Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 30-09-2016
Uruchomiony przez Sebastian (administrator)  SEBASTIANPC (01-10-2016 14:29:59)
Uruchomiony z C:\Users\Sebastian\Desktop\Nowy folder
Załadowane profile: Sebastian (Dostępne profile: Sebastian)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
() C:\Program Files (x86)\OSCAR Editor X7\OscarEditor.exe
(DesktopNerds) C:\Program Files (x86)\DesktopNerds\Gamma Control\GC.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Murray Hurps Software Pty Ltd) C:\Program Files (x86)\Ad Muncher\AdMunch.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Murray Hurps Software Pty Ltd) C:\Program Files (x86)\Ad Muncher\AdMunch64.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(BlackBerry Limited) C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
() C:\Program Files (x86)\Common Files\Research In Motion\nginx\nginx.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_23_0_0_162.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_23_0_0_162.exe
(Panda Security, S.L.) C:\ProgramData\Panda Security\Panda Devices Agent\Downloads\4f5403c6e84435fbda10346629885c02\PSCampaign.exe


==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5199984 2011-06-20] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-04-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Ad Muncher] => C:\Program Files (x86)\Ad Muncher\AdMunch.exe [560760 2014-12-19] (Murray Hurps Software Pty Ltd)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [443640 2014-10-31] (BlackBerry Limited)
HKLM-x32\...\Run: [RIM PeerManager] => C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\PeerManager.exe [4861688 2015-03-19] (BlackBerry Limited)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [109824 2016-08-05] (Panda Security, S.L.)
HKU\S-1-5-21-3580256871-2974044544-3284647674-1000\...\Run: [GammaControllerDN2] => C:\Program Files (x86)\DesktopNerds\Gamma Control\GC.exe [1019904 2012-11-21] (DesktopNerds)
HKU\S-1-5-21-3580256871-2974044544-3284647674-1000\...\Run: [OscarEditor] => C:\Program Files (x86)\OSCAR Editor X7\OscarEditor.exe [3340288 2012-03-20] ()
HKU\S-1-5-21-3580256871-2974044544-3284647674-1000\...\Run: [GammaControllerDN3] => C:\Program Files (x86)\DesktopNerds\Gamma Control\GC.exe [1019904 2012-11-21] (DesktopNerds)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{F8E2BC00-AFB4-4718-856B-6153D3FAC52F}: [DhcpNameServer] 192.168.1.1

Internet Explorer:
==================
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Sebastian\AppData\Roaming\Mozilla\Firefox\Profiles\wcgszz49.default-1475324852937
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_162.dll [2016-09-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-14] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2015-03-19] ()
FF Plugin HKU\S-1-5-21-3580256871-2974044544-3284647674-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-03-10] ()

