Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 08-07-2017
Uruchomiony przez mateusz (administrator)  OLTA (08-07-2017 15:21:35)
Uruchomiony z G:\
Załadowane profile: mateusz (Dostępne profile: UpdatusUser & Ola & Asia & mateusz & Administrator)
Platform: Windows 10 Home Wersja 1511 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka nie została wykryta!)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Intel Corporation) C:\Windows\SysWOW64\IntelCpHeciSvc.exe
(ArtistScope Pty Ltd) C:\Program Files\Common Files\ArtistScope\CSHelper64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331STI.EXE
(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Cyberlink) C:\Program Files (x86)\Lenovo\Power2Go\Power2Go.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [3242696 2015-10-07] (ELAN Microelectronics Corp.)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [935104 2014-11-25] (Conexant Systems, Inc.)
HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [17080376 2012-10-28] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [191544 2012-10-28] (Lenovo(beijing) Limited)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1830616 2014-04-10] (Conexant Systems, Inc.)
HKLM-x32\...\Run: [331BigDog] => C:\Program Files (x86)\USB Camera\VM331STI.EXE [561672 2015-06-12] (Vimicro)
HKLM-x32\...\Run: [332BigDog] => C:\Program Files (x86)\USB Camera2\VM332STI.EXE
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-07-25] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2012-07-27] (CyberLink)
HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167024 2012-07-27] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] => C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [mbot_pl_185] => [X]
HKLM-x32\...\Run: [gmsd_pl_71] => [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
AppInit_DLLs: C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [183144 2017-01-17] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [161016 2017-01-17] (NVIDIA Corporation)
GroupPolicy: Ograniczenia - Chrome <==== UWAGA
CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <==== UWAGA

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Winsock: Catalog5-x64 04 %SystemRoot%\system32\NLAapi.dll => Brak pliku 
Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{9db80c2c-e85e-41ed-a423-5049335638be}: [DhcpNameServer] 8.8.8.8 8.8.4.4

Internet Explorer:
==================
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=130903587206560641&GUID=255055FB-833B-4290-87E2-029C4B78C4FD
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.v9.com/?type=hp&ts=1442215201&from=mych123&uid=st1000lm024xhn-m101mbb_s2u5j9aca14615&z=23df97d8514a3f1c22729ebg5zezbo6o6g1w4ebzfm
HKU\S-1-5-21-1905935580-2008056121-2251755093-1009\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
HKU\S-1-5-21-1905935580-2008056121-2251755093-1009\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
HKU\S-1-5-21-1905935580-2008056121-2251755093-1009\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com
SearchScopes: HKLM-x32 -> {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = hxxp://www.v9.com/web?type=ds&ts=1425448469&from=zbd1&uid=st1000lm024xhn-m101mbb_s2u5j9aca14615&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Brak nazwy -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> Brak pliku
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-02-10] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-02-10] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF HKLM-x32\...\Firefox\Extensions: [searchengine@gmail.com] - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\v2mxewxr.default\extensions\searchengine@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [istart_ffnt@gmail.com] - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\v2mxewxr.default\extensions\istart_ffnt@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [quick_searchff@gmail.com] - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\v2mxewxr.default\extensions\quick_searchff@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sweetsearch@gmail.com] - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\v2mxewxr.default\extensions\sweetsearch@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\9pxclggc.default-1446389850467\extensions\arthurj8283@gmail.com
FF Extension: (xRocket Toolbar) - C:\Users\Ola\AppData\Roaming\Mozilla\Firefox\Profiles\9pxclggc.default-1446389850467\extensions\arthurj8283@gmail.com [2015-11-02] [Brak podpisu cyfrowego]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => nie znaleziono
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_26_0_0_131.dll [2017-06-24] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_131.dll [2017-06-24] ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll [2014-06-06] (Google, Inc.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-02-10] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-02-10] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50906.0\npctrl.dll [2017-03-09] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL [2012-12-19] (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-28] (Google Inc.)

