Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 18-06-2017 01 Uruchomiony przez Krzysztof (administrator) KRZYSZTOF-PC (19-06-2017 12:53:32) Uruchomiony z D:\Pobrane Załadowane profile: Krzysztof (Dostępne profile: Krzysztof) Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe (Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (MSI) C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe (Valve Corporation) D:\Program Files\Steam\Steam.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe (GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema 2\Sound Blaster Cinema 2\SBCinema2.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (MSI) C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvsphelper64.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA GeForce Experience\NVIDIA Share.exe (Node.js) C:\Program Files (x86)\NVIDIA Corporation\NvNode\NVIDIA Web Helper.exe (Valve Corporation) D:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe (Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe (Disc Soft Ltd) D:\Program Files\Programy\Daemon\DAEMON Tools Lite\DiscSoftBusService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe (Microsoft Corporation) D:\Program Files\Programy\Microsoft Office\Office15\MSOSYNC.EXE (Valve Corporation) D:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe (Valve Corporation) D:\Program Files\Steam\bin\cef\cef.win7\steamwebhelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Antivirus\AVGUI.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (EFD Software) D:\Program Files\Programy\HD Tune\HDTune.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7575256 2014-05-12] (Realtek Semiconductor) HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64 HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [239592 2017-05-31] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [AVGUI.exe] => C:\Program Files (x86)\AVG\Antivirus\AvLaunch.exe [263232 2017-05-23] (AVG Technologies CZ, s.r.o.) HKLM-x32\...\Run: [Sound Blaster Cinema 2] => C:\Program Files (x86)\Creative\Sound Blaster Cinema 2\Sound Blaster Cinema 2\SBCinema2.exe [1440768 2014-02-24] (Creative Technology Ltd) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-03-06] (Intel Corporation) HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1047536 2014-04-08] (MSI) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation) HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\Run: [Power2GoExpress8] => NA HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\Run: [Steam] => D:\Program Files\Steam\steam.exe [3042592 2017-06-08] (Valve Corporation) HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\Run: [DAEMON Tools Lite Automount] => D:\Program Files\Programy\Daemon\DAEMON Tools Lite\DTAgent.exe [4471536 2015-05-21] (Disc Soft Ltd) HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\Run: [YxhdPack] => regsvr32.exe C:\Users\Krzysztof\AppData\Local\YxhdPack\MetaPathText.dll <===== UWAGA HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\Run: [Ubwpmedia] => C:\Windows\SysWOW64\regsvr32.exe C:\Users\Krzysztof\AppData\Local\Andfworks\IcuCcNetwork.dll <===== UWAGA HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: F - F:\ HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: G - G:\h3_setup.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: H - H:\Autorun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {149b38c0-9e83-11e6-9fd2-448a5bcdaa98} - I:\autorun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {18b0ab9e-3b97-11e5-bcb3-448a5bcdaa98} - G:\autorun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {18b0ac6d-3b97-11e5-bcb3-448a5bcdaa98} - I:\autorun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {38fffd05-031a-11e5-9784-448a5bcdaa98} - H:\setup.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {6525c0fe-10eb-11e5-9bad-448a5bcdaa98} - F:\autorun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {ce6d094c-11ab-11e5-926c-448a5bcdaa98} - J:\LGAutoRun.exe HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\...\MountPoints2: {f8ebe3c6-17ce-11e7-9ba1-448a5bcdaa98} - F:\autorun.exe ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku ShellIconOverlayIdentifiers: [00avg] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku ShellIconOverlayIdentifiers: [0PerformanceMonitor] -> {3B5B973C-92A4-4855-9D3F-0F3D23332208} => -> Brak pliku Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2015-05-25] ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt Tcpip\Parameters: [DhcpNameServer] 31.11.202.254 37.8.214.2 Tcpip\..\Interfaces\{7015D565-FBFC-43B0-9B48-9A128CF0AD7C}: [DhcpNameServer] 31.11.202.254 37.8.214.2 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp HKU\S-1-5-21-2931802536-4269123018-3022612060-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://friendly-google-search.blogspot.com SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> D:\Program Files\Programy\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-05-25] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2012-10-01] (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2012-10-01] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-25] (Oracle Corporation) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - D:\Program Files\Programy\Microsoft Office\Office15\MSOSB.DLL [2012-10-01] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: qus0nbzj.default FF ProfilePath: C:\Users\Krzysztof\AppData\Roaming\Mozilla\Firefox\Profiles\qus0nbzj.default [2017-06-19] FF Extension: (Adblock Plus) - C:\Users\Krzysztof\AppData\Roaming\Mozilla\Firefox\Profiles\qus0nbzj.