Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 01-06-2017
Uruchomiony przez Lambert (administrator)  LAMBERT7 (02-06-2017 12:24:56)
Uruchomiony z C:\Users\Lambert\Downloads
Załadowane profile: Lambert (Dostępne profile: Lambert)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: "C:\Program Files (x86)\Hippig\Application\chrome.exe" "%1")
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\Elex-tech\YAC\iSafeTray.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Valve Corporation) D:\Program Files (x86)\Steam\Steam.exe
(Electronic Arts) D:\Program Files (x86)\Origin\Origin.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
() C:\Gry\Counter-Strike 1.6 v43\SteamServerBrowser\SteamServerBrowser.exe
() H:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe
(Gaijin Entertainment) C:\Users\Lambert\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Electronic Arts) D:\Program Files (x86)\Origin\OriginWebHelperService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Valve Corporation) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
() C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
() D:\Program Files (x86)\Origin\QtWebEngineProcess.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Hippig\Application\chrome.exe
() C:\Users\Lambert\Downloads\qd1y4yyr.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKLM\ DisallowedCertificates: 03D22C9C66915D58C88912B64C1F984B8344EF09 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 0F684EC1163281085C6AF20528878103ACEFCAAB (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 1667908C9E22EFBD0590E088715CC74BE4C60884 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 18DEA4EFA93B06AE997D234411F3FD72A677EECE (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 2026D13756EB0DB753DF26CB3B7EEBE3E70BB2CF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 249BDA38A611CD746A132FA2AF995A2D3C941264 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 31AC96A6C17C425222C46D55C3CCA6BA12E54DAF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 331E2046A1CCA7BFEF766724394BE6112B4CA3F7 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 3353EA609334A9F23A701B9159E30CB6C22D4C59 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 373C33726722D3A5D1EDD1F1585D5D25B39BEA1A (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 3850EDD77CC74EC9F4829AE406BBF9C21E0DA87F (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 3D496FA682E65FC122351EC29B55AB94F3BB03FC (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 4243A03DB4C3C15149CEA8B38EEA1DA4F26BD159 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 42727E052C0C2E1B35AB53E1005FD9EDC9DE8F01 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 4420C99742DF11DD0795BC15B7B0ABF090DC84DF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 4C0AF5719009B7C9D85C5EAEDFA3B7F090FE5FFF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 5240AB5B05D11B37900AC7712A3C6AE42F377C8C (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 5DD3D41810F28B2A13E9A004E6412061E28FA48D (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 7457A3793086DBB58B3858D6476889E3311E550E (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 76A9295EF4343E12DFC5FE05DC57227C1AB00D29 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 775B373B33B9D15B58BC02B184704332B97C3CAF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 7D7F4414CCEF168ADF6BF40753B5BECD78375931 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 872CD334B7E7B3C3D1C6114CD6B221026D505EAB (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 88AD5DFE24126872B33175D1778687B642323ACF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 9132E8B079D080E01D52631690BE18EBC2347C1E (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 982D98951CF3C0CA2A02814D474A976CBFF6BDB1 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 9A08641F7C5F2CCA0888388BE3E5DBDDAAA3B361 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 9C43F665E690AB4D486D4717B456C5554D4BCEB5 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: 9E3F95577B37C74CA2F70C1E1859E798B7FC6B13 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: A1F8DCB086E461E2ABB4B46ADCFA0B48C58B6E99 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: A5341949ABE1407DD7BF7DFE75460D9608FBC309 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: A59CC32724DD07A6FC33F7806945481A2D13CA2F (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: AB7E760DA2485EA9EF5A6EEE7647748D4BA6B947 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: AD4C5429E10F4FF6C01840C20ABA344D7401209F (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: AD96BB64BA36379D2E354660780C2067B81DA2E0 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: B8EBF0E696AF77F51C96DB4D044586E2F4F8FD84 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: CDC37C22FE9272D8F2610206AD397A45040326B8 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: D3F78D747E7C5D6D3AE8ABFDDA7522BFB4CBD598 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: DB303C9B61282DE525DC754A535CA2D6A9BD3D87 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: DB77E5CFEC34459146748B667C97B185619251BA (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: E22240E837B52E691C71DF248F12D27F96441C00 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: E513EAB8610CFFD7C87E00BCA15C23AAB407FCEF (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: ED841A61C0F76025598421BC1B00E24189E68D54 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: F83099622B4A9F72CB5081F742164AD1B8D048C9 (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: FBB42F089AF2D570F2BF6F493D107A3255A9BB1A (Avast Antivirus/Software) <==== UWAGA
HKLM\ DisallowedCertificates: FFFA650F2CB2ABC0D80527B524DD3F9FC172C138 (Avast Antivirus/Software) <==== UWAGA
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [3042592 2017-06-01] (Valve Corporation)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [EADM] => D:\Program Files (x86)\Origin\Origin.exe [3048312 2017-05-31] (Electronic Arts)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [SteamServerBrowser] => C:\Gry\Counter-Strike 1.6 v43\SteamServerBrowser\SteamServerBrowser.exe [206848 2017-01-10] ()
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [WallpaperEngine] => H:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe [691200 2017-02-16] ()
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Gaijin.Net Agent] => C:\Users\Lambert\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [2012616 2017-05-25] (Gaijin Entertainment)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [background_fault] => C:\Users\Lambert\AppData\Local\background_fault\aswRD.exe [1419576 2017-05-27] (AVAST Software) <===== UWAGA
HKLM\...\Providers\1ol3sxub: C:\Program Files (x86)\Clihotain Configuration\local64spl.dll
IFEO\GoogleUpdate.exe: [Debugger] 324095823984.exe
IFEO\GoogleUpdaterService.exe: [Debugger] 8736459873644.exe
ShellExecuteHooks: Brak nazwy - {6A69B0BA-392B-11E7-B267-64006A5CFC23} - C:\Users\Lambert\AppData\Roaming\Prageghtthasuy\Cohispphokisy.dll [145408 2017-05-20] ()
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> Brak pliku

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DAE85576-4113-4901-BA51-FEF5A2A9840E}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495817398&z=539fb33b098d581863e9993g4z3tcw5b0g1q1t5bbg&from=che0812&uid=WDCXWD1200JS-00MHB0_WD-WCANN104216642166&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.ourluckysites.com/search/?type=ds&ts=1495817398&z=539fb33b098d581863e9993g4z3tcw5b0g1q1t5bbg&from=che0812&uid=WDCXWD1200JS-00MHB0_WD-WCANN104216642166&q={searchTerms}
HKU\S-1-5-21-489643024-731826354-959299013-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www-searching.com/?pid=s&s=H5Kzbcnbl1BU,6a532031-42f4-47fc-916e-b7d6d8da77f6,&vp=ch&prd=set_ie
HKU\S-1-5-21-489643024-731826354-959299013-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKU\S-1-5-21-489643024-731826354-959299013-1000 -> {9A91F84A-3E08-4774-B825-7A6604704214} URL = hxxp://www-searching.com/s.ashx?prd=opensearch&q={searchTerms}&s=H5Kzbcnbl1BU,6a532031-42f4-47fc-916e-b7d6d8da77f6,
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: s23dqcrs.default
FF ProfilePath: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\naweriweentcofise\Profiles\s23dqcrs.default\Profiles\s23dqcrs.default [nie znaleziono]
FF ProfilePath: C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\naweriweentcofise\Profiles\s23dqcrs.default\Profiles\s23dqcrs.default [nie znaleziono]
FF ProfilePath: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default [2017-05-28]
FF user.js: detected! => C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\user.js [2017-05-26]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\s23dqcrs.default -> initialsite123
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\s23dqcrs.default -> initialsite123
FF Homepage: Mozilla\Firefox\Profiles\s23dqcrs.default -> hxxp://www.luckysearch123.com?type=hp&ts=1495813616&from=ca9a0525&uid=wdcxwd1200js-00mhb0_wd-wcann104216642166&z=7e527a4ccae801a9a9a6823gbz6tcw5b4gdccoceag
