Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 21-12-2016 Uruchomiony przez Visek (administrator) VISKO (25-12-2016 20:30:50) Uruchomiony z C:\Users\Visek\Downloads Załadowane profile: Visek (Dostępne profile: Visek) Platform: Windows 8.1 (Update) (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Opera) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe (DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Electronic Arts) C:\Program Files (x86)\Origin\OriginWebHelperService.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Realtek semiconductor) C:\Windows\RTFTrack.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe (Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe () C:\Program Files (x86)\CNT\Navitel Navigator Update Center\NavitelUpdaterService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe (CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe () C:\Program Files (x86)\Origin\QtWebEngineProcess.exe (Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe (Microsoft Corporation) C:\Windows\System32\Taskmgr.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe (Opera Software) C:\Program Files (x86)\Opera\42.0.2393.94\opera.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2876816 2013-03-05] (ELAN Microelectronics Corp.) HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6339656 2013-04-10] (Realtek semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17097200 2013-11-21] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [193008 2013-11-21] (Lenovo(beijing) Limited) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [909016 2013-10-21] (Conexant Systems, Inc.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => "C:\WINDOWS\system32\rundll32.exe" C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [168464 2012-10-30] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [217088 2012-04-18] (CyberLink Corp.) HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.) HKLM-x32\...\Run: [Intel AppUp(SM) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [587288 2016-09-22] (Oracle Corporation) HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [570880 2013-12-27] (Nikon Corporation) HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-07-27] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1282120 2013-05-02] (CANON INC.) HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8912088 2016-08-26] (Piriform Ltd) HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\...\Run: [uTorrent] => C:\Users\Visek\AppData\Roaming\uTorrent\uTorrent.exe [2133504 2016-06-09] (BitTorrent Inc.) HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3044848 2016-12-07] (Electronic Arts) HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\...\Run: [Service for Navitel Navigator Update Center] => C:\Program Files (x86)\CNT\Navitel Navigator update center\NavitelUpdaterService.exe [458352 2016-08-10] () HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\WINDOWS\system32\scrnsave.scr [11776 2014-11-21] (Microsoft Corporation) AppInit_DLLs: C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [181488 2016-08-26] (NVIDIA Corporation) AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [159352 2016-08-26] (NVIDIA Corporation) ShellIconOverlayIdentifiers: [SugarSyncBackedUp] -> {0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncPending] -> {62CCD8E3-9C21-41E1-B55E-1E26DFC68511} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncRoot] -> {A759AFF6-5851-457D-A540-F4ECED148351} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.) ShellIconOverlayIdentifiers: [SugarSyncShared] -> {1574C9EF-7D58-488F-B358-8B78C1538F51} => C:\Program Files (x86)\SugarSync\SugarSyncShellExt_x64.dll [2012-05-14] (SugarSync, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CodecPackUpdateChecker.lnk [2015-01-27] ShortcutTarget: CodecPackUpdateChecker.lnk -> C:\Windows\SysWOW64\C2MP\UpdateChecker.exe () ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{01C46775-F337-421B-A9ED-4FAC2CC04C02}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Internet Explorer: ================== HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com/ HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com