Chrome: 
=======
CHR Profile: C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default [2017-07-08]
CHR Extension: (Prezentacje Google) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-07-08]
CHR Extension: (Dokumenty Google) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-07-08]
CHR Extension: (Dysk Google) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-07-08]
CHR Extension: (YouTube) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-07-08]
CHR Extension: (Arkusze Google) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-07-08]
CHR Extension: (Dokumenty Google offline) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-07-08]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-07-08]
CHR Extension: (Gmail) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-07-08]
CHR Extension: (Chrome Media Router) - C:\Users\mateusz.Olta\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-08]
CHR HKLM-x32\...\Chrome\Extension: [aaaaifmhgonleehnkppkhhchcbhhigac] - C:\Users\Ola\AppData\Local\koyotesoftmoviestoolbar\GC\toolbar.crx [2013-06-25]
CHR HKLM-x32\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files (x86)\BonanzaDeals\BonanzaDeals.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [ojcgaoafcmbadjkfdippkdddgkeaipbn] - C:\Program Files (x86)\DealPly\DealPly.crx <nie znaleziono>

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R4 CSHelper; C:\Program Files\Common Files\ArtistScope\CSHelper64.exe [361552 2013-10-08] (ArtistScope Pty Ltd)
S4 Disc Soft Lite Bus Service; C:\Program Files (x86)\DAEMON Tools Lite\DiscSoftBusService.exe [1443520 2016-04-04] (Disc Soft Ltd)
R4 ETDService; C:\Program Files\Elantech\ETDService.exe [144072 2015-10-07] (ELAN Microelectronics Corp.)
R4 igfxCUIService1.0.0.0; C:\WINDOWS\system32\igfxCUIService.exe [330136 2015-08-27] (Intel Corporation)
R4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R4 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-12-29] (NVIDIA Corporation)
R4 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [304456 2017-02-07] ()
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2016-10-25] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2017-03-28] (Microsoft Corporation)
R4 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-08-12] (Atheros) [Brak podpisu cyfrowego]
S4 NlaSvc; %SystemRoot%\System32\nlasvc.dll [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 CH341SER_A64; C:\WINDOWS\System32\Drivers\CH341S64.SYS [58368 2011-11-04] (www.winchiphead.com)
R1 CSDriver; C:\Program Files\Common Files\ArtistScope\CSDriver64.sys [61424 2013-10-08] ()
S3 dg_ssudbus; C:\WINDOWS\system32\DRIVERS\ssudbus.sys [131712 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 dtlitescsibus; C:\WINDOWS\System32\drivers\dtlitescsibus.sys [30264 2016-05-08] (Disc Soft Ltd)
R3 dtliteusbbus; C:\WINDOWS\System32\drivers\dtliteusbbus.sys [47672 2016-05-08] (Disc Soft Ltd)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115448 2013-11-21] (EZB Systems, Inc.)
S3 ssudmdm; C:\WINDOWS\system32\DRIVERS\ssudmdm.sys [165504 2016-09-05] (Samsung Electronics Co., Ltd.)
R3 vm331avs; C:\WINDOWS\System32\Drivers\vm331avs.sys [802312 2015-06-12] (Vimicro Corporation)
S0 WdBoot; C:\WINDOWS\System32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
R0 WdFilter; C:\WINDOWS\System32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 wdm_usb; C:\WINDOWS\system32\DRIVERS\usb2ser.sys [159936 2016-08-16] (MBB)
R3 WdNisDrv; C:\WINDOWS\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)
S3 wsvd; C:\WINDOWS\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
R1 {29b136c9-938d-4d3d-8df8-d649d9b74d02}w64; C:\WINDOWS\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys [60704 2014-06-09] () [Brak podpisu cyfrowego]
R1 {62469e06-7e58-4462-b250-e2bdf049adec}Gw64; C:\WINDOWS\System32\drivers\{62469e06-7e58-4462-b250-e2bdf049adec}Gw64.sys [48792 2015-03-21] () [Brak podpisu cyfrowego]
R1 {c5e48979-bd7f-4cf7-9b73-2482a67a4f37}w64; C:\WINDOWS\System32\drivers\{c5e48979-bd7f-4cf7-9b73-2482a67a4f37}w64.sys [44688 2014-09-22] () [Brak podpisu cyfrowego]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-07-08 15:18 - 2017-07-08 15:21 - 00000000 ____D C:\FRST
2017-07-08 15:13 - 2017-07-08 15:13 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\CyberLink
2017-07-08 15:09 - 2017-07-08 15:09 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\LSC
2017-07-08 15:08 - 2017-07-08 15:08 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\LSC
2017-07-08 15:06 - 2017-07-08 15:06 - 00003638 _____ C:\WINDOWS\System32\Tasks\CreateExplorerShellUnelevatedTask
2017-07-08 15:02 - 2017-07-08 15:02 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\Skype
2017-07-08 15:01 - 2017-07-08 15:03 - 00002478 _____ C:\Users\mateusz.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-07-08 15:01 - 2017-07-08 15:03 - 00000000 ___RD C:\Users\mateusz.Olta\OneDrive
