Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 27-02-2017 01 Uruchomiony przez SonekXT (administrator) SONEK (28-02-2017 23:16:49) Uruchomiony z D:\Muzyka\Luty 17 Załadowane profile: SonekXT (Dostępne profile: SonekXT & Gość) Platform: Windows 8.1 (Update) (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Hanwang Technology Co.,Ltd. ) C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe (ASUS Cloud Corporation) C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Video DSP\DriverMFTService.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (Intel Corporation) C:\Windows\System32\igfxEM.exe (Intel Corporation) C:\Windows\System32\igfxHK.exe () C:\Windows\System32\igfxTray.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Disc Soft Ltd) D:\Programy\DAEMON Tools Pro\DTShellHlp.exe (Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Piotr Pawlowski) D:\Programy\foobar2000\foobar2000.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.) HKLM-x32\...\Run: [WebStorage] => C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\ASUSWSLoader.exe [63296 2014-08-20] () HKLM-x32\...\Run: [vmware-tray.exe] => D:\Programy\VmWare\vmware-tray.exe [104128 2015-08-14] (VMware, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [596528 2015-12-22] (Oracle Corporation) HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Run: [Steam] => D:\Steam\steam.exe [2881824 2017-01-19] (Valve Corporation) HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8461224 2015-09-16] (Piriform Ltd) HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Run: [ScreenShooter] => D:\Programy\ScreenShooter5\ScreenShooter5.exe [967680 2015-09-18] () HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Run: [DAEMON Tools Pro Agent] => D:\Programy\DAEMON Tools Pro\DTAgent.exe [4807952 2015-02-27] (Disc Soft Ltd) HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Run: [AceStream] => C:\Users\SonekXT\AppData\Roaming\ACEStream\engine\ace_engine.exe [27000 2015-12-18] () HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [132608 2014-10-29] (Microsoft Corporation) ShellIconOverlayIdentifiers: [!AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7191} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: [!AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D809} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: [!AsusWSShellExt_U] -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4E} => C:\Program Files (x86)\Common Files\AWS\2.1.11.399\ASUSWSShellExt64.dll [2013-06-26] (ASUS Cloud Corporation.) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{0199C4A5-5E33-4584-B638-23467EBC03E9}: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{EF1D4202-CC1D-4879-95EC-70B17C8721CB}: [DhcpNameServer] 8.8.8.8 8.8.4.4 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130885147582697900&GUID=F8DBF183-75C4-436F-B9FD-D4A4BD86B4DF HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130885147582701342&GUID=F8DBF183-75C4-436F-B9FD-D4A4BD86B4DF HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1 SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1 SearchScopes: HKU\S-1-5-21-1008228202-3920569872-3301867926-1001 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2014-01-23] (Microsoft Corporation) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll [2015-02-10] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\ssv.dll [2016-01-25] (Oracle Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2014-01-21] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\jp2ssv.dll [2016-01-25] (Oracle Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-02-17] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: hgoqat2d.default FF ProfilePath: C:\Users\SonekXT\AppData\Roaming\Mozilla\Firefox\Profiles\hgoqat2d.default [2017-02-28] FF Homepage: Mozilla\Firefox\Profiles\hgoqat2d.default -> hxxp://www.google.pl/ FF Extension: (Firefox Hotfix) - C:\Users\SonekXT\AppData\Roaming\Mozilla\Firefox\Profiles\hgoqat2d.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-08-30] FF Extension: (Adblock Plus) - C:\Users\SonekXT\AppData\Roaming\Mozilla\Firefox\Profiles\hgoqat2d.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23] FF Extension: (SHA-1 deprecation staged rollout) - C:\Users\SonekXT\AppData\Roaming\Mozilla\Firefox\Profiles\hgoqat2d.default\features\{383ccb12-fac5-43c4-b95f-b1ce2dcf100c}\disableSHA1rollout@mozilla.org.xpi [2017-02-25] FF HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\...\Firefox\Extensions: [acewebextension_unlisted@acestream.org] - C:\Users\SonekXT\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi FF Extension: (Ace Stream Web Extension) - C:\Users\SonekXT\AppData\Roaming\ACEStream\extensions\awe\firefox\acewebextension_unlisted.xpi [2017-01-31] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-23] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-23] () FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [Brak pliku] FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-09-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-09-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\dtplugin\npDeployJava1.dll [2016-01-25] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.71.2 -> C:\Program Files (x86)\Java\jre1.8.0_71\bin\plugin2\npjp2.dll [2016-01-25] (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 -> C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2014-01-21] (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-21] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.32.7\npGoogleUpdate3.dll [2016-12-18] (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1008228202-3920569872-3301867926-1001: @acestream.net/acestreamplugin,version=3.1.2 -> C:\Users\SonekXT\AppData\Roaming\ACEStream\player\npace_plugin.dll [2017-01-31] (Innovative Digital Technologies) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [2014-01-21] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2016-12-23] (Adobe Systems Inc.) Chrome: ======= CHR Profile: C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default [2017-02-15] CHR Extension: (Prezentacje Google) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-21] CHR Extension: (Dokumenty Google) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-21] CHR Extension: (Dysk Google) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-21] CHR Extension: (YouTube) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-21] CHR Extension: (Google Search) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-21] CHR Extension: (Arkusze Google) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-21] CHR Extension: (Dokumenty Google offline) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-21] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-21] CHR Extension: (Gmail) - C:\Users\SonekXT\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-21] CHR HKU\S-1-5-21-1008228202-3920569872-3301867926-1001\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [mjbepbhonbojpoaenhckjocchgfiaofo] - hxxps://clients2.google.com/service/update2/crx ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 ASUS FaceID Service; C:\Program Files\ASUS\ASUS FaceID\HWFaceKeyService.exe [261648 2013-10-24] (Hanwang Technology Co.,Ltd. ) R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage\2.1.11.399\AsusWSWinService.exe [71168 2014-08-20] (ASUS Cloud Corporation) [Brak podpisu cyfrowego] S4 Disc Soft Pro Bus Service; D:\Programy\DAEMON Tools Pro\DiscSoftBusService.exe [1291024 2015-02-27] (Disc Soft Ltd) R2 DriverMFTService; C:\Program Files (x86)\Asus\ASUS Video DSP\DriverMFTService.exe [9728 2014-10-29] (ASUSTek Computer Inc.) [Brak podpisu cyfrowego] S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-20] (Microsoft Corporation) [Brak podpisu cyfrowego] S4 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent) S4 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [124520 2014-10-21] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344976 2014-12-15] (Intel Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation) R2 IpOverUsbSvc; C:\Program Files (x86)\Common Files\Microsoft Shared\Phone Tools\CoreCon\11.0\bin\IpOverUsbSvc.exe [22744 2015-02-05] (Microsoft Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-09-03] (Intel Corporation) S4 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] () S4 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [455616 2016-09-30] (NVIDIA Corporation) S4 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [455616 2016-09-30] (NVIDIA Corporation) S4 NVIDIA Wireless Controller Service; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\nvwirelesscontroller.exe [1163712 2016-09-30] (NVIDIA Corporation) S4 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2017-01-24] (Electronic Arts) S4 Origin Web Helper Service; C:\Program Files (x86)\Origin\OriginWebHelperService.exe [2184208 2017-01-24] (Electronic Arts) S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [Brak podpisu cyfrowego] S2 VMAuthdService; D:\Programy\VmWare\vmware-authd.exe [89792 2015-08-14] (VMware, Inc.) S2 VMwareHostd; D:\Programy\VmWare\vmware-hostd.exe [12465344 2015-08-14] () S3 VsEtwService120; C:\Program Files\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [73512 2014-11-21] (ASUS Corporation) R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.) R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-17] (Motorola Solutions, Inc.) S3 CH341SER_A64; C:\Windows\System32\Drivers\CH341S64.SYS [58368 2011-11-04] (www.winchiphead.com) R3 dtproscsibus; C:\Windows\System32\drivers\dtproscsibus.sys [30352 2015-10-05] (Disc Soft Ltd) R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [225008 2014-10-21] (Intel Corporation) R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [79528 2014-10-16] (Intel Corporation) R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [17280 2012-08-06] ( ) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [126976 2014-09-03] (Intel Corporation) R1 mirrorv3; C:\Windows\system32\DRIVERS\rminiv3.sys [5632 2012-12-18] (Famatech International Corp.) R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3482600 2014-11-17] (Intel Corporation) S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [4649440 2013-06-18] (Intel Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2016-09-30] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [46016 2016-09-17] (NVIDIA Corporation) S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13536 2015-05-25] () R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [508120 2014-08-15] (Realsil Semiconductor Corporation) R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-10-05] (Duplex Secure Ltd.) R0 vsock; C:\Windows\System32\drivers\vsock.sys [75512 2015-08-04] (VMware, Inc.) R2 vstor2-mntapi20-shared; C:\Windows\SysWow64\drivers\vstor2-mntapi20-shared.sys [34520 2015-07-09] (VMware, Inc.) S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation) R3 WUDFWpdComp; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation) U0 msahci; system32\drivers\msahci.