FF NewTab: Mozilla\Firefox\Profiles\s23dqcrs.default -> hxxp://www.luckysearch123.com?type=hp&ts=1495813616&from=ca9a0525&uid=wdcxwd1200js-00mhb0_wd-wcann104216642166&z=7e527a4ccae801a9a9a6823gbz6tcw5b4gdccoceag
FF Extension: (Fast search) - C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\Extensions\amcontextmenu@loucypher [2017-05-20]
FF Extension: (xRocket Toolbar) - C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\Extensions\arthurj8283@gmail.com [2017-05-26] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\searchplugins\1ol3sxub.xml [2017-05-20]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\searchplugins\luck.xml [2017-05-26]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\searchplugins\smod.xml [2017-05-21]
FF ProfilePath: C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default [2017-06-02]
FF NewTab: Firefox\Firefox\Profiles\s23dqcrs.default -> hxxp://www-searching.com/?site=shyosffdefault&prd=set_ff&s=h5kzbcnbl1bu,6a532031-42f4-47fc-916e-b7d6d8da77f6,
FF SelectedSearchEngine: Firefox\Firefox\Profiles\s23dqcrs.default -> initialsite123
FF Homepage: Firefox\Firefox\Profiles\s23dqcrs.default -> hxxp://www.searchinme.com/
FF Extension: (SimilarWeb) - C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\Extensions\@DA3566E2-F709-11E5-8E87-A604BC8E7F8B.xpi [2017-05-26] [Brak podpisu cyfrowego]
FF Extension: (HSearch) - C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\Extensions\@E97YHOMI-FU8L-IM23-VUT9-RVDZT7M8XL8H.xpi [2017-05-26] [Brak podpisu cyfrowego]
FF Extension: (Fast search) - C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\Extensions\amcontextmenu@loucypher [2017-05-25]
FF Extension: (Polski Language Pack) - C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\Extensions\langpack-pl@firefox.mozilla.org.xpi [2017-05-25] [Brak podpisu cyfrowego]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\searchplugins\1ol3sxub.xml [2017-05-20]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\searchplugins\smod.xml [2017-05-21]
FF SearchPlugin: C:\Users\Lambert\AppData\Roaming\Firefox\Firefox\Profiles\s23dqcrs.default\searchplugins\startsearch.xml [2017-05-25]
FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\s23dqcrs.default\extensions\arthurj8283@gmail.com
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_205.dll [2016-11-01] ()
FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_205.dll [2016-11-01] ()
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-05-30] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-05-30] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin HKU\S-1-5-21-489643024-731826354-959299013-1000: @my.com/Games -> C:\Users\Lambert\AppData\Local\MyComGames\NPMyComDetector.dll [2017-04-22] (MY.COM B.V.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.luckysearch123.com?type=hp&ts=1495813616&from=ca9a0525&uid=wdcxwd1200js-00mhb0_wd-wcann104216642166&z=7e527a4ccae801a9a9a6823gbz6tcw5b4gdccoceag
CHR StartupUrls: Default -> "hxxp://www.luckysearch123.com?type=hp&ts=1495813616&from=ca9a0525&uid=wdcxwd1200js-00mhb0_wd-wcann104216642166&z=7e527a4ccae801a9a9a6823gbz6tcw5b4gdccoceag"
CHR Profile: C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default [2017-06-02]
CHR Extension: (Prezentacje Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-13]
CHR Extension: (BetterTTV) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2017-04-21]
CHR Extension: (Dokumenty Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-13]
CHR Extension: (Dysk Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-13]
CHR Extension: (YouTube) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-13]
CHR Extension: (Arkusze Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-13]
CHR Extension: (Dokumenty Google offline) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-13]
CHR Extension: (AdBlock) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-13]
CHR Extension: (Unlimited Free VPN - Hola) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkojfkhlekighikafcpjkiklfbnlmeio [2017-05-07]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-13]
CHR Extension: (Chrome Media Router) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-20]
CHR HKU\S-1-5-21-489643024-731826354-959299013-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [jlcgehabolcakkjhgmgpkagpolbjlhfa] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 BIT; C:\ProgramData\BIT\BIT.dll [1812992 2017-06-01] (TODO: <公司名>) [Brak podpisu cyfrowego] <==== UWAGA
