Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 14-08-2016
Uruchomiony przez Jan (administrator)  JAN-KOMPUTER (14-08-2016 22:02:10)
Uruchomiony z D:\ffts
Załadowane profile: Jan (Dostępne profile: Jan)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
(百度在线网络技术（北京）有限公司) C:\Users\Jan\AppData\Local\Baidu\BaiduClient\2.5.0.2084\BaiduService.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.2\ToolbarUpdater.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) D:\steam\Steam.exe
(Highresolution Enterprises) D:\m4\XMouseButtonControl.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Valve Corporation) D:\steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13671792 2014-03-14] (Realtek Semiconductor)
HKLM\...\Run: [XMouseButtonControl] => D:\m4\XMouseButtonControl.exe [1127408 2015-10-19] (Highresolution Enterprises)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [6709008 2016-07-28] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [2162760 2016-07-21] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-11-09] (Oracle Corporation)
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe [186640 2016-07-20] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\Run: [DAEMON Tools Lite] => D:\demon tools\DTLite.exe [3673728 2012-11-06] (DT Soft Ltd)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\Run: [Steam] => D:\steam\steam.exe [2852128 2016-08-03] (Valve Corporation)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\Run: [GoogleChromeAutoLaunch_1F14D2380DB1DE09582B9D790BD95BA5] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [961352 2016-08-03] (Google Inc.)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\Run: [BaiduClient] => C:\Users\Jan\AppData\Local\Baidu\BaiduClient\2.5.0.2084\Baidu.exe [672240 2016-08-14] (百度在线网络技术（北京）有限公司)
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {0497301b-4ca5-11e5-8742-0c5b8f279a64} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {0b1f92a2-deea-11e5-851a-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {0e5b4e7f-f71b-11e4-88de-f9dd8f8ecc35} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {0f0b07b3-6cf0-11e5-bd77-0c5b8f279a64} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {0f0b07bf-6cf0-11e5-bd77-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {16083516-2de7-11e5-8932-fcaa1401b23b} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {2fe06f7e-2eee-11e5-9922-fcaa1401b23b} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {2fe06f8b-2eee-11e5-9922-fcaa1401b23b} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {32dd338f-2d27-11e5-b1f5-0c5b8f279a64} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {4108f0f0-bb9e-11e5-867c-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {457c6efd-8cff-11e5-a5ee-fcaa1401b23b} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {55313fe3-5c0d-11e6-a1d5-fcaa1401b23b} - G:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {723049f4-f718-11e4-9cef-f99fd495595c} - H:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {74836eca-d18e-11e5-b51e-806e6f6e6963} - F:\HTC_Sync_Manager_PC.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {94b257f2-b3b0-11e5-9270-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {94b25800-b3b0-11e5-9270-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {94b2580c-b3b0-11e5-9270-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {993f4764-f721-11e4-b05c-fcaa1401b23b} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {b198c710-6e65-11e5-ba91-0c5b8f279a64} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {c040fb1a-86fd-11e5-bc45-0c5b8f279a64} - F:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {d967c307-7e44-11e5-954e-0c5b8f279a64} - E:\setup.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {f1d46e07-105a-11e5-a68e-fcaa1401b23b} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {f4227027-f71c-11e4-a24e-fcaa1401b23b} - E:\AutoRun.exe
HKU\S-1-5-21-1941685375-2250058660-3908555107-1000\...\MountPoints2: {ff240a89-b6c6-11e5-a510-0c5b8f279a64} - F:\AutoRun.exe

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: 127.0.0.1 validation.sls.microsoft.com
Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{245AB50C-2634-4F2D-A25C-79199D851F76}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{324AEDAE-CD6C-4E84-8FF2-77D36FB59494}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{32AF430B-5D02-4CB8-9B6F-585D6431C68F}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{404F32C6-E321-4C80-904E-6D96F65448E7}: [NameServer] 133.130.91.20
