Witam,bardzo prosze o sprawdzenie log-ów z Frst poniewaz komputer bardzo muli i wszystko trwa wieki.
Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 05-02-2017
Uruchomiony przez pawel (administrator) PAWEL-KOMPUTER (05-02-2017 21:40:52)
Uruchomiony z C:\Users\pawel\Downloads
Załadowane profile: pawel (Dostępne profile: pawel & Gość)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Procesy (filtrowane) =================
(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Program Files (x86)\EaseUS\Todo Backup\bin\TodoBackupService.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
() C:\Program Files (x86)\GLPCCamera\monitorpad.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(CHENGDU YIWO Tech Development Co., Ltd) C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
==================== Rejestr (filtrowane) ====================
(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)
HKLM\...\Run: [ETDCtrl] = & gt; C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.)
HKLM\...\Run: [Acer ePower Management] = & gt; C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [862088 2011-01-28] (Acer Incorporated)
HKLM\...\Run: [GLSystray] = & gt; C:\Program Files (x86)\GLPCCamera\monitorpad.exe [69632 2010-04-27] ()
HKLM\...\Run: [ALU] = & gt; C:\Program Files\Acer\Acer Updater\ALU.exe [2419104 2016-06-06] (Acer Incorporated)
HKLM-x32\...\Run: [SuiteTray] = & gt; C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [340336 2010-09-28] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisTecPMMUpdate] = & gt; C:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe [407920 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [EgisUpdate] = & gt; C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201584 2010-09-18] (Egis Technology Inc.)
HKLM-x32\...\Run: [Norton Online Backup] = & gt; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-01] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] = & gt; C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35696 2009-02-28] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LManager] = & gt; C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [StartCCC] = & gt; C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-01-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] = & gt; C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [EaseUS EPM tray] = & gt; C:\Program Files (x86)\EaseUS\EaseUS Partition Master 10.2\bin\EpmNews.exe [2089056 2014-11-18] (CHENGDU YIWO Tech Development Co., Ltd)
HKLM-x32\...\Run: [GrooveMonitor] = & gt; C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation)
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] = & gt; msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] = & gt; msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\Run: [Skype] = & gt; C:\Program Files (x86)\Skype\Phone\Skype.exe [50670720 2016-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {14facf1b-c57d-11e3-97aa-3859f94fe7b1} - F:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {14facf44-c57d-11e3-97aa-3859f94fe7b1} - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {7d94bc9d-d57d-11e5-9396-3859f94fe7b1} - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {8878f208-cc47-11e5-97f9-b870f4a9cf16} - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {97178ba1-ce45-11e5-92e1-b870f4a9cf16} - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {97178bac-ce45-11e5-92e1-b870f4a9cf16} - E:\AutoRun.exe
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\...\MountPoints2: {f56512bf-bbd8-11e5-b87f-3859f94fe7b1} - E:\AutoRun.exe
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] = & gt; msiexec.exe /qn /x{voidguid}
ShellIconOverlayIdentifiers: [00avast] - & gt; {472083B0-C522-11CF-8763-00608CC02F24} = & gt; - & gt; Brak pliku
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk [2011-04-15]
ShortcutTarget: Acer VCM.lnk - & gt; C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
BootExecute:
GroupPolicy: Ograniczenia - Chrome & lt; ======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia & lt; ======= UWAGA
==================== Internet (filtrowane) ====================
(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{1140A1CA-E6E8-43A8-98E2-B53E389735DC}: [DhcpNameServer] 192.168.1.1 192.168.1.1
Internet Explorer:
==================
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.wp.pl/?dp=20160807
HKU\S-1-5-21-2416977680-1910873838-3357786379-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKLM - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms} & form=AARTDF & pc=MAAR & src=IE-SearchBox
SearchScopes: HKLM - & gt; {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms} & form=AARTDF & pc=MAAR & src=IE-SearchBox
SearchScopes: HKLM-x32 - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms} & form=AARTDF & pc=MAAR & src=IE-SearchBox
SearchScopes: HKLM-x32 - & gt; {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms} & form=AARTDF & pc=MAAR & src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-2416977680-1910873838-3357786379-1000 - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2416977680-1910873838-3357786379-1000 - & gt; {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - & gt; {9030D464-4C02-4ABF-8ECC-5164760863C6} - & gt; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Adobe PDF Link Helper - & gt; {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - & gt; C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27] (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - & gt; {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - & gt; C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - & gt; {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - & gt; C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-10-10] (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - & gt; {9030D464-4C02-4ABF-8ECC-5164760863C6} - & gt; C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.)