S2 DsSvc; C:\ProgramData\Package Cache\{00C5024D-925C-4E9E-A8E6-F9B84ABE0DA0}\packages\Win81_SDK\9bcb3fab78e80d68be28892ea7ad46c3.msp [84 2017-05-25] () [Brak podpisu cyfrowego]
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [245544 2017-05-21] (EasyAntiCheat Ltd)
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [98456 2017-05-25] () <==== UWAGA
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [512576 2017-05-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7955008 2017-05-20] (GOG.com)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
S2 glory; C:\Users\Lambert\AppData\Local\glory\glory.dll [909824 2017-06-01] (glory) [Brak podpisu cyfrowego] <==== UWAGA
U2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-02-10] (Hi-Rez Studios) [Brak podpisu cyfrowego]
R2 iSafeService; C:\Program Files (x86)\Elex-tech\YAC\iSafeSvc.exe [130512 2017-05-22] (Elex do Brasil Participações Ltda)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
S3 Origin Client Service; D:\Program Files (x86)\Origin\OriginClientService.exe [2155920 2017-05-31] (Electronic Arts)
R2 Origin Web Helper Service; D:\Program Files (x86)\Origin\OriginWebHelperService.exe [3125656 2017-05-31] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-12-16] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WinSAPSvc; C:\Users\Lambert\AppData\Roaming\WinSAPSvc\WinSAP.dll [1886720 2017-06-01] () [Brak podpisu cyfrowego] <==== UWAGA

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R1 iSafeKrnl; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnl.sys [262344 2016-05-23] (Elex do Brasil Participações Ltda) <==== UWAGA
S3 iSafeKrnlBoot; C:\Windows\System32\DRIVERS\iSafeKrnlBoot.sys [55056 2016-05-23] (Elex do Brasil Participações Ltda) <==== UWAGA
R1 iSafeKrnlKit; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlKit.sys [110112 2016-05-23] (Elex do Brasil Participações Ltda) <==== UWAGA
R1 iSafeKrnlMon; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [52440 2016-05-23] (Elex do Brasil Participações Ltda) <==== UWAGA
R1 iSafeKrnlR3; C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlR3.sys [103904 2016-05-23] (Elex do Brasil Participações Ltda) <==== UWAGA
R1 iSafeNetFilter; C:\Windows\System32\DRIVERS\iSafeNetFilter.sys [52392 2016-05-19] (Elex do Brasil Participações Ltda) <==== UWAGA
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
U3 aswbdisk; Brak ImagePath
U2 snare; Brak ImagePath
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
U2 terana; Brak ImagePath
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
U3 ufryapog; \??\C:\Users\Lambert\AppData\Local\Temp\ufryapog.sys [X] <==== UWAGA

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-02 12:23 - 2017-06-02 12:24 - 00000000 ____D C:\FRST
2017-06-02 12:22 - 2017-06-02 12:22 - 00018421 _____ C:\Users\Lambert\Desktop\test.txt
2017-06-02 10:25 - 2017-06-02 10:25 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Lambert\Downloads\SPTDinst-v189-x64.exe
2017-06-02 10:21 - 2017-06-02 10:21 - 00380928 _____ C:\Users\Lambert\Downloads\qd1y4yyr.exe
2017-06-02 09:54 - 2017-06-02 12:24 - 00057581 _____ C:\Users\Lambert\Downloads\Addition.txt
2017-06-02 09:52 - 2017-06-02 12:24 - 00025457 _____ C:\Users\Lambert\Downloads\FRST.txt
2017-06-02 09:52 - 2017-06-02 09:52 - 02433536 _____ (Farbar) C:\Users\Lambert\Downloads\FRST64.exe
2017-06-01 19:00 - 2017-06-01 19:00 - 00000000 ____D C:\Users\Lambert\AppData\Local\glory
2017-06-01 18:57 - 2017-06-01 18:57 - 00000000 ____D C:\Stuvatybugtain
2017-05-28 16:27 - 2017-05-28 16:27 - 00003134 _____ C:\Windows\System32\Tasks\Trojan Remover
2017-05-28 11:24 - 2017-05-28 11:24 - 00000000 ___HD C:\$AV_ASW
2017-05-28 11:21 - 2017-05-28 11:21 - 00032600 _____ (AVAST Software) C:\Windows\system32\Drivers\aswD9A0.tmp
2017-05-28 11:17 - 2017-05-28 11:17 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\AVAST Software