2017-07-08 15:01 - 2017-07-08 15:01 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\VirtualStore
2017-07-08 15:00 - 2017-07-08 15:20 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\Google
2017-07-08 15:00 - 2017-07-08 15:08 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\Adobe
2017-07-08 15:00 - 2017-07-08 15:02 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\Packages
2017-07-08 15:00 - 2017-07-08 15:00 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\ActiveSync
2017-07-08 14:57 - 2017-07-08 15:13 - 00001133 _____ C:\Users\mateusz.Olta\Desktop\Cyberlink Power2Go.lnk
2017-07-08 14:57 - 2017-07-08 15:01 - 00000000 ____D C:\Users\mateusz.Olta
2017-07-08 14:57 - 2017-07-08 14:57 - 00000020 ___SH C:\Users\mateusz.Olta\ntuser.ini
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Ustawienia lokalne
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Szablony
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Moje dokumenty
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Menu Start
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Documents\Moje wideo
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Documents\Moje obrazy
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Documents\Moja muzyka
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\Dane aplikacji
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\AppData\Local\Historia
2017-07-08 14:57 - 2017-07-08 14:57 - 00000000 _SHDL C:\Users\mateusz.Olta\AppData\Local\Dane aplikacji
2017-07-08 14:57 - 2016-04-17 00:55 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2017-07-08 14:57 - 2016-04-17 00:55 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Roaming\Macromedia
2017-07-08 14:57 - 2016-04-17 00:55 - 00000000 ____D C:\Users\mateusz.Olta\AppData\Local\Microsoft Help
2017-07-08 14:57 - 2010-12-19 07:31 - 00000189 _____ C:\Users\mateusz.Olta\Desktop\Lenovo Telephony Start Now.url
2017-07-08 14:51 - 2017-07-08 14:51 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Roaming\Skype
2017-07-08 14:51 - 2017-07-08 14:51 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\LSC
2017-07-08 14:44 - 2017-07-08 14:52 - 00002492 _____ C:\Users\Administrator.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2017-07-08 14:44 - 2017-07-08 14:52 - 00000000 ___RD C:\Users\Administrator.Olta\OneDrive
2017-07-08 14:43 - 2017-07-08 14:43 - 00000000 __SHD C:\Users\Administrator\IntelGraphicsProfiles
2017-07-08 14:43 - 2017-07-08 14:43 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\Google
2017-07-08 14:42 - 2017-07-08 14:45 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\Packages
2017-07-08 14:42 - 2017-07-08 14:42 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\ActiveSync
2017-07-08 14:04 - 2017-07-08 14:04 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\Adobe
2017-07-08 14:03 - 2017-07-08 14:03 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Roaming\LSC
2017-07-08 14:03 - 2017-07-08 14:03 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Roaming\Adobe
2017-07-08 14:02 - 2017-07-08 14:44 - 00000000 ____D C:\Users\Administrator.Olta
2017-07-08 14:02 - 2017-07-08 14:02 - 00000020 ___SH C:\Users\Administrator.Olta\ntuser.ini
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Ustawienia lokalne
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Szablony
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Moje dokumenty
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Menu Start
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Documents\Moje wideo
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Documents\Moje obrazy
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Documents\Moja muzyka
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\Dane aplikacji
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programy
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\AppData\Local\Historia
2017-07-08 14:02 - 2017-07-08 14:02 - 00000000 _SHDL C:\Users\Administrator.Olta\AppData\Local\Dane aplikacji
2017-07-08 14:02 - 2016-04-17 00:55 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo
2017-07-08 14:02 - 2016-04-17 00:55 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Roaming\Macromedia
2017-07-08 14:02 - 2016-04-17 00:55 - 00000000 ____D C:\Users\Administrator.Olta\AppData\Local\Microsoft Help
2017-07-08 14:02 - 2012-10-28 12:50 - 00001151 _____ C:\Users\Administrator.Olta\Desktop\Cyberlink Power2Go.lnk
2017-07-08 14:02 - 2010-12-19 07:31 - 00000189 _____ C:\Users\Administrator.Olta\Desktop\Lenovo Telephony Start Now.url
2017-07-08 01:53 - 2017-07-08 13:21 - 00461826 _____ C:\WINDOWS\ntbtlog.txt
2017-07-08 01:41 - 2017-07-08 01:41 - 00012864 ____N C:\bootsqm.dat
2017-07-07 23:36 - 2017-07-07 23:36 - 00000000 ___HD C:\$Windows.~BT
2017-07-07 23:34 - 2017-07-07 23:59 - 00000000 ___HD C:\$SysReset
2017-07-07 22:23 - 2017-07-07 23:59 - 00000000 _____ C:\Recovery.txt

