Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x86) Wersja: 02-06-2017 Uruchomiony przez Aga (administrator) AGA-KOMPUTER (04-06-2017 12:24:39) Uruchomiony z D:\Pobieranie Załadowane profile: Aga & (Dostępne profile: Aga) Platform: Microsoft Windows 7 Ultimate (X86) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: Chrome) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Baidu, Inc.) C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavSvc.exe (Baidu, Inc.) C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Baidu, Inc.) C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BHipsSvc.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation) C:\Program Files\Intel\Bluetooth\BleServicesCtrl.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Sony Corporation) C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe (© 2015 Microsoft Corporation) C:\Users\Aga\AppData\Local\Microsoft\BingSvc\BingSvc.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.561\SSScheduler.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Sony Corporation) C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe (Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\devmonsrv.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\hidfind.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe (Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\obexsrv.exe (Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\mediasrv.exe (Motorola Solutions, Inc.) C:\Program Files\Intel\Bluetooth\btplayerctrl.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Lenovo) C:\Users\Aga\AppData\Local\Apps\2.0\PANCRABW.K66\K7YRAA8Y.4KW\lsb...tion_2d7b41b05b24775e_0001.0006_3b0a905c8de4f74a\LSB.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Baidu, Inc.) C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavUpdater.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe (Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe (Baidu, Inc.) C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\Bav.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe ==================== Rejestr (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [Baidu Antivirus] => C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavTray.exe [1998832 2016-02-13] (Baidu, Inc.) HKLM\...\Run: [Nvtmru] => "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe" HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286704 2013-05-08] (Intel Corporation) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [530776 2013-06-27] (Alps Electric Co., Ltd.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12005080 2013-08-20] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [978648 2013-08-06] (Realtek Semiconductor) HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-11] (Intel Corporation) HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files\Intel\Bluetooth\BleServicesCtrl.exe [159536 2012-09-17] (Intel Corporation) HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files\Intel\Bluetooth\btmshellex.dll",TrayApp HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM\...\Run: [] => [X] HKLM\...\Run: [PMBVolumeWatcher] => C:\Program Files\Sony\PlayMemories Home\PMBVolumeWatcher.exe [3005120 2017-04-04] (Sony Corporation) HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\...\Run: [BingSvc] => C:\Users\Aga\AppData\Local\Microsoft\BingSvc\BingSvc.exe [144008 2016-03-09] (© 2015 Microsoft Corporation) HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\...\Run: [mailruhomesearch] => "C:\Users\Aga\AppData\Local\Mail.Ru\Sputnik\ptls\mailruhomesearch.exe" --pr_deferred AppInit_DLLs: C:\Windows\system32\nvinit.dll => C:\Windows\system32\nvinit.dll [201576 2013-08-25] (NVIDIA Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => -> Brak pliku ShellIconOverlayIdentifiers: [BaiduAntivirusIconLock] -> {0A93904A-BB1E-4a0c-9753-B57B9AE272CC} => C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavShx.dll [2016-02-13] (Baidu, Inc.) Startup: C:\Users\Aga\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk [2016-02-19] ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2017-05-27] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.561\SSScheduler.exe (McAfee, Inc.) GroupPolicy: Ograniczenia ? <======= UWAGA GroupPolicy\User: Ograniczenia ? <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Hosts: 0.0.0.1 mssplus.mcafee.com Tcpip\Parameters: [DhcpNameServer] 46.175.236.1 192.168.0.1 Tcpip\Parameters: [NameServer] 82.163.142.7 95.211.158.134 Tcpip\..