2017-05-28 11:13 - 2017-05-28 11:14 - 00158880 _____ (AVAST Software) C:\Windows\system32\Drivers\aswE06B.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 01007160 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDA3D.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00569192 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDE57.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00339696 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDEB6.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00334576 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswD53A.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00311808 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswD152.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00190256 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswD3C3.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00128648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDD9A.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00101152 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDB28.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00075704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDDF8.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00049016 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswD5E7.tmp
2017-05-28 11:13 - 2017-05-28 11:01 - 00038296 _____ (AVAST Software) C:\Windows\system32\Drivers\aswDD2C.tmp
2017-05-28 10:58 - 2017-05-28 11:21 - 00000000 ____D C:\Program Files\AVAST Software
2017-05-28 08:09 - 2017-05-28 08:09 - 00007602 _____ C:\Users\Lambert\AppData\Local\Resmon.ResmonCfg
2017-05-27 20:46 - 2017-05-27 20:46 - 00000000 ____D C:\ProgramData\Loaris
2017-05-27 20:45 - 2017-05-27 20:45 - 01381296 _____ (Loaris LLC) C:\Users\Lambert\Downloads\Loaris Trojan Remover 3.0.2 [1].exe
2017-05-27 20:44 - 2017-05-27 20:44 - 01273672 _____ ( ) C:\Users\Lambert\Downloads\Loaris Trojan Remover 3.0.2.exe
2017-05-27 20:29 - 2017-05-28 16:50 - 00000140 _____ C:\Windows\Reimage.ini
2017-05-27 20:29 - 2017-05-27 20:29 - 00604928 _____ (Reimage) C:\Users\Lambert\Downloads\ReimageRepair.exe
2017-05-27 19:49 - 2017-05-27 19:48 - 303178200 _____ C:\Users\Lambert\Downloads\Emsisoft Emergency Kit 2017.4.0.7437 [1].exe
2017-05-27 19:42 - 2017-05-27 19:43 - 01273672 _____ ( ) C:\Users\Lambert\Downloads\Emsisoft Emergency Kit 2017.4.0.7437.exe
2017-05-27 19:27 - 2017-05-27 19:27 - 63035592 _____ (Malwarebytes ) C:\Users\Lambert\Downloads\Malwarebytes Free 3.1.2.1733 [1].exe
2017-05-27 19:25 - 2017-05-27 19:26 - 01273672 _____ ( ) C:\Users\Lambert\Downloads\Malwarebytes Free 3.1.2.1733.exe
2017-05-27 19:09 - 2017-05-27 19:11 - 63035592 _____ (Malwarebytes ) C:\Users\Lambert\Downloads\mb3-setup-adwc.adwc100.3.1.2.1733.exe
2017-05-27 19:08 - 2017-05-27 19:08 - 04110280 _____ C:\Users\Lambert\Downloads\adwcleaner_6.047 (2).exe
2017-05-27 18:57 - 2017-05-27 19:50 - 00000000 ____D C:\Pipisy
2017-05-27 18:56 - 2017-05-27 18:56 - 04110280 _____ C:\Users\Lambert\Downloads\adwcleaner_6.047(1).exe
2017-05-27 18:54 - 2017-05-27 18:54 - 04110280 _____ C:\Users\Lambert\Downloads\adwcleaner_6.047 (1).exe
2017-05-27 18:52 - 2017-05-27 18:52 - 02221356 _____ C:\Users\Lambert\Downloads\AdwCleaner Portable AdwCleaner 5.019 PL.rar
2017-05-27 18:52 - 2015-11-09 10:06 - 00000000 ____D C:\Users\Lambert\Desktop\AdwCleaner Portable AdwCleaner 5.019 PL
2017-05-27 18:51 - 2017-05-27 18:51 - 02126848 _____ C:\Users\Lambert\Downloads\AdwCleaner 4.111.exe
2017-05-27 18:50 - 2017-05-27 18:50 - 01682432 _____ C:\Users\Lambert\Downloads\AdwCleaner 5.013.exe
2017-05-27 18:50 - 2017-05-27 18:50 - 00000000 ____D C:\AdwCleaner
2017-05-27 18:49 - 2017-05-27 18:49 - 00002960 _____ C:\Windows\System32\Tasks\{C3660774-1430-4C6F-8E8D-021096A1846D}
2017-05-27 18:31 - 2017-05-27 18:29 - 03968543 _____ C:\Users\Lambert\Desktop\adwcleaner_6.040.rar
2017-05-27 18:31 - 2016-12-03 05:11 - 03968464 _____ C:\Users\Lambert\Desktop\adwcleaner_6.040.exe
2017-05-27 18:29 - 2017-05-27 18:29 - 03968543 _____ C:\Users\Lambert\Downloads\adwcleaner_6.040.rar
2017-05-27 18:18 - 2017-05-27 18:19 - 04110280 _____ C:\Users\Lambert\Downloads\adwcleaner_6.047.exe
2017-05-26 18:48 - 2017-05-27 18:58 - 00000000 ____D C:\Users\Lambert\AppData\Local\terana
2017-05-25 22:20 - 2017-05-25 22:20 - 00000000 ____D C:\Users\Lambert\Documents\ARC SYSTEM WORKS
2017-05-25 22:02 - 2017-05-25 22:02 - 00000671 _____ C:\Users\Public\Desktop\GUILTY GEAR XX ACCENT CORE PLUS R.lnk
2017-05-25 18:42 - 2017-05-25 20:42 - 00000000 ___SD C:\Users\Lambert\AppData\LocalLow\Temp
2017-05-25 18:17 - 2017-05-25 18:17 - 00000000 ____D C:\Users\Lambert\AppData\Local\Hippig
2017-05-25 11:04 - 2017-06-02 11:24 - 00002286 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-05-25 11:04 - 2017-06-02 11:24 - 00001980 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2017-05-25 11:04 - 2017-05-25 11:04 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Firefox
2017-05-25 11:04 - 2017-05-25 11:04 - 00000000 ____D C:\Users\Lambert\AppData\Local\Firefox
2017-05-25 11:03 - 2017-05-25 11:04 - 00000000 ____D C:\Program Files (x86)\Firefox