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-06-14] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_131.dll [2017-06-17] () FF Plugin: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll [2015-04-23] (EA Digital Illusions CE AB) FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @microsoft.com/SharePoint,version=14.0 -> D:\PROGRA~2\Programy\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-17] () FF Plugin-x32: @esn/npbattlelog,version=2.7.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll [2015-04-23] (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-04-03] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-04-03] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-25] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-25] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2012-10-01] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-12-11] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-12-11] (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-30] (Google Inc.) FF Plugin-x32: Adobe Reader -> D:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2017-03-28] (Adobe Systems Inc.) Chrome: ======= CHR HomePage: Default -> hxxps://www.youtube.com/watch?v=GZc3EsElqeA CHR StartupUrls: Default -> "hxxps://www.facebook.com/","hxxp://smoki.nightwood.net/","hxxps://ombre.pl/product-pol-1235-SWETER-E75-CZARNY.html","hxxps://ombre.pl/product-pol-3854-T-SHIRT-S723-CZARNY.html","hxxps://ombre.pl/product-pol-53-T-SHIRT-S370-BIALA.html","hxxps://ombre.pl/product-pol-1356-POLO-S539-CZARNA.html","hxxps://ombre.pl/product-pol-274-BLUZA-CAMILO-CZARNA.html","hxxps://ombre.pl/product-pol-1720-Spodnie-P306-CZARNE.html","hxxps://ozonee.pl/product-pol-11889-STREET-STAR-7108-SPODENKI-MESKIE-CZARNE.html","hxxps://ozonee.pl/product-pol-6204-ATHLETIC-9042-T-SHIRT-MESKI-CZARNY.html","hxxps://ozonee.pl/product-pol-6205-ATHLETIC-9042-T-SHIRT-MESKI-BIALY.html","hxxps://www.youtube.com/feed/subscriptions","hxxps://tipanddonation.com/profile/dashboard" CHR Profile: C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default [2017-06-19] CHR Extension: (Prezentacje Google) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-12-04] CHR Extension: (Dysk Google) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-04] CHR Extension: (YouTube) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-04] CHR Extension: (Arkusze Google) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-12-04] CHR Extension: (Dokumenty Google offline) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-04] CHR Extension: (AdBlock) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-06-16] CHR Extension: (TwitchAlerts Stream Labels) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\kgmggmdngboajiakmbpdknfpdelbjbcg [2017-04-21] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09] CHR Extension: (Gmail) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-04] CHR Extension: (Chrome Media Router) - C:\Users\Krzysztof\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-12] ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R2 AVG Antivirus; C:\Program Files (x86)\AVG\Antivirus\AVGSvc.exe [264432 2017-05-23] (AVG Technologies CZ, s.r.o.) R3 avgbIDSAgent; C:\Program Files (x86)\AVG\Antivirus\x64\aswidsagenta.exe [7396872 2017-05-23] (AVG Technologies CZ, s.r.o.) R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1428656 2017-05-31] (AVG Technologies CZ, s.r.o.) R3 Disc Soft Lite Bus Service; D:\Program Files\Programy\Daemon\DAEMON Tools Lite\DiscSoftBusService.exe [1272560 2015-05-21] (Disc Soft Ltd) S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [409128 2017-03-01] (EasyAntiCheat Ltd) S3 GalaxyClientService; D:\Program Files\GalaxyClient\GalaxyClientService.exe [513088 2017-06-07] (GOG.com) S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [8077376 2017-06-07] (GOG.com) U2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-05-12] (Hi-Rez Studios) [Brak podpisu cyfrowego] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [Brak podpisu cyfrowego] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-04-03] (Intel Corporation) R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [162800 2014-03-17] (MSI) R2 NvContainerLocalSystem; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) S3 NvContainerNetworkService; C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe [462784 2017-02-23] (NVIDIA Corporation) R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [459832 2016-12-11] (NVIDIA Corporation) R2 NvTelemetryContainer; C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe [425408 