Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 30-04-2017 Uruchomiony przez Adam (administrator) ADAM-RYMKIEWICZ (01-05-2017 15:15:12) Uruchomiony z C:\Users\Adam\Desktop\1 Załadowane profile: Adam (Dostępne profile: Adam) Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe (AVG Technologies CZ, s.r.o.) D:\PcTuneUpAVG\Framework\Common\avgsvca.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\ns.exe (Anti-Malware) C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe () C:\Program Files (x86)\BloodyToneMaker\BloodyToneMaker\Bloody ToneMaker1.exe (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe () C:\Program Files (x86)\Bloody6\Bloody6\Bloody6.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (AVG Technologies CZ, s.r.o.) D:\PcTuneUpAVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (AVG Technologies CZ, s.r.o.) D:\PcTuneUpAVG\Framework\Common\avguix.exe (Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\ns.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe () C:\Program Files (x86)\BloodyToneMaker\BloodyToneMaker\SDK\CM_LibraryIO.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (AVG Technologies CZ, s.r.o.) D:\PcTuneUpAVG\AVG PC TuneUp\TuneUpUtilitiesApp64.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13636824 2013-07-26] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [Plumbytes Anti-Malware] => C:\Program Files\Plumbytes Software\Plumbytes Anti-Malware\Plumbytes.exe [2492656 2017-03-18] (Anti-Malware) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-03] (Intel Corporation) HKLM-x32\...\Run: [AvgUi] => D:\PcTuneUpAVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.) HKU\S-1-5-21-1457618405-901922512-1867227837-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8455960 2015-08-19] (Piriform Ltd) HKU\S-1-5-21-1457618405-901922512-1867227837-1001\...\Run: [BloodyToneMaker] => C:\Program Files (x86)\BloodyToneMaker\BloodyToneMaker\Bloody ToneMaker1.exe [8473088 2016-03-02] () HKU\S-1-5-21-1457618405-901922512-1867227837-1001\...\Run: [Bloody2] => C:\Program Files (x86)\Bloody6\Bloody6\Bloody6.exe [19248640 2016-09-06] () HKU\S-1-5-21-1457618405-901922512-1867227837-1001\...\MountPoints2: {97310814-bb78-11e4-8ebc-d050993f3397} - F:\AutoRun.exe HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-10-14] (Microsoft Corporation) ShellIconOverlayIdentifiers: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ShellIconOverlayIdentifiers: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ShellIconOverlayIdentifiers: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ShellIconOverlayIdentifiers-x32: [ OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ShellIconOverlayIdentifiers-x32: [ OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ShellIconOverlayIdentifiers-x32: [ OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\buShell.dll [2017-03-16] (Symantec Corporation) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{2B1E47BB-44F3-4589-B4A3-F2C733806DEC}: [DhcpNameServer] 192.168.42.129 Tcpip\..\Interfaces\{43596F79-6780-43F8-8F7B-5AEEF2F5DA8B}: [DhcpNameServer] 192.168.0.1 Internet Explorer: ================== HKU\S-1-5-21-1457618405-901922512-1867227837-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.gazeta.pl/0,0.html?p=190 SearchScopes: HKU\S-1-5-21-1457618405-901922512-1867227837-1001 -> 769D5B6784EE46CE83C68A6C9D92480E URL = hxxps://www.google.com/search?q={searchTerms}&rlz=1I7PLXB_plPL610 SearchScopes: HKU\S-1-5-21-1457618405-901922512-1867227837-1001 -> {AF721B36-2455-4FA4-B994-4EDD9CB01D79} URL = hxxps://www.google.com/search?q={searchTerms} BHO: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\coIEPlg.dll [2017-03-16] (Symantec Corporation) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-25] (Google Inc.) BHO-x32: Norton Identity Safety -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\coIEPlg.dll [2017-03-16] (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\ssv.dll [2017-04-15] (Oracle Corporation) BHO-x32: ArcPluginIEBHO Class -> {84BFE29A-8139-402a-B2A4-C23AE9E1A75F} -> D:\Neverwinter\Arc\Plugins\ArcPluginIE.dll [2017-02-22] (Perfect World Entertainment Inc) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-25] (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\jp2ssv.dll [2017-04-15] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-25] (Google Inc.) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\coIEPlg.dll [2017-03-16] (Symantec Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine32\22.9.1.12\coIEPlg.dll [2017-03-16] (Symantec Corporation) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2016-04-25] (Google Inc.) Toolbar: HKU\S-1-5-21-1457618405-901922512-1867227837-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2016-04-25] (Google Inc.) FireFox: ======== FF DefaultProfile: i32avz9s.default FF ProfilePath: C:\Users\Adam\AppData\Roaming\TomTom\HOME\Profiles\vf1ohptm.default [2015-09-24] FF Extension: (Emulator) - C:\Users\Adam\AppData\Roaming\TomTom\HOME\Profiles\vf1ohptm.default\Extensions\Navcore.9.510.1234792@tomtom.com [2015-09-24] [Brak podpisu cyfrowego] FF Extension: (Brak nazwy) - D:\Gry\NviTomTom\TomTom HOME 2\xul\extensions\MapShare-status@tomtom.com [nie znaleziono] FF ProfilePath: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\i32avz9s.default [2017-05-01] FF Homepage: Mozilla\Firefox\Profiles\i32avz9s.default -> hxxp://www.gazeta.pl/0,0.html?p=190 FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon FF Extension: (Norton Security Toolbar) - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon [2017-03-31] FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.6.0.142\coFFAddon FF Plugin: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelogx64.dll [2015-04-30] (EA Digital Illusions CE AB) FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation) FF Plugin-x32: @esn/npbattlelog,version=2.7.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.1\npbattlelog.dll [2015-04-30] (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\dtplugin\npDeployJava1.dll [2017-04-15] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.121.2 -> C:\Program Files (x86)\Java\jre1.8.0_121\bin\plugin2\npjp2.dll [2017-04-15] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50905.0\npctrl.dll [2017-02-10] ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-03-17] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-03-17] (NVIDIA Corporation) FF Plugin-x32: @perfectworld.com/npArcPlayNowPlugin -> D:\Neverwinter\Arc\Plugins\npArcPluginFF.dll [2017-02-22] (Perfect World Entertainment Inc) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-27] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-04-05] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1457618405-901922512-1867227837-1001: @nsroblox.roblox.com/launcher -> C:\Users\Adam\AppData\Local\Roblox\Versions\version-398bf2b17c844b38\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation) FF Plugin HKU\S-1-5-21-1457618405-901922512-1867227837-1001: @nsroblox.roblox.com/launcher64 -> C:\Users\Adam\AppData\Local\Roblox\Versions\version-398bf2b17c844b38\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation) FF Plugin HKU\S-1-5-21-1457618405-901922512-1867227837-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Adam\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-02-24] (Unity Technologies ApS) Chrome: ======= CHR DefaultProfile: Default CHR HomePage: Default -> hxxp://www.gazeta.pl/0,0.html?p=190 CHR StartupUrls: Default -> "hxxp://google.pl/" CHR Profile: C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default [2017-05-01] CHR Extension: (BMW M Power) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfhaolblehplannlbgaldknldolnniep [2016-07-18] CHR Extension: (AdBlock) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-13] CHR Extension: (Norton Identity Safe) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2016-04-27] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09] CHR Extension: (Chrome Media Router) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-03-30] CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\Exts\Chrome.crx [2017-03-21] CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\Exts\Chrome.crx [2017-03-21] CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 ArcService; D:\Neverwinter\Arc\ArcService.exe [87064 2017-02-22] (Perfect World Entertainment Inc) R2 avgsvc; D:\PcTuneUpAVG\Framework\Common\avgsvca.exe [1146128 2016-12-06] (AVG Technologies CZ, s.r.o.) S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [392480 2017-02-15] (EasyAntiCheat Ltd) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego] R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Brak podpisu