Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 30-07-2017
Uruchomiony przez Admin (administrator)  ADMIN-KOMPUTER (30-07-2017 19:18:13)
Uruchomiony z C:\Users\Admin\Desktop
Załadowane profile: Admin (Dostępne profile: Admin)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 8 (Domyślna przeglądarka: Opera)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Digital Wave Ltd.) C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.5\GoogleCrashHandler64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Spotify Ltd) C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Trazege и Guilds Team, World of Gothic RU) C:\Users\Admin\Documents\Gothicowe pliki!\j\Ret.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Lisabon) C:\Users\Admin\Documents\Gothicowe pliki!\j\Soft\MS_VisualC_Redist_Hybrid\VCR_Hybrid_x86\VCR_Hybrid_x86.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Opera Software) C:\Program Files (x86)\Opera\46.0.2597.57\opera.exe
(Microsoft Corporation) C:\Users\Admin\AppData\Local\Temp\VCRedist\VCRedist_2012_x86_False_v\11.0.50727.1\vcredist_x86_eng.exe
(Microsoft Corporation) C:\Users\Admin\AppData\Local\Temp\VCRedist\VCRedist_2012_x86_False_v\11.0.50727.1\vcredist_x86_eng.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-05-28] (NVIDIA Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [8466648 2015-05-15] (Realtek Semiconductor)
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirna.exe [240400 2016-12-06] (AVG Technologies CZ, s.r.o.)
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\...\Run: [Spotify Web Helper] => C:\Users\Admin\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1433712 2016-12-02] (Spotify Ltd)
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\...\Run: [Spotify] => C:\Users\Admin\AppData\Roaming\Spotify\Spotify.exe [7071344 2016-12-02] (Spotify Ltd)
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8944344 2016-09-28] (Piriform Ltd)
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\...\Policies\Explorer: [NoWindowsUpdate] 1
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2010-11-20] (Microsoft Corporation)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{19CA2A02-6A64-4D33-80EB-706C9F9F9E36}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{3C28A88B-73B6-4484-BA9E-34E53803C0EA}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{B3672176-33E1-4B4A-805F-53030F4F266B}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\S-1-5-21-3109908236-30789010-4173930357-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
BHO: YoukuEyeOnIE64 Class -> {509DC5B8-F673-4102-B86E-5BF20BF4EE54} -> C:\Users\Admin\AppData\Roaming\ytmediacenter\X64\ykcool64.dll => Brak pliku
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12] (Microsoft Corporation)
BHO-x32: YoukuEyeOnIE Class -> {7DC4B5B6-C122-44C4-825C-B310513A47CB} -> C:\Users\Admin\AppData\Roaming\ytmediacenter\ykcool.dll => Brak pliku
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-20] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-20] (Microsoft Corporation)

FireFox:
========
FF DefaultProfile: pg5km707.default
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\pg5km707.default [2016-12-06] <==== UWAGA
FF Extension: (English (US) Language Pack) - C:\Users\Admin\AppData\Roaming\Firefox\Firefox\Profiles\pg5km707.default\Extensions\langpack-en-US@firefox.mozilla.org.xpi [2016-12-01] [Brak podpisu cyfrowego]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-28] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-28] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.5\npGoogleUpdate3.dll [2017-04-29] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-07-02] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3109908236-30789010-4173930357-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-05-08] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-3109908236-30789010-4173930357-1000: youku.com/YoukuAgent -> C:\Users\Admin\AppData\Roaming\ytmediacenter\npYoukuAgent.dll [Brak pliku]
FF Plugin HKU\S-1-5-21-3109908236-30789010-4173930357-1000: youku.com/YoukuAgent_x86_64 -> C:\Users\Admin\AppData\Roaming\ytmediacenter\X64\npYoukuAgent_x64.dll [Brak pliku]

Chrome: 
=======
CHR DefaultProfile: ChromeDefaultData
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData [2017-07-29] <==== UWAGA
CHR Extension: (Dokumenty Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\aohghmighlieiainnegkcijnfilokake [2016-10-20]
CHR Extension: (Dysk Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-10-20]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-10-20]
CHR Extension: (Dokumenty Google offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-10-14]
CHR Extension: (Skype) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2017-07-28]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-03-17]
CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-10-20]
CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ChromeDefaultData\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-07-23]
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default [2017-07-24]
CHR Extension: (Prezentacje Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-07-12]
CHR Extension: (Dokumenty Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-07-28]
CHR Extension: (Dysk Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-05-27]
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-05-27]
CHR Extension: (Google Search) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-07-28]
CHR Extension: (Arkusze Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-07-12]
CHR Extension: (Dokumenty Google offline) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-05-27]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-06-19]
CHR Extension: (Fast search) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pbdpajcdgknpendpmecafmopknefafha [2016-12-03]
CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-07-28]
CHR Extension: (Chrome Media Router) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-09-04]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - hxxps://clients2.google.com/service/update2/crx

Opera: 
=======
OPR Session Restore: -> [funkcja włączona]
OPR Extension: (Adblock Plus) - C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2017-07-12]