HKU\S-1-5-21-3229826569-2663044726-3155959205-1002\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com URLSearchHook: HKLM-x32 -> Domyślne = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D} SearchScopes: HKU\S-1-5-21-3229826569-2663044726-3155959205-1002 -> DefaultScope {2701380C-CE96-496F-9908-DB5E7754E3B9} URL = SearchScopes: HKU\S-1-5-21-3229826569-2663044726-3155959205-1002 -> {2701380C-CE96-496F-9908-DB5E7754E3B9} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_111\bin\ssv.dll [2016-10-31] (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-31] (Oracle Corporation) BHO-x32: Canon Easy-WebPrint EX BHO -> {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} -> C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll [2015-02-23] (CANON INC.) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\ssv.dll [2016-10-31] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\jp2ssv.dll [2016-10-31] (Oracle Corporation) BHO-x32: IEPluginBHO Class -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> C:\Users\Visek\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-10-28] (GG Network S.A.) Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.) Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll [2015-02-23] (CANON INC.) FireFox: ======== FF Plugin: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-31] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-31] (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll [Brak pliku] FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\WINDOWS\SysWOW64\Adobe\Director\np32dsw_1223183.dll [2015-12-22] (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-11-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-11-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\dtplugin\npDeployJava1.dll [2016-10-31] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.111.2 -> C:\Program Files (x86)\Java\jre1.8.0_111\bin\plugin2\npjp2.dll [2016-10-31] (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-10-01] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3229826569-2663044726-3155959205-1002: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Visek\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-04-27] (Unity Technologies ApS) Opera: ======= OPR Extension: (Adblock Plus) - C:\Users\Visek\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2016-11-21] ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [319376 2014-10-01] (Intel Corporation) R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-18] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-11-06] (Intel Corporation) S3 LSC.Services.SystemService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSC.Services.SystemService.exe [273232 2016-08-24] (Lenovo) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273136 2013-04-18] () R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation) R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation) S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2119688 2016-12-07] (Electronic Arts) R2 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2180624 2016-12-07] (Electronic Arts) R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2015-05-21] (DEVGURU Co., LTD.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3388144 2013-04-18] (Intel® Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R3 btmhsf; C:\WINDOWS\system32\DRIVERS\btmhsf.sys [1390904 2013-09-05] (Motorola Solutions, Inc.) R3 dtsoftbus01; C:\WINDOWS\System32\drivers\dtsoftbus01.sys [283064 2015-02-20] (Disc Soft Ltd) S3 IObitUnlocker; C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.sys [36568 2013-09-30] (IObit) R3 NETwNe64; C:\WINDOWS\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\WINDOWS\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation) R3 rtsuvc; C:\WINDOWS\system32\DRIVERS\rtsuvc.sys [8243272 2013-04-10] (Realtek Semiconductor Corp.) S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation) R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation) R2 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation) S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink) S1 MpKsl67900a41; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{C0A1880F-1CA4-4529-8C4C-1BDE0BC6D469}\MpKsl67900a41.