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-04-19] (Advanced Micro Devices, Inc.) [Brak podpisu cyfrowego]
S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
R3 BlackBerry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [588024 2014-10-31] (BlackBerry Limited)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [241936 2016-05-02] (EasyAntiCheat Ltd)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [153096 2016-08-05] (Panda Security, S.L.)
S3 Origin Client Service; D:\Origin\OriginClientService.exe [2104840 2016-02-03] (Electronic Arts)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [86104 2016-07-19] (Panda Security, S.L.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [48584 2016-08-05] (Panda Security, S.L.)
R2 RIM MDNS; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [396024 2015-03-19] (Apple Inc.)
R2 RIM Tunnel Service; C:\Program Files (x86)\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1354488 2015-03-19] (BlackBerry Limited)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2011-06-14] (VIA Technologies, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 blackberryncm; C:\Windows\System32\DRIVERS\blackberryncm6_AMD64.sys [25088 2014-09-08] (BlackBerry)
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-07-24] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-07-24] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [94456 2015-12-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [201464 2015-12-04] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [110840 2015-12-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [110840 2015-12-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\System32\DRIVERS\NNSNAHSL.sys [48912 2015-04-27] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [103160 2015-12-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [80592 2016-03-14] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [124152 2015-12-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [300280 2015-12-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [177424 2016-02-17] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [113400 2015-12-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [264976 2016-02-17] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [106232 2015-12-04] (Panda Security, S.L.)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [171792 2016-08-05] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [127248 2016-08-05] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [205072 2016-08-05] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [131344 2016-08-05] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [144656 2016-08-05] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [114960 2016-08-05] (Panda Security, S.L.)
U3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [70360 2016-08-08] (Panda Security, S.L.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [79872 2014-05-06] (BlackBerry Limited)
R3 rimvndis; C:\Windows\System32\Drivers\rimvndis6_AMD64.sys [18432 2015-03-19] (BlackBerry Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-10-01 14:27 - 2016-10-01 14:27 - 00000000 ____D C:\Users\Sebastian\Desktop\Stare dane programu Firefox
2016-10-01 14:24 - 2016-08-08 11:00 - 00070360 _____ (Panda Security, S.L.) C:\Windows\system32\Drivers\PSKMAD.sys
2016-10-01 14:19 - 2016-10-01 14:19 - 02403328 _____ (Farbar) C:\Users\Sebastian\Desktop\FRST64.exe
2016-10-01 14:08 - 2016-10-01 14:29 - 00000000 ____D C:\Users\Sebastian\Desktop\Nowy folder
2016-10-01 14:00 - 2016-10-01 14:00 - 00133669 _____ C:\Users\Sebastian\Desktop\bookmarks.html
2016-10-01 14:00 - 2016-10-01 14:00 - 00041659 _____ C:\Users\Sebastian\Desktop\bookmarks-2016-10-01.json
2016-09-28 01:49 - 2016-09-28 01:49 - 00005078 _____ C:\Users\Sebastian\Desktop\raport panda.txt
2016-09-28 00:50 - 2016-09-28 00:50 - 00045478 _____ C:\Users\Sebastian\Desktop\Shortcut.txt
2016-09-28 00:02 - 2016-09-28 00:50 - 00021332 _____ C:\Users\Sebastian\Desktop\FRST.txt
2016-09-28 00:02 - 2016-09-28 00:03 - 00035562 _____ C:\Users\Sebastian\Desktop\Addition.txt
2016-09-27 23:58 - 2016-10-01 14:29 - 00000000 ____D C:\FRST
2016-09-27 23:58 - 2016-09-28 01:48 - 00000000 ____D C:\Users\Sebastian\Desktop\gmer
2016-09-27 23:40 - 2016-09-27 23:41 - 00002193 _____ C:\Users\Public\Desktop\Panda Free Antivirus.lnk
2016-09-27 23:40 - 2016-09-27 23:40 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\Panda Security
2016-09-27 23:40 - 2016-09-27 23:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2016-09-27 23:40 - 2016-09-27 23:40 - 00000000 ____D C:\Program Files (x86)\Panda Security
2016-09-27 23:39 - 2016-09-27 23:40 - 00000000 ____D C:\ProgramData\Panda Security
2016-09-27 23:36 - 2016-09-27 23:38 - 67703688 _____ (Panda Security, S.L.) C:\Users\Sebastian\Desktop\FREEAV.exe
2016-09-25 11:49 - 2016-09-25 11:49 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\.technic
2016-09-25 11:48 - 2016-09-25 11:48 - 04734664 _____ () C:\Users\Sebastian\Desktop\TechnicLauncher.exe

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-10-01 14:24 - 2014-12-20 05:11 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-10-01 14:24 - 2014-11-18 15:31 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-10-01 14:24 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-10-01 14:21 - 2015-10-12 14:46 - 00000000 ____D C:\Users\Sebastian\AppData\LocalLow\Temp
2016-10-01 14:20 - 2014-11-16 17:42 - 00001065 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-10-01 14:20 - 2014-11-16 16:50 - 00001198 _____ C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-10-01 14:20 - 2014-11-16 16:50 - 00001168 _____ C:\Users\Sebastian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-10-01 14:20 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\GroupPolicy
2016-10-01 14:17 - 2015-01-26 15:41 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-10-01 14:17 - 2014-11-16 18:00 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\TS3Client
2016-10-01 14:09 - 2016-08-13 15:43 - 00000530 _____ C:\Users\Sebastian\Desktop\Nowy dokument tekstowy (5).txt
2016-10-01 14:02 - 2014-12-12 00:30 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-10-01 03:05 - 2014-11-24 01:33 - 00000000 ____D C:\Users\Sebastian\AppData\Local\Battle.net
2016-09-29 23:22 - 2014-11-22 19:28 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\.minecraft
2016-09-28 10:16 - 2009-07-14 06:45 - 00319040 _____ C:\Windows\system32\FNTCACHE.DAT
2016-09-28 01:57 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-09-28 01:57 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-09-27 23:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-09-27 23:40 - 2014-11-16 17:08 - 00058032 _____ C:\Users\Sebastian\AppData\Local\GDIPFONTCACHEV1.DAT
2016-09-24 02:33 - 2014-11-18 21:03 - 00000000 ____D C:\Users\Sebastian\AppData\Roaming\BitComet
2016-09-22 14:54 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2016-09-14 01:02 - 2014-12-12 00:30 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-09-14 01:02 - 2014-11-16 18:48 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-09-14 01:02 - 2014-11-16 18:48 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-09-14 01:02 - 2014-11-16 18:48 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-09-14 01:02 - 2014-11-16 18:48 - 00000000 ____D C:\Windows\system32\Macromed

==================== Pliki w katalogu głównym wybranych folderów =======

2015-10-10 09:26 - 2015-10-10 09:26 - 0007605 _____ () C:\Users\Sebastian\AppData\Local\Resmon.ResmonCfg

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll
[2010-11-21 05:24] - [2014-11-22 10:15] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2010-11-21 05:24] - [2014-11-22 10:15] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-09-18 19:50

==================== Koniec  FRST.txt ============================