Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 26-04-2017
Uruchomiony przez user (administrator)  USER-KOMPUTER (26-04-2017 23:03:08)
Uruchomiony z D:\[FileTracker.pl]Pitbull. Nowe porządki HQAC3[wilu75]
Załadowane profile: user (Dostępne profile: user & Tebe)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Users\user\Desktop\ATI.ACE\Fuel\Fuel.Service.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(Visicom Media Inc.) C:\ProgramData\ManyCam\Service\ManyCamService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe
(Mega Limited) C:\Users\user\AppData\Local\MEGAsync\MEGAsync.exe
(Twitch Interactive, Inc.) C:\Users\user\AppData\Roaming\Curse Client\Bin\Electron\TwitchUI.exe
(IObit) D:\Program Files (x86)\IObit\Game Booster 3\gbtray.exe
(Valve Corporation) D:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13307496 2011-10-17] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2692520 2009-05-14] (ESET)
HKLM-x32\...\Run: [AMD AVT] => Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [Discord] => C:\ProgramData\SquirrelMachineInstalls\Discord.exe [52553728 2017-03-20] (Hammer & Chisel, Inc.)
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Run: [DAEMON Tools Lite] => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Run: [Overwolf] => C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Run: [Skype] => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /regrun
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [3019552 2017-04-21] (Valve Corporation)
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Run: [World of Tanks] => "D:\Games\World_of_Tanks\WargamingGameUpdater.exe"
ShellIconOverlayIdentifiers: [
 MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX64.dll [2016-11-14] ()
ShellIconOverlayIdentifiers: [
 MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX64.dll [2016-11-14] ()
ShellIconOverlayIdentifiers: [
 MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX64.dll [2016-11-14] ()
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-03-21] (Google)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  -> Brak pliku
ShellIconOverlayIdentifiers-x32: [
 MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX32.dll [2016-11-14] ()
ShellIconOverlayIdentifiers-x32: [
 MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX32.dll [2016-11-14] ()
ShellIconOverlayIdentifiers-x32: [
 MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\user\AppData\Local\MEGAsync\ShellExtX32.dll [2016-11-14] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2014-06-02]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-10-28]
ShortcutTarget: MEGAsync.lnk -> C:\Users\user\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)
Startup: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Twitch.lnk [2017-04-12]
ShortcutTarget: Twitch.lnk -> C:\Users\user\AppData\Roaming\Curse Client\Bin\Twitch.exe (Twitch Interactive, Inc.)
GroupPolicy: Ograniczenia <======= UWAGA
GroupPolicy\User: Ograniczenia <======= UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

AutoConfigURL: [S-1-5-21-1327809303-1382241205-4292598097-1000] => hxxp://noblockweb.org/wpad.dat?b78e5aea619b1b217c55d23d0cc2f64f23870761
Hosts: Nie znaleziono pliku Hosts w domyślnym katalogu
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{CA0C173C-21C6-4189-90CD-040D770AF992}: [DhcpNameServer] 192.168.0.1
ManualProxies: 0hxxp://noblockweb.org/wpad.dat?b78e5aea619b1b217c55d23d0cc2f64f23870761

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=www.wp.pl/?src01=dp120140815
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=www.wp.pl/?src01=dp120140815
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131299551762299962&GUID=00000000-0000-0000-0000-000000000000
URLSearchHook: HKLM-x32 -> Domyślne = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1327809303-1382241205-4292598097-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSE1
BHO-x32: Brak nazwy -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> Brak pliku
BHO-x32: Brak nazwy -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> Brak pliku
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -  Brak pliku