2017-02-23] (NVIDIA Corporation) S3 Origin Client Service; D:\Program Files\Origin\OriginClientService.exe [2124296 2017-03-10] (Electronic Arts) S2 Origin Web Helper Service; D:\Program Files\Origin\OriginWebHelperService.exe [2185232 2017-03-10] (Electronic Arts) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2015-05-30] () R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [344576 2014-04-17] (Qualcomm Atheros) [Brak podpisu cyfrowego] R2 UserAccess7; C:\Windows\SysWOW64\UAService7.exe [135168 2016-09-13] (Sony DADC Austria AG.) [Brak podpisu cyfrowego] S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 DigitalWave.Update.Service; "C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe" [X] ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 avgbdisk; C:\Windows\system32\drivers\avgbdiska.sys [166624 2017-05-23] (AVG Technologies CZ, s.r.o.) R1 avgbidsdriver; C:\Windows\system32\drivers\avgbidsdrivera.sys [314128 2017-05-23] (AVG Technologies CZ, s.r.o.) R0 avgbidsh; C:\Windows\system32\drivers\avgbidsha.sys [192584 2017-05-23] (AVG Technologies CZ, s.r.o.) R0 avgblog; C:\Windows\system32\drivers\avgbloga.sys [336896 2017-05-23] (AVG Technologies CZ, s.r.o.) R0 avgbuniv; C:\Windows\system32\drivers\avgbuniva.sys [51336 2017-05-23] (AVG Technologies CZ, s.r.o.) S3 avgHwid; C:\Windows\system32\drivers\avgHwid.sys [39424 2017-05-23] (AVG Technologies CZ, s.r.o.) R2 avgMonFlt; C:\Windows\system32\drivers\avgMonFlt.sys [129776 2017-05-23] (AVG Technologies CZ, s.r.o.) R1 avgRdr; C:\Windows\system32\drivers\avgRdr2.sys [102280 2017-05-23] (AVG Technologies CZ, s.r.o.) R0 avgRvrt; C:\Windows\system32\drivers\avgRvrt.sys [76832 2017-05-23] (AVG Technologies CZ, s.r.o.) R1 avgSnx; C:\Windows\system32\drivers\avgSnx.sys [1008288 2017-05-23] (AVG Technologies CZ, s.r.o.) R1 avgSP; C:\Windows\system32\drivers\avgSP.sys [570320 2017-05-23] (AVG Technologies CZ, s.r.o.) R2 avgStm; C:\Windows\system32\drivers\avgStm.sys [160008 2017-05-23] (AVG Technologies CZ, s.r.o.) R0 avgVmm; C:\Windows\system32\drivers\avgVmm.sys [340824 2017-05-23] (AVG Technologies CZ, s.r.o.) R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [82096 2014-04-10] (Qualcomm Atheros, Inc.) R1 CLVirtualDrive; C:\Windows\System32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink) R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2015-05-26] (Disc Soft Ltd) R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-11] () R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [129200 2014-03-27] (Qualcomm Atheros, Inc.) S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-12-16] (Malwarebytes) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-04-03] (Intel Corporation) R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [27584 2017-02-23] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [46016 2017-01-06] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [57792 2017-01-20] (NVIDIA Corporation) R2 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [163644 2016-06-29] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Brak podpisu cyfrowego] U5 UnlockerDriver5; D:\Program Files\Programy\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () U0 aswVmm; Brak ImagePath S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X] S3 MSICDSetup; \??\E:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-19 12:53 - 2017-06-19 12:53 - 00000000 ____D C:\FRST 2017-06-18 23:52 - 2017-06-18 23:57 - 159071489 _____ C:\Users\Krzysztof\Desktop\a (07).mp4 2017-06-18 23:51 - 2017-06-18 23:51 - 19166132 _____ C:\Users\Krzysztof\Desktop\a (06).mp4 2017-06-18 21:21 - 2017-06-18 23:49 - 4082294240 _____ C:\Users\Krzysztof\Desktop\a (05).mp4 2017-06-18 21:16 - 2017-06-18 21:20 - 85983232 _____ C:\Users\Krzysztof\Desktop\a (04).mp4 2017-06-18 14:40 - 2017-06-18 15:09 - 795438382 _____ C:\Users\Krzysztof\Desktop\a (03).mp4 2017-06-18 14:39 - 2017-06-18 14:40 - 11492989 _____ C:\Users\Krzysztof\Desktop\a (02).mp4 2017-06-18 14:39 - 2017-06-18 14:39 - 00777278 _____ C:\Users\Krzysztof\Desktop\a (01).mp4 2017-06-18 14:15 - 2017-06-18 14:39 - 656808500 _____ C:\Users\Krzysztof\Desktop\a.mp4 2017-06-16 13:27 - 2017-06-18 13:24 - 00000875 _____ C:\Users\Krzysztof\Desktop\HD Tune.lnk 2017-06-15 15:30 - 2017-06-18 00:59 - 00000199 _____ C:\Users\Krzysztof\Desktop\internety.txt 2017-06-12 23:11 - 2017-06-13 14:20 - 00001063 _____ C:\Users\Public\Desktop\Heores of Might and Magic 3.lnk 2017-06-08 15:15 - 2017-06-18 23:59 - 00000000 ____D C:\Users\Krzysztof\AppData\LocalLow\Mozilla 2017-06-08 15:12 - 2017-06-08 15:12 - 00001163 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2017-06-08 15:12 - 2017-06-08 15:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2017-06-08 15:12 - 2017-06-08 15:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2017-05-23 19:17 - 2017-05-23 19:17 - 00401584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\avgBoot.exe ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-19 12:40 - 2009-07-14 06:45 - 00028320 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-06-19 12:40 - 2009-07-14 06:45 - 00028320 