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-28 23:15 - 2017-02-28 23:16 - 00000000 ____D C:\FRST 2017-02-26 21:29 - 2017-02-26 21:29 - 09572850 _____ C:\Users\SonekXT\Desktop\Alpha Software (AL-PCS-WIN) 2.70.rar 2017-02-26 20:02 - 2017-02-26 20:04 - 133211075 _____ C:\Users\SonekXT\Desktop\DBPolskaSubs - DBS80 HD.mp4 2017-02-17 14:57 - 2017-02-28 23:05 - 02508462 _____ C:\Users\SonekXT\Desktop\Grafik pracy UTR.xlsm 2017-02-16 15:22 - 2017-02-16 15:22 - 00046179 _____ C:\Users\SonekXT\Desktop\z_air4sem1st.pdf ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-02-28 23:00 - 2015-09-28 16:40 - 00000000 ____D C:\Users\SonekXT\AppData\Local\Packages 2017-02-28 22:42 - 2016-11-16 10:30 - 00000000 ____D C:\Users\SonekXT\AppData\LocalLow\Mozilla 2017-02-28 22:42 - 2015-09-29 19:04 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\foobar2000 2017-02-28 12:30 - 2016-01-08 19:06 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2017-02-28 01:10 - 2015-10-01 17:55 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\TS3Client 2017-02-26 21:47 - 2015-11-30 11:26 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\VMware 2017-02-26 21:47 - 2015-11-30 11:26 - 00000000 ____D C:\Users\SonekXT\AppData\Local\VMware 2017-02-26 20:11 - 2015-10-05 11:31 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2017-02-25 18:15 - 2015-09-29 20:16 - 00000000 ____D C:\Windows\system32\MRT 2017-02-25 18:14 - 2016-05-03 15:43 - 00000000 ____D C:\Program Files\KMSpico 2017-02-24 20:57 - 2013-08-22 16:20 - 00000000 ____D C:\Windows\CbsTemp 2017-02-24 20:55 - 2015-09-29 20:16 - 138020592 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe 2017-02-24 13:42 - 2013-08-22 14:36 - 00000000 ____D C:\Windows\Inf 2017-02-23 21:09 - 2015-12-09 12:58 - 00000000 ____D C:\ProgramData\Origin 2017-02-23 21:09 - 2015-09-29 17:28 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\Origin 2017-02-23 14:37 - 2015-09-28 16:46 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1008228202-3920569872-3301867926-1001 2017-02-23 13:59 - 2015-10-04 20:23 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2017-02-23 13:59 - 2015-10-04 20:23 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2017-02-23 11:10 - 2015-09-28 18:01 - 00000000 ____D C:\Users\SonekXT\AppData\Local\Adobe 2017-02-23 11:09 - 2016-01-08 19:06 - 00003818 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-02-23 11:09 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-02-23 11:09 - 2013-08-22 16:36 - 00000000 ____D C:\Windows\system32\Macromed 2017-02-19 09:48 - 2014-10-21 12:14 - 00848420 _____ C:\Windows\system32\perfh015.dat 2017-02-19 09:48 - 2014-10-21 12:14 - 00183386 _____ C:\Windows\system32\perfc015.dat 2017-02-19 09:48 - 2014-03-18 16:26 - 01941448 _____ C:\Windows\system32\PerfStringBackup.INI 2017-02-17 18:48 - 2016-04-02 19:58 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\.ACEStream 2017-02-16 21:15 - 2017-01-26 21:27 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\Audacity 2017-02-16 21:14 - 2015-02-15 11:03 - 00421888 _____ C:\Users\SonekXT\Desktop\lame_enc.dll 2017-02-16 18:18 - 2015-09-28 21:39 - 00000000 ____D C:\Users\SonekXT\AppData\Local\Steam 2017-02-15 16:18 - 2013-08-22 15:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-02-15 16:01 - 2013-08-22 14:25 - 00262144 ___SH C:\Windows\system32\config\BBI 2017-02-14 15:52 - 2015-04-07 21:24 - 00000000 ____D C:\ProgramData\NVIDIA 2017-02-13 15:24 - 2015-09-29 20:49 - 00000000 ____D C:\Users\SonekXT\Desktop\Dokumenty 2017-02-11 21:26 - 2015-09-29 17:28 - 00000000 ____D C:\Users\SonekXT\AppData\Local\Origin 2017-02-07 23:22 - 2015-09-28 21:44 - 00000000 ____D C:\Program Files (x86)\Origin 2017-02-07 11:22 - 2015-11-30 00:00 - 00000000 ____D C:\ProgramData\VMware 2017-02-07 09:34 - 2016-09-08 16:04 - 00005084 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Sonek-SonekXT Sonek 2017-02-06 23:04 - 2016-09-29 15:08 - 00000000 ____D C:\Users\SonekXT\Documents\FIFA 17 2017-02-06 22:52 - 2015-11-21 17:48 - 00002223 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-02-06 20:41 - 2016-12-18 20:02 - 00835576 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-02-06 20:41 - 2016-12-18 20:02 - 00177656 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-01-30 20:28 - 2016-11-16 08:38 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-01-30 20:28 - 2015-09-28 17:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-01-30 20:05 - 2016-10-05 22:04 - 00000000 ____D C:\Users\SonekXT\AppData\Local\CrashDumps 2017-01-30 20:05 - 2015-11-06 20:45 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\uTorrent 2017-01-30 20:05 - 2015-10-05 11:01 - 00000000 ____D C:\Users\SonekXT\AppData\Roaming\DAEMON Tools Pro ==================== Pliki w katalogu głównym wybranych folderów ======= 2015-09-28 16:41 - 2016-11-10 19:45 - 0000165 _____ () C:\Users\SonekXT\AppData\Roaming\sp_data.sys 2015-04-07 21:27 - 2015-04-07 21:27 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2016-03-02 20:03 - 2016-03-18 16:09 - 0009216 _____ () C:\ProgramData\ppe_fleetdb.vdb 2014-10-21 05:28 - 2012-09-07 12:37 - 0000103 _____ () C:\ProgramData\SetStretch.VBS ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-11-09 19:54 ==================== Koniec FRST.txt ============================