2017-05-25 11:03 - 2017-05-25 11:03 - 00000000 ____D C:\Users\Public\Documents\Google
2017-05-25 11:03 - 2017-05-25 11:03 - 00000000 ____D C:\Program Files (x86)\Hippig
2017-05-25 11:02 - 2017-05-25 11:02 - 00000000 ____D C:\Windows\system32\log
2017-05-25 11:02 - 2017-05-25 11:02 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Elex-tech
2017-05-25 11:02 - 2017-05-25 11:02 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2017-05-25 11:02 - 2016-05-23 04:41 - 00055056 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2017-05-25 11:02 - 2016-05-19 08:42 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2017-05-25 11:01 - 2017-06-02 11:22 - 00000000 _____ C:\Users\Public\Documents\report.dat
2017-05-25 11:01 - 2017-06-02 08:57 - 00000000 ____D C:\Users\Lambert\AppData\Local\background_fault
2017-05-25 11:01 - 2017-05-28 11:00 - 00000000 _____ C:\Users\Public\Documents\temp.dat
2017-05-25 10:58 - 2017-06-01 18:59 - 00000000 ____D C:\Program Files\MK
2017-05-25 10:57 - 2017-05-28 12:05 - 00000000 ____D C:\Cosusp
2017-05-24 22:38 - 2017-05-24 22:38 - 00653718 _____ C:\Users\Lambert\Desktop\cc_20170524_223819.reg
2017-05-24 22:33 - 2017-05-24 22:34 - 09551280 _____ (Piriform Ltd) C:\Users\Lambert\Desktop\ccsetup530.exe
2017-05-24 22:26 - 2017-05-24 22:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-05-24 22:26 - 2017-05-24 22:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-05-24 22:15 - 2017-06-02 11:23 - 00000000 ____D C:\ProgramData\AVAST Software
2017-05-24 21:59 - 2017-05-24 22:15 - 167800790 _____ C:\Users\Lambert\Desktop\Avast! Free Antivirus 2016 11.1.2241 Final.rar
2017-05-24 21:28 - 2017-05-24 21:28 - 00000000 ____D C:\ProgramData\.mono
2017-05-24 20:03 - 2017-05-24 20:03 - 00000000 ____D C:\ProgramData\BIT
2017-05-24 20:02 - 2017-06-01 19:00 - 00003598 _____ C:\Windows\System32\Tasks\Milimili
2017-05-24 20:02 - 2017-05-25 11:00 - 00000000 ____D C:\Users\Lambert\AppData\Local\snare
2017-05-24 20:02 - 2017-05-24 20:02 - 00000000 ____D C:\Program Files (x86)\MIO
2017-05-24 20:01 - 2017-06-01 19:00 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\WinSAPSvc
2017-05-24 20:01 - 2017-05-24 20:02 - 00000132 _____ C:\ProgramData\log.binb
2017-05-24 20:00 - 2017-06-01 18:57 - 00000000 ____D C:\Program Files (x86)\Walchshjit
2017-05-24 20:00 - 2017-05-24 20:00 - 00000000 ____D C:\Program Files\1ol3sxub
2017-05-24 18:16 - 2017-05-24 18:16 - 00000000 ____D C:\ProgramData\CDProjekt RED
2017-05-24 18:15 - 2017-05-24 18:15 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\CDProjektRED
2017-05-24 18:13 - 2017-05-24 18:13 - 00001285 _____ C:\Users\Public\Desktop\Gwent.lnk
2017-05-24 17:34 - 2017-05-24 17:34 - 00001291 _____ C:\Users\Public\Desktop\Gwint.lnk
2017-05-24 17:34 - 2017-05-24 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gwint [GOG.com]
2017-05-24 17:07 - 2017-05-24 17:28 - 156003320 _____ (GOG.com ) C:\Users\Lambert\Desktop\setup_gwent_1.2.9.5a_pl.exe
2017-05-24 17:07 - 2017-05-24 17:07 - 00000064 _____ C:\Users\Lambert\Desktop\gogGalaxy.auth
2017-05-21 19:49 - 2017-05-21 19:49 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\Freejam
2017-05-21 18:42 - 2017-05-21 18:42 - 00000222 _____ C:\Users\Lambert\Desktop\Guns and Robots.url
2017-05-21 18:41 - 2017-05-21 18:41 - 00000222 _____ C:\Users\Lambert\Desktop\Robocraft.url
2017-05-21 07:56 - 2017-05-21 07:56 - 00003262 _____ C:\Windows\System32\Tasks\IBUpd2
2017-05-21 07:54 - 2017-05-21 07:56 - 00000000 ____D C:\Users\Lambert\AppData\Local\BrowserAir
2017-05-21 07:54 - 2017-05-21 07:54 - 00004248 _____ C:\Windows\System32\Tasks\SMW_UpdateTask_Time_3835313734393736322d2355786c325a5b5734412d34
2017-05-21 07:54 - 2017-05-21 07:54 - 00000000 ____D C:\ProgramData\SearchModule
2017-05-20 21:26 - 2017-05-20 21:26 - 00000135 _____ C:\Users\Lambert\Desktop\Just Cause Demo.url
2017-05-20 20:43 - 2017-05-20 20:44 - 08649410 _____ C:\Users\Lambert\Desktop\Saints Row 2 Spolszczenie.rar
2017-05-20 20:39 - 2017-05-20 20:39 - 00000000 ____D C:\Users\Lambert\AppData\Local\THQ
2017-05-20 20:39 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2017-05-20 17:56 - 2017-05-20 17:56 - 00000000 ____D C:\Users\Lambert\Documents\Duke Nukem Forever
2017-05-20 17:49 - 2017-05-20 19:09 - 48971969 _____ C:\Users\Lambert\Desktop\fmATLON4450B.rar
2017-05-20 15:46 - 2017-05-20 15:54 - 00000000 ____D C:\Users\Lambert\Documents\gothic3
2017-05-20 15:46 - 2017-05-20 15:46 - 00000196 _____ C:\Users\Lambert\Desktop\Gothic 3™.lnk