cyfrowego] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation) S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4307704 2016-02-25] (INCA Internet Co., Ltd.) R2 NS; C:\Program Files (x86)\Norton Security\Engine\22.9.1.12\NS.exe [326160 2017-03-16] (Symantec Corporation) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [492480 2017-03-28] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [492480 2017-03-28] (NVIDIA Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [464440 2017-03-17] (NVIDIA Corporation) R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-03-28] (NVIDIA Corporation) S3 Origin Client Service; D:\Origin\OriginClientService.exe [2119688 2016-12-06] (Electronic Arts) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-18] (Realtek Semiconductor) R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-01-08] (DEVGURU Co., LTD.) R2 TuneUp.UtilitiesSvc; D:\PcTuneUpAVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [5906704 2017-02-21] (AVG Technologies CZ, s.r.o.) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\BASHDefs\20170426.001\BHDrvx64.sys [1831064 2017-04-06] (Symantec Corporation) R1 ccSet_NS; C:\Windows\system32\drivers\NSx64\1609010.00C\ccSetx64.sys [174240 2017-02-20] (Symantec Corporation) R3 CMUAC; C:\Windows\System32\DRIVERS\Headset6400x1.SYS [386560 2013-10-03] (A4Tech Inc.) S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [378136 2014-09-29] (Intel Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497312 2017-01-26] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [156824 2017-01-26] (Symantec Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\IPSDefs\20170428.001\IDSvia64.sys [1036440 2017-04-27] (Symantec Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [30144 2017-03-28] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47552 2017-03-28] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [57792 2017-01-20] (NVIDIA Corporation) R1 SRTSP; C:\Windows\System32\Drivers\NSx64\1609010.00C\SRTSP64.SYS [770200 2017-03-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NSx64\1609010.00C\SRTSPX64.SYS [49312 2017-03-16] (Symantec Corporation) S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.) R0 SymEFASI; C:\Windows\System32\drivers\NSx64\1609010.00C\SYMEFASI64.SYS [1716896 2017-02-20] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102608 2017-03-05] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NSx64\1609010.00C\Ironx64.SYS [291480 2017-02-20] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NSx64\1609010.00C\SYMNETS.SYS [567512 2017-02-20] (Symantec Corporation) R3 TuneUpUtilitiesDrv; D:\PcTuneUpAVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [32304 2017-02-21] (AVG Netherlands B.V.) S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X] S3 NAVENG; \??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs\20161128.022\ENG64.SYS [X] S3 NAVEX15; \??\C:\Program Files (x86)\Norton Security\NortonData\22.6.0.142\Definitions\SDSDefs\20161128.022\EX64.SYS [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-05-01 15:14 - 2017-05-01 15:15 - 00000000 ____D C:\Users\Adam\Desktop\1 2017-05-01 15:14 - 2017-05-01 15:15 - 00000000 ____D C:\FRST 2017-05-01 15:02 - 2017-05-01 15:02 - 00000000 ____D C:\Users\Adam\AppData\Local\{12A8CCFE-3C33-4995-BAD8-074E4C5B22FD} 2017-05-01 14:59 - 2017-05-01 14:59 - 60107896 _____ (Malwarebytes ) C:\Users\Adam\Downloads\mb3-setup-consumer-3.0.6.1469-10103.exe 2017-05-01 14:54 - 2017-05-01 14:54 - 00000000 ____D C:\Program Files\Plumbytes Software 2017-05-01 04:08 - 2017-05-01 04:08 - 04102600 _____ C:\Users\Adam\Downloads\adwcleaner_6.046.exe 2017-05-01 04:00 - 2017-05-01 04:00 - 00002916 _____ C:\Windows\System32\Tasks\{0FD81E7B-F1BB-49E4-B6F0-B4D62B6B722F} 2017-05-01 03:59 - 2017-05-01 03:59 - 00002916 _____ C:\Windows\System32\Tasks\{87DAEABE-911B-440C-A1D2-AE3B448EEBA2} 2017-05-01 02:58 - 2017-05-01 02:58 - 00002926 _____ C:\Windows\System32\Tasks\{AC14CD26-EB1B-4753-BD07-2CAA1BF959EA} 2017-05-01 02:57 - 2017-05-01 02:57 - 00002912 _____ C:\Windows\System32\Tasks\{75F758EC-1C2A-40D0-B523-847182B7EFE2} 2017-05-01 02:56 - 2017-05-01 02:56 - 00002912 _____ C:\Windows\System32\Tasks\{08E4C7CA-FB7F-4E14-B638-E22E6865C30E} 2017-05-01 02:47 - 2017-05-01 02:47 - 00002926 _____ C:\Windows\System32\Tasks\{D285C046-E0F8-4552-B82D-3F52325FC96E} 2017-05-01 