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-12-25 20:30 - 2016-12-25 20:32 - 00020008 _____ C:\Users\Visek\Downloads\FRST.txt 2016-12-25 20:29 - 2016-12-25 20:30 - 00000000 ____D C:\FRST 2016-12-25 20:27 - 2016-12-25 20:27 - 00380928 _____ C:\Users\Visek\Downloads\j9ygsz8u.exe 2016-12-25 20:26 - 2016-12-25 20:26 - 02420736 _____ (Farbar) C:\Users\Visek\Downloads\FRST64.exe 2016-12-25 16:28 - 2016-12-25 16:28 - 00102506 _____ C:\Users\Visek\Desktop\ws36_aktualizacja_danych.pdf 2016-12-15 18:38 - 2016-12-01 15:13 - 00869576 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll 2016-12-15 18:38 - 2016-12-01 15:13 - 00678592 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp120_clr0400.dll 2016-12-15 18:38 - 2016-12-01 15:11 - 00875720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll 2016-12-15 18:38 - 2016-12-01 15:11 - 00536768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp120_clr0400.dll 2016-12-15 18:38 - 2016-10-20 14:14 - 00029888 _____ (Microsoft Corporation) C:\WINDOWS\system32\aspnet_counters.dll 2016-12-15 18:38 - 2016-10-20 14:10 - 00028352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aspnet_counters.dll 2016-12-15 09:07 - 2016-11-12 20:08 - 25759744 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-12-15 09:07 - 2016-11-12 19:53 - 06049280 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2016-12-15 09:07 - 2016-11-12 19:17 - 20302848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-12-15 09:07 - 2016-11-12 18:41 - 15257088 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-12-15 09:07 - 2016-11-12 18:21 - 13653504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-12-15 09:06 - 2016-11-19 22:24 - 00567152 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2016-12-15 09:06 - 2016-11-19 22:24 - 00152856 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcrypt.dll 2016-12-15 09:06 - 2016-11-19 20:29 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys 2016-12-15 09:06 - 2016-11-19 19:44 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2016-12-15 09:06 - 2016-11-19 18:53 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2016-12-15 09:06 - 2016-11-19 18:22 - 00111104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcrypt.dll 2016-12-15 09:06 - 2016-11-16 22:49 - 00377176 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\clfs.sys 2016-12-15 09:06 - 2016-11-12 22:06 - 00738104 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10level9.dll 2016-12-15 09:06 - 2016-11-12 20:38 - 00613632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10level9.dll 2016-12-15 09:06 - 2016-11-12 20:25 - 00576000 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll 2016-12-15 09:06 - 2016-11-12 20:07 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll 2016-12-15 09:06 - 2016-11-12 19:29 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll 2016-12-15 09:06 - 2016-11-12 19:23 - 01033216 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll 2016-12-15 09:06 - 2016-11-12 19:14 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll 2016-12-15 09:06 - 2016-11-12 19:10 - 00806912 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2016-12-15 09:06 - 2016-11-12 18:45 - 00880640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll 2016-12-15 09:06 - 2016-11-12 18:38 - 00693248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2016-12-15 09:06 - 2016-11-12 18:37 - 04608000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2016-12-15 09:06 - 2016-11-12 18:35 - 02920960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2016-12-15 09:06 - 2016-11-12 18:20 - 01543680 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2016-12-15 09:06 - 2016-11-12 18:11 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2016-12-15 09:06 - 2016-11-12 18:05 - 02444800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2016-12-15 09:06 - 2016-11-12 18:02 - 01312256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2016-12-15 09:06 - 2016-11-12 18:02 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2016-12-15 09:06 - 2016-11-11 03:33 - 01541240 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll 2016-12-15 09:06 - 2016-11-09 18:25 - 01376768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll 2016-12-15 09:06 - 2016-11-05 21:46 - 00422744 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys 2016-12-15 09:06 - 2016-11-05 19:35 - 04169216 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2016-12-15 09:06 - 2016-11-05 18:57 - 03320320 _____ (Microsoft Corporation) C:\WINDOWS\system32\msi.dll 2016-12-15 09:06 - 2016-11-05 18:11 - 03606528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msi.dll 2016-12-15 09:06 - 2016-11-05 16:56 - 02778624 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll 2016-12-15 09:06 - 2016-11-05 16:46 - 02463744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll 2016-12-15 09:06 - 2016-10-28 03:56 - 01380048 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll 2016-12-15 09:06 - 2016-10-27 15:28 - 01097728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll 2016-12-15 09:06 - 2016-10-12 22:49 - 00379224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\storport.sys 2016-12-15 09:06 - 2016-10-12 22:11 - 00922968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\refs.sys 2016-12-15 09:06 - 2016-10-11 17:45 - 00175104 _____ (Microsoft Corporation) C:\WINDOWS\system32\TpmTasks.dll 2016-12-15 09:06 - 2016-10-11 00:31 - 00990040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\http.sys 2016-12-15 09:06 - 2016-10-10 19:18 - 00069976 _____ (Microsoft Corporation) C:\WINDOWS\system32\apisetschema.dll 2016-12-15 09:06 - 2016-10-10 19:18 - 00022360 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cmimcext.sys 2016-12-15 09:06 - 2016-10-09 15:17 - 00229888 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionQueue.dll 2016-12-15 09:06 - 2016-10-09 15:08 - 00116224 _____ (Microsoft Corporation) C:\WINDOWS\system32\shsetup.dll 2016-12-15 09:06 - 2016-10-09 15:08 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shsetup.dll 2016-12-15 09:06 - 2016-10-08 23:24 - 00658432 _____ (Microsoft Corporation) C:\WINDOWS\system32\dnsapi.dll 2016-12-15 09:06 - 2016-10-08 22:31 - 00498688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dnsapi.dll 2016-12-15 09:06 - 2016-10-08 22:10 - 03547648 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll 2016-12-15 09:06 - 2016-10-05 15:01 - 01200128 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Globalization.dll 2016-12-15 09:06 - 2016-10-05 15:00 - 00868864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Globalization.dll 2016-12-15 09:06 - 2016-10-05 15:00 - 00323072 _____ (Microsoft Corporation) C:\WINDOWS\system32\GlobCollationHost.dll 2016-12-15 09:06 - 2016-10-05 14:52 - 00513456 _____ C:\WINDOWS\SysWOW64\locale.nls 2016-12-15 09:06 - 2016-10-05 14:52 - 00513456 _____ C:\WINDOWS\system32\locale.nls 2016-12-15 09:06 - 2016-10-05 05:15 - 01969944 _____ (Microsoft Corporation) C:\WINDOWS\system32\crypt32.dll 2016-12-15 09:06 - 2016-10-05 05:15 - 01613528 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\crypt32.dll 2016-12-15 09:06 - 2016-10-05 05:15 - 00324896 _____ (Microsoft Corporation) C:\WINDOWS\system32\wintrust.dll 2016-12-15 09:06 - 2016-10-05 05:15 - 00245320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wintrust.dll 2016-12-15 09:06 - 2016-09-27 21:16 - 00445873 _____ C:\WINDOWS\system32\ApnDatabase.xml 2016-12-15 09:06 - 2016-09-20 23:30 - 02462040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys 2016-12-11 22:40 - 2016-12-11 22:40 - 00000730 _____ C:\Users\Public\Desktop\Amiga SWOS.lnk 2016-12-11 22:40 - 2016-12-11 22:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SWOS United 2016-12-11 21:28 - 2016-12-11 21:28 - 00002112 _____ C:\Users\Public\Desktop\Lenovo Solution Center.lnk 2016-11-26 19:02 - 2016-12-10 22:24 - 00013312 ___SH C:\Users\Visek\Downloads\Thumbs.db ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-12-25 20:22 - 2015-03-04 18:22 - 00000000 ____D C:\ProgramData\Origin 2016-12-25 20:18 - 2015-01-27 20:48 - 00000000 ____D C:\Users\Visek\AppData\Roaming\MPC-HC 2016-12-25 20:18 - 2015-01-24 01:08 - 02978816 ___SH C:\Users\Visek\Desktop\Thumbs.db 2016-12-25 20:18 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\Inf 2016-12-25 20:17 - 2016-11-24 22:38 - 00000000 ____D C:\Users\Visek\Desktop\biz ratunkowy kopia ew zapas 2016-12-25 19:58 - 2015-04-12 00:03 - 00000000 ____D