Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01
Ran by Kinia (administrator) on LUNITEK (10-04-2016 17:05:11)
Running from C:\Users\Kinia\Desktop
Loaded Profiles: Kinia (Available Profiles: Kinia)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: Angielski (Stany Zjednoczone)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Autodesk Inc.) C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Dropbox, Inc.) C:\Users\Kinia\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Razer Inc.) C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe
(Autodesk, Inc.) D:\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(DEVGURU Co., LTD.) C:\Program Files\SAMSUNG\USB Drivers\25_escape\conn\ss_conn_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\ProgramData\Razer\Synapse\RzStats\RzStats.Manager.exe
(Razer, Inc.) C:\Program Files (x86)\Razer\InGameEngine\32bit\RazerIngameEngine.exe
(Razer, Inc.) C:\Users\Kinia\AppData\Local\Razer\InGameEngine\cache\RzStats.Manager\rzcefrenderprocess.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Akamai Technologies, Inc.) C:\Users\Kinia\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Kinia\AppData\Local\Akamai\netsession_win.exe
() C:\Program Files (x86)\screenSHU\screenSHU.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-13] (ELAN Microelectronics Corp.)
HKLM\...\Run: [IgfxTray] => "C:\Windows\system32\igfxtray.exe"
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2789248 2016-02-17] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2000-01-01] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2226280 2011-05-17] (Realtek Semiconductor)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [594240 2016-01-13] (Razer Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [595504 2016-01-29] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-318038007-921987228-2979523656-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Kinia\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-318038007-921987228-2979523656-1000\...\Run: [BingSvc] => C:\Users\Kinia\AppData\Local\Microsoft\BingSvc\BingSvc.exe
HKU\S-1-5-21-318038007-921987228-2979523656-1000\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-318038007-921987228-2979523656-1000\...\Policies\Explorer: [] 
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [175368 2016-02-09] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [175368 2016-02-09] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [153208 2016-02-09] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kinia\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kinia\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Kinia\AppData\Roaming\Dropbox\bin\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.)
Startup: C:\Users\Kinia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk [2016-03-20]
ShortcutTarget: Dropbox.lnk -> C:\Users\Kinia\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 80.243.191.66 8.8.8.8
Tcpip\..\Interfaces\{2D2A0267-7480-46B4-B882-EE88464E7F38}: [DhcpNameServer] 192.168.240.2 192.168.192.2
Tcpip\..\Interfaces\{C8110C4F-6E36-4B1E-931E-EB56E6089097}: [DhcpNameServer] 192.168.42.129
Tcpip\..\Interfaces\{D2A7267B-1BE7-4BD7-B07E-0F0D34B34D29}: [DhcpNameServer] 80.243.191.66 8.8.8.8

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-318038007-921987228-2979523656-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-318038007-921987228-2979523656-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-318038007-921987228-2979523656-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=pl-pl
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_74\bin\ssv.dll [2016-02-20] (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll [2011-03-13] (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_74\bin\jp2ssv.dll [2016-02-20] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default
FF DefaultSearchEngine: Google
FF SearchEngineOrder.3: Google
FF SearchEngineOrder.US.3: data:text/plain,browser.search.order.US.3=Google
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Session Restore: -> is enabled.
FF Keyword.URL: hxxp://www.bing.com/search?FORM=SL5MDF&PC=SL5M&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_213.dll [2016-04-08] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-06-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2014-06-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_213.dll [2016-04-08] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-06-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xdp -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.xfdf -> C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll [2015-01-12] (Foxit Corporation)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2015-02-13] (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=11.74.2 -> C:\Program Files (x86)\Java\jre1.8.0_74\bin\dtplugin\npDeployJava1.dll [2016-02-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.74.2 -> C:\Program Files (x86)\Java\jre1.8.0_74\bin\plugin2\npjp2.dll [2016-02-20] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [No File]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-03] (Google Inc.)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2014-06-19] (Tracker Software Products (Canada) Ltd.)
FF Plugin HKU\S-1-5-21-318038007-921987228-2979523656-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Kinia\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-08-20] (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\user.js [2016-02-28]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2014-06-19] (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\searchplugins\duckduckgo.xml [2014-08-03]
FF SearchPlugin: C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\searchplugins\wwwjdic-ja.xml [2014-08-03]
FF Extension: Rikaichan - C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2015-05-30]
FF Extension: Rikaichan Japanese-English Dictionary File - C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\extensions\rikaichan-jpen@polarcloud.com [2016-01-09]
FF Extension: Sharp Angle 1.0.1 - C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\Extensions\{4bf99d86-1f37-4311-a79d-5136408f4421}.xpi [2016-02-28] [not signed]
FF Extension: Video DownloadHelper - C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}.xpi [2015-10-31]
FF Extension: Adblock Plus - C:\Users\Kinia\AppData\Roaming\Mozilla\Firefox\Profiles\6sx7rejr.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-01-20]