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1146128 2016-12-06] (AVG Technologies CZ, s.r.o.)
S2 AxAutoMntSrv; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [39376 2015-03-12] (Alcohol Soft Development Team)
R2 DigitalWave.Update.Service; C:\Program Files (x86)\Common Files\DVDVideoSoft\lib\app_updater.exe [440808 2017-03-22] (Digital Wave Ltd.)
S3 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-28] (NVIDIA Corporation)
S2 MCSvc; C:\ProgramData\Microsoft\Blend\14.0\1033\ResourceCacher.dll [350208 2016-12-06] () [Brak podpisu cyfrowego] <==== UWAGA
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [7760504 2017-02-15] (INCA Internet Co., Ltd.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-05-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23006864 2015-05-28] (NVIDIA Corporation)
S3 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [Brak podpisu cyfrowego]
S2 Themes; C:\Windows\system32\themeservice.dll [44544 2009-07-14] (Microsoft Corporation) [DependOnService: iThemes5]<==== UWAGA
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 BattlenetCommonFiles; "C:\Program Files (x86)\Battle.net\BattlenetCommonFiles.exe" c54102ea829e4d458c86147e71427a8f [X]
S2 Convxxxx; "C:\Users\Admin\AppData\Roaming\bfibe\UvConverter.exe" {2C8E8C85-942B-451C-8243-97A089265577} [X]
S2 ed2kidle; "C:\Program Files (x86)\amuleC\ed2k.exe" -downloadwhenidle [X] <==== UWAGA
S2 IntelIntel; "C:\Intel\IntelIntel.exe" 3e19779b2974487e881c2174c0562504 [X]
S4 MKJogoRealtek; "C:\Program Files (x86)\Realtek\MKJogoRealtek.exe" ae2ce54ab1294744903dca4a5f8539bf [X]
S4 MKJogoRemoteMouse; "C:\Program Files (x86)\MKJogo\MKJogoRemoteMouse.exe" 420f678469254505a655a4b567f7c9a0 [X]
S3 Origin Client Service; "C:\Program Files (x86)\Origin\OriginClientService.exe" [X]
S2 RiotGamesUsers; "C:\Riot Games\RiotGamesUsers.exe" 388837891c4f496ea6203a5f71b2a421 [X]
S2 SkypeMSBuild; "C:\Program Files (x86)\Skype\SkypeMSBuild.exe" e47b5abf08794d6b8b774f94eeb062f4 [X]
S2 UsersNVIDIA; "C:\Users\UsersNVIDIA.exe" b48f42ba07304dd38f2ef02dfd46c678 [X]
S3 WebServe; C:\Program Files (x86)\YouKu\YoukuClient\WebServe.exe [X]
S2 WooxySpacekace; "C:\Wooxy\WooxySpacekace.exe" affe6dc7e5264e7e8e5695737342bee0 [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2017-06-03] () [Brak podpisu cyfrowego]
R2 KuaiZipDrive2; C:\Windows\system32\drivers\KuaiZipDrive2.sys [93072 2016-10-14] (WinMount International Inc) <==== UWAGA
S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2017-06-03] () [Brak podpisu cyfrowego]
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-05-28] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2016-01-05] (Duplex Secure Ltd.)
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-02] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== UWAGA
S3 WinRing0_1_2_0; C:\Program Files (x86)\IObit\Game Booster 3\Driver\WinRing0x64.sys [14544 2010-11-01] (OpenLibSys.org)
U3 ap77gkbf; C:\Windows\System32\Drivers\ap77gkbf.sys [0 ] (Microsoft Corporation) <==== UWAGA (zerobajtowy plik/folder)

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-07-30 19:18 - 2017-07-30 19:20 - 000016995 _____ C:\Users\Admin\Desktop\FRST.txt
2017-07-30 19:18 - 2017-07-30 19:18 - 000000000 ____D C:\Users\Admin\Desktop\FRST-OlderVersion
2017-07-30 13:06 - 2017-07-30 19:18 - 002381312 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2017-07-30 13:06 - 2017-07-30 19:18 - 000000000 ____D C:\FRST
2017-07-29 12:02 - 2017-07-29 12:02 - 000019857 _____ C:\Users\Admin\Downloads\Ret2_patches.torrent
2017-07-29 11:56 - 2017-07-29 11:56 - 000001873 _____ C:\Users\Admin\Desktop\Gothic II Returning.lnk
2017-07-29 11:54 - 2017-07-29 11:54 - 004935939 _____ C:\Users\Admin\Desktop\RET2_Scripts_en_0066R1_hotfix7.7z
2017-07-29 11:54 - 2017-07-29 11:54 - 000067320 _____ C:\Users\Admin\Desktop\AST_en_0066R1_hotfix7.7z
2017-07-29 11:42 - 2017-07-29 11:56 - 000000000 ____D C:\Users\Admin\Documents\Gothic  2
2017-07-22 09:51 - 2017-07-22 09:51 - 000000000 ____D C:\Users\Admin\Documents\Gothic lepsza wersja
2017-07-19 09:32 - 2017-07-19 10:42 - 391030784 _____ C:\Users\Admin\Documents\Gothic-II-Returning.iso
2017-07-19 09:32 - 2017-07-19 09:32 - 000000000 ____D C:\Users\Admin\Documents\FreeTorrentDownload
2017-07-19 09:31 - 2017-07-19 09:31 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2017-07-19 09:31 - 2017-07-19 09:31 - 000000000 ____D C:\ProgramData\DigitalWave.ApplicationUpdater_files
2017-07-19 09:30 - 2017-07-19 09:31 - 000000000 ____D C:\Users\Admin\AppData\Roaming\DVDVideoSoft
2017-07-19 09:30 - 2017-07-19 09:30 - 001449624 _____ (Digital Wave Ltd ) C:\Users\Admin\Downloads\FreeTorrentDownload_1.0.73.1027_d.exe
2017-07-19 09:30 - 2017-07-19 09:30 - 000000000 ____D C:\Program Files (x86)\DVDVideoSoft
2017-07-19 09:28 - 2017-07-19 09:28 - 000011692 _____ C:\Users\Admin\Downloads\Gothic-II-Returning.torrent
2017-07-12 18:29 - 2017-07-15 14:06 - 000000000 ____D C:\Users\Admin\AppData\Local\MEGAsync
2017-07-10 21:03 - 2017-07-10 21:03 - 001106840 _____ (Unity Technologies ApS) C:\Users\Admin\Desktop\UnityWebPlayer64.exe
2017-07-03 20:19 - 2017-07-03 20:19 - 000001987 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Valendor PL.lnk
2017-07-03 20:19 - 2017-07-03 20:19 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Valendor PL