01:58 - 2017-05-01 01:58 - 00178800 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt_x64.dll 2017-04-30 02:35 - 2017-04-30 02:35 - 00002736 _____ C:\Windows\System32\Tasks\AVGPCTuneUp_Task_BkGndMaintenance 2017-04-27 19:09 - 2017-04-27 19:09 - 00000625 _____ C:\Users\Adam\Desktop\Aslains WoT Logs Archiver.lnk 2017-04-27 18:08 - 2017-04-27 18:08 - 00000000 ____D C:\Users\Adam\AppData\Local\Gaijin 2017-04-27 02:35 - 2017-04-27 02:35 - 00003704 _____ C:\Windows\System32\Tasks\Java Platform SE Auto Updater 2017-04-27 02:32 - 2017-04-27 02:32 - 00001313 _____ C:\Users\Public\Desktop\AVG PC TuneUp.lnk 2017-04-27 02:32 - 2017-04-27 02:32 - 00001313 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp.lnk 2017-04-27 02:32 - 2017-04-27 02:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC TuneUp 2017-04-27 02:32 - 2017-02-21 09:29 - 00053008 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\TURegOpt.exe 2017-04-27 02:32 - 2017-02-21 09:25 - 00044304 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\authuitu.dll 2017-04-27 02:32 - 2017-02-21 09:25 - 00042256 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\SysWOW64\authuitu.dll 2017-04-27 02:31 - 2017-04-30 18:38 - 00003576 _____ C:\Windows\System32\Tasks\AVG EUpdate Task 2017-04-24 00:12 - 2017-03-28 05:32 - 00153536 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2017-04-24 00:12 - 2017-03-28 05:32 - 00127424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2017-04-24 00:12 - 2017-03-28 05:32 - 00047552 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2017-04-23 17:33 - 2017-04-23 17:33 - 00000955 _____ C:\Users\Public\Desktop\The Sims 3.lnk 2017-04-19 23:47 - 2017-04-19 23:48 - 00000000 ____D C:\Users\Adam\Desktop\Zdjęcia 2017-04-16 23:31 - 2017-04-27 18:43 - 00000000 ____D C:\Users\Adam\AppData\LocalLow\uTorrent 2017-04-15 14:46 - 2017-04-16 13:07 - 00000000 ____D C:\Users\Adam\AppData\Roaming\.minecraftzyczu 2017-04-15 14:46 - 2017-04-16 13:07 - 00000000 ____D C:\Users\Adam\AppData\Roaming\.minecraft 2017-04-05 00:09 - 2017-04-05 00:11 - 00000804 _____ C:\Users\Public\Desktop\Neverwinter.lnk 2017-04-05 00:09 - 2017-04-05 00:11 - 00000000 ____D C:\Users\Adam\AppData\Roaming\Arc 2017-04-05 00:09 - 2017-04-05 00:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Perfect World Entertainment 2017-04-05 00:09 - 2017-04-05 00:09 - 00000509 _____ C:\Users\Public\Desktop\Arc.lnk ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-05-01 15:13 - 2015-09-17 23:16 - 00000000 ____D C:\ProgramData\Malwarebytes 2017-05-01 15:10 - 2009-07-14 06:45 - 00023056 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-05-01 15:10 - 2009-07-14 06:45 - 00023056 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-05-01 15:08 - 2009-07-14 19:55 - 00741136 _____ C:\Windows\system32\perfh015.dat 2017-05-01 15:08 - 2009-07-14 19:55 - 00156208 _____ C:\Windows\system32\perfc015.dat 2017-05-01 15:08 - 2009-07-14 07:13 - 01672612 _____ C:\Windows\system32\PerfStringBackup.INI 2017-05-01 15:08 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2017-05-01 15:04 - 2014-10-13 13:55 - 00000000 ____D C:\ProgramData\NVIDIA 2017-05-01 15:02 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-05-01 15:01 - 2016-02-08 21:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-05-01 15:00 - 2014-10-14 20:34 - 00000000 ____D C:\Users\Adam\AppData\Roaming\TS3Client 2017-05-01 04:09 - 2016-12-03 18:04 - 00000554 _____ C:\Users\Public\Desktop\WarThunder.lnk 2017-05-01 04:09 - 2016-12-03 18:04 - 00000000 ____D C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WarThunder 2017-05-01 04:09 - 2016-03-21 17:04 - 00000000 ____D C:\AdwCleaner 2017-05-01 04:09 - 2016-02-08 21:38 - 00000000 ____D C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome 2017-05-01 04:09 - 2015-04-13 16:15 - 00000995 _____ C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2017-05-01 04:09 - 2015-04-13 16:12 - 00000000 ____D C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks 2017-05-01 04:09 - 2014-10-14 20:32 - 00001304 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-05-01 04:09 - 2014-10-14 20:32 - 00001292 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-05-01 04:02 - 2014-10-15 14:03 - 00000000 ____D C:\Users\Adam\AppData\Local\CrashDumps 2017-05-01 03:55 - 2015-11-13 22:04 - 00103736 _____ C:\Windows\SysWOW64\PnkBstrB.exe 