Chrome: 
=======
CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=pl-pl
CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=__PARAM__&q={searchTerms}
CHR DefaultSearchKeyword: Default -> bing.com
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-28]
CHR Extension: (Dokumenty Google) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-28]
CHR Extension: (Dysk Google) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-28]
CHR Extension: (YouTube) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-28]
CHR Extension: (Adblock Plus) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-03-25]
CHR Extension: (Google Search) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-28]
CHR Extension: (Arkusze Google) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-28]
CHR Extension: (Dokumenty Google offline) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-19]
CHR Extension: (rikaikun) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jipdnfibhldikgcjhfnomkfpcebammhp [2016-02-28]
CHR Extension: (IPA furigana) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\jnnbgnfnncobhklficfkdnclohaklifi [2016-02-28]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\Kinia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-07]
CHR HKU\S-1-5-21-318038007-921987228-2979523656-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AdAppMgrSvc; C:\Program Files (x86)\Common Files\Autodesk Shared\AppManager\R1\AdAppMgrSvc.exe [599944 2014-12-05] (Autodesk Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [74912 2011-03-13] (Atheros Commnucations) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1164672 2016-02-17] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1135416 2015-10-05] (Malwarebytes)
R2 mitsijm2014; D:\Autodesk\Inventor 2014\Moldflow\bin\mitsijm.exe [952608 2013-01-25] (Autodesk, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1880960 2016-02-17] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [6474112 2016-02-17] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2609024 2016-02-17] (NVIDIA Corporation)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1284848 2016-03-21] (Overwolf LTD)
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-11-05] ()
R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-12-31] (DEVGURU Co., LTD.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2015-03-27] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-07-10] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2015-03-27] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-10-05] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-10-05] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [28032 2016-02-17] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [47760 2015-12-18] (NVIDIA Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [9101016 2000-01-01] (Realtek Semiconductor Corp.)
S3 rzbtendpt; C:\Windows\System32\DRIVERS\rzbtendpt.sys [50392 2015-08-13] (Razer Inc)