Tcpip\..\Interfaces\{44942ED0-C817-4A23-9A8D-95A6E2DA3ADC}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{4AB48076-B69A-4ED2-973A-43C8AA082013}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{4C436DE1-CF2A-40DB-8D2F-F53A32F6E4E3}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{73B7F00C-230F-470C-B3FD-5D50388AF0CE}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{84537883-94F6-4A0E-B66F-274DA4DF0273}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{910B7A12-A3C6-42E6-9459-83B6B39729C9}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{ACFB3EA6-BF4C-431D-ACB2-130A1FF9E9F0}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{CE81AF90-980B-4EC7-BFAA-F278A8E7636D}: [NameServer] 133.130.91.20
Tcpip\..\Interfaces\{CE81AF90-980B-4EC7-BFAA-F278A8E7636D}: [DhcpNameServer] 192.168.8.1 192.168.8.1
Tcpip\..\Interfaces\{EB388F25-98DA-4EF5-BE5F-DD595ACA527A}: [DhcpNameServer] 192.168.8.1 192.168.8.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = 
SearchScopes: HKU\S-1-5-21-1941685375-2250058660-3908555107-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={5B8ACFED-6EB2-4DAF-9700-20D44B34EF1C}&mid=162afed9292847cdbf5528d69271b0af-8d5f52727ba33efd0130e0a4f15b3668e02ce083&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1215tb&pr=fr&d=2015-05-10 16:40:40&v=4.2.8.608&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1941685375-2250058660-3908555107-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={5B8ACFED-6EB2-4DAF-9700-20D44B34EF1C}&mid=162afed9292847cdbf5528d69271b0af-8d5f52727ba33efd0130e0a4f15b3668e02ce083&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1215tb&pr=fr&d=2015-05-10 16:40:40&v=4.2.8.608&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-29] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-29] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.3.2.18\AVG Web TuneUp.dll [2016-07-21] (AVG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> D:\Nowy folder (2)\bin\jp2ssv.dll => Brak pliku
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-29] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-29] (Oracle Corporation)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.3.2\\npsitesafety.dll [Brak pliku]
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.mysites123.com/?type=hp&ts=1454698199&z=3e1869c54183170c9c702fagbz9w4zdqct9b6g9t0t&from=amt&uid=st1000dm003-1er162_z4y2lyh0xxxxz4y2lyh0
CHR StartupUrls: Default -> "chrome://newtab/"
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\ppGoogleNaClPluginChrome.dll => Brak pliku
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\pdf.dll => Brak pliku
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll => Brak pliku
CHR Profile: C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Steam inventory helper) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2016-08-11]
CHR Extension: (LoungeDestroyer) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2016-06-20]
CHR Extension: (AdBlock) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-08-02]
CHR Extension: (CSGO Raffles) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\iimkannipkbnedhlbaillakkkimfakkd [2016-06-20]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-05]
CHR Extension: (Oddshot) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\olnoeeagkgpkplnhmnnlgodjnjgckhja [2016-08-02]
CHR Extension: (Chrome Media Router) - C:\Users\Jan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-09]

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [674552 2016-07-28] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5267456 2016-07-28] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1097488 2016-07-20] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [760024 2016-07-28] (AVG Technologies CZ, s.r.o.)
R2 BaiduService.exe; C:\Users\Jan\AppData\Local\Baidu\BaiduClient\2.5.0.2084\BaiduService.exe [241416 2016-08-14] (百度在线网络技术（北京）有限公司)
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [227896 2016-04-05] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [5971000 2016-04-05] (GOG.com)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [242264 2015-09-23] ()
S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2015-05-10] ()
R2 vToolbarUpdater40.3.2; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.3.2\ToolbarUpdater.exe [1309768 2016-07-21] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [976456 2016-07-21] ()

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [314112 2016-06-30] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [261376 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [260352 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [261888 2016-07-19] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [298752 2016-07-12] (AVG Technologies CZ, s.r.o.)