BHO-x32: Bing Bar Helper - & gt; {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - & gt; C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - & gt; {DBC80044-A445-435b-BC74-9C25C1C588A9} - & gt; C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-10-10] (Oracle Corporation)
BHO-x32: IEPluginBHO Class - & gt; {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - & gt; C:\Users\pawel\AppData\Roaming\Gadu-Gadu 10\_userdata\ggbho.2.dll [2009-12-21] (GG Network S.A.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll [2011-03-01] (Microsoft Corporation.)
FireFox:
========
FF ProfilePath: C:\Users\pawel\AppData\Roaming\Mozilla\Firefox\Profiles\ziv4cfn0.default-1452794668783 [2017-02-05]
FF user.js: detected! = & gt; C:\Users\pawel\AppData\Roaming\Mozilla\Firefox\Profiles\ziv4cfn0.default-1452794668783\user.js [2016-08-07]
FF Homepage: Mozilla\Firefox\Profiles\ziv4cfn0.default-1452794668783 - & gt; hxxp://www.wp.pl/?dp=20160807
FF Extension: (Firefox Hotfix) - C:\Users\pawel\AppData\Roaming\Mozilla\Firefox\Profiles\ziv4cfn0.default-1452794668783\Extensions\firefox-hotfix@mozilla.org.xpi [2016-09-17]
FF Extension: (Browser-Security) - C:\Users\pawel\AppData\Roaming\Mozilla\Firefox\Profiles\ziv4cfn0.default-1452794668783\Extensions\firefox@browser-security.de.xpi [2016-11-05]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird = & gt; nie znaleziono
FF Plugin: @microsoft.com/GENUINE - & gt; disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - & gt; C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.5 - & gt; C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-22] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - & gt; C:\Windows\system32\Macromed\Flash\NPSWF32.dll [Brak pliku]
FF Plugin-x32: @google.com/npwebplugin - & gt; C:\Windows\system32\npwebplugin.dll [Brak pliku]
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 - & gt; C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-10] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 - & gt; C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-10-10] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - & gt; disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - & gt; C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - & gt; C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - & gt; C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation)
==================== Usługi (filtrowane) ====================
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
R2 EaseUS Agent; C:\Program Files (x86)\EaseUS\Todo Backup\bin\Agent.exe [37416 2014-12-15] (CHENGDU YIWO Tech Development Co., Ltd)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [2836296 2016-12-14] (ESET)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] ()
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 Update BrowseMark; " C:\Program Files (x86)\BrowseMark\updateBrowseMark.exe " [X]
S2 Util BrowseMark; " C:\Program Files (x86)\BrowseMark\bin\utilBrowseMark.exe " [X]
===================== Sterowniki (filtrowane) ======================
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
S3 ampa; C:\Windows\system32\ampa.sys [17008 2015-01-02] () [Brak podpisu cyfrowego]
S3 ampa; C:\Windows\SysWOW64\ampa.sys [17008 2015-01-02] () [Brak podpisu cyfrowego]
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [132272 2016-12-13] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [106768 2016-12-13] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [180544 2016-12-13] (ESET)
R2 ekbdflt; C:\Windows\System32\DRIVERS\ekbdflt.sys [49672 2016-12-13] (ESET)
R1 epfw; C:\Windows\System32\DRIVERS\epfw.sys [77616 2016-12-13] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [60536 2016-12-13] (ESET)
R1 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [96856 2016-12-13] (ESET)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [18528 2014-11-18] ()
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [14944 2014-11-18] ()
R0 EUBKMON; C:\Windows\System32\drivers\EUBKMON.sys [48168 2014-12-14] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [10848 2014-11-18] ()
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [10208 2014-11-18] ()
S3 glavcam; C:\Windows\System32\DRIVERS\glavcam.sys [1708032 2013-02-20] (Windows (R) Codename Longhorn DDK provider)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Huawei Technologies Co., Ltd.)