R3 rzendpt; C:\Windows\System32\DRIVERS\rzendpt.sys [50392 2015-08-13] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-09-23] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [130880 2015-12-15] (Razer, Inc.)
R3 rzvkeyboard; C:\Windows\System32\DRIVERS\rzvkeyboard.sys [44232 2015-08-13] (Razer Inc)
S2 Sentinel64; C:\Windows\System32\Drivers\Sentinel64.sys [145448 2009-09-17] (SafeNet, Inc.)
S3 ss_conn_usb_driver; C:\Windows\System32\Drivers\ss_conn_usb_driver.sys [26392 2014-12-31] (DEVGURU Co., LTD.)
S3 WinRing0_1_2_0; D:\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
R1 {4bf99d86-1f37-4311-a79d-5136408f4421}Gw64; C:\Windows\System32\drivers\{4bf99d86-1f37-4311-a79d-5136408f4421}Gw64.sys [48784 2016-02-28] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U3 fwddapod; \??\C:\Users\Kinia\AppData\Local\Temp\fwddapod.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-10 17:05 - 2016-04-10 17:05 - 00023765 _____ C:\Users\Kinia\Desktop\FRST.txt
2016-04-10 17:04 - 2016-04-10 17:05 - 02374144 _____ (Farbar) C:\Users\Kinia\Desktop\FRST64.exe
2016-04-10 17:00 - 2016-04-10 17:00 - 00104981 _____ C:\Users\Kinia\Desktop\GMER.txt
2016-04-10 13:03 - 2016-04-10 13:44 - 01346560 _____ C:\Users\Kinia\Desktop\Data_proj2.xls
2016-04-08 00:50 - 2016-04-08 00:50 - 05934784 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2016-04-06 22:45 - 2016-04-06 22:50 - 240233751 _____ C:\Users\Kinia\Desktop\frozen-rift-map-skin.zip
2016-04-06 16:20 - 2016-04-06 16:20 - 02822620 _____ C:\Users\Kinia\Desktop\AMIDST-3.7.exe
2016-03-29 15:11 - 2016-03-29 15:11 - 00000000 ____D C:\Users\Kinia\Desktop\Saves
2016-03-24 17:16 - 2016-03-24 17:16 - 00000804 _____ C:\Users\Kinia\Desktop\ANKI AUDIO — skrót.lnk
2016-03-24 17:14 - 2016-03-24 17:14 - 00000829 _____ C:\Users\Kinia\Desktop\みんなの日本語 — skrót.lnk
2016-03-24 15:01 - 2016-03-24 15:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2016-03-24 04:26 - 2016-03-24 04:26 - 05066104 _____ (AVAST Software) C:\Users\Kinia\Desktop\avast_free_antivirus_setup_online.exe
2016-03-20 00:39 - 2016-03-20 00:39 - 00000000 ____D C:\Users\Kinia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2016-03-17 01:12 - 2016-03-17 01:12 - 00000772 _____ C:\Users\Kinia\Desktop\Skyrim (SKSE).lnk
2016-03-17 00:23 - 2016-03-17 01:09 - 00000000 ____D C:\Users\Kinia\Documents\Nexus Mod Manager
2016-03-17 00:23 - 2016-03-17 00:23 - 00000000 ____D C:\Users\Kinia\AppData\Local\Black_Tree_Gaming
2016-03-16 23:35 - 2016-04-07 22:58 - 00000598 _____ C:\Users\Public\Desktop\Nexus Mod Manager.lnk
2016-03-16 23:35 - 2016-04-07 22:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager
2016-03-14 22:08 - 2016-03-14 22:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wooxy
2016-03-13 01:00 - 2016-03-17 13:05 - 00000000 ____D C:\Users\Kinia\AppData\Local\Skyrim
2016-03-13 01:00 - 2016-03-13 01:00 - 00000000 ____D C:\Users\Kinia\Documents\My Games