R0 Avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [77056 2016-06-20] (AVG Technologies CZ, s.r.o.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2015-10-29] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [229376 2015-05-10] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-14] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S3 TSSKX64; C:\Windows\System32\drivers\tsskx64.sys [52728 2016-08-14] (电脑管家)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S1 QMUdisk; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17900.206\QMUdisk64.sys [X]
S1 softaal; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17900.206\softaal64.sys [X]
S1 SRepairDrv; \??\C:\Program Files (x86)\Tencent\QQPCMGR\SRepairDrv [X]
S2 tsnethlpx64; \??\C:\Program Files (x86)\Tencent\QQPCMgr\11.8.17900.206\TsNetHlpX64.sys [X]
S3 VBAudioVACMME; system32\DRIVERS\vbaudio_cable64_win7.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-14 21:42 - 2016-08-14 22:02 - 00000000 ____D C:\FRST
2016-08-14 21:30 - 2016-08-14 21:30 - 00000000 ____D C:\Users\Jan\.oracle_jre_usage
2016-08-14 21:29 - 2016-07-22 13:48 - 06500888 _____ (Geek Uninstaller) C:\Users\Jan\Desktop\geek.exe
2016-08-14 21:25 - 2016-08-14 21:26 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Baidu
2016-08-14 21:15 - 2016-08-14 21:15 - 00001106 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-08-14 21:01 - 2016-08-14 21:01 - 00001181 _____ C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\百度.lnk
2016-08-14 21:01 - 2016-08-14 21:01 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\百度
2016-08-14 20:41 - 2016-08-14 20:42 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Geek Uninstaller
2016-08-14 20:29 - 2016-08-14 20:41 - 00000000 ____D C:\ProgramData\TXQMPC
2016-08-14 20:29 - 2016-08-14 20:29 - 00000000 ____D C:\Program Files\Common Files\Tencent
2016-08-14 20:28 - 2016-08-14 20:59 - 00000000 ____D C:\ProgramData\Tencent
2016-08-14 20:28 - 2016-08-14 20:28 - 00095224 _____ (电脑管家) C:\Windows\system32\Drivers\TFsFltX64.sys
2016-08-14 20:28 - 2016-08-14 20:28 - 00052728 _____ (电脑管家) C:\Windows\system32\Drivers\TSSKX64.sys
2016-08-14 20:26 - 2016-08-14 20:28 - 00000000 ____D C:\ProgramData\Baidu
2016-08-14 20:26 - 2016-08-14 20:26 - 00000000 ____D C:\Users\Jan\AppData\Local\Baidu
2016-08-14 15:36 - 2016-08-14 15:36 - 00000868 _____ C:\Users\Jan\Desktop\Fallout4 — skrót.lnk
2016-08-14 15:31 - 2016-08-14 15:31 - 00000000 ____D C:\Users\Jan\Documents\SkidRow
2016-08-14 14:12 - 2016-08-14 14:12 - 00000000 ____D C:\Program Files (x86)\Fallout 4
2016-08-14 11:54 - 2016-08-14 11:54 - 00000000 ____D C:\Users\Jan\AppData\Local\Fallout4
2016-08-11 12:47 - 2015-05-10 15:51 - 01001472 _____ (DiBcom SA) C:\Windows\system32\Drivers\mod7700.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00439808 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbwwan.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00229376 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juwwanecm.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00225920 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00117248 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwusbdev.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00104448 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcacm.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00090112 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jubusenum.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00073216 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_jucdcecm.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00032768 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00030720 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_juextctrl.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00022016 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_hwupgrade.sys