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default [2017-04-25]
FF Extension: (WS-Recommender) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\Extensions\recws@ws.com [2014-10-18] [Brak podpisu cyfrowego]
FF Extension: (Surf Safely) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\Extensions\{B89F6276-BABC-072D-2973-0A30170DC49F} [2014-07-02] [Brak podpisu cyfrowego]
FF Extension: (Brak nazwy) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\extensions\sitefinder@sitefinder.com [nie znaleziono]
FF Extension: (Brak nazwy) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\extensions\faststartff@gmail.com [nie znaleziono]
FF Extension: (Brak nazwy) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\extensions\3446275a-5477-4d33-bd0d-44b466c519cd@4bf28e24-5833-4fb8-88c3-cd8403bb6141.com [nie znaleziono]
FF Extension: (Brak nazwy) - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\23ou4egn.default\extensions\0b105cbff1eb40b89bca7dae371d@7ead239035fb4613ab38ef.com [nie znaleziono]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono
FF HKU\S-1-5-21-1327809303-1382241205-4292598097-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: (McAfee Security Scan Plus) - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] [Brak podpisu cyfrowego]
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [Brak pliku]
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-08-17] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [Brak pliku]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [Brak pliku]
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.450 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll [2010-02-15] (RealNetworks, Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.3\npGoogleUpdate3.dll [2017-04-06] (Google Inc.)
FF Plugin HKU\S-1-5-21-1327809303-1382241205-4292598097-1000: @nsroblox.roblox.com/launcher -> C:\Users\user\AppData\Local\Roblox\Versions\version-8792f1948dc240b5\\NPRobloxProxy.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-1327809303-1382241205-4292598097-1000: @nsroblox.roblox.com/launcher64 -> C:\Users\user\AppData\Local\Roblox\Versions\version-8792f1948dc240b5\\NPRobloxProxy64.dll [2013-01-01] ( ROBLOX Corporation)
FF Plugin HKU\S-1-5-21-1327809303-1382241205-4292598097-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\user\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-11-13] (Unity Technologies ApS)

Chrome: 
=======
CHR DefaultProfile: Profile 1
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default [2017-04-26]
CHR Extension: (Dysk Google) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-22]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-25]
CHR Extension: (Google Search) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-26]
CHR Extension: (Dokumenty Google offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-04-05]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR Profile: C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-04-26]
CHR Extension: (Dokumenty Google) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-24]
CHR Extension: (Dysk Google) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-24]
CHR Extension: (YouTube) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-24]
CHR Extension: (Unknown Space) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bpjdbdbhiomamecfnjahemfimgjamhjd [2017-04-25]
CHR Extension: (Dokumenty Google offline) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-24]
CHR Extension: (AdBlock) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-14]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-24]
CHR Extension: (Chrome Media Router) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-04-26]
CHR HKLM-x32\...\Chrome\Extension: [aaaammnmhbmpkgdcfbpolmjlkkkcpcea] - C:\Users\user\AppData\Local\APN\GoogleCRXs\aaaammnmhbmpkgdcfbpolmjlkkkcpcea_7.17.1.0.crx <nie znaleziono>

Opera: 
=======
OPR Extension: (Tampermonkey) - C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2017-01-21]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AMD FUEL Service; C:\Users\user\Desktop\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.) [Brak podpisu cyfrowego]
S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2016-10-15] (BitRaider, LLC)
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-07-12] (BitRaider, LLC)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [395536 2016-12-21] (EasyAntiCheat Ltd)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [731840 2009-05-14] (ESET)
U2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-03-28] (Hi-Rez Studios) [Brak podpisu cyfrowego]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [Brak podpisu cyfrowego]
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [625632 2015-07-22] (Lenovo)
R2 ManyCam Service; C:\ProgramData\ManyCam\Service\ManyCamService.exe [544984 2016-03-31] (Visicom Media Inc.)
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3611808 2015-07-22] (INCA Internet Co., Ltd.)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-05-10] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 .EsetTrialReset; C:\Windows\system32\regedt32.exe /s C:\Windows\esettrialreset.reg
S3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
S3 OverwolfUpdater; "C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe" /RunningFrom SCM" [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AODDriver4.2; C:\Users\user\Desktop\ATI.ACE\Fuel\amd64\AODDriver2.sys [57472 2012-04-09] (Advanced Micro Devices)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21616 2011-11-02] ()
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 eamon; C:\Windows\System32\DRIVERS\eamon.sys [142776 2009-05-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [134024 2009-05-14] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [121152 2009-05-14] (ESET)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-12-19] ()
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2013-09-06] () [Brak podpisu cyfrowego]
R3 WinRing0_1_2_0; D:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [122624 2011-01-13] (ZTE Incorporated)
U3 ai89qi8c; Brak ImagePath
S3 AODDriver; \??\C:\Program Files (x86)\GIGABYTE\ET6\amd64\AODDriver.sys [X]
S3 BRDriver64; \??\C:\programdata\bitraider\BRDriver64.sys [X]
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz134; \??\C:\Users\user\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X] <==== UWAGA
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 RTCore64; \??\C:\Users\user\Desktop\2\MSI Afterburner\RTCore64.sys [X]
U3 aftcaaob; \??\C:\Users\user\AppData\Local\Temp\aftcaaob.sys [X] <==== UWAGA