C:\Users\Visek\AppData\Roaming\Skype 2016-12-25 19:41 - 2016-11-21 19:25 - 00000000 ____D C:\Program Files\Recuva 2016-12-25 19:23 - 2014-11-21 05:46 - 01828496 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2016-12-25 19:23 - 2014-11-21 05:07 - 00808198 _____ C:\WINDOWS\system32\perfh015.dat 2016-12-25 19:23 - 2014-11-21 05:07 - 00164014 _____ C:\WINDOWS\system32\perfc015.dat 2016-12-25 17:47 - 2015-02-18 12:10 - 00003972 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{08EA6B76-5C4B-4369-9B95-DE0CCC34E021} 2016-12-24 16:09 - 2015-01-25 09:58 - 00000892 _____ C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job 2016-12-24 13:20 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-12-22 23:29 - 2015-01-26 11:24 - 00003600 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3229826569-2663044726-3155959205-1002 2016-12-22 22:36 - 2015-02-11 22:16 - 00003882 _____ C:\WINDOWS\System32\Tasks\Opera scheduled Autoupdate 1422049553 2016-12-22 22:36 - 2015-01-23 22:45 - 00001074 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2016-12-22 22:36 - 2015-01-23 22:41 - 00000000 ____D C:\Program Files (x86)\Opera 2016-12-16 18:44 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-12-16 09:30 - 2015-03-15 22:27 - 00000212 _____ C:\WINDOWS\Tasks\AutoKMS.job 2016-12-16 09:29 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-12-16 09:29 - 2013-08-22 15:44 - 00482152 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-12-15 23:45 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2016-12-15 23:42 - 2013-08-22 14:36 - 00000000 ____D C:\WINDOWS\system32\oobe 2016-12-15 19:18 - 2015-01-24 00:13 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-12-15 19:13 - 2015-01-24 00:12 - 135632432 ____C (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-12-12 00:00 - 2016-11-23 10:49 - 00835576 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-12-12 00:00 - 2016-11-23 10:49 - 00177656 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2016-12-11 22:39 - 2016-11-13 18:08 - 00000000 ____D C:\Games 2016-12-11 21:28 - 2013-11-21 00:14 - 00000000 ____D C:\WINDOWS\System32\Tasks\Lenovo 2016-12-11 21:28 - 2013-11-21 00:14 - 00000000 ____D C:\Program Files\Lenovo 2016-12-11 21:28 - 2013-11-21 00:13 - 00000000 ____D C:\Program Files (x86)\Lenovo 2016-12-11 21:25 - 2013-11-21 00:14 - 00000000 ____D C:\WINDOWS\Downloaded Installations 2016-12-11 19:29 - 2015-12-27 14:37 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2016-12-07 18:33 - 2015-03-04 18:22 - 00000000 ____D C:\Program Files (x86)\Origin 2016-11-26 18:29 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-11-01 21:25 - 2015-11-01 21:25 - 0000268 ___RH () C:\Users\Visek\AppData\Roaming\Sync Schema 2015-11-01 21:26 - 2015-11-01 21:26 - 0000268 ___RH () C:\Users\Visek\AppData\Roaming\Sync Services 2015-11-01 21:25 - 2015-11-01 21:25 - 0000268 ___RH () C:\Users\Visek\AppData\Roaming\Synth Basics 2015-11-01 21:23 - 2015-11-01 21:23 - 0000268 ___RH () C:\Users\Visek\AppData\Roaming\Track Settings 2015-05-15 17:31 - 2015-05-15 17:31 - 0007602 _____ () C:\Users\Visek\AppData\Local\Resmon.ResmonCfg 2013-11-20 23:52 - 2013-11-20 23:52 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2015-11-01 21:23 - 2015-11-01 21:23 - 0000012 ___RH () C:\ProgramData\manual 2015-11-01 21:23 - 2015-11-01 21:23 - 0000020 ____H () C:\ProgramData\PKP_DLeo.DAT 2015-11-01 21:26 - 2015-11-01 21:26 - 0000020 ____H () C:\ProgramData\PKP_DLes.DAT 2015-11-01 21:25 - 2016-10-01 15:49 - 0000020 ____H () C:\ProgramData\PKP_DLet.DAT 2015-11-01 21:25 - 2015-11-01 21:25 - 0000020 ____H () C:\ProgramData\PKP_DLev.DAT 2015-11-01 21:25 - 2015-11-01 21:25 - 0000268 ___RH () C:\ProgramData\Synth Pads 2015-11-01 21:26 - 2015-11-01 21:26 - 0000268 ___RH () C:\ProgramData\Synth Textures 2015-11-01 21:25 - 2015-11-01 21:25 - 0000268 ___RH () C:\ProgramData\System Image Utility 2015-11-01 21:23 - 2015-11-01 21:25 - 0000012 ___RH () C:\ProgramData\Tremolo 2015-11-01 21:26 - 2015-11-01 21:26 - 0000012 ___RH () C:\ProgramData\Trumpet Section 2015-11-01 21:25 - 2015-11-01 21:25 - 0000012 ___RH () C:\ProgramData\URLs ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-12-25 12:38 ==================== Koniec FRST.txt ============================