Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:14-05-2016
Uruchomiony przez Arni556 (administrator)  ADRIAN (14-05-2016 13:15:28)
Uruchomiony z C:\Users\Arni556\Downloads
Załadowane profile: Arni556 (Dostępne profile: Arni556)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\AvrcpService.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTDevMgr.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\systemcore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Security, Inc.) C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\systemcore\mfefire.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\systemcore\mfefire.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(McAfee, Inc.) C:\Program Files\mcafee\msc\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe
(WildTangent) C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McAMTaskAgent.exe
(Microsoft Corp.) C:\Windows\System32\Defrag.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\APRP\aprp.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\platform\McUICnt.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\timeout.exe
(Realtek Semiconductor Corporation) C:\Program Files (x86)\Realtek\Realtek Bluetooth\BTServer.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
() C:\Program Files (x86)\Realtek\Realtek Bluetooth\SkypePlugin.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
() C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\ASUSWSLoader.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Conexant Systems, Inc) C:\Program Files\CONEXANT\SAII\SmartAudio.exe
(GG Network S.A.) C:\Users\Arni556\AppData\Local\GG\Application\gghub.exe
(GG Network S.A.) C:\Users\Arni556\AppData\Local\GG\Application\ggapp.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(GG Network S.A.) C:\Users\Arni556\AppData\Local\GG\Application\ggdrive\ggdrive.exe
(Microsoft Corporation) C:\Windows\WinStore\WSHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AsusTek) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2464072 2014-11-06] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [919768 2014-10-13] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM\...\Run: [BtServer] => C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTServer.exe [217088 2014-06-06] (Realtek Semiconductor Corporation)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2013-04-09] (Pixart Imaging Inc)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\ASUSWSLoader.exe [63296 2014-08-20] ()
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [AdBlock] => "AdBlock.exe"
HKLM-x32\...\RunOnce: [systwin] => "systwin.exe"
HKU\S-1-5-21-1202582443-2431899416-2755814704-1001\...\Run: [uTorrent] => C:\Users\Arni556\AppData\Roaming\uTorrent\uTorrent.exe [2382336 2016-05-02] (BitTorrent Inc.)
HKU\S-1-5-21-1202582443-2431899416-2755814704-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8698584 2016-04-15] (Piriform Ltd)
HKU\S-1-5-21-1202582443-2431899416-2755814704-1001\...\Run: [AdobeBridge] => [X]
ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 31.11.202.254 37.8.214.2
Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{397D177B-A2F7-4322-B1F9-669B05A7798D}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{397D177B-A2F7-4322-B1F9-669B05A7798D}: [DhcpNameServer] 31.11.202.254 37.8.214.2
Tcpip\..\Interfaces\{CAEB8296-E7B4-46EE-9C27-5E10C533BDF5}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
HKU\S-1-5-21-1202582443-2431899416-2755814704-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://search.msn.com/spbasic.htm
SearchScopes: HKLM -> DefaultScope - brak wartości
SearchScopes: HKLM-x32 -> DefaultScope - brak wartości
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\OCHelper.dll [2016-04-29] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\root\VFS\ProgramFilesX64\Microsoft Office\Office16\GROOVEEX.DLL [2016-04-29] (Microsoft Corporation)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2016-05-09] (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2016-05-09] (McAfee, Inc.)
Handler-x32: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-29] (Microsoft Corporation)
Handler-x32: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-29] (Microsoft Corporation)
Handler-x32: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-29] (Microsoft Corporation)
Handler-x32: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files (x86)\Microsoft Office\root\Office16\MSOSB.DLL [2016-04-29] (Microsoft Corporation)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll [2016-05-09] (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll [2016-05-09] (McAfee, Inc.)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll [2016-03-31] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll [2016-03-31] (McAfee, Inc.)

FireFox:
========
FF ProfilePath: C:\Users\Arni556\AppData\Roaming\Mozilla\Firefox\Profiles\2jmvrf9x.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_21_0_0_242.dll [2016-05-13] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_242.dll [2016-05-13] ()
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files (x86)\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-04-29] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-11] (Google Inc.)