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-04-26 22:57 - 2017-04-26 23:01 - 00031447 _____ C:\Users\user\Desktop\Rook.txt
2017-04-26 22:45 - 2017-04-26 23:03 - 00000000 ____D C:\FRST
2017-04-26 14:01 - 2017-04-26 14:22 - 00000000 ____D C:\AdwCleaner
2017-04-26 12:44 - 2017-04-26 12:44 - 00000000 ____D C:\Users\user\AppData\Roaming\Google
2017-04-26 12:39 - 2017-04-26 12:39 - 00058408 _____ C:\Users\user\AppData\Local\GDIPFONTCACHEV1.DAT
2017-04-26 12:33 - 2017-04-26 12:33 - 00268832 _____ C:\Windows\system32\FNTCACHE.DAT
2017-04-19 16:59 - 2017-04-25 14:35 - 00011028 _____ C:\Users\user\Desktop\Nowy dokument tekstowy (4).txt
2017-04-12 14:31 - 2017-04-12 14:31 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-04-12 14:31 - 2017-04-12 14:31 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-04-12 14:31 - 2017-04-12 14:31 - 00004582 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2017-04-12 14:31 - 2017-04-12 14:31 - 00004424 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-04-12 11:34 - 2017-04-12 11:34 - 00000963 _____ C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Twitch.lnk
2017-04-12 11:34 - 2017-04-12 11:34 - 00000000 ____D C:\Users\user\AppData\Roaming\Twitch
2017-04-12 11:34 - 2017-04-12 11:34 - 00000000 ____D C:\ProgramData\Twitch
2017-04-08 12:32 - 2017-04-26 22:59 - 00000000 ____D C:\Users\user\Desktop\Pat
2017-04-06 22:03 - 2017-04-06 22:04 - 00000000 ____D C:\Program Files (x86)\GUME4AE.tmp

