Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 17-10-2016 Uruchomiony przez Leszek (administrator) LESZEK-KOMPUTER (23-10-2016 19:49:08) Uruchomiony z D:\EXE Załadowane profile: Leszek (Dostępne profile: Leszek) Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe (AnVir Software) C:\Program Files (x86)\AnVir Task Manager\anvirlauncher.exe (Performix LLC) C:\Program Files (x86)\Adguard\AdguardSvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgfwsa.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe (Bongiovi Acoustics) D:\PROGRAMY\Bongiovi DPS\Bongiovi DPS.exe (Winstep Software Technologies) C:\Program Files (x86)\Winstep\Nexus.exe (Performix LLC) C:\Program Files (x86)\Adguard\Adguard.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe (QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\KeyScrambler.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (QFX Software Corporation) C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [] => D:\PROGRAMY\Bongiovi DPS\Bongiovi DPS.exe [1933840 2016-09-12] (Bongiovi Acoustics) HKLM-x32\...\Run: [KeyScrambler] => C:\Program Files (x86)\KeyScrambler\keyscrambler.exe [515600 2016-04-01] (QFX Software Corporation) HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [218896 2016-09-13] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [218896 2016-09-13] (AVG Technologies CZ, s.r.o.) HKLM\...\Policies\Explorer: [NoViewOnDrive] 0 HKLM\...\Policies\Explorer: [DisableLocalMachineRun] 0 HKLM\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0 HKLM\...\Policies\Explorer: [DisableCurrentUserRun] 0 HKLM\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0 HKLM\...\Policies\Explorer: [NoViewContextMenu] 0 HKLM\...\Policies\Explorer: [NoShellSearchButton] 0 HKLM\...\Policies\Explorer: [NoFile] 0 HKLM\...\Policies\Explorer: [HideClock] 0 HKLM\...\Policies\Explorer: [NoTrayContextMenu] 0 HKLM\...\Policies\Explorer: [NoTrayItemsDisplay] 0 HKLM\...\Policies\Explorer: [NoSetFolders] 0 HKLM\...\Policies\Explorer: [NoDevMgrUpdate] 0 HKLM\...\Policies\Explorer: [NoSetTaskbar] 0 HKLM\...\Policies\Explorer: [NoDeletePrinter] 0 HKLM\...\Policies\Explorer: [NoDFSTab] 0 HKLM\...\Policies\Explorer: [NoChangeStartMenu] 0 HKLM\...\Policies\Explorer: [NoLogoff] 0 HKLM\...\Policies\Explorer: [NoWindowsUpdate] 0 HKLM\...\Policies\Explorer: [NoEncryptOnMove] 0 HKLM\...\Policies\Explorer: [NoRunasInstallPrompt] 0 HKLM\...\Policies\Explorer: [NoResolveSearch] 0 HKLM\...\Policies\Explorer: [NoSaveSettings] 0 HKLM\...\Policies\Explorer: [NoHardwareTab] 0 HKLM\...\Policies\Explorer: [NoStartMenuSubFolders] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Run: [Nexus] => C:\Program Files (x86)\Winstep\Nexus.exe [29469312 2016-03-08] (Winstep Software Technologies) HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Run: [Adguard] => C:\Program Files (x86)\Adguard\Adguard.exe [5608440 2016-08-26] (Performix LLC) HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\system: [DisableCMD] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\system: [NoDispAppearancePage] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\system: [NoDispBackgroundPage] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\system: [NoDispSettingsPage] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoViewOnDrive] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [DisableLocalMachineRun] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [DisableLocalMachineRunOnce] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [DisableCurrentUserRun] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [DisableCurrentUserRunOnce] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoViewContextMenu] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoShellSearchButton] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoFind] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoFile] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [HideClock] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoTrayContextMenu] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoTrayItemsDisplay] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoSetFolders] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoDevMgrUpdate] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoSetTaskbar] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoDeletePrinter] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoDFSTab] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoChangeStartMenu] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoLogoff] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoWindowsUpdate] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoEncryptOnMove] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoRunasInstallPrompt] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoResolveSearch] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoSaveSettings] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoHardwareTab] 0 HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Policies\Explorer: [NoStartMenuSubFolders] 0 HKU\S-1-5-18\...\Run: [XDM] => D:\PROGRAMY\xdm.exe [726016 2016-07-15] (Subhra Das Gupta) AppInit_DLLs: C:\PROGRA~2\KeyCryptSDK\KeyCrypt64(4).dll => C:\Program Files (x86)\KeyCryptSDK\KeyCrypt64(4).dll [95712 2016-08-11] (Zemana Ltd.) AppInit_DLLs-x32: C:\PROGRA~2\KeyCryptSDK\KeyCrypt32(4).dll => C:\Program Files (x86)\KeyCryptSDK\KeyCrypt32(4).dll [86936 2016-08-11] (Zemana Ltd.) GroupPolicy: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 208.67.222.220 208.67.220.222 Tcpip\..\Interfaces\{D1430F22-71B9-470D-8DB9-D51523E4BD41}: [NameServer] 208.67.222.222,208.67.220.220,93.174.25.97 Tcpip\..\Interfaces\{D1430F22-71B9-470D-8DB9-D51523E4BD41}: [DhcpNameServer] 208.67.222.220 208.67.220.222 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO-x32: IE 4.x-6.x BHO for Internet Download Accelerator -> {2A646672-9C3A-4C28-9A7A-1FB0F63F28B6} -> C:\Program Files (x86)\IDA\idaiehlp.dll [2016-04-01] (WestByte) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: 15eunx8e.default FF ProfilePath: C:\Users\Leszek\AppData\Roaming\Mozilla\Firefox\Profiles\15eunx8e.default [2016-10-23] FF Extension: (Adguard AdBlocker) - C:\Users\Leszek\AppData\Roaming\Mozilla\Firefox\Profiles\15eunx8e.default\Extensions\adguardadblocker@adguard.com.xpi [2016-06-11] FF Extension: (VTzilla) - C:\Users\Leszek\AppData\Roaming\Mozilla\Firefox\Profiles\15eunx8e.default\Extensions\info@virustotal.com.xpi [2016-07-30] FF Extension: (FlashGot) - C:\Users\Leszek\AppData\Roaming\Mozilla\Firefox\Profiles\15eunx8e.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2016-09-17] FF Extension: (FT DeepDark) - C:\Users\Leszek\AppData\Roaming\Mozilla\Firefox\Profiles\15eunx8e.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2016-10-10] FF Extension: (IDA Remote Download) - C:\Program Files (x86)\IDA\distribution\bundles\idaremote@westbyte.com [2016-09-16] FF HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Firefox\Extensions: [idapluginff@westbyte.com] - C:\Program Files (x86)\IDA\distribution\bundles\idapluginff@westbyte.com FF Extension: (Internet Download Accelerator Plugin) - C:\Program Files (x86)\IDA\distribution\bundles\idapluginff@westbyte.com [2016-09-16] FF HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Firefox\Extensions: [idamm@westbyte.com] - C:\Program Files (x86)\IDA\distribution\bundles\idamm@westbyte.com FF Extension: (Internet Download Accelerator Media Monitor) - C:\Program Files (x86)\IDA\distribution\bundles\idamm@westbyte.com [2016-09-16] FF HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Firefox\Extensions: [idabarff@westbyte.com] - C:\Program Files (x86)\IDA\distribution\bundles\idabarff@westbyte.com FF Extension: (Internet Download Accelerator Toolbar) - C:\Program Files (x86)\IDA\distribution\bundles\idabarff@westbyte.com [2016-09-16] FF HKU\S-1-5-21-1953485706-3048050180-2069795806-1000\...