FF Extension: McAfee WebAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi [2015-12-29]
FF Extension: Adblock Plus - C:\Users\Arni556\AppData\Roaming\Mozilla\Firefox\Profiles\2jmvrf9x.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-05-02]
FF HKLM\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor\saffplg.xpi
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2016-05-02] [Brak podpisu cyfrowego]

Chrome: 
=======
CHR Profile: C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-05-02]
CHR Extension: (Dokumenty Google) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-05-02]
CHR Extension: (Dysk Google) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-04-12]
CHR Extension: (Adblock Plus) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-05-02]
CHR Extension: (Arkusze Google) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-05-02]
CHR Extension: (Dokumenty Google offline) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-02]
CHR Extension: (Gmail) - C:\Users\Arni556\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-04-12]
CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-05-12]
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2016-05-12]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe [71168 2014-08-20] (ASUS Cloud Corporation) [Brak podpisu cyfrowego]
R2 AvrcpService; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\AvrcpService.exe [43224 2014-07-03] (Realtek Semiconductor Corporation)
R2 BTDevManager; C:\Program Files (x86)\REALTEK\Realtek Bluetooth\BTDevMgr.exe [94720 2014-04-29] () [Brak podpisu cyfrowego]
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [2911464 2016-04-29] (Microsoft Corporation)
R2 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-11-06] (NVIDIA Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282072 2014-03-18] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-12-09] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-12-09] (Intel Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\McSACore.exe [163592 2016-05-09] (McAfee, Inc.)
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [889704 2016-03-31] (McAfee, Inc.)
S3 McAWFwk; c:\Program Files\Common Files\McAfee\ActWiz\McAWFwk.exe [332528 2014-03-12] (McAfee, Inc.)
R2 mcbootdelaystartsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.9.656.0\McCSPServiceHost.exe [1709096 2016-03-14] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [718248 2016-03-07] (McAfee, Inc.)
S4 McOobeSv2; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [234192 2016-01-25] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [382456 2016-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [279488 2016-01-25] (McAfee, Inc.)
R2 ModuleCoreService; C:\Program Files\Common Files\McAfee\ModuleCore\ModuleCoreService.exe [1037048 2016-03-15] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [453520 2016-03-10] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-11-06] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19819848 2014-11-06] (NVIDIA Corporation)
S3 ose; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [202288 2016-04-28] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 PEFService; C:\Program Files\Common Files\Intel Security\PEF\CORE\PEFService.exe [896456 2016-03-02] (Intel Security, Inc.)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [Brak podpisu cyfrowego]
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-10-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-10-21] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [69904 2014-12-31] (ASUS Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [79248 2016-01-29] (McAfee, Inc.)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [207208 2015-05-19] (McAfee, Inc.)
R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-10-16] (Intel Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [100312 2013-12-09] (Intel Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [422184 2016-01-29] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [351656 2016-01-29] (McAfee, Inc.)
S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [83608 2016-01-29] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496368 2016-01-29] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [847608 2016-01-29] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [543488 2016-02-10] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [109480 2016-02-10] (McAfee, Inc.)