2017-05-20 15:02 - 2017-05-20 15:02 - 00000000 ____D C:\Users\Lambert\AppData\Local\AdvinstAnalytics
2017-05-20 15:01 - 2017-05-24 22:26 - 00000000 ____D C:\Program Files\Common Files\Noobzo
2017-05-20 15:01 - 2017-05-20 15:01 - 00006034 _____ C:\Windows\System32\Tasks\Arujogh Cloud
2017-05-20 15:01 - 2017-05-20 15:01 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Showuk
2017-05-20 15:01 - 2017-05-20 15:01 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Microleaves
2017-05-20 15:01 - 2017-05-20 15:01 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Google
2017-05-20 14:59 - 2017-05-20 15:00 - 00006088 _____ C:\Windows\System32\Tasks\Clihotain Configuration
2017-05-20 14:59 - 2017-05-20 14:59 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\UCChannel
2017-05-20 14:59 - 2017-05-20 14:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YeaDesktop
2017-05-20 14:58 - 2017-05-25 09:05 - 00000000 ____D C:\Program Files (x86)\Clihotain Configuration
2017-05-20 14:58 - 2017-05-25 09:03 - 00000000 ____D C:\Program Files\Common Files\509E0
2017-05-20 14:58 - 2017-05-20 14:58 - 08640000 _____ (Microsoft Corporation) C:\Windows\csrss.exe
2017-05-20 14:58 - 2017-05-20 14:58 - 00000000 ____D C:\Windows\Azart
2017-05-20 14:58 - 2017-05-20 14:58 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Prageghtthasuy
2017-05-20 14:58 - 2017-05-20 14:58 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Event Monitor
2017-05-20 14:57 - 2017-05-28 15:47 - 00016762 _____ C:\Windows\System32\Tasks\Keyboard Checksum Verifier
2017-05-20 14:57 - 2017-05-24 20:01 - 00002112 _____ C:\ProgramData\log.ewbt
2017-05-20 14:57 - 2017-05-24 20:01 - 00000128 _____ C:\ProgramData\log.ewbb
2017-05-20 14:57 - 2017-05-20 15:02 - 00000000 ____D C:\Users\Lambert\AppData\Local\Phoceshgrherry
2017-05-20 14:57 - 2017-05-20 14:57 - 00073216 _____ C:\Windows\taskmgr.exe
2017-05-20 14:57 - 2017-05-20 14:57 - 00000000 ____D C:\Users\Lambert\AppData\Local\kemgadeojglibflomicgnfeopkdfflnk
2017-05-20 13:38 - 2017-05-20 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Velvet Assassin
2017-05-20 13:10 - 2017-05-20 13:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gothic III
2017-05-18 12:03 - 2017-05-18 12:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Folder Size
2017-05-18 12:03 - 2017-05-18 12:03 - 00000000 ____D C:\Program Files (x86)\Folder Size
2017-05-18 10:26 - 2017-05-18 10:26 - 00000000 ____D C:\Users\Lambert\Documents\PCSX2
2017-05-18 10:23 - 2017-05-18 10:24 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-05-18 10:23 - 2017-05-18 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-02 12:23 - 2016-09-13 20:38 - 00000000 ____D C:\ProgramData\Origin
2017-06-02 12:11 - 2016-10-06 11:39 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Skype
2017-06-02 11:25 - 2016-09-13 17:31 - 00001501 _____ C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-06-02 11:25 - 2016-09-13 17:31 - 00001467 _____ C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2017-06-02 11:24 - 2016-11-01 01:57 - 00002050 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2017-06-02 11:24 - 2016-09-13 17:57 - 00002477 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-06-02 11:18 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-06-02 11:18 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-06-02 11:08 - 2016-09-13 18:48 - 00000000 ____D C:\ProgramData\NVIDIA
2017-06-02 11:08 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-02 10:22 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-06-02 09:30 - 2016-11-26 00:31 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\Mozilla
2017-06-02 08:40 - 2016-11-05 10:56 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\vlc
2017-06-01 18:07 - 2016-09-13 20:51 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Origin
2017-05-29 21:20 - 2017-03-01 22:47 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\TS3Client
2017-05-29 21:10 - 2010-11-21 14:53 - 00749618 _____ C:\Windows\system32\perfh015.dat
2017-05-29 21:10 - 2010-11-21 14:53 - 00161096 _____ C:\Windows\system32\perfc015.dat
2017-05-29 21:10 - 2009-07-14 07:13 - 01697332 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-28 20:26 - 2016-09-15 18:22 - 00000000 ____D C:\Users\Lambert\Documents\FIFA 14
2017-05-28 16:50 - 2016-10-01 13:20 - 00000000 ____D C:\Windows\system32\appmgmt
2017-05-28 15:47 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Keyboard Checksum Verifier
2017-05-28 11:17 - 2016-09-13 17:47 - 00000000 ____D C:\temp