\Interfaces\{61DAA90B-BF4B-4A43-9CE6-42A0042F900A}: [NameServer] 82.163.142.7 95.211.158.134 Tcpip\..\Interfaces\{61DAA90B-BF4B-4A43-9CE6-42A0042F900A}: [DhcpNameServer] 46.175.236.1 192.168.0.1 Tcpip\..\Interfaces\{91F0582E-3F06-4984-8A0F-02FFF7CAC157}: [NameServer] 82.163.142.7 95.211.158.134 Tcpip\..\Interfaces\{B0EED1B6-CB08-48FD-8EC9-4DE53AF502C5}: [NameServer] 82.163.142.7 95.211.158.134 Tcpip\..\Interfaces\{EC6C85EE-BC11-4C4E-BC8E-22B7F884A041}: [NameServer] 82.163.142.7 95.211.158.134 Tcpip\..\Interfaces\{EC6C85EE-BC11-4C4E-BC8E-22B7F884A041}: [DhcpNameServer] 82.163.142.7 Tcpip\..\Interfaces\{EE020378-6564-467D-A549-964357A0CF26}: [NameServer] 82.163.142.7 95.211.158.134 Internet Explorer: ================== HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms} HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://mail.ru/cnt/10445?gp=811040 HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp URLSearchHook: [S-1-5-21-2516821565-3541718767-3179136043-1003] UWAGA => Brak domyślnego URLSearchHook SearchScopes: HKLM -> DefaultScope {ielnksrch} URL = SearchScopes: HKLM -> ielnksrch URL = hxxp://www.bing.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2516821565-3541718767-3179136043-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = SearchScopes: HKU\S-1-5-21-2516821565-3541718767-3179136043-1000 -> {ielnksrch} URL = hxxp://www.bing.com/search?q={searchTerms} BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2011-02-12] (Microsoft Corporation) BHO: Ďîčńę@Mail.Ru -> {8E8F97CD-60B5-456F-A201-73065652D099} -> C:\Users\Aga\AppData\Local\Mail.Ru\Sputnik\IESearchPlugin.dll => Brak pliku BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: 55l6ksat.default FF ProfilePath: C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default [2017-06-04] FF DefaultSearchEngine: Mozilla\Firefox\Profiles\55l6ksat.default -> Поиск@Mail.Ru FF SearchEngineOrder.3: Mozilla\Firefox\Profiles\55l6ksat.default -> Bing FF SelectedSearchEngine: Mozilla\Firefox\Profiles\55l6ksat.default -> Поиск@Mail.Ru FF Homepage: Mozilla\Firefox\Profiles\55l6ksat.default -> hxxp://mail.ru/cnt/10445?gp=811040 FF Keyword.URL: Mozilla\Firefox\Profiles\55l6ksat.default -> hxxp://go.mail.ru/distib/ep/?product_id=%7B25C21B7A-6853-49CB-8621-00AEAD9C316C%7D&gp=811041 FF Extension: (Bing Search) - C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\Extensions\bingsearch.full@microsoft.com.xpi [2016-03-09] FF Extension: (Firefox Hotfix) - C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\Extensions\firefox-hotfix@mozilla.org.xpi [2017-02-17] FF Extension: (Домашняя страница Mail.Ru) - C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\Extensions\homepage@mail.ru [2017-03-13] FF Extension: (Поиск@Mail.Ru) - C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\Extensions\search@mail.ru [2017-03-13] FF SearchPlugin: C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\searchplugins\bing-.xml [2016-03-09] FF SearchPlugin: C:\Users\Aga\AppData\Roaming\Mozilla\Firefox\Profiles\55l6ksat.default\searchplugins\mailru.xml [2017-03-13] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_25_0_0_171.dll [2017-05-13] () FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-05-16] (Intel Corporation) FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-05-16] (Intel Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-04] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-05-04] (Google Inc.) FF Plugin: @videolan.org/vlc,version=2.2.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.2.