R3 mfesapsn; C:\Program Files (x86)\McAfee\SiteAdvisor\x64\mfesapsn.sys [45728 2016-03-15] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [245096 2016-01-29] (McAfee, Inc.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2014-11-06] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation)
R3 RtkA2dp; C:\Windows\system32\drivers\RtkA2dp.sys [178392 2014-09-24] (Realtek Semiconductor Corporation)
R3 RtkAvrcpCtrlr; C:\Windows\System32\drivers\RtkAvrcpCtrlr.sys [69848 2013-06-21] (Realtek Semiconductor Corporation)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [580824 2014-10-14] (Realtek Semiconductor Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [444632 2013-10-18] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3593432 2014-10-07] (Realtek Semiconductor Corporation                           )
U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [24688 2016-05-12] ()
S3 t_mouse.sys; C:\Windows\system32\DRIVERS\t_mouse.sys [6144 2013-04-09] ()
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [35856 2014-10-21] (Microsoft Corporation)
R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [257880 2014-10-21] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-10-21] (Microsoft Corporation)
U0 msahci; system32\drivers\msahci.sys [X]
U3 uxldrpod; \??\C:\Users\Arni556\AppData\Local\Temp\uxldrpod.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-05-14 13:15 - 2016-05-14 13:16 - 00024205 _____ C:\Users\Arni556\Downloads\FRST.txt
2016-05-14 13:12 - 2016-05-14 13:15 - 00000000 ____D C:\FRST
2016-05-14 13:12 - 2016-05-14 13:12 - 00000000 ____D C:\Users\Arni556\Downloads\FRST-OlderVersion
2016-05-14 13:12 - 2016-05-14 13:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2016-05-14 13:09 - 2016-05-14 13:16 - 00003846 _____ C:\Windows\System32\Tasks\Intel Security DAT Reputation (AMCore) periodic endpoint safety pulse
2016-05-13 21:17 - 2016-05-14 13:12 - 02382336 _____ (Farbar) C:\Users\Arni556\Downloads\FRST64.exe
2016-05-13 21:10 - 2016-05-13 21:10 - 00380928 _____ C:\Users\Arni556\Downloads\51ev8d2w.exe
2016-05-12 23:30 - 2016-05-12 23:30 - 00000000 ____D C:\Users\Arni556\AppData\Local\PackageAware
2016-05-12 23:30 - 2016-05-12 23:30 - 00000000 ____D C:\ProgramData\{D9F9C87D-6338-4977-AD5C-EE6EE6F6B6EC}
2016-05-12 23:30 - 2016-05-12 23:30 - 00000000 ____D C:\ProgramData\{7E8842F4-ECF1-457B-9B22-AA8299B810D9}
2016-05-12 20:21 - 2016-05-12 20:21 - 00000000 _____ C:\Recovery.txt
2016-05-12 20:17 - 2016-05-12 20:18 - 00122928 _____ C:\Users\Arni556\Downloads\Startup Programs (ADRIAN) 2016-05-12 20.17.30.txt
2016-05-12 20:17 - 2016-05-12 20:17 - 00513136 _____ C:\Users\Arni556\Downloads\Silent Runners.vbs
2016-05-12 19:46 - 2016-05-12 20:07 - 00000000 ____D C:\ProgramData\RogueKiller
2016-05-12 19:46 - 2016-05-12 19:46 - 00024688 _____ C:\Windows\system32\Drivers\TrueSight.sys
2016-05-12 19:45 - 2016-05-12 19:46 - 19837512 _____ C:\Users\Arni556\Downloads\RogueKiller.exe
2016-05-12 19:43 - 2016-05-12 19:43 - 00000839 _____ C:\Users\Arni556\Desktop\JRT.txt
2016-05-12 19:41 - 2016-05-12 19:41 - 01610816 _____ (Malwarebytes) C:\Users\Arni556\Downloads\JRT.exe
2016-05-12 18:05 - 2016-05-12 18:06 - 00004096 _____ C:\Users\Arni556\Desktop\Rkill.txt
2016-05-12 17:57 - 2016-05-12 18:40 - 00000000 ____D C:\AdwCleaner
2016-05-12 17:57 - 2016-05-12 17:57 - 03640384 _____ C:\Users\Arni556\Downloads\AdwCleaner.exe
2016-05-12 15:23 - 2016-05-12 15:24 - 73578015 _____ C:\Users\Arni556\Downloads\Omsi2.ru_Mercedes_o530G.7z
2016-05-12 15:21 - 2016-05-12 15:22 - 157945363 _____ C:\Users\Arni556\Downloads\v1.4_Mercedes_O530_Facelift.7z
2016-05-12 13:56 - 2016-05-12 16:59 - 00000000 ____D C:\Users\Arni556\Desktop\Praca licencjacka
2016-05-11 22:05 - 2016-05-14 13:16 - 00004020 _____ C:\Windows\System32\Tasks\Intel Security DAT Reputation (AMCore) Post DAT update endpoint safety pulse
2016-05-07 05:43 - 2016-05-07 00:14 - 00303226 _____ ( ) C:\Windows\AdBlock.exe
2016-05-04 17:46 - 2016-05-07 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-05-04 14:09 - 2016-05-04 14:20 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-05-04 14:09 - 2016-05-04 14:09 - 00003502 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-MicrosoftAccount-pliszka.adrian@gazeta.pl