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-04-26 14:22 - 2009-07-14 06:45 - 00029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-04-26 14:22 - 2009-07-14 06:45 - 00029136 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-04-26 14:15 - 2014-12-20 11:06 - 00000000 ____D C:\Users\user\AppData\Roaming\Curse Client
2017-04-26 14:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\tracing
2017-04-26 14:11 - 2016-05-08 19:43 - 00065536 _____ C:\Windows\system32\Ikeext.etl
2017-04-26 14:11 - 2013-06-08 14:28 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2017-04-26 14:11 - 2013-06-03 19:19 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2017-04-26 14:11 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-04-26 12:42 - 2015-11-20 19:25 - 00004000 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{2A595FFA-2843-4A7A-8DC5-85A08A1AFE74}
2017-04-26 00:54 - 2014-03-09 18:14 - 00000000 ____D C:\Users\user\AppData\Roaming\TS3Client
2017-04-25 22:11 - 2012-12-21 16:59 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-04-25 21:49 - 2015-09-16 14:14 - 00000000 ____D C:\Users\user\AppData\Roaming\uTorrent
2017-04-23 12:17 - 2016-11-08 14:13 - 00000058 _____ C:\Users\user\Desktop\Nowy dokument tekstowy (3).txt
2017-04-21 13:10 - 2016-06-23 12:44 - 00003350 _____ C:\Windows\System32\Tasks\ESET Windows 10 upgrade – Refresh settings
2017-04-21 01:59 - 2014-03-11 12:16 - 00000000 ____D C:\Users\user\AppData\Local\Battle.net
2017-04-19 20:48 - 2016-08-17 12:40 - 00000822 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-04-17 21:38 - 2012-12-20 15:40 - 00000000 ____D C:\Users\user\AppData\Local\CrashDumps
2017-04-12 14:32 - 2013-09-17 15:35 - 00000000 ____D C:\Users\user\AppData\Local\Adobe
2017-04-12 14:31 - 2012-12-21 16:16 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-04-12 14:31 - 2012-12-21 16:16 - 00000000 ____D C:\Windows\system32\Macromed
2017-04-11 09:58 - 2017-03-20 02:00 - 00000000 ____D C:\Users\user\AppData\Roaming\discord
2017-04-06 22:04 - 2012-12-21 16:59 - 00003480 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2017-04-06 22:04 - 2012-12-21 16:59 - 00003352 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2017-03-31 20:55 - 2014-09-21 17:47 - 00000000 ____D C:\Program Files (x86)\TeamSpeak 3 Client
2017-03-30 11:49 - 2011-04-12 15:21 - 00740438 _____ C:\Windows\system32\perfh015.dat
2017-03-30 11:49 - 2011-04-12 15:21 - 00156012 _____ C:\Windows\system32\perfc015.dat
2017-03-30 11:49 - 2009-07-14 07:13 - 01670590 _____ C:\Windows\system32\PerfStringBackup.INI
2017-03-30 11:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf

==================== Pliki w katalogu głównym wybranych folderów =======

2016-12-29 17:15 - 2016-12-29 17:15 - 26640264 _____ () C:\Users\user\AppData\Roaming\gameboxsetup.exe
2016-09-15 15:52 - 2016-09-15 15:52 - 0000000 ___SH () C:\Users\user\AppData\Local\LumaEmu
2013-07-03 19:09 - 2013-07-03 22:05 - 0000854 _____ () C:\Users\user\AppData\Local\PMB Filer耯pa
2014-07-01 16:19 - 2014-07-01 16:19 - 0000003 _____ () C:\Users\user\AppData\Local\proxy.log
2015-06-11 14:04 - 2015-06-11 14:04 - 0000834 _____ () C:\Users\user\AppData\Local\recently-used.xbel
2013-08-31 11:12 - 2013-08-31 11:12 - 0007605 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-05-06 17:14 - 2014-05-06 21:41 - 0001140 _____ () C:\ProgramData\HirezPipeError.txt