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-04-10 17:05 - 2014-10-19 22:12 - 00000000 ____D C:\FRST
2016-04-10 16:54 - 2015-06-22 10:12 - 00001162 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-318038007-921987228-2979523656-1000UA.job
2016-04-10 16:50 - 2014-07-02 14:39 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-04-10 16:10 - 2015-06-14 13:23 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-04-10 16:03 - 2009-07-14 06:45 - 00021200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-04-10 16:03 - 2009-07-14 06:45 - 00021200 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-04-10 14:10 - 2014-07-31 14:17 - 00000000 ____D C:\Users\Kinia\Documents\Anki
2016-04-10 13:37 - 2015-04-12 22:37 - 00000000 ____D C:\Users\Kinia\AppData\Local\screenSHU
2016-04-10 12:45 - 2014-07-03 10:44 - 00000000 ____D C:\Users\Kinia\AppData\Local\Akamai
2016-04-10 11:44 - 2014-07-02 18:02 - 04438098 _____ C:\Windows\system32\perfh011.dat
2016-04-10 11:44 - 2014-07-02 18:02 - 03981180 _____ C:\Windows\system32\perfc011.dat
2016-04-10 11:44 - 2014-07-02 17:53 - 12016638 _____ C:\Windows\system32\perfh015.dat
2016-04-10 11:44 - 2014-07-02 17:53 - 04133944 _____ C:\Windows\system32\perfc015.dat
2016-04-10 11:44 - 2009-07-14 07:13 - 00006270 _____ C:\Windows\system32\PerfStringBackup.INI
2016-04-10 03:01 - 2014-07-06 01:12 - 00000000 ___RD C:\Users\Kinia\Dropbox
2016-04-10 03:00 - 2014-07-06 01:06 - 00000000 ____D C:\Users\Kinia\AppData\Roaming\Dropbox
2016-04-10 02:59 - 2015-06-14 13:23 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-04-10 02:58 - 2015-09-25 21:57 - 00000358 _____ C:\Windows\Tasks\DriverToolkit Autorun.job
2016-04-10 02:58 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-04-10 02:57 - 2016-01-11 03:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-04-10 02:57 - 2014-07-02 13:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-04-10 02:53 - 2014-07-03 15:03 - 00000000 ____D C:\Users\Kinia\AppData\Local\CrashDumps
2016-04-10 02:43 - 2014-07-03 13:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2016-04-10 00:00 - 2015-06-22 10:12 - 00001110 _____ C:\Windows\Tasks\DropboxUpdateTaskUserS-1-5-21-318038007-921987228-2979523656-1000Core.job
2016-04-09 19:41 - 2014-11-13 21:03 - 00000000 ____D C:\Users\Kinia\AppData\Roaming\TS3Client
2016-04-08 00:50 - 2014-07-02 14:39 - 00797376 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-04-08 00:50 - 2014-07-02 14:39 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-04-08 00:50 - 2014-07-02 14:39 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-04-07 19:24 - 2016-02-28 16:43 - 00000000 ____D C:\Users\Kinia\AppData\Local\lolvochanger
2016-04-01 23:15 - 2015-03-29 01:03 - 00000000 ____D C:\Users\Kinia\AppData\Local\Battle.net
2016-03-30 22:47 - 2015-06-14 13:25 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-03-27 17:44 - 2015-05-13 17:30 - 00000000 ____D C:\Program Files (x86)\Overwolf
2016-03-24 14:54 - 2014-07-02 18:17 - 00000000 ____D C:\ProgramData\AVAST Software
2016-03-24 04:29 - 2015-10-07 14:19 - 00000000 ____D C:\Users\Kinia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameSub
2016-03-24 04:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-03-21 13:10 - 2015-09-09 15:52 - 00000000 ____D C:\Users\Kinia\AppData\Local\cache
2016-03-14 22:04 - 2014-07-16 22:33 - 00000000 ____D C:\Users\Kinia\AppData\Roaming\uTorrent
2016-03-14 21:59 - 2015-11-09 14:48 - 00000000 ____D C:\Users\Kinia\Desktop\Zdjęcia
2016-03-13 15:20 - 2014-08-18 14:39 - 00000000 ____D C:\ProgramData\Package Cache

==================== Files in the root of some directories =======

2011-09-26 20:55 - 2011-09-26 20:55 - 6871040 _____ () C:\Program Files (x86)\GUTB1A3.tmp
2015-11-05 17:00 - 2015-11-25 18:32 - 0005120 _____ () C:\Users\Kinia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-01-31 12:04 - 2016-01-31 12:04 - 0006731 _____ () C:\Users\Kinia\AppData\Local\recently-used.xbel
2015-05-30 17:49 - 2015-05-30 17:49 - 0000153 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc

Some files in TEMP:
====================
C:\Users\Kinia\AppData\Local\Temp\Nexus Mod Manager-0.61.15.exe
C:\Users\Kinia\AppData\Local\Temp\Nexus Mod Manager-0.61.16.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-04-10 15:56

==================== End of FRST.txt ============================