2016-05-04 14:08 - 2016-05-12 12:57 - 00001125 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
2016-05-04 14:07 - 2016-05-12 12:57 - 00001217 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6.lnk
2016-05-04 14:07 - 2016-05-12 12:57 - 00001087 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
2016-05-04 14:06 - 2016-05-12 12:57 - 00001179 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6.lnk
2016-05-04 14:06 - 2016-05-04 14:08 - 00000000 ____D C:\Program Files\Adobe
2016-05-04 14:03 - 2016-05-12 12:57 - 00001533 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
2016-05-04 14:03 - 2016-05-12 12:57 - 00001363 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
2016-05-04 14:03 - 2016-05-04 14:07 - 00000000 ____D C:\Program Files (x86)\Adobe
2016-05-04 13:55 - 2016-05-14 13:11 - 00000000 ____D C:\Users\Arni556\AppData\Local\Adobe
2016-05-03 21:43 - 2016-05-03 21:43 - 00000000 ____D C:\Windows\LastGood
2016-05-03 21:12 - 2016-05-03 21:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Open Rails
2016-05-03 20:54 - 2016-05-03 21:14 - 00000000 ____D C:\Users\Arni556\Desktop\Symulatory
2016-05-03 20:12 - 2016-05-03 20:12 - 00000000 ____D C:\Windows\LastGood.Tmp
2016-05-03 18:57 - 2016-05-04 15:42 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\NVIDIA
2016-05-03 18:17 - 2016-05-03 18:17 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Train Store PL
2016-05-03 17:54 - 2016-05-03 23:18 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Open Rails
2016-05-03 17:54 - 2016-05-03 17:54 - 00000000 ____D C:\Program Files (x86)\Microsoft XNA
2016-05-03 17:54 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_4.dll
2016-05-03 17:54 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_4.dll
2016-05-03 17:54 - 2009-03-16 14:18 - 00069448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_3.dll
2016-05-03 17:54 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_6.dll
2016-05-03 17:54 - 2007-04-04 18:53 - 00081768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xinput1_3.dll
2016-05-03 17:54 - 2007-03-12 16:42 - 03495784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_33.dll
2016-05-03 17:54 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll
2016-05-03 17:01 - 2016-05-04 16:07 - 00000000 _____ C:\Users\Arni556\AppData\Roaming\FileOut.cns
2016-05-03 17:01 - 2016-05-04 16:07 - 00000000 _____ C:\Users\Arni556\AppData\Roaming\FileIn.cns
2016-05-03 16:56 - 2016-05-03 16:56 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games
2016-05-03 15:12 - 2016-05-12 19:18 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-05-03 15:11 - 2016-05-12 19:18 - 00000000 ____D C:\Users\Arni556\Desktop\mbar
2016-05-03 12:58 - 2016-05-03 12:58 - 00000001 _____ C:\Windows\SysWOW64\pl.html
2016-05-03 00:51 - 2016-05-12 12:57 - 00000874 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-05-03 00:51 - 2016-05-03 00:51 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-05-03 00:51 - 2016-05-03 00:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-05-03 00:51 - 2016-05-03 00:51 - 00000000 ____D C:\Program Files\CCleaner
2016-05-03 00:48 - 2016-05-13 23:59 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-05-03 00:48 - 2016-05-13 20:59 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-05-03 00:48 - 2016-05-03 00:48 - 00000000 ____D C:\Users\Arni556\AppData\Local\Macromedia
2016-05-02 17:41 - 2016-05-12 18:58 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-05-02 17:40 - 2016-05-12 18:58 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-05-02 17:40 - 2016-05-12 12:57 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-05-02 17:40 - 2016-05-02 17:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-05-02 17:40 - 2016-05-02 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-05-02 17:40 - 2016-05-02 17:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-05-02 17:40 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-05-02 17:40 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-05-02 17:34 - 2016-05-12 12:57 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-05-02 17:34 - 2016-05-12 12:57 - 00001159 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-05-02 17:34 - 2016-05-07 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-05-02 17:34 - 2016-05-02 19:34 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Nutni