Niektóre pliki w TEMP:
====================
2016-07-10 02:06 - 2016-07-10 02:06 - 0003584 _____ () C:\Users\user\AppData\Local\Temp\1_izfhqr.dll
2017-02-22 18:35 - 2017-02-22 18:35 - 0000056 _____ () C:\Users\user\AppData\Local\Temp\4593aada5cb9eeafbc297b0a754f813c.dll
2016-09-15 15:47 - 2016-09-15 15:48 - 0008192 _____ () C:\Users\user\AppData\Local\Temp\76b86cpg.dll
2014-03-08 08:28 - 2014-03-08 08:28 - 0879768 _____ (Skytech Co., Ltd.) C:\Users\user\AppData\Local\Temp\amt_awesomehp.exe
2013-02-19 14:06 - 2013-02-19 14:06 - 0358600 _____ (Ask.com) C:\Users\user\AppData\Local\Temp\APNStub.exe
2014-04-21 05:51 - 2014-04-21 05:51 - 10372136 _____ () C:\Users\user\AppData\Local\Temp\BackupSetup.exe
2016-06-01 21:01 - 2016-06-01 21:01 - 0427008 _____ () C:\Users\user\AppData\Local\Temp\BushelledDesegregates.dll
2013-09-06 18:33 - 2013-09-06 18:33 - 0036864 _____ () C:\Users\user\AppData\Local\Temp\CmdLineExt02.dll
2013-12-02 13:13 - 2013-12-02 13:14 - 3090032 _____ (Search Results) C:\Users\user\AppData\Local\Temp\DefaultTabSetup2.exe
2013-03-19 13:22 - 2010-02-26 11:45 - 0080896 _____ (Microsoft Corporation) C:\Users\user\AppData\Local\Temp\devcon.exe
2013-09-20 13:09 - 2013-09-20 14:55 - 0046592 _____ (Sony DADC Austria AG) C:\Users\user\AppData\Local\Temp\drm_dialogs.dll
2015-01-25 13:12 - 2016-03-09 12:52 - 0204800 _____ (Sony DADC Austria AG) C:\Users\user\AppData\Local\Temp\drm_dyndata_7380014.dll
2017-02-22 18:35 - 2017-02-22 18:35 - 0000512 _____ () C:\Users\user\AppData\Local\Temp\ed6e8e8c4b588010c8f64663407c6196.dll
2016-05-23 12:46 - 2016-05-23 12:46 - 0425472 _____ () C:\Users\user\AppData\Local\Temp\ElevatorsWarehousing.dll
2013-03-27 17:46 - 2013-03-27 17:46 - 0171432 _____ () C:\Users\user\AppData\Local\Temp\el_inst.exe
2017-02-18 16:01 - 2017-02-18 16:02 - 3138708 _____ (ESET) C:\Users\user\AppData\Local\Temp\ese9A7B.tmp.exe
2013-08-01 09:04 - 2013-09-09 19:08 - 0986136 _____ () C:\Users\user\AppData\Local\Temp\ggdrive-menu.exe
2013-08-01 09:04 - 2013-09-09 19:08 - 1228520 _____ () C:\Users\user\AppData\Local\Temp\ggdrive-overlay.exe
2017-01-17 15:40 - 2017-01-17 15:40 - 0683008 _____ () C:\Users\user\AppData\Local\Temp\Girlvania_Summer_Lust__1haiv5g.exe
2017-01-17 15:30 - 2017-01-17 15:31 - 0683008 _____ () C:\Users\user\AppData\Local\Temp\Girlvania_Summer_Lust__fhavm0.exe
2016-05-09 17:36 - 2010-04-30 17:21 - 0188416 _____ () C:\Users\user\AppData\Local\Temp\GLFD440.tmp.dll
2013-09-15 11:51 - 2013-04-14 14:30 - 3265980 _____ (unSigned Softworks) C:\Users\user\AppData\Local\Temp\gta-san-andreas.exe
2013-05-01 23:01 - 2017-02-24 01:36 - 0037376 _____ (Microsoft) C:\Users\user\AppData\Local\Temp\HiPatchSelfUpdateWindow.exe
2013-05-01 23:01 - 2017-02-23 18:05 - 0020480 _____ (Microsoft) C:\Users\user\AppData\Local\Temp\HiRezLauncherControls.dll
2013-08-01 09:04 - 2014-02-05 17:07 - 0056856 _____ () C:\Users\user\AppData\Local\Temp\installstats.exe
2013-04-10 09:39 - 2013-04-10 09:39 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl1479.tmp.exe
2013-05-02 08:34 - 2013-05-02 08:34 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl16F9.tmp.exe
2013-04-20 09:37 - 2013-04-20 09:37 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl1C36.tmp.exe
2013-04-24 21:39 - 2013-04-24 21:39 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl333F.tmp.exe
2013-03-29 23:43 - 2013-03-29 23:43 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl8B4D.tmp.exe