\Firefox\Extensions: [idaremote@westbyte.com] - C:\Program Files (x86)\IDA\distribution\bundles\idaremote@westbyte.com FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_185.dll [2016-10-11] () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_185.dll [2016-10-11] () FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-01-29] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-01-29] (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-07-28] (Adobe Systems Inc.) Chrome: ======= CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 Adguard Service; C:\Program Files (x86)\Adguard\AdguardSvc.exe [149496 2016-08-26] (Performix LLC) S3 AnviCsbSvc; D:\PROGRAMY\Cloud System Booster\CSBSvc.exe [42768 2015-04-27] (Anvisoft) S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [647864 2016-10-13] (AVG Technologies CZ, s.r.o.) R2 avgfws; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2050040 2016-10-13] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5332384 2016-10-13] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1149712 2016-09-13] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [727512 2016-10-13] (AVG Technologies CZ, s.r.o.) S3 Chemtable Startup Checking; D:\PROGRAMY\Reg Organizer\StartupCheckingService.exe [1075968 2015-06-27] (Chemtable Software) S4 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2016-01-29] (NVIDIA Corporation) S3 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [3046688 2016-07-29] (IObit) S3 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706128 2016-01-29] (NVIDIA Corporation) S3 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833360 2016-01-29] (NVIDIA Corporation) S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2013-08-15] (Puran Software) [Brak podpisu cyfrowego] R2 Themes; C:\Windows\system32\themeservice.dll [44544 2016-10-01] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) U4 CmdAgent; Brak ImagePath S3 myTuningSvc; Brak ImagePath S4 WiseBootAssistant; Brak ImagePath S4 ZAMSvc; "C:\Program Files (x86)\Zemana AntiMalware\ZAM.exe" /service [X] ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 adgnetworktdidrv; C:\Windows\System32\drivers\adgnetworktdidrv.sys [62536 2016-07-21] () R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.) R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [73480 2016-06-06] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [311552 2016-09-22] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [272640 2016-07-27] (AVG Technologies CZ, s.r.o.) R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [265472 2016-09-20] (AVG Technologies CZ, s.r.o.) R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [254208 2016-09-26] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [299264 2016-07-27] (AVG Technologies CZ, s.r.o.) R0 avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [77056 2016-06-20] (AVG Technologies CZ, s.r.o.) S3 bbwfp; D:\PROGRAMY\Cloud System Booster\wfp\x64\BBWFP.sys [40720 2015-03-24] (Anvisoft) S3 dfg; C:\Windows\SysWOW64\drivers\dfg.sys [23552 2015-08-10] (defrag Development Team) [Brak podpisu cyfrowego] R3 digitalpower; C:\Windows\System32\drivers\digitalpower.sys [29184 2015-09-10] (Bongiovi Acoustics) R1 dvdfabio; C:\Windows\system32\drivers\dvdfabio.sys [12704 2014-08-29] (DVDFab Software) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [18528 2014-11-18] () S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [15968 2014-11-18] () S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [10848 2014-11-18] () S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [10208 2014-11-18] () R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-04-17] (REALiX(tm)) R3 keycrypt; C:\Windows\System32\DRIVERS\KeyCrypt64.sys [158848 2016-08-11] (Zemana Ltd.) R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [224720 2015-08-18] (QFX Software Corporation) S3 MDA_NTDRV; C:\Windows\system32\MDA_NTDRV.sys [21208 2013-02-25] () S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2016-01-29] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-06-13] (NVIDIA Corporation) R3 vdrive; C:\Windows\System32\DRIVERS\vdrive.sys [44960 2014-08-29] (DVDFab Software) U3 DfSdkS; Brak ImagePath S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X] S3 tsusbhub; system32\drivers\tsusbhub.