2016-05-02 17:34 - 2016-05-02 18:00 - 00000000 ____D C:\Users\Arni556\AppData\Local\Mozilla
2016-05-02 17:34 - 2016-05-02 17:36 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\VuviroKit
2016-05-02 17:30 - 2016-05-12 12:57 - 00002035 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\allegro.pl  (2).lnk
2016-05-02 17:30 - 2016-05-12 12:57 - 00002001 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Booking  (2).lnk
2016-05-02 17:06 - 2016-05-02 19:34 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Guikn
2016-05-02 17:06 - 2016-05-02 17:34 - 00000000 ____D C:\Users\Arni556\AppData\Local\Tempfolder
2016-05-02 17:06 - 2016-05-02 17:06 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\MolfKolgaj
2016-05-02 17:06 - 2016-04-28 23:47 - 00305984 _____ ( ) C:\Windows\systwin.exe
2016-05-02 17:05 - 2016-05-02 17:07 - 00000000 ____D C:\Users\Public\Documents\dmp
2016-05-02 17:00 - 2016-05-02 17:00 - 06494208 _____ C:\Users\Arni556\AppData\Roaming\agent.dat
2016-05-02 17:00 - 2016-05-02 17:00 - 01626777 _____ C:\Users\Arni556\AppData\Roaming\Keyphase.tst
2016-05-02 17:00 - 2016-05-02 17:00 - 00938496 _____ C:\Users\Arni556\AppData\Roaming\Lamdex.exe
2016-05-02 17:00 - 2016-05-02 17:00 - 00938496 _____ C:\Users\Arni556\AppData\Roaming\Keyphase.exe
2016-05-02 17:00 - 2016-05-02 17:00 - 00127488 _____ C:\Users\Arni556\AppData\Roaming\Installer.dat
2016-05-02 17:00 - 2016-05-02 17:00 - 00072717 _____ C:\Users\Arni556\AppData\Roaming\Lamdex.tst
2016-05-02 17:00 - 2016-05-02 17:00 - 00018432 _____ C:\Users\Arni556\AppData\Roaming\Main.dat
2016-05-02 15:54 - 2016-05-05 21:13 - 00000000 ____D C:\ProgramData\Adobe
2016-05-02 15:54 - 2016-05-04 14:08 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-05-02 14:55 - 2016-05-02 14:55 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-05-02 14:44 - 2016-05-12 23:30 - 00000000 __HDC C:\ProgramData\~0
2016-05-02 14:44 - 2016-05-12 23:30 - 00000000 ____D C:\Program Files\Common Files\Topaz Labs
2016-05-02 14:44 - 2016-05-12 23:30 - 00000000 ____D C:\Program Files (x86)\Topaz Labs
2016-05-02 14:44 - 2016-05-12 12:57 - 00000283 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kosz.lnk
2016-05-02 14:07 - 2016-05-02 14:07 - 00000000 ____D C:\Users\Arni556\AppData\LocalLow\Adobe
2016-05-02 14:02 - 2016-05-02 14:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2016-05-02 14:01 - 2016-05-02 19:33 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\{6402F97B-592D-8ED0-8C92-6A62ED4128B1}
2016-05-02 13:57 - 2016-05-02 13:57 - 00002659 _____ C:\Users\Arni556\Desktop\µTorrent.lnk
2016-05-02 13:56 - 2016-05-03 00:54 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\uTorrent
2016-04-25 21:40 - 2016-05-12 12:57 - 00002354 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive dla Firm.lnk
2016-04-23 17:19 - 2016-04-23 17:21 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\download
2016-04-23 17:19 - 2014-07-25 04:39 - 00293320 ____N (深圳市迅雷网络技术有限公司) C:\Users\Arni556\AppData\Roaming\xldl.dll
2016-04-22 13:08 - 2016-04-22 13:08 - 00000000 ____D C:\ProgramData\GG
2016-04-22 00:23 - 2016-04-22 00:23 - 00003106 _____ C:\Windows\System32\Tasks\{E13A6586-1AFA-4370-BF34-C46740C4A699}
2016-04-15 12:01 - 2016-04-15 12:01 - 00000000 __SHD C:\Users\Arni556\AppData\LocalLow\EmieUserList
2016-04-15 12:01 - 2016-04-15 12:01 - 00000000 __SHD C:\Users\Arni556\AppData\LocalLow\EmieSiteList

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-05-14 13:15 - 2016-04-13 02:24 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1202582443-2431899416-2755814704-1001
2016-05-14 13:15 - 2016-04-12 20:08 - 00003984 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{A64F5073-BEE3-415E-AA29-F367F781B8F9}
2016-05-14 13:13 - 2016-04-13 02:20 - 00000125 _____ C:\Users\Arni556\AppData\Roaming\sp_data.sys
2016-05-14 13:13 - 2016-04-12 20:40 - 00000000 ___RD C:\Users\Arni556\OneDrive
2016-05-14 13:13 - 2016-04-12 20:09 - 00001066 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-05-14 13:12 - 2016-04-12 20:17 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\GG
2016-05-14 13:11 - 2016-04-13 15:16 - 00000000 ____D C:\Users\Arni556\Documents\Pliki programu Outlook