2013-04-07 22:24 - 2013-04-07 22:24 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl9971.tmp.exe
2013-04-03 11:38 - 2013-04-03 11:38 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl9E22.tmp.exe
2013-04-15 10:21 - 2013-04-15 10:21 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\ipl9F98.tmp.exe
2013-05-07 09:12 - 2013-05-07 09:12 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplA1E9.tmp.exe
2013-05-16 10:27 - 2013-05-16 10:27 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplA266.tmp.exe
2013-03-25 09:45 - 2013-03-25 09:46 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplA2A4.tmp.exe
2013-03-23 07:25 - 2013-03-23 07:25 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplADAC.tmp.exe
2013-05-24 10:37 - 2013-05-24 10:37 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplB0A8.tmp.exe
2013-05-22 08:16 - 2013-05-22 08:16 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplB115.tmp.exe
2013-05-05 07:05 - 2013-05-05 07:05 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplBA0B.tmp.exe
2013-05-14 10:12 - 2013-05-14 10:12 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplBDC2.tmp.exe
2013-04-01 11:37 - 2013-04-01 11:37 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplCD1D.tmp.exe
2013-04-12 12:26 - 2013-04-12 12:26 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplD152.tmp.exe
2013-05-09 10:22 - 2013-05-09 10:22 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplD26B.tmp.exe
2013-04-22 21:24 - 2013-04-22 21:24 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplD603.tmp.exe
2013-03-27 16:51 - 2013-03-27 16:51 - 15684104 _____ () C:\Users\user\AppData\Local\Temp\iplDFC3.tmp.exe
2012-11-15 17:44 - 2012-01-31 17:43 - 0057711 _____ () C:\Users\user\AppData\Local\Temp\MD5Hash.dll
2013-02-19 22:10 - 2013-09-04 19:03 - 3970696 _____ (Ask) C:\Users\user\AppData\Local\Temp\setup.exe
2014-07-15 11:08 - 2014-07-15 11:09 - 8159712 _____ () C:\Users\user\AppData\Local\Temp\setup[1].exe
2013-09-06 18:33 - 2013-09-06 18:33 - 0012067 _____ () C:\Users\user\AppData\Local\Temp\SIntf16.dll
2013-09-06 18:33 - 2013-09-06 18:33 - 0019924 _____ () C:\Users\user\AppData\Local\Temp\SIntf32.dll
2013-09-06 18:33 - 2013-09-06 18:33 - 0024516 _____ () C:\Users\user\AppData\Local\Temp\SIntfNT.dll
2013-07-07 19:14 - 2013-08-06 07:19 - 31954536 _____ (Skype Technologies S.A.) C:\Users\user\AppData\Local\Temp\SkypeSetup.exe
2013-05-29 17:45 - 2013-05-29 17:45 - 1786688 _____ () C:\Users\user\AppData\Local\Temp\sonarinst.exe
2013-05-14 11:54 - 2013-05-14 11:54 - 0430080 _____ (Eclipse Foundation) C:\Users\user\AppData\Local\Temp\swt-win32-3740.dll
2013-03-19 13:16 - 2013-03-19 13:17 - 153548912 _____ (Advanced Micro Devices, Inc.) C:\Users\user\AppData\Local\Temp\tmp6A94.exe
2013-09-20 13:09 - 2013-09-20 13:09 - 3385474 _____ (Nival Interactive                                           ) C:\Users\user\AppData\Local\Temp\ubi7D4C.tmp.exe
2017-01-14 00:05 - 2017-01-14 00:05 - 13977352 _____ (Microsoft Corporation) C:\Users\user\AppData\Local\Temp\vcredist_x86.exe
2014-01-07 09:32 - 2013-08-31 13:55 - 0147460 _____ (n/a) C:\Users\user\AppData\Local\Temp\_Uninstall_0.exe
2014-04-24 19:07 - 2014-04-24 19:07 - 0021208 _____ () C:\Users\user\AppData\Local\Temp\{E779A7D2-ACAD-491B-99E6-16BB0880317F}-34.0.1847.131_34.0.1847.116_chrome_updater.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-04-13 20:18

==================== Koniec  FRST.txt ============================