2016-08-11 12:47 - 2015-05-10 15:51 - 00013952 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_usbenumfilter.sys
2016-08-10 16:34 - 2016-08-13 17:44 - 00000000 ____D C:\Users\Jan\Desktop\Nowy folder (3)
2016-08-03 13:40 - 2016-08-03 13:40 - 00000000 ____D C:\Users\Jan\Desktop\DeSmuME - 0.9.7 - Win64
2016-08-03 13:40 - 2016-08-03 13:39 - 01419179 _____ C:\Users\Jan\Desktop\DeSmuME - 0.9.7 - Win64.zip
2016-08-03 13:38 - 2016-08-03 13:39 - 00000000 ____D C:\Users\Jan\Desktop\Pokemon Diamond
2016-08-03 13:37 - 2016-08-03 13:36 - 20364962 _____ C:\Users\Jan\Desktop\pokemon diamond.rar
2016-08-03 13:37 - 2016-08-03 13:35 - 00500779 _____ C:\Users\Jan\Desktop\Emulator GBA.rar
2016-08-03 13:37 - 2008-02-18 21:35 - 00000000 ____D C:\Users\Jan\Desktop\vba
2016-08-02 14:48 - 2016-08-10 16:41 - 00000000 ____D C:\Users\Jan\Desktop\Nowy folder (2)
2016-07-25 16:11 - 2016-07-25 16:11 - 00000000 ____D C:\Users\Jan\AppData\LocalLow\NoBrakesGames
2016-07-24 14:26 - 2016-07-24 14:26 - 00000202 _____ C:\Users\Jan\Desktop\Evolve Stage 2.url
2016-07-20 12:02 - 2016-07-20 12:02 - 00004269 _____ C:\Users\Jan\AppData\Local\recently-used.xbel
2016-07-20 11:39 - 2016-07-20 12:02 - 00000000 ____D C:\Users\Jan\Desktop\Nowy folder
2016-07-19 12:27 - 2016-07-19 12:27 - 00261888 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-08-14 21:43 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-14 21:43 - 2009-07-14 06:45 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-14 21:40 - 2011-02-04 19:55 - 05696934 _____ C:\Windows\system32\perfh015.dat
2016-08-14 21:40 - 2011-02-04 19:55 - 01834108 _____ C:\Windows\system32\perfc015.dat
2016-08-14 21:40 - 2009-07-14 07:13 - 00006208 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-14 21:36 - 2015-05-10 15:45 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-14 21:35 - 2015-05-10 15:37 - 00000000 ____D C:\ProgramData\MFAData
2016-08-14 21:35 - 2015-05-10 15:32 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-14 21:35 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-14 21:30 - 2015-05-10 15:29 - 00000000 ____D C:\Users\Jan
2016-08-14 21:22 - 2015-05-10 15:32 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-14 21:15 - 2015-05-10 15:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-08-14 21:15 - 2015-05-10 15:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-08-14 21:14 - 2015-10-29 16:36 - 00000000 ____D C:\Users\Jan\AppData\Roaming\DAEMON Tools Lite
2016-08-14 21:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-08-14 21:01 - 2015-05-10 15:48 - 00074392 _____ C:\Users\Jan\AppData\Local\GDIPFONTCACHEV1.DAT
2016-08-14 21:00 - 2016-07-14 16:29 - 00000563 _____ C:\Users\Public\Desktop\Minecraft.lnk
2016-08-14 21:00 - 2016-07-05 13:45 - 00000890 _____ C:\Users\Public\Desktop\Europa Universalis IV Mare Nostrum.lnk
2016-08-14 21:00 - 2016-05-14 12:54 - 00002587 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft PowerPoint Viewer .lnk
2016-08-14 21:00 - 2016-05-14 11:10 - 00001470 _____ C:\Users\Public\Desktop\LibreOffice 5.1.lnk
2016-08-14 21:00 - 2016-04-06 13:17 - 00000708 _____ C:\Users\Public\Desktop\Stardew Valley.lnk
2016-08-14 21:00 - 2016-03-06 10:11 - 00000741 _____ C:\Users\Jan\Desktop\Pillars of Eternity The White March Part I.lnk
2016-08-14 21:00 - 2016-02-25 14:13 - 00000938 _____ C:\Users\Jan\Desktop\Stronghold Crusader 2.lnk
2016-08-14 21:00 - 2016-02-22 22:50 - 00001179 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2016-08-14 21:00 - 2016-02-22 22:26 - 00000778 _____ C:\Users\Public\Desktop\Battle.net.lnk
2016-08-14 21:00 - 2016-01-18 15:48 - 00000512 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-14 21:00 - 2015-12-14 15:35 - 00000978 _____ C:\Users\Public\Desktop\AVG.lnk