2016-05-14 00:19 - 2016-04-12 20:09 - 00001070 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-05-13 21:21 - 2016-04-12 20:10 - 00002223 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-05-13 21:21 - 2016-04-12 20:10 - 00002211 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-05-13 20:42 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness
2016-05-12 20:08 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-05-12 19:24 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\Registration
2016-05-12 18:24 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\Inf
2016-05-12 12:57 - 2016-04-13 02:18 - 00001456 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-05-12 12:57 - 2016-04-13 02:18 - 00000469 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Documents.lnk
2016-05-12 12:57 - 2016-04-13 02:18 - 00000467 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Pictures.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002446 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002434 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002419 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002416 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002413 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002380 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel 2016.lnk
2016-05-12 12:57 - 2016-04-12 22:16 - 00002370 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher 2016.lnk
2016-05-12 12:57 - 2016-04-12 20:18 - 00001628 _____ C:\Users\Arni556\Desktop\GG dysk.lnk
2016-05-12 12:57 - 2016-04-12 20:17 - 00001169 _____ C:\Users\Arni556\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GG.lnk
2016-05-12 12:57 - 2016-04-12 20:17 - 00001161 _____ C:\Users\Arni556\Desktop\GG.lnk
2016-05-12 12:57 - 2015-05-30 16:55 - 00001906 _____ C:\ProgramData\Microsoft\Windows\Start Menu\SmartAudio.lnk
2016-05-12 12:57 - 2015-05-30 16:45 - 00000712 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel(R) HD Graphics Control Panel.lnk
2016-05-12 12:57 - 2014-10-21 06:30 - 00002520 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WildTangent Games App - asus.lnk
2016-05-12 12:55 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2016-05-11 21:54 - 2016-04-13 02:18 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Adobe
2016-05-11 17:31 - 2016-04-13 02:18 - 00000000 ____D C:\Users\Arni556
2016-05-11 09:14 - 2016-04-12 20:09 - 00004042 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-05-11 09:14 - 2016-04-12 20:09 - 00003806 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-05-07 22:24 - 2015-05-30 16:48 - 00000000 ____D C:\ProgramData\NVIDIA
2016-05-07 06:04 - 2013-08-22 17:36 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-05-07 06:03 - 2014-10-21 06:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2016-05-05 21:26 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2016-05-04 22:49 - 2016-04-13 02:18 - 00000000 ____D C:\Users\Arni556\AppData\Local\NVIDIA Corporation
2016-05-04 22:49 - 2016-04-13 02:18 - 00000000 ____D C:\Users\Arni556\AppData\Local\NVIDIA
2016-05-04 17:17 - 2013-08-22 16:44 - 05099016 _____ C:\Windows\system32\FNTCACHE.DAT
2016-05-04 13:55 - 2014-10-21 13:14 - 00807160 _____ C:\Windows\system32\perfh015.dat
2016-05-04 13:55 - 2014-10-21 13:14 - 00163478 _____ C:\Windows\system32\perfc015.dat
2016-05-04 13:55 - 2014-03-18 17:26 - 01825074 _____ C:\Windows\system32\PerfStringBackup.INI
2016-05-03 20:06 - 2014-10-21 06:29 - 00000000 ____D C:\ProgramData\Package Cache
2016-05-03 15:39 - 2014-10-21 12:37 - 00000000 ____D C:\Windows\Log
2016-05-03 15:18 - 2016-04-12 20:09 - 00000000 ____D C:\Users\Arni556\AppData\Local\Apps\2.0
2016-05-03 00:54 - 2014-10-21 14:09 - 00000000 ____D C:\Windows\Panther
2016-05-02 17:34 - 2016-04-12 20:17 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Mozilla
2016-04-29 23:53 - 2013-08-22 17:36 - 00000000 ___HD C:\Program Files\WindowsApps
2016-04-27 14:48 - 2016-04-12 21:32 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Foxit Software
2016-04-25 21:40 - 2016-04-12 22:36 - 00003180 _____ C:\Windows\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-1202582443-2431899416-2755814704-1001
2016-04-24 12:09 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF
2016-04-22 13:08 - 2016-04-12 20:17 - 00000000 ____D C:\Users\Arni556\AppData\Local\GG
2016-04-22 00:23 - 2016-04-13 01:46 - 00000000 ____D C:\Users\Arni556\AppData\Roaming\Skype
2016-04-22 00:23 - 2014-10-21 06:29 - 00000000 ____D C:\ProgramData\Skype
