Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 28-09-2016
Uruchomiony przez Bartosz (administrator)  TOSHIBA (29-09-2016 20:27:13)
Uruchomiony z C:\Users\Bartosz\Downloads
Załadowane profile: Bartosz (Dostępne profile: Bartosz)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\TecoService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Spotify Ltd) C:\Users\Bartosz\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Toshiba) C:\Program Files\Toshiba\TOSHIBA Places Icon Utility\TosDIMonitor.exe
() C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\Toshiba\TPHM\TPCHWMsg.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [TosReelTimeMonitor] => C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2011-03-30] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566696 2011-03-02] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [967544 2011-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1544104 2011-04-07] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710040 2010-12-08] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711576 2011-04-05] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] => C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2011-03-04] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [150992 2011-06-15] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [NBAgent] => c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1406248 2011-01-07] (Nero AG)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [252792 2010-06-04] (TOSHIBA)
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1294712 2010-11-29] (TOSHIBA Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9107616 2016-09-27] (AVAST Software)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-19\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-20\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8641240 2016-02-12] (Piriform Ltd)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [IPLA!] => C:\Program Files (x86)\ipla\ipla.exe [21407008 2015-12-09] (Cyfrowy Polsat S.A.)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2858272 2016-09-20] (Valve Corporation)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [ALLUpdate] => C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3670472 2015-07-28] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [Napisy24Update] => C:\Program Files (x86)\Napisy24\Napisy24Update.exe [3709896 2015-11-04] (Napisy24.pl)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\chomikbox.exe [3939840 2015-12-10] ( )
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [Napisy24.pl] => C:\Program Files (x86)\Napisy24\Napisy24.exe [5598144 2016-02-25] (Napisy24.pl)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [Spotify Web Helper] => C:\Users\Bartosz\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1523312 2016-09-03] (Spotify Ltd)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\Run: [Spotify] => C:\Users\Bartosz\AppData\Roaming\Spotify\Spotify.exe [6930544 2016-09-03] (Spotify Ltd)
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: E - E:\BSAutoRun.exe
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: F - F:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: G - G:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: {4ce5ac9c-eec0-11e5-ae3d-806e6f6e6963} - E:\autorun.exe
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: {955109f3-0923-11e6-a969-e89a8f88a207} - G:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: {c1b498f5-0a48-11e6-8e01-e89a8f88a207} - H:\setup.exe
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\...\MountPoints2: {ced44482-f091-11e5-930b-e89a8f88a207} - F:\_AUTORUN\AUTORUN.EXE
HKU\S-1-5-18\...\Run: [TOPI.EXE] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-27] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Toshiba Places Icon Utility.lnk [2011-06-15]
ShortcutTarget: Toshiba Places Icon Utility.lnk -> C:\Program Files\Toshiba\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Toshiba)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Configuration Utility.lnk [2016-03-20]
ShortcutTarget: TP-LINK Wireless Configuration Utility.lnk -> C:\Program Files (x86)\TP-LINK\TP-LINK Wireless Configuration Utility\TWCU.exe ()
Startup: C:\Users\Bartosz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GameRanger.lnk [2016-04-23]
ShortcutTarget: GameRanger.lnk -> C:\Users\Bartosz\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe (GameRanger Technologies)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{1EBC526B-D25D-4AE9-B38A-929D99568911}: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{8F6ACA8D-EDCB-420B-BAC8-6B06D638FC45}: [DhcpNameServer] 192.168.1.254

Internet Explorer:
==================
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gazeta.pl/0,0.html?p=190
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://toshiba.eu/places?touch=4&cat=1
HKU\S-1-5-21-1725284843-4271641495-247276432-1000\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://toshiba.eu/places?touch=4&cat=1
SearchScopes: HKLM -> DefaultScope {55BB8AE1-EA25-435A-8BBC-C8B71AC5765B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {55BB8AE1-EA25-435A-8BBC-C8B71AC5765B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> DefaultScope {55BB8AE1-EA25-435A-8BBC-C8B71AC5765B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {55BB8AE1-EA25-435A-8BBC-C8B71AC5765B} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1725284843-4271641495-247276432-1000 -> DefaultScope {79768FDB-628D-44E8-857E-AC9F0F923DD7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1725284843-4271641495-247276432-1000 -> {4BF2C6BB-7DBA-4902-9C02-854E21D7BD28} URL = hxxp://rover.ebay.com/rover/1/4908-44618-9400-8/4?satitle={searchTerms}
SearchScopes: HKU\S-1-5-21-1725284843-4271641495-247276432-1000 -> {79768FDB-628D-44E8-857E-AC9F0F923DD7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=TSHMDF&pc=MATM&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1725284843-4271641495-247276432-1000 -> {840CEA87-295A-4316-9FC3-16C85938936C} URL = hxxp://www.amazon.co.uk/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibauk-win7-ie-search-21&index=blended&linkCode=ur2
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-09-27] (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-11-15] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-09-27] (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Skype Plug-In -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27] (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-06-15] (Sun Microsystems, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-09-27] (Skype Technologies S.A.)