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2016-06-01] (VideoLAN) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.) Chrome: ======= CHR HomePage: Default -> msn.com/?pc=__PARAM__&ocid=__PARAM__DHP&osmkt=pl-pl CHR StartupUrls: Default -> "hxxp://google.pl/" CHR DefaultSearchURL: Default -> hxxp://www.bing.com/search?FORM=__PARAM__DF&PC=__PARAM__&q={searchTerms} CHR DefaultSearchKeyword: Default -> bing.com CHR Profile: C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default [2017-06-04] CHR Extension: (Prezentacje Google) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-02-13] CHR Extension: (Dokumenty Google) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-02-13] CHR Extension: (Dysk Google) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-02-13] CHR Extension: (YouTube) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-02-13] CHR Extension: (Adblock Plus) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-05-19] CHR Extension: (Google Search) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2016-02-13] CHR Extension: (Arkusze Google) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-02-13] CHR Extension: (Dokumenty Google offline) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-16] CHR Extension: (AdBlock) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2017-04-15] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-09] CHR Extension: (Gmail) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-02-13] CHR Extension: (Chrome Media Router) - C:\Users\Aga\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-05-13] CHR Profile: C:\Users\Aga\AppData\Local\Google\Chrome\User Data\System Profile [2016-02-13] CHR HKLM\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx CHR HKU\S-1-5-21-2516821565-3541718767-3179136043-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [fcfenmboojpjinhpgggodefccipikbpd] - hxxps://clients2.google.com/service/update2/crx Opera: ======= OPR Extension: (SearchWay) - C:\Users\Aga\AppData\Roaming\Opera Software\Opera Stable\Extensions\achhckalphdlhbnohjonneffefbmaddi [2017-03-13] ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S2 AdobeARMservice; C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe [82128 2016-09-08] () [Brak podpisu cyfrowego] R2 BavSvc; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BavSvc.exe [2791312 2016-02-13] (Baidu, Inc.) S3 BdSandboxSrv; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdSandboxSrv.exe [391200 2015-03-05] (Baidu, Inc.) R2 BHipsSvc; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BHipsSvc.exe [531232 2016-02-13] (Baidu, Inc.) R2 Bluetooth Device Monitor; C:\Program Files\Intel\Bluetooth\devmonsrv.exe [1132920 2013-06-25] (Motorola Solutions, Inc.) R2 Bluetooth Media Service; C:\Program Files\Intel\Bluetooth\mediasrv.exe [1366392 2013-04-23] (Motorola Solutions, Inc.) R2 Bluetooth OBEX Service; C:\Program Files\Intel\Bluetooth\obexsrv.exe [1153400 2013-04-23] (Motorola Solutions, Inc.) S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [279024 2013-08-12] (Intel Corporation) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [930240 2016-06-14] (NVIDIA Corporation) R2 HPSupportSolutionsFrameworkService; C:\Program Files\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [28552 2016-04-26] (Hewlett-Packard Company) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [583680 2013-02-13] (Intel(R) Corporation) [Brak podpisu cyfrowego] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-02-13] (Intel(R) Corporation) R2 Intel(R) ME Service; C:\Program Files\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-05-16] (Intel Corporation) R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-16] (Intel Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.561\McCHSvc.exe [321768 2017-05-16] (McAfee, Inc.) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [242928 2013-08-06] () R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation) S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [2904000 2016-06-14] (NVIDIA Corporation) S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2016704 2016-06-14] (NVIDIA Corporation) R2 PMBDeviceInfoProvider; C:\Program Files\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [505024 2017-04-04] (Sony Corporation) R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [6894960 2017-05-14] (Reimage®) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation) R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2526448 2013-08-06] (Intel® Corporation) ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R3 ACPIVPC; C:\Windows\System32\DRIVERS\AcpiVpc.sys [26392 2012-07-08] (Lenovo Corporation) S3 BdApiUtil; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdApiUtil.sys [101448 2016-02-13] (Baidu, Inc.) R3 bdark; C:\Windows\system32\drivers\bdark.sys [82376 2015-05-28] () S3 BdCameraProtect; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\BdCameraProtect.sys [21416 2016-02-13] (Baidu, Inc.) S3 BdSandbox; C:\Windows\System32\drivers\BdSandbox.sys [197624 2015-03-05] (Baidu, Inc.) R1 Bfilter; C:\Windows\System32\drivers\Bfilter.sys [50120 2016-02-13] (Baidu, Inc.) R1 Bfmon; C:\Windows\System32\drivers\Bfmon.sys [31176 2016-02-13] (Baidu, Inc.) R0 Bhbase; C:\Windows\System32\drivers\Bhbase.sys [81736 2016-02-13] (Baidu, Inc.) S3 BHipsEx; C:\Windows\System32\drivers\BHipsEx.sys [138184 2016-02-13] (Baidu, Inc.) R1 Bnbase; C:\Windows\System32\drivers\bnbasex.sys [75432 2016-02-13] (Baidu, Inc.) R1 Bndef; C:\Windows\System32\drivers\bndef.sys [461224 2016-02-13] (Baidu, Inc.) R3 Bnmon; C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.148966.0\Bnmon.sys [84936 2016-02-13] (Baidu, Inc.) R1 Bprotect; C:\Windows\System32\drivers\Bprotect.sys [197064 2016-02-13] (Baidu, Inc.) R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [109880 2013-04-23] (Motorola Solutions, Inc.) R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1097528 2013-04-23] (Motorola Solutions, Inc.) R0 iaStorA; C:\Windows\System32\DRIVERS\iaStorA.sys [542192 2013-05-08] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [26608 2013-05-08] (Intel Corporation) R3 ibtusb; C:\Windows\System32\DRIVERS\ibtusb.sys [102856 2013-07-01] (Intel Corporation) R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-04-11] (Intel Corporation) R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [359408 2013-04-11] (Intel Corporation) R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [792560 2013-04-11] (Intel Corporation) R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-01-11] (Intel Corporation) R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwsn02.sys [2914784 2013-08-15] (Intel Corporation) R0 nvpciflt; C:\Windows\System32\DRIVERS\nvpciflt.sys [25376 2013-08-25] (NVIDIA Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26048 2016-06-14] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [50744 2016-04-14] (NVIDIA Corporation) S3 ALSysIO; \??\C:\Users\Aga\AppData\Local\Temp\ALSysIO.sys [X] U0 aswVmm; Brak ImagePath ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-04 12:24 - 2017-06-04 12:24 - 00000000 ____D C:\FRST 2017-06-04 11:53 - 2017-06-04 12:01 - 00000000 ____D C:\ProgramData\Reimage Protector 2017-06-04 11:53 - 2017-06-04 12:01 - 00000000 ____D C:\Program Files\Reimage 2017-06-04 11:53 - 2017-06-04 12:00 - 00000140 _____ C:\Windows\Reimage.ini 2017-06-01 18:12 - 2017-06-01 18:12 - 00000000 ____D C:\IZRAEL film 2017-05-27 21:00 - 2017-05-27 21:00 - 00002045 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2017-05-27 21:00 - 2017-05-27 21:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2017-05-27 20:59 - 2017-05-27 20:59 - 00000000 ____D C:\ProgramData\McAfee Security Scan 2017-05-06 08:59 - 2017-05-06 09:03 - 00000000 ____D C:\Users\Aga\Desktop\pomysły na działkę ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2017-06-04 12:04 - 2016-02-13 21:39 - 00000000 ____D C:\ProgramData\BavSvc_exe 2017-06-04 12:02 - 2016-02-13 21:53 - 00000284 _____ C:\Windows\Tasks\Price Fountain.job 2017-06-04 11:54 - 2016-02-14 00:14 - 00000000 ____D C:\Users\UpdatusUser 2017-06-04 11:48 - 2016-02-15 12:54 - 00000000 ____D C:\Windows\system32\appmgmt 2017-06-04 11:46 - 2016-10-30 22:38 - 00000000 ____D C:\Program Files\Morgan 2017-06-03 21:33 - 2016-05-17 22:28 - 00000312 _____ C:\Windows\Tasks\HPCeeScheduleForAga.job 2017-06-01 21:26 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF 2017-06-01 21:25 - 2009-07-14 06:34 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2017-06-01 21:25 - 2009-07-14 06:34 - 00010016 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2017-06-01 21:22 - 2016-02-13 20:51 - 01697448 _____ C:\Windows\system32\PerfStringBackup.INI 2017-06-01 21:22 - 2009-07-14 10:07 - 00753438 _____ C:\Windows\system32\perfh015.dat 2017-06-01 21:22 - 2009-07-14 10:07 - 00160250 _____ C:\Windows\system32\perfc015.dat 2017-06-01 21:22 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf 2017-06-01 21:19 - 2016-02-13 