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X] S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-10-23 18:56 - 2016-10-23 18:56 - 00000207 _____ C:\Windows\tweaking.com-regbackup-LESZEK-KOMPUTER-Windows-7-Ultimate-(64-bit).dat 2016-10-23 18:56 - 2016-10-23 18:56 - 00000000 ____D C:\RegBackup 2016-10-23 18:54 - 2016-10-23 18:54 - 00000606 _____ C:\Users\Leszek\Desktop\Tweaking.com - Windows Repair.lnk 2016-10-23 18:54 - 2016-10-23 18:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2016-10-23 18:53 - 2016-10-23 18:54 - 00127567 _____ C:\Windows\Tweaking.com - Windows Repair Setup Log.txt 2016-10-23 17:44 - 2016-10-23 17:44 - 00000000 ____D C:\e9fdd98714ec2ee29a40 2016-10-23 17:40 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe 2016-10-23 17:40 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe 2016-10-23 16:41 - 2016-10-23 16:43 - 00000000 ____D C:\SMCLpav 2016-10-23 14:37 - 2016-10-23 14:37 - 00001173 _____ C:\Users\Leszek\Desktop\błędy.txt 2016-10-23 13:27 - 2016-10-23 13:27 - 00015174 _____ C:\Users\Leszek\Desktop\Informacje o systemie.txt 2016-10-23 11:19 - 2016-10-23 19:49 - 00000000 ____D C:\FRST 2016-10-23 10:41 - 2016-10-23 10:41 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\abelhadigital.com 2016-10-23 10:41 - 2016-10-23 10:41 - 00000000 ____D C:\ProgramData\abelhadigital.com 2016-10-23 10:36 - 2016-10-23 10:36 - 00000000 ____D C:\Users\Public\Documents\HostsMan Backups 2016-10-23 10:36 - 2016-10-23 10:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HostsMan 2016-10-22 21:37 - 2016-10-22 21:37 - 00003258 _____ C:\Windows\System32\Tasks\Driver Booster Scheduler 2016-10-22 12:59 - 2016-10-22 12:59 - 00284968 _____ C:\Windows\system32\FNTCACHE.DAT 2016-10-22 11:56 - 2016-10-22 11:56 - 00061624 _____ C:\Users\Leszek\AppData\Local\GDIPFONTCACHEV1.DAT 2016-10-22 10:46 - 2016-10-22 10:46 - 00000000 ____D C:\Users\Leszek\Documents\Steganos Safe 2016-10-22 10:40 - 2016-10-22 10:40 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\extensions 2016-10-22 10:39 - 2016-10-23 10:09 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\Steganos 2016-10-21 16:50 - 2016-10-21 16:50 - 00000651 _____ C:\Users\Leszek\Desktop\firefox.txt 2016-10-21 16:10 - 2016-10-21 16:10 - 00000259 _____ C:\Windows\SysWOW64\d3dx9_11.dll.tmp 2016-10-16 14:42 - 2016-10-16 14:42 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\ERS Game Studios 2016-10-15 20:57 - 2016-10-15 20:57 - 00000713 _____ C:\Users\Public\Desktop\Loaris Trojan Remover.lnk 2016-10-15 20:57 - 2016-10-15 20:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Loaris Trojan Remover 2016-10-15 20:56 - 2016-10-15 20:56 - 00000000 ____D C:\ProgramData\Loaris 2016-10-14 17:21 - 2016-10-14 17:21 - 00000000 ____D C:\Users\Leszek\AppData\Local\Bongiovi_Acoustics 2016-10-14 17:21 - 2016-10-14 17:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bongiovi Acoustics 2016-10-14 17:21 - 2016-10-14 17:21 - 00000000 ____D C:\ProgramData\Bongiovi Acoustics 2016-10-14 17:21 - 2015-09-10 14:31 - 00029184 _____ (Bongiovi Acoustics) C:\Windows\system32\Drivers\digitalpower.sys 2016-10-14 16:19 - 2016-10-14 16:19 - 00000000 ____D C:\Windows\IObit 2016-10-12 22:32 - 2016-10-12 22:32 - 00000000 ____D C:\Users\Leszek\Desktop\f 2016-10-12 18:00 - 2016-10-12 18:00 - 00000000 ____D C:\Users\Leszek\AppData\Local\RegistryBackups 2016-10-12 18:00 - 2016-10-12 18:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Registrar Registry Manager (64-bit) 2016-10-11 21:05 - 2016-10-11 21:05 - 00000000 ____D C:\ProgramData\Arcabit 2016-10-11 21:05 - 2016-10-11 21:05 - 00000000 ____D C:\Program Files\ArcabitSkanerOnline 2016-10-02 16:01 - 2010-11-20 05:27 - 14174208 _____ (Microsoft Corporation) C:\Windows\system32\Shell32.dll.backup 2016-10-02 16:01 - 2010-11-20 05:27 - 01808384 _____ (Microsoft Corporation) C:\Windows\system32\pnidui.dll.backup 2016-10-02 16:01 - 2010-11-20 05:27 - 00898560 _____ (Microsoft Corporation) C:\Windows\system32\OobeFldr.dll.backup 2016-10-02 16:01 - 2010-11-20 05:27 - 00225280 _____ (Microsoft Corporation) C:\Windows\system32\SndVolSSO.dll.backup 2016-10-02 16:01 - 2010-11-20 05:26 - 01866240 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll.backup 2016-10-02 16:01 - 2010-11-20 05:25 - 00780800 _____ (Microsoft Corporation) C:\Windows\system32\ActionCenter.dll.backup 2016-10-02 16:01 - 2010-11-20 05:24 - 02872320 _____ (Microsoft Corporation) C:\Windows\Explorer.exe.backup 2016-10-02 16:01 - 2009-07-14 03:28 - 20268032 _____ (Microsoft Corporation) C:\Windows\system32\ImageRes.dll.backup 2016-10-01 08:04 - 2016-10-01 08:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sunrise Seven 2016-09-30 19:27 - 2016-10-21 17:20 - 00000000 ___RD C:\Users\Leszek\Desktop\HTM 2016-09-30 16:42 - 2016-09-30 16:42 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Paste As File 2016-09-30 16:42 - 2016-09-30 16:42 - 00000000 ____D C:\Program Files (x86)\PasteAsFile 2016-09-26 18:19 - 2016-09-26 18:19 - 00254208 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys 2016-09-25 10:46 - 2016-09-25 10:46 - 00000653 _____ C:\Users\Leszek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Run XP Repair Pro 4.0.lnk 2016-09-25 10:46 - 2016-09-25 10:46 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\XP Repair Pro 4.0 2016-09-25 10:44 - 2016-09-25 10:44 - 00000000 ____D C:\Users\Leszek\AppData\Local\{42FFD6CD-1797-4302-8C84-959BECBCDA13} 2016-09-24 07:48 - 2016-10-15 21:46 - 00000000 __SHD C:\Users\Leszek\AppData\Roaming\wyUpdate AU 2016-09-24 07:48 - 2016-09-24 07:48 - 00000000 __SHD C:\Users\Leszek\wc ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-10-23 19:49 - 2016-06-12 23:06 - 00000000 ____D C:\ProgramData\Adguard 2016-10-23 19:47 - 2009-07-14 19:55 - 00896264 _____ C:\Windows\system32\perfh015.dat 2016-10-23 19:47 - 2009-07-14 19:55 - 00206074 _____ C:\Windows\system32\perfc015.dat 2016-10-23 19:47 - 2009-07-14 07:13 - 01901878 _____ C:\Windows\system32\PerfStringBackup.INI 2016-10-23 19:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2016-10-23 19:43 - 2016-08-19 17:13 - 00000000 ____D C:\Program Files (x86)\Adguard 2016-10-23 19:43 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-10-23 19:42 - 2009-07-14 06:45 - 00020800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-10-23 19:42 - 2009-07-14 06:45 - 00020800 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-10-23 19:20 - 2016-04-08 13:31 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-10-23 18:51 - 2016-04-08 16:29 - 00000000 ____D C:\ProgramData\MFAData 2016-10-23 17:00 - 2016-08-08 21:17 - 00104870 _____ C:\Windows\ZAM_Guard.krnl.trace 2016-10-23 17:00 - 2016-07-23 21:23 - 43479040 _____ C:\Windows\system32\config\PuranRegCSoft.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 36503552 _____ C:\Windows\system32\config\PuranRegCCOM.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 15372288 _____ C:\Windows\system32\config\PuranRegCSys.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 02682880 _____ C:\Windows\system32\config\PuranRegCUserClass.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 01953792 _____ C:\Windows\system32\config\PuranRegCUser.