FireFox:
========
FF ProfilePath: C:\Users\Bartosz\AppData\Roaming\Mozilla\Firefox\Profiles\pugnobtj.default
FF Homepage: hxxp://www.gazeta.pl/0,0.html?p=190
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_182.dll [2016-03-20] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_182.dll [2016-03-20] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Extension: (Adblock Plus) - C:\Users\Bartosz\AppData\Roaming\Mozilla\Firefox\Profiles\pugnobtj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-31]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-09-27]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-09-27]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.gazeta.pl/0,0.html?p=190
CHR StartupUrls: Default -> "hxxp://www.gazeta.pl/0,0.html?p=190"
CHR Profile: C:\Users\Bartosz\AppData\Local\Google\Chrome\User Data\Default [2016-09-29]
CHR Extension: (Adblock Plus) - C:\Users\Bartosz\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-08-23]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Bartosz\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Chrome Media Router) - C:\Users\Bartosz\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-23]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <nie znaleziono>

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-27] (AVAST Software)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego]
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-09-27] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-09-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-09-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-09-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-27] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513632 2016-09-27] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-09-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-09-27] (AVAST Software)
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-03-23] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-03-23] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 Tosrfcom; Brak ImagePath
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-09-29 20:27 - 2016-09-29 20:27 - 00021444 _____ C:\Users\Bartosz\Downloads\FRST.txt
2016-09-29 20:06 - 2016-09-29 20:07 - 00000928 _____ C:\Users\Bartosz\Desktop\d.txt
2016-09-29 20:04 - 2016-09-29 20:05 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Bartosz\Downloads\SPTDinst-v189-x64.exe
2016-09-29 19:37 - 2016-09-29 20:27 - 00000000 ____D C:\FRST
2016-09-29 19:37 - 2016-09-29 19:37 - 00380928 _____ C:\Users\Bartosz\Downloads\gwhhy4mn.exe
2016-09-29 19:36 - 2016-09-29 19:36 - 02404352 _____ (Farbar) C:\Users\Bartosz\Downloads\Niepotwierdzony 164862.crdownload
2016-09-29 19:35 - 2016-09-29 19:36 - 02404352 _____ (Farbar) C:\Users\Bartosz\Downloads\FRST64.exe
2016-09-27 21:29 - 2016-09-27 21:29 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-09-27 21:29 - 2016-09-27 21:29 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-09-26 18:39 - 2016-09-26 18:39 - 00000000 ____D C:\Users\Bartosz\AppData\LocalLow\uTorrent
2016-09-17 10:42 - 2016-09-17 10:42 - 00082315 _____ C:\Users\Bartosz\Downloads\FAV-13-A-218322-09-16-WRO.pdf
2016-09-10 04:21 - 2014-10-04 12:16 - 00000298 _____ C:\Users\Bartosz\Desktop\INSTRUKCJA.txt
2016-09-10 04:20 - 2016-09-10 04:20 - 01783623 _____ C:\Users\Bartosz\Downloads\Fifa 14 Aktualizacja składów 14-15.zip
2016-09-10 04:02 - 2016-09-10 04:02 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-09-10 03:52 - 2016-09-28 18:19 - 00000000 ____D C:\Users\Bartosz\Documents\FIFA 14
2016-09-10 03:52 - 2016-09-10 03:52 - 00000857 _____ C:\Users\Public\Desktop\FIFA 14.lnk
2016-09-10 03:52 - 2016-09-10 03:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 14
2016-09-04 00:57 - 2016-09-04 00:57 - 00001138 _____ C:\Users\Bartosz\Desktop\ALLPlayer Radio.lnk
2016-09-04 00:57 - 2016-09-04 00:57 - 00001026 _____ C:\Users\Bartosz\Desktop\ALLPlayer.lnk
2016-09-04 00:57 - 2016-09-04 00:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ALLPlayer
2016-09-04 00:57 - 2016-09-04 00:57 - 00000000 ____D C:\ProgramData\ALLPlayer
2016-09-04 00:57 - 2013-04-05 21:26 - 02106368 _____ C:\Windows\SysWOW64\ac3filter.ax
2016-09-04 00:57 - 2013-04-05 21:26 - 00276992 _____ (IntelleSoft) C:\Windows\SysWOW64\BugTrap.dll
2016-09-04 00:57 - 2011-06-02 02:10 - 00644608 _____ C:\Windows\SysWOW64\xvidcore.dll
2016-09-04 00:57 - 2007-10-07 15:36 - 00258048 _____ C:\Windows\SysWOW64\libFLAC.dll
2016-09-04 00:56 - 2016-09-04 00:56 - 30944072 _____ (ALLPlayer ) C:\Users\Bartosz\Downloads\ALLPlayerPL.exe
2016-09-03 13:01 - 2016-09-29 20:20 - 00000000 ____D C:\Users\Bartosz\AppData\Local\Spotify
2016-09-03 13:01 - 2016-09-03 13:01 - 00001822 _____ C:\Users\Bartosz\Desktop\Spotify.lnk
2016-09-03 13:01 - 2016-09-03 13:01 - 00001808 _____ C:\Users\Bartosz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2016-09-03 13:00 - 2016-09-29 20:20 - 00000000 ____D C:\Users\Bartosz\AppData\Roaming\Spotify
2016-09-03 13:00 - 2016-09-03 13:00 - 00356056 _____ (Spotify Ltd) C:\Users\Bartosz\Downloads\SpotifySetup.exe
2016-09-02 17:04 - 2016-09-02 17:04 - 00326844 _____ C:\Users\Bartosz\Downloads\O19_Faktura_indywidualna_000-038-3523-8656_16_08_F002_AA.pdf
2016-08-30 19:28 - 2016-08-30 19:29 - 00939144 _____ C:\Windows\Minidump\083016-35396-01.dmp
2016-08-30 19:28 - 2016-08-30 19:28 - 433726718 _____ C:\Windows\MEMORY.DMP