S3 massfilter; system32\drivers\massfilter.sys [X]
==================== NetSvcs (filtrowane) ===================
(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)
==================== Jeden miesiąc - utworzone pliki i foldery ========
(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
2017-02-05 21:40 - 2017-02-05 21:44 - 00016174 _____ C:\Users\pawel\Downloads\FRST.txt
2017-02-05 21:40 - 2017-02-05 21:40 - 00000000 ____D C:\FRST
2017-02-05 21:39 - 2017-02-05 21:40 - 02421248 _____ (Farbar) C:\Users\pawel\Downloads\FRST64.exe
2017-02-05 20:51 - 2017-02-05 20:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2017-02-05 20:33 - 2017-02-05 20:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Works
2017-02-05 20:30 - 2017-02-05 20:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio
2017-02-05 19:59 - 2017-02-05 19:59 - 00000000 ____D C:\Program Files\Microsoft Office
2017-02-05 19:57 - 2017-02-05 19:57 - 00000000 ____D C:\Program Files (x86)\Microsoft Visual Studio 8
2017-02-05 19:46 - 2017-02-05 19:46 - 00000000 ____D C:\Users\pawel\AppData\Local\Microsoft Help
2017-02-05 19:40 - 2017-02-05 19:40 - 00000000 __RHD C:\MSOCache
2017-02-05 19:23 - 2017-02-05 19:23 - 00000000 ____D C:\Users\pawel\Desktop\MicrosoftOffice.2007.Enterprise.PL
2017-02-05 19:16 - 2017-02-05 19:18 - 00000000 ____D C:\Users\pawel\Desktop\admin
2017-02-05 19:06 - 2017-02-05 19:06 - 00000000 ____D C:\Users\pawel\AppData\Local\{A9DD119A-998D-471D-8CBB-26F4C29D437B}
2017-02-05 19:06 - 2017-02-05 19:06 - 00000000 ____D C:\Users\pawel\AppData\Local\{4EF83FE1-E3FB-43BB-B5D9-5A424FCBFC92}
2017-02-05 18:21 - 2016-12-13 17:11 - 00132272 _____ (ESET) C:\Windows\system32\Drivers\eamonm.sys
2017-02-05 18:20 - 2017-02-05 18:20 - 00001991 _____ C:\Users\Public\Desktop\Ochrona bankowości internetowej.lnk
2017-02-05 18:20 - 2017-02-05 18:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
2017-02-05 18:20 - 2017-02-05 18:20 - 00000000 ____D C:\ProgramData\ESET
2017-02-05 18:13 - 2017-02-05 18:17 - 115248768 _____ (ESET) C:\Users\pawel\Downloads\ess_nt64_plk.exe
==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========
(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)
2017-02-05 21:42 - 2014-04-13 19:49 - 00740348 _____ C:\Windows\system32\perfh015.dat
2017-02-05 21:42 - 2014-04-13 19:49 - 00155890 _____ C:\Windows\system32\perfc015.dat
2017-02-05 21:42 - 2009-07-14 06:13 - 01669190 _____ C:\Windows\system32\PerfStringBackup.INI
2017-02-05 21:42 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-02-05 21:38 - 2014-12-06 20:13 - 00000000 ____D C:\Users\pawel\AppData\Roaming\Skype
2017-02-05 20:32 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2017-02-05 20:31 - 2014-04-13 10:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2017-02-05 20:30 - 2010-11-21 08:16 - 00000000 ____D C:\Windows\ShellNew
2017-02-05 20:10 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2017-02-05 19:52 - 2009-07-14 03:34 - 00000580 _____ C:\Windows\win.ini