21:00 - 00000000 ____D C:\Users\Aga\AppData\Local\Deployment 2017-06-01 21:17 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2017-06-01 18:49 - 2016-02-13 23:33 - 00000000 ____D C:\Users\Aga\AppData\Roaming\vlc 2017-05-27 20:59 - 2016-03-02 18:50 - 00000000 ____D C:\Program Files\McAfee Security Scan 2017-05-16 21:59 - 2016-02-13 21:25 - 00002147 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2017-05-16 21:59 - 2016-02-13 21:25 - 00002135 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2017-05-16 09:49 - 2017-03-31 22:39 - 00000000 ____D C:\Users\Aga\AppData\Local\Microsoft Games 2017-05-13 14:38 - 2016-03-02 18:50 - 00803320 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2017-05-13 14:38 - 2016-03-02 18:50 - 00144888 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2017-05-13 14:38 - 2016-03-02 18:50 - 00000000 ____D C:\Windows\system32\Macromed 2017-05-10 17:06 - 2016-02-13 20:46 - 00000000 ____D C:\Users\Aga 2017-05-06 08:59 - 2017-01-13 14:24 - 00000000 ____D C:\Users\Aga\Desktop\PULPIT ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-02-13 22:12 - 2016-02-13 22:12 - 7767040 _____ () C:\Users\Aga\AppData\Roaming\agent.dat 2016-02-13 22:12 - 2016-02-13 22:12 - 0062976 _____ () C:\Users\Aga\AppData\Roaming\Config.xml 2016-02-13 22:11 - 2016-02-13 22:12 - 0010944 _____ () C:\Users\Aga\AppData\Roaming\InstallationConfiguration.xml 2016-02-13 22:11 - 2016-02-13 22:11 - 0126976 _____ () C:\Users\Aga\AppData\Roaming\Installer.dat 2016-02-13 22:12 - 2016-02-13 22:12 - 0018432 _____ () C:\Users\Aga\AppData\Roaming\Main.dat 2016-02-13 22:12 - 2016-02-13 22:12 - 0005568 _____ () C:\Users\Aga\AppData\Roaming\md.xml 2016-02-13 22:12 - 2016-02-13 22:12 - 0126464 _____ () C:\Users\Aga\AppData\Roaming\noah.dat 2016-02-13 22:12 - 2016-02-13 22:12 - 1828370 _____ () C:\Users\Aga\AppData\Roaming\TrueLax.tst 2016-02-13 22:12 - 2016-02-13 22:12 - 0032038 _____ () C:\Users\Aga\AppData\Roaming\uninstall_temp.ico 2016-02-13 22:53 - 2016-02-14 11:21 - 0000067 _____ () C:\Users\Aga\AppData\Roaming\WB.CFG 2016-04-25 20:05 - 2016-04-25 20:05 - 0000000 _____ () C:\Users\Aga\AppData\Local\{4F53AA78-FE9E-4769-B97D-CCF83A64758B} 2016-05-07 04:02 - 2016-05-07 04:02 - 0000000 _____ () C:\Users\Aga\AppData\Local\{C8BB3E69-11C4-4B6B-B098-FF9E0CCB1647} 2016-02-28 22:50 - 2016-03-02 18:36 - 0000085 ___SH () C:\ProgramData\.zreglib 2016-02-19 23:06 - 2016-02-19 23:06 - 0000057 _____ () C:\ProgramData\Ament.ini 2016-02-14 00:46 - 2016-02-14 00:46 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Niektóre pliki w TEMP: ==================== 2016-02-28 13:09 - 2016-02-28 13:09 - 0005632 _____ () C:\Users\Aga\AppData\Local\Temp\5thfw9zi.dll 2017-06-04 11:46 - 2016-10-30 22:38 - 0033559 _____ () C:\Users\Aga\AppData\Local\Temp\A~NSISu_.exe 2016-03-09 22:29 - 2016-03-09 22:29 - 0144008 _____ (© 2015 Microsoft Corporation) C:\Users\Aga\AppData\Local\Temp\BingSvc.exe 2016-03-09 22:29 - 2016-03-09 22:29 - 1118360 _____ (© 2015 Microsoft Corporation) C:\Users\Aga\AppData\Local\Temp\BSvcProcessor.exe 2016-03-09 22:29 - 2016-03-09 22:29 - 0170128 _____ (© 2015 Microsoft Corporation) C:\Users\Aga\AppData\Local\Temp\BSvcUpdater.exe 2016-03-09 22:19 - 2016-03-09 22:19 - 2612880 _____ (Microsoft Corporation) C:\Users\Aga\AppData\Local\Temp\DefaultPack.EXE 2016-03-02 18:44 - 2016-03-02 18:44 - 1112881 _____ (Docesipete ) C:\Users\Aga\AppData\Local\Temp\ICReinstall_c[1].exe 2016-02-28 22:26 - 2016-02-28 22:44 - 1100108 _____ ( ) C:\Users\Aga\AppData\Local\Temp\ICReinstall_SetupCloneCD.exe 2017-03-17 20:48 - 2017-03-14 15:08 - 4114192 _____ (Mail.Ru) C:\Users\Aga\AppData\Local\Temp\mrutmp.exe 2016-03-16 23:27 - 2016-03-08 08:05 - 0721768 _____ (NVIDIA Corporation) C:\Users\Aga\AppData\Local\Temp\nvSCPAPI.dll 2016-07-14 22:06 - 2016-03-08 08:05 - 0325688 _____ (NVIDIA Corporation) C:\Users\Aga\AppData\Local\Temp\nvStInst.exe 2011-04-01 12:57 - 2011-04-01 12:57 - 0149352 _____ (Microsoft Corporation) C:\Users\Aga\AppData\Local\Temp\ose00000.exe 2017-06-04 11:53 - 2017-06-04 11:53 - 12152528 _____ (Reimage) C:\Users\Aga\AppData\Local\Temp\ReimagePackage.exe ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2017-06-02 00:20 ==================== Koniec FRST.txt ============================