 ___RD C:\Documents and Settings\TEMP.DOM-E0E53E84451\Ulubione
2015-12-28 09:43 - 2015-12-28 17:57 - 00000672 __RSH C:\Documents and Settings\TEMP.DOM-E0E53E84451\ntuser.pol
2015-12-28 09:43 - 2015-12-28 09:43 - 00000020 ___SH C:\Documents and Settings\TEMP.DOM-E0E53E84451\ntuser.ini
2015-12-28 09:43 - 2015-12-28 09:43 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Pulpit
2015-12-28 09:43 - 2015-12-28 09:43 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Menu Start\Programy\Autostart
2015-12-28 09:43 - 2015-12-28 09:43 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Menu Start\Programy
2015-12-28 09:43 - 2015-12-28 09:43 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Menu Start
2015-12-28 09:42 - 2015-12-28 09:42 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451\Ustawienia lokalne
2015-12-27 11:56 - 2016-01-03 13:15 - 00000000 ____D C:\Documents and Settings\TEMP.DOM-E0E53E84451

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-01-03 13:46 - 2011-06-19 19:36 - 00001028 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2016-01-03 13:45 - 2009-01-08 18:33 - 00032426 _____ C:\WINDOWS\SchedLgU.Txt
2016-01-03 13:45 - 2009-01-08 18:33 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2016-01-03 13:44 - 2014-01-23 13:20 - 00000000 ____D C:\Documents and Settings\All Users\Menu Start\Programy\Fraps
2016-01-03 13:44 - 2013-10-30 14:27 - 00000000 ____D C:\Documents and Settings\Daniel\Pulpit
2016-01-03 13:44 - 2013-10-28 15:14 - 00000000 ____D C:\Documents and Settings\All Users\Menu Start\Programy\Bandicam
2016-01-03 13:44 - 2011-09-20 16:20 - 00000000 ____D C:\Documents and Settings\All Users\Menu Start\Programy\Skype
2016-01-03 13:44 - 2009-01-08 19:19 - 00000000 __RHD C:\Documents and Settings\All Users\Dane aplikacji
2016-01-03 13:37 - 2009-01-08 19:10 - 00000000 ____D C:\WINDOWS
2016-01-03 13:36 - 2009-01-08 19:20 - 00000000 ___RD C:\Documents and Settings\All Users\Menu Start
2016-01-03 13:21 - 2011-06-19 19:37 - 00001819 _____ C:\Documents and Settings\All Users\Pulpit\Google Chrome.lnk
2016-01-03 13:21 - 2011-06-19 19:36 - 00001036 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2016-01-03 13:15 - 2014-08-21 18:20 - 00000000 ____D C:\Program Files\Gwiezdny Mściciel
2016-01-03 13:15 - 2013-10-30 14:27 - 00000000 ___RD C:\Documents and Settings\Daniel\Menu Start\Programy
2016-01-03 13:15 - 2011-06-15 10:39 - 00000000 ____D C:\Program Files\Activision
2016-01-03 13:15 - 2009-08-18 19:14 - 00000000 ____D C:\Program Files\Wanted Guns
2016-01-03 13:15 - 2009-01-08 18:35 - 00000000 ___RD C:\Documents and Settings\user\Menu Start\Programy
2016-01-03 13:14 - 2009-07-16 14:20 - 00000000 ____D C:\Program Files\Formula Challenge
2016-01-03 13:14 - 2009-01-08 19:20 - 00000000 ___RD C:\Documents and Settings\All Users\Menu Start\Programy
2016-01-03 13:12 - 2009-01-08 19:20 - 00000000 ____D C:\Documents and Settings\All Users\Pulpit
2016-01-03 13:12 - 2009-01-08 18:35 - 00000000 ____D C:\Documents and Settings\user\Pulpit
2016-01-02 13:33 - 2001-07-22 03:17 - 00002206 _____ C:\WINDOWS\system32\wpa.dbl
2015-12-27 11:56 - 2009-01-08 19:19 - 00000000 ____D C:\Documents and Settings
2015-12-23 20:00 - 2009-01-08 18:35 - 00000292 ___SH C:\Documents and Settings\user\ntuser.ini

==================== Pliki w katalogu głównym wybranych folderów =======

2012-09-19 10:37 - 2012-09-19 10:37 - 0000054 _____ () C:\Program Files\ExUninst.ini
2012-09-19 10:37 - 2007-06-04 11:03 - 0004286 _____ () C:\Program Files\Geografia1F.ico
2012-09-19 10:37 - 2012-09-19 10:38 - 0011279 _____ () C:\Program Files\Uninst.isu

Pliki do przeniesienia lub usunięcia:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

==================== Koniec  FRST.txt ============================