2017-05-27 19:50 - 2017-02-12 19:16 - 00000000 ____D C:\Users\Lambert\AppData\Local\CrashDumps
2017-05-27 19:43 - 2016-09-13 17:50 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Mumble
2017-05-26 18:20 - 2016-10-14 22:28 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2017-05-25 22:13 - 2016-12-13 22:58 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\BitTorrent
2017-05-25 22:13 - 2016-12-13 22:29 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\BitTorrent
2017-05-25 22:01 - 2016-10-29 18:30 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\DAEMON Tools Lite
2017-05-25 11:03 - 2016-09-13 18:43 - 00000000 ____D C:\ProgramData\Package Cache
2017-05-24 22:37 - 2016-09-18 12:18 - 00000000 ____D C:\Windows\Minidump
2017-05-24 22:37 - 2016-09-13 18:00 - 00000000 ____D C:\Windows\Panther
2017-05-24 22:26 - 2016-10-06 11:39 - 00000000 ____D C:\ProgramData\Skype
2017-05-24 22:17 - 2016-10-06 14:03 - 00000000 ____D C:\Program Files\Common Files\AV
2017-05-24 22:15 - 2016-09-13 17:53 - 00063144 _____ C:\Users\Lambert\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-24 19:59 - 2009-07-14 06:45 - 00290848 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-24 18:13 - 2017-04-20 17:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2017-05-24 18:08 - 2017-04-20 17:32 - 00000000 ____D C:\Program Files (x86)\GOG Galaxy
2017-05-23 20:37 - 2016-09-13 23:38 - 00000000 ____D C:\Users\Lambert\Documents\Euro Truck Simulator 2
2017-05-22 18:23 - 2009-07-14 07:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-05-21 18:42 - 2016-09-13 20:16 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-05-21 18:41 - 2017-02-15 00:25 - 00245544 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2017-05-21 18:04 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2017-05-20 19:40 - 2016-12-18 19:00 - 00000000 ____D C:\ProgramData\TruckersMP
2017-05-20 18:31 - 2016-10-15 10:20 - 00000000 ___RD C:\Users\Lambert\Desktop\Gówno
2017-05-20 14:57 - 2016-09-14 19:01 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-05-20 13:38 - 2016-09-13 22:46 - 00000000 ____D C:\Users\Lambert\Documents\My Games
2017-05-20 13:10 - 2016-09-13 17:47 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-05-18 12:05 - 2017-02-14 19:45 - 00000000 ____D C:\ProgramData\Codemasters
2017-05-18 12:03 - 2017-02-11 20:38 - 02301330 _____ (MindGems, Inc. ) C:\Users\Lambert\Downloads\Folder Size Free 3.4.0.0 [1].exe
2017-05-18 11:51 - 2017-01-28 18:53 - 00000000 ____D C:\Gry
2017-05-17 22:53 - 2016-10-17 19:29 - 00000000 ____D C:\Users\Lambert\Documents\Witcher 2
2017-05-15 22:27 - 2017-03-30 20:22 - 00000000 ____D C:\Users\Lambert\Documents\Max Payne Savegames
2017-05-11 19:17 - 2016-11-20 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-11 19:17 - 2016-11-01 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-05-07 22:03 - 2016-12-16 19:56 - 00282296 _____ C:\Windows\SysWOW64\PnkBstrB.xtr
2017-05-07 22:03 - 2016-12-16 19:55 - 00282296 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2017-05-07 22:00 - 2016-12-16 19:55 - 00215128 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2017-05-04 22:54 - 2017-01-11 23:45 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Audacity
2017-05-04 18:10 - 2017-04-02 21:31 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\discord

==================== Pliki w katalogu głównym wybranych folderów =======

2017-05-28 08:09 - 2017-05-28 08:09 - 0007602 _____ () C:\Users\Lambert\AppData\Local\Resmon.ResmonCfg
2016-09-13 18:22 - 2016-09-13 18:22 - 0000000 _____ () C:\Users\Lambert\AppData\Local\{CDB39C7B-51CB-4A3E-BDF9-8D90DE43D449}
2016-09-13 20:00 - 2016-09-13 20:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2017-05-24 20:01 - 2017-05-24 20:02 - 0000132 _____ () C:\ProgramData\log.binb
2017-05-20 14:57 - 2017-05-24 20:01 - 0000128 _____ () C:\ProgramData\log.ewbb
2017-05-20 14:57 - 2017-05-24 20:01 - 0002112 _____ () C:\ProgramData\log.ewbt

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\Lambert\AppData\Local\background_fault\aswRD.exe


Niektóre pliki w TEMP:
====================
2014-11-08 10:33 - 2015-02-18 21:07 - 0564224 _____ () C:\Users\Lambert\AppData\Local\Temp\Quarantine.exe
2017-05-27 20:29 - 2017-05-27 20:29 - 13460656 _____ (Reimage) C:\Users\Lambert\AppData\Local\Temp\ReimagePackage.exe
2014-11-08 10:47 - 2014-10-17 13:39 - 0665682 _____ (SQLite Development Team) C:\Users\Lambert\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-05-14 11:19

==================== Koniec  FRST.txt ============================