2016-04-20 21:19 - 2015-05-30 17:13 - 00000000 ____D C:\Program Files\Common Files\McAfee
2016-04-20 21:18 - 2013-08-22 17:36 - 00000000 ___HD C:\Windows\ELAMBKUP
2016-04-20 21:17 - 2016-04-13 11:17 - 00000000 ____D C:\Windows\System32\Tasks\McAfee
2016-04-16 10:36 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache
2016-04-16 10:36 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2016-04-16 10:33 - 2014-10-21 13:14 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\SysWOW64\winrm
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\SysWOW64\WCN
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\system32\winrm
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\system32\WCN
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\system32\slmgr
2016-04-16 10:33 - 2014-03-18 16:58 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\WinStore
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\MUI
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\Com
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\MUI
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\migwiz
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\PolicyDefinitions
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\IME
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2016-04-16 10:33 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\SysWOW64\oobe
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\SysWOW64\Dism
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\system32\Sysprep
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\system32\oobe
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\system32\Dism
2016-04-16 10:33 - 2013-08-22 15:36 - 00000000 ____D C:\Windows\servicing
2016-04-16 10:32 - 2014-03-18 17:10 - 00000000 ____D C:\Program Files\Windows Journal
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\SystemResetPlatform
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\Com
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\Help
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Windows Defender
2016-04-16 10:32 - 2013-08-22 17:36 - 00000000 ____D C:\Program Files\Common Files\System
2016-04-15 13:37 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\SysWOW64\en-GB
2016-04-15 13:37 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\en-GB
2016-04-14 17:49 - 2016-04-13 02:18 - 00000000 ____D C:\Users\Arni556\AppData\Local\Packages

==================== Pliki w katalogu głównym wybranych folderów =======

2016-05-02 17:00 - 2016-05-02 17:00 - 6494208 _____ () C:\Users\Arni556\AppData\Roaming\agent.dat
2016-05-03 17:01 - 2016-05-04 16:07 - 0000000 _____ () C:\Users\Arni556\AppData\Roaming\FileIn.cns
2016-05-03 17:01 - 2016-05-04 16:07 - 0000000 _____ () C:\Users\Arni556\AppData\Roaming\FileOut.cns
2016-05-02 17:00 - 2016-05-02 17:00 - 0127488 _____ () C:\Users\Arni556\AppData\Roaming\Installer.dat
2016-05-02 17:00 - 2016-05-02 17:00 - 0938496 _____ () C:\Users\Arni556\AppData\Roaming\Keyphase.exe
2016-05-02 17:00 - 2016-05-02 17:00 - 1626777 _____ () C:\Users\Arni556\AppData\Roaming\Keyphase.tst
2016-05-02 17:00 - 2016-05-02 17:00 - 0938496 _____ () C:\Users\Arni556\AppData\Roaming\Lamdex.exe
2016-05-02 17:00 - 2016-05-02 17:00 - 0072717 _____ () C:\Users\Arni556\AppData\Roaming\Lamdex.tst
2016-05-02 17:00 - 2016-05-02 17:00 - 0018432 _____ () C:\Users\Arni556\AppData\Roaming\Main.dat
2016-04-13 02:20 - 2016-05-14 13:13 - 0000125 _____ () C:\Users\Arni556\AppData\Roaming\sp_data.sys
2016-04-23 17:19 - 2014-07-25 04:39 - 0293320 ____N (深圳市迅雷网络技术有限公司) C:\Users\Arni556\AppData\Roaming\xldl.dll
2016-04-13 02:18 - 2016-05-14 13:11 - 0299780 _____ () C:\Users\Arni556\AppData\Local\BTServer.log
2014-10-21 06:28 - 2012-09-07 13:40 - 0000256 _____ () C:\ProgramData\SetStretch.cmd
2014-10-21 06:28 - 2009-07-22 12:04 - 0024576 _____ () C:\ProgramData\SetStretch.exe
2014-10-21 06:28 - 2012-09-07 13:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS

Niektóre pliki w TEMP:
====================
C:\Users\Arni556\AppData\Local\Temp\dllnt_dump.dll
C:\Users\Arni556\AppData\Local\Temp\libeay32.dll
C:\Users\Arni556\AppData\Local\Temp\msvcr120.dll
C:\Users\Arni556\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-05-06 16:31

==================== Koniec  FRST.txt ============================