2016-08-14 21:00 - 2015-09-17 15:43 - 00000715 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2016-08-14 21:00 - 2015-07-08 11:18 - 00001319 _____ C:\Users\Public\Desktop\League of Legends.lnk
2016-08-14 21:00 - 2015-06-04 13:52 - 00000860 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-08-14 21:00 - 2015-05-10 21:47 - 00000584 _____ C:\Users\Jan\Desktop\TeamSpeak 3 Client.lnk
2016-08-14 21:00 - 2015-05-10 15:32 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-14 21:00 - 2015-05-10 15:29 - 00001455 _____ C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-14 21:00 - 2015-05-10 15:29 - 00001421 _____ C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-08-14 21:00 - 2015-05-10 15:28 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-08-14 21:00 - 2015-05-10 15:27 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-08-14 21:00 - 2009-07-14 07:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-08-14 21:00 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-08-14 21:00 - 2009-07-14 06:57 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-08-14 21:00 - 2009-07-14 06:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-08-14 21:00 - 2009-07-14 06:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-08-14 21:00 - 2009-07-14 06:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-08-14 20:59 - 2009-07-14 06:45 - 00336328 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-14 20:59 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\schemas
2016-08-14 20:57 - 2015-07-12 14:54 - 00000000 ____D C:\Users\Jan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-08-14 20:34 - 2015-11-09 22:27 - 00000000 ____D C:\Users\Jan\AppData\Roaming\BitTorrent
2016-08-14 12:14 - 2016-03-10 16:24 - 00000000 ____D C:\Users\Jan\Documents\My Games
2016-08-14 12:12 - 2016-04-06 13:17 - 00000000 ____D C:\Users\Jan\AppData\Roaming\StardewValley
2016-08-11 13:01 - 2015-05-10 15:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2016-08-10 16:37 - 2015-12-16 19:55 - 00000000 ____D C:\Users\Jan\Desktop\sdfsdf
2016-08-09 16:09 - 2016-02-22 22:26 - 00000000 ____D C:\Users\Jan\AppData\Local\Battle.net
2016-08-07 17:31 - 2016-02-22 22:29 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2016-08-06 21:41 - 2015-05-10 15:50 - 00000000 ____D C:\ProgramData\DatacardService
2016-08-05 16:40 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2016-08-04 14:50 - 2015-12-14 15:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2016-08-01 12:17 - 2015-05-10 15:32 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-08-01 12:17 - 2015-05-10 15:32 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-21 20:27 - 2015-05-10 16:40 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp
2016-07-21 20:26 - 2015-05-10 16:40 - 00000000 ____D C:\ProgramData\AVG Web TuneUp
2016-07-20 12:02 - 2015-09-17 15:45 - 00000000 ____D C:\Users\Jan\.gimp-2.8

==================== Pliki w katalogu głównym wybranych folderów =======

2016-05-14 13:01 - 2016-05-14 13:12 - 0005632 _____ () C:\Users\Jan\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-07-20 12:02 - 2016-07-20 12:02 - 0004269 _____ () C:\Users\Jan\AppData\Local\recently-used.xbel
2015-06-04 13:50 - 2015-06-04 13:50 - 0007605 _____ () C:\Users\Jan\AppData\Local\Resmon.ResmonCfg
2015-05-10 15:54 - 2015-05-10 15:54 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Niektóre pliki w TEMP:
====================
C:\Users\Jan\AppData\Local\Temp\1-20150313-152755.exe
C:\Users\Jan\AppData\Local\Temp\530a4b37283766d34ebc81987899a1ad.exe
C:\Users\Jan\AppData\Local\Temp\redirmgr.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-08-06 16:51

==================== Koniec  FRST.txt ============================