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-09-29 20:26 - 2009-07-14 06:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-09-29 20:26 - 2009-07-14 06:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-09-29 20:22 - 2016-07-29 21:17 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d1e9cdcc3ac855.job
2016-09-29 20:21 - 2016-03-24 12:37 - 00000000 ____D C:\Program Files (x86)\Steam
2016-09-29 20:20 - 2016-04-23 09:35 - 00000000 ____D C:\Users\Bartosz\AppData\Local\ChomikBox
2016-09-29 20:20 - 2016-04-23 09:35 - 00000000 ____D C:\Users\Bartosz\.gstreamer-0.10
2016-09-29 20:20 - 2016-03-22 00:25 - 00000000 ____D C:\Users\Bartosz\AppData\Roaming\ipla
2016-09-29 20:18 - 2016-07-29 21:17 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d1e9cdcb74b64f.job
2016-09-29 20:18 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-09-29 18:43 - 2016-03-20 22:24 - 00004180 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-09-28 22:13 - 2016-03-25 02:17 - 00000000 ____D C:\Users\Bartosz\AppData\Roaming\StardewValley
2016-09-28 21:50 - 2011-02-14 11:01 - 00740792 _____ C:\Windows\system32\perfh015.dat
2016-09-28 21:50 - 2011-02-14 11:01 - 00156076 _____ C:\Windows\system32\perfc015.dat
2016-09-28 21:50 - 2009-07-14 07:13 - 01670766 _____ C:\Windows\system32\PerfStringBackup.INI
2016-09-28 21:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-09-28 16:40 - 2016-03-20 23:37 - 00003956 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1458509829
2016-09-27 21:31 - 2016-03-20 22:24 - 00969184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2016-09-27 21:31 - 2016-03-20 22:24 - 00513632 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-09-27 21:29 - 2016-03-20 23:35 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00969560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.147500469067607
2016-09-27 21:29 - 2016-03-20 22:24 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.147500469295410
2016-09-27 21:29 - 2016-03-20 22:24 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-09-27 21:29 - 2016-03-20 22:24 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-09-27 16:07 - 2016-03-22 00:25 - 00000000 ____D C:\ProgramData\ipla
2016-09-26 22:51 - 2016-04-01 19:52 - 00000000 ____D C:\Users\Bartosz\AppData\Roaming\uTorrent
2016-09-23 21:23 - 2016-06-14 16:26 - 00000000 ____D C:\Users\Bartosz\AppData\Roaming\Skype
2016-09-23 21:23 - 2011-06-15 14:40 - 00000000 ____D C:\ProgramData\Skype
2016-09-17 11:24 - 2016-03-22 00:21 - 00002208 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-09-17 11:24 - 2016-03-22 00:21 - 00002196 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-09-11 11:35 - 2016-04-23 09:36 - 00000000 ____D C:\Users\Bartosz\Downloads\ChomikBox
2016-09-10 03:54 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-09-08 18:28 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-09-04 00:57 - 2016-03-27 15:45 - 00000000 ____D C:\Program Files (x86)\ALLPlayer
2016-08-30 19:28 - 2016-03-30 23:15 - 00000000 ____D C:\Windows\Minidump
2016-08-30 17:10 - 2011-06-15 14:41 - 00000000 ___RD C:\Program Files (x86)\Skype

==================== Pliki w katalogu głównym wybranych folderów =======

2016-03-21 11:28 - 2016-03-21 11:28 - 6871040 _____ () C:\Program Files (x86)\GUT9A0E.tmp

Niektóre pliki w TEMP:
====================
C:\Users\Bartosz\AppData\Local\Temp\ipl1D30.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl2FD6.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl3726.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl4DA2.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl583D.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl68D0.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\ipl86EA.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplB21F.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplBB91.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplBE9D.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplC1D7.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplCB98.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\iplFC8.tmp.exe
C:\Users\Bartosz\AppData\Local\Temp\Napisy24.exe
C:\Users\Bartosz\AppData\Local\Temp\_is722.exe


==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-05-27 15:41

==================== Koniec  FRST.txt ============================