2017-05-01 02:53 - 2016-04-27 14:55 - 00000000 ____D C:\Windows\System32\Tasks\Remediation 2017-05-01 02:06 - 2014-10-15 12:24 - 00000000 ____D C:\ProgramData\Origin 2017-05-01 02:05 - 2014-10-15 20:13 - 00103736 _____ C:\Windows\SysWOW64\PnkBstrB.ex0 2017-05-01 01:55 - 2016-12-10 19:02 - 00000000 ____D C:\Users\Adam\AppData\Local\PunkBuster 2017-04-28 12:32 - 2009-07-14 06:45 - 00318008 _____ C:\Windows\system32\FNTCACHE.DAT 2017-04-28 03:31 - 2014-10-14 23:28 - 00000000 ____D C:\Users\Adam\AppData\Roaming\uTorrent 2017-04-28 03:19 - 2014-10-29 18:56 - 00000000 ____D C:\Users\Adam\AppData\Local\Ubisoft Game Launcher 2017-04-27 20:51 - 2014-10-14 20:31 - 00003480 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2017-04-27 20:51 - 2014-10-14 20:31 - 00003352 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2017-04-27 19:19 - 2014-10-14 20:05 - 00071864 _____ C:\Users\Adam\AppData\Local\GDIPFONTCACHEV1.DAT 2017-04-27 02:35 - 2016-05-08 21:22 - 00000000 ___RD C:\Users\Adam\Desktop\Gry 2017-04-27 02:35 - 2014-11-16 03:53 - 00000000 ____D C:\Users\Adam\AppData\Roaming\TeamViewer 2017-04-27 02:32 - 2016-03-27 15:57 - 00000000 ____D C:\Users\Adam\AppData\Local\AvgSetupLog 2017-04-27 02:32 - 2015-06-28 23:34 - 00000000 ____D C:\Users\Adam\AppData\Local\Avg 2017-04-27 02:30 - 2015-06-28 23:34 - 00000000 ____D C:\ProgramData\AVG 2017-04-24 00:14 - 2014-10-13 13:54 - 00000000 ____D C:\ProgramData\NVIDIA Corporation 2017-04-24 00:12 - 2016-12-26 23:22 - 00004146 _____ C:\Windows\System32\Tasks\NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-27 16:55 - 00003554 _____ C:\Windows\System32\Tasks\NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00003852 _____ C:\Windows\System32\Tasks\NvNodeLauncher_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00003738 _____ C:\Windows\System32\Tasks\NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00003738 _____ C:\Windows\System32\Tasks\NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00003730 _____ C:\Windows\System32\Tasks\NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00003494 _____ C:\Windows\System32\Tasks\NvProfileUpdaterOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} 2017-04-24 00:12 - 2016-09-14 18:55 - 00001412 _____ C:\Users\Public\Desktop\GeForce Experience.lnk 2017-04-24 00:12 - 2014-10-13 13:54 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation 2017-04-24 00:12 - 2014-10-13 13:50 - 00000000 ____D C:\Program Files\NVIDIA Corporation 2017-04-23 17:33 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2017-04-19 23:51 - 2016-03-27 16:11 - 00000000 ___RD C:\Users\Adam\Desktop\Diagnostyka i Czyszczenie 2017-04-19 23:43 - 2014-12-14 21:23 - 00000000 ____D C:\ProgramData\EA Logs 2017-04-15 02:13 - 2014-10-15 23:00 - 00000000 ____D C:\ProgramData\Oracle 2017-04-15 02:07 - 2014-10-15 23:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2017-04-15 02:06 - 2014-10-15 23:02 - 00097856 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2017-04-15 02:06 - 2014-10-15 23:00 - 00000000 ____D C:\Program Files (x86)\Java 2017-04-13 21:09 - 2009-07-14 07:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2017-04-13 00:16 - 2014-10-13 13:32 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2017-04-11 18:58 - 2015-11-10 11:58 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2017-04-11 18:58 - 2015-06-23 14:12 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task ==================== Pliki w katalogu głównym wybranych folderów ======= 2014-10-15 00:09 - 2014-10-15 00:09 - 0000017 _____ () C:\Users\Adam\AppData\Local\resmon.resmoncfg 2016-12-26 23:22 - 2017-02-08 00:18 - 0005110 _____ () C:\ProgramData\NvTelemetryContainer.log 2016-12-26 23:22 - 2017-02-07 15:34 - 0005110 _____ () C:\ProgramData\NvTelemetryContainer.log_backup1 Niektóre pliki w TEMP: ==================== 2017-05-01 02:47 - 2017-05-01 02:47 - 0065536 _____ (Sony DADC Austria AG) C:\Users\Adam\AppData\Local\Temp\drm_dialogs.dll 2017-05-01 01:54 - 2017-05-01 04:01 - 0208896 _____ (Sony DADC Austria AG) C:\Users\Adam\AppData\Local\Temp\drm_dyndata_7340014.dll 2017-05-01 02:04 - 2017-05-01 02:58 - 0212992 _____ (Sony DADC Austria AG) C:\Users\Adam\AppData\Local\Temp\drm_dyndata_7350007.dll ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-04-23 23:49 ==================== Koniec FRST.txt ============================