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00241664 _____ C:\Windows\system32\config\PuranRegCNetwork.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00241664 _____ C:\Windows\system32\config\PuranRegCLocal.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00143360 _____ C:\Windows\system32\config\PuranRegCDefault.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00065536 _____ C:\Windows\system32\config\PuranRegCSam.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00028672 _____ C:\Windows\system32\config\PuranRegCBCD.pur 2016-10-23 17:00 - 2016-07-23 21:23 - 00000010 _____ C:\Windows\system32\config\PuranBackupTime.pur 2016-10-23 17:00 - 2016-06-04 08:54 - 00000000 ____D C:\Program Files (x86)\System Ninja 2016-10-23 16:59 - 2016-08-08 21:17 - 00103850 _____ C:\Windows\ZAM.krnl.trace 2016-10-23 08:02 - 2016-09-20 18:31 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task 2016-10-23 07:48 - 2009-07-14 07:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2016-10-22 21:37 - 2016-04-17 09:26 - 00002890 _____ C:\Windows\System32\Tasks\Driver Booster SkipUAC (Leszek) 2016-10-22 21:29 - 2016-07-13 11:28 - 00000414 __RSH C:\ProgramData\ntuser.pol 2016-10-22 11:53 - 2016-05-21 07:48 - 00000000 ____D C:\Users\Leszek\AppData\Local\CrashDumps 2016-10-22 11:53 - 2016-04-17 17:26 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\uTorrent 2016-10-22 07:05 - 2016-08-28 16:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-10-21 16:41 - 2016-08-28 16:40 - 00000000 ____D C:\Program Files\Mozilla Firefox 2016-10-20 18:26 - 2016-04-16 17:13 - 00000000 ____D C:\AdwCleaner 2016-10-18 19:05 - 2016-06-08 21:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2016-10-16 14:42 - 2016-04-23 22:45 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\NVIDIA 2016-10-16 12:36 - 2016-04-08 12:32 - 00000000 ____D C:\Program Files\WinRAR 2016-10-15 14:41 - 2016-04-08 18:24 - 00000000 ____D C:\Users\Leszek\AppData\Roaming\foobar2000 2016-10-14 17:38 - 2016-04-17 09:27 - 00000000 ____D C:\ProgramData\ProductData 2016-10-14 16:19 - 2016-04-17 09:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster 3 2016-10-11 19:20 - 2016-04-08 13:31 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2016-10-11 19:20 - 2016-04-08 13:31 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2016-10-11 19:20 - 2016-04-08 13:31 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2016-10-11 19:20 - 2016-04-08 13:31 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2016-10-11 19:20 - 2016-04-08 13:31 - 00000000 ____D C:\Windows\system32\Macromed 2016-10-05 19:39 - 2016-04-17 07:17 - 00000000 ____D C:\Users\Public\Documents\Winstep 2016-10-01 17:18 - 2016-09-17 21:43 - 00000000 ___RD C:\Users\Leszek\Desktop\KEY 2016-10-01 16:35 - 2016-04-08 12:35 - 02851840 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll 2016-10-01 16:35 - 2009-07-14 01:55 - 00332288 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2016-10-01 16:35 - 2009-07-14 01:54 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\themeservice.dll 2016-10-01 08:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe 2016-09-24 16:04 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Resources 2016-09-24 12:52 - 2016-08-08 21:17 - 00000000 ____D C:\Program Files (x86)\KeyCryptSDK 2016-09-24 07:48 - 2016-04-08 12:20 - 00000000 ____D C:\Users\Leszek ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-07-24 15:59 - 2016-07-24 16:23 - 0000534 _____ () C:\Users\Leszek\AppData\Roaming\burnaware.ini 2016-06-12 23:07 - 2016-08-19 17:13 - 0000257 _____ () C:\ProgramData\fontcacheev1.dat Pliki do przeniesienia lub usunięcia: ==================== C:\ProgramData\fontcacheev1.dat C:\Users\Leszek\language90.dll ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-10-22 23:14 ==================== Koniec FRST.txt ============================