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-07-08 15:12 - 2016-04-17 01:07 - 00005434 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2017-07-08 15:12 - 2016-02-13 19:29 - 08289522 _____ C:\WINDOWS\system32\perfh015.dat
2017-07-08 15:12 - 2016-02-13 19:29 - 02415078 _____ C:\WINDOWS\system32\perfc015.dat
2017-07-08 15:00 - 2016-02-13 19:52 - 00000000 __RHD C:\Users\Public\AccountPictures
2017-07-08 14:52 - 2016-12-09 21:04 - 00003284 _____ C:\WINDOWS\System32\Tasks\OneDrive Standalone Update Task v2
2017-07-08 14:43 - 2014-10-08 17:29 - 00000000 ____D C:\Users\Administrator
2017-07-08 14:37 - 2016-04-17 00:39 - 00000000 ____D C:\ProgramData\NVIDIA
2017-07-08 14:37 - 2016-02-13 19:48 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2017-07-08 14:03 - 2015-03-01 12:51 - 00004202 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{339DDF33-043B-47BE-B925-41BF31E1254F}
2017-07-08 13:22 - 2015-10-30 08:28 - 01310720 ___SH C:\WINDOWS\system32\config\BBI
2017-07-08 03:26 - 2015-03-28 11:32 - 00000000 ___RD C:\Users\Asia\Desktop\6rG#@E W[5 3
2017-07-08 00:48 - 2016-04-17 00:44 - 00000000 ____D C:\Users\Asia
2017-07-02 15:33 - 2014-10-25 14:51 - 00002289 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2017-07-02 15:33 - 2014-10-25 14:51 - 00002277 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2017-07-02 15:28 - 2016-07-16 11:16 - 00000000 ____D C:\Program Files\ByteFence
2017-06-24 17:29 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\SysWOW64\Macromed
2017-06-24 17:29 - 2015-10-30 09:24 - 00000000 ____D C:\WINDOWS\system32\Macromed
2017-06-24 17:18 - 2017-05-03 02:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-06-24 17:18 - 2013-03-28 11:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

==================== Pliki w katalogu głównym wybranych folderów =======

2012-10-28 12:29 - 2012-10-28 12:29 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Niektóre pliki w TEMP:
====================
2016-05-08 13:40 - 2016-05-08 13:40 - 0102912 _____ () C:\Users\Ola\AppData\Local\Temp\bitool.dll
2016-11-16 13:08 - 2016-11-16 13:10 - 2550648 _____ (Google Inc.) C:\Users\Ola\AppData\Local\Temp\{F9E8AE92-E546-4912-A3A7-AC2844CA7F4D}-54.0.2840.99_54.0.2840.71_chrome_updater.exe

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-07-02 15:44

==================== Koniec  FRST.txt ============================