2017-02-05 19:13 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-05 19:13 - 2009-07-14 05:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-05 19:04 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-05 18:26 - 2016-08-07 19:05 - 00000000 ____D C:\Users\pawel\AppData\Roaming\Browser-Security
2017-02-05 18:25 - 2015-05-02 18:10 - 00000000 ____D C:\Users\pawel\AppData\Local\ESET
2017-02-05 18:20 - 2016-02-22 20:16 - 00000000 ____D C:\Program Files\ESET
==================== Pliki w katalogu głównym wybranych folderów =======
2011-04-15 08:25 - 2010-03-02 22:59 - 0131984 _____ () C:\ProgramData\FullRemove.exe
Niektóre pliki w TEMP:
====================
2014-03-22 21:09 - 2014-03-22 21:09 - 0026424 _____ (AVG) C:\Users\pawel\AppData\Local\Temp\DseShExt-x64.dll
2014-03-22 21:09 - 2014-03-22 21:09 - 0028472 _____ (AVG) C:\Users\pawel\AppData\Local\Temp\DseShExt-x86.dll
2014-04-13 19:15 - 2014-04-13 19:22 - 56910544 _____ () C:\Users\pawel\AppData\Local\Temp\gg10.upgr.exe
2015-05-02 18:09 - 2016-02-07 11:51 - 0372936 _____ (ESET) C:\Users\pawel\AppData\Local\Temp\InstHelper.exe
2017-02-05 19:39 - 2006-10-27 23:14 - 0145184 _____ (Microsoft Corporation) C:\Users\pawel\AppData\Local\Temp\ose00000.exe
2014-03-22 21:09 - 2014-03-22 21:09 - 0032056 _____ (AVG) C:\Users\pawel\AppData\Local\Temp\SDShelEx-win32.dll
2014-03-22 21:09 - 2014-03-22 21:09 - 0031544 _____ (AVG) C:\Users\pawel\AppData\Local\Temp\SDShelEx-x64.dll
2016-02-17 21:10 - 2016-02-24 16:06 - 0192512 _____ () C:\Users\pawel\AppData\Local\Temp\sfamcc00001.dll
2016-02-24 16:07 - 2016-02-24 16:07 - 0192512 _____ () C:\Users\pawel\AppData\Local\Temp\sfamcc00002.dll
2016-02-24 16:07 - 2016-02-24 16:07 - 0158720 _____ () C:\Users\pawel\AppData\Local\Temp\sfareca00002.dll
2015-02-10 18:56 - 2015-02-10 18:56 - 0105984 _____ () C:\Users\pawel\AppData\Local\Temp\sfextra.dll
2015-09-13 20:41 - 2016-02-17 19:00 - 43532408 _____ (Skype Technologies S.A.) C:\Users\pawel\AppData\Local\Temp\SkypeSetup.exe
==================== Bamital & volsnap ======================
(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)
C:\Windows\system32\winlogon.exe = & gt; Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe = & gt; Plik podpisany cyfrowo
C:\Windows\explorer.exe = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe = & gt; Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe = & gt; Plik podpisany cyfrowo
C:\Windows\system32\services.exe = & gt; Plik podpisany cyfrowo
C:\Windows\system32\User32.dll = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll = & gt; Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe = & gt; Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll = & gt; Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll = & gt; Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll = & gt; Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys = & gt; Plik podpisany cyfrowo
LastRegBack: 2014-04-13 10:54
==================== Koniec FRST.txt ============================