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-06-19 12:39 - 2015-06-17 20:35 - 00000000 ____D C:\Users\Krzysztof\AppData\Local\CrashDumps 2017-06-19 12:39 - 2015-05-26 22:10 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\PhotoScape 2017-06-19 12:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2017-06-19 12:31 - 2011-02-04 19:20 - 00743744 _____ C:\Windows\system32\perfh015.dat 2017-06-19 12:31 - 2011-02-04 19:20 - 00157344 _____ C:\Windows\system32\perfc015.dat 2017-06-19 12:31 - 2009-07-14 07:13 - 01679416 _____ C:\Windows\system32\PerfStringBackup.INI 2017-06-19 12:29 - 2015-05-25 15:49 - 00003998 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5A1D3C41-A9EF-4B9D-B332-EF9D39AB92F1} 2017-06-19 12:26 - 2017-03-04 15:58 - 00005110 _____ C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Krzysztof-PC-Krzysztof Krzysztof-PC 2017-06-19 12:25 - 2015-05-25 15:38 - 00000000 ____D C:\ProgramData\NVIDIA 2017-06-19 12:24 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-06-18 23:52 - 2016-05-16 19:07 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\OBS 2017-06-18 23:44 - 2015-11-26 13:28 - 00000000 ____D C:\Program Files (x86)\Battle.net 2017-06-18 23:44 - 2015-05-25 22:59 - 00000000 ____D C:\Users\Krzysztof\AppData\Local\Battle.net 2017-06-18 13:53 - 2017-03-04 15:24 - 00003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task 2017-06-17 13:12 - 2015-05-25 16:02 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2017-06-17 13:12 - 2015-05-25 16:02 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2017-06-17 13:12 - 2015-05-25 16:02 - 00004412 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2017-06-17 13:12 - 2015-05-25 16:02 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2017-06-17 13:12 - 2015-05-25 16:02 - 00000000 ____D C:\Windows\system32\Macromed 2017-06-16 13:27 - 2017-02-03 19:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HD Tune 2017-06-14 17:57 - 2015-05-25 23:23 - 00000000 ___RD C:\Users\Krzysztof\Desktop\programy 2017-06-14 17:08 - 2017-04-21 21:37 - 00002431 _____ C:\Users\Krzysztof\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StreamLabels.lnk 2017-06-12 23:12 - 2015-10-26 17:58 - 00000000 ___RD C:\Users\Krzysztof\Desktop\gry 2017-06-12 23:11 - 2015-07-06 12:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HoMM3 HD 2017-06-11 23:04 - 2015-06-07 00:25 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\.minecraft 2017-06-11 16:20 - 2015-06-14 17:58 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\Audacity 2017-06-09 13:05 - 2015-06-15 11:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com 2017-06-08 22:26 - 2017-05-13 02:28 - 00001139 _____ C:\Users\Public\Desktop\Gwent.lnk 2017-06-07 16:28 - 2017-04-22 10:53 - 00000000 ____D C:\Users\Krzysztof\AppData\Local\streamtip-alerter 2017-06-06 18:28 - 2017-04-21 21:37 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\streamlabels 2017-05-29 16:55 - 2017-03-04 15:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2017-05-26 12:51 - 2015-06-14 16:15 - 00000000 ____D C:\Users\Krzysztof\AppData\Roaming\uTorrent 2017-05-26 12:50 - 2015-12-29 21:30 - 00000000 ____D C:\Windows\Minidump 2017-05-23 19:17 - 2017-03-04 15:25 - 01008288 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSnx.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00570320 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgSP.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00340824 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgVmm.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00336896 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbloga.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00314128 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsdrivera.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00192584 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbidsha.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00166624 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbdiska.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00160008 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgstm.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00159496 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgstm.sys.149555986464901 2017-05-23 19:17 - 2017-03-04 15:25 - 00129776 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgMonFlt.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00102280 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgRdr2.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00076832 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgRvrt.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00051336 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgbuniva.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00039424 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgHwid.sys 2017-05-23 19:17 - 2017-03-04 15:25 - 00003920 _____ C:\Windows\System32\Tasks\Antivirus Emergency Update ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-06-14 18:42 ==================== Koniec FRST.txt ============================