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-07-30 19:20 - 2016-02-21 00:28 - 000000000 ____D C:\ProgramData\Package Cache
2017-07-30 19:15 - 2009-07-14 06:45 - 000009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-07-30 19:15 - 2009-07-14 06:45 - 000009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-07-30 17:21 - 2016-04-22 11:12 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Spotify
2017-07-30 17:16 - 2016-04-22 11:12 - 000000000 ____D C:\Users\Admin\AppData\Local\Spotify
2017-07-30 17:15 - 2015-06-06 11:57 - 000000000 ____D C:\ProgramData\NVIDIA
2017-07-30 17:15 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2017-07-30 00:22 - 2013-12-03 23:30 - 000000000 ____D C:\Users\Admin\Desktop\PBE
2017-07-30 00:12 - 2017-04-02 21:34 - 000003600 _____ C:\Windows\System32\Tasks\AVG EUpdate Task
2017-07-29 18:23 - 2015-06-06 12:59 - 000000000 ____D C:\Users\Admin\AppData\Local\ElevatedDiagnostics
2017-07-29 12:12 - 2016-03-23 15:54 - 000000000 ____D C:\Users\Admin\Documents\Gothicowe pliki!
2017-07-26 16:38 - 2015-06-06 13:01 - 000002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-07-25 20:42 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf
2017-07-24 15:02 - 2015-06-06 13:01 - 000004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2017-07-20 15:31 - 2015-06-06 11:39 - 000003900 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1433583595
2017-07-20 15:31 - 2015-06-06 11:39 - 000000000 ____D C:\Program Files (x86)\Opera
2017-07-17 11:30 - 2009-07-14 19:55 - 003631068 _____ C:\Windows\system32\perfh015.dat
2017-07-17 11:30 - 2009-07-14 19:55 - 001135418 _____ C:\Windows\system32\perfc015.dat
2017-07-17 11:30 - 2009-07-14 07:13 - 000006496 _____ C:\Windows\system32\PerfStringBackup.INI
2017-07-15 20:00 - 2015-12-11 22:47 - 000000000 ____D C:\Users\Admin\.gimp-2.8
2017-07-15 14:03 - 2016-05-28 02:21 - 000000000 ____D C:\Users\Admin\AppData\Roaming\uTorrent
2017-07-15 13:11 - 2016-11-12 19:54 - 000000000 ____D C:\Users\Admin\Desktop\skiny do lola
2017-07-12 18:08 - 2015-06-06 11:24 - 000000406 _____ C:\Windows\Tasks\DriverEasy Scheduled Scan.job
2017-07-11 16:42 - 2017-05-28 20:27 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2017-07-11 16:36 - 2017-05-29 22:27 - 000000000 ____D C:\Users\Admin\AppData\Roaming\.minecraft
2017-07-11 16:36 - 2017-05-28 20:27 - 000000000 ____D C:\Program Files (x86)\Minecraft
2017-07-11 16:34 - 2017-05-29 22:27 - 000000560 _____ C:\Windows\SysWOW64\nativelog.txt
2017-07-05 16:51 - 2016-01-05 18:49 - 000000000 ____D C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\World of Gothic

==================== Pliki w katalogu głównym wybranych folderów =======

2016-10-14 21:54 - 2016-10-14 21:54 - 007203328 _____ () C:\Users\Admin\AppData\Roaming\agent.dat
2016-10-14 21:53 - 2016-10-14 21:53 - 000140288 _____ () C:\Users\Admin\AppData\Roaming\Installer.dat
2016-10-14 21:54 - 2016-10-14 21:54 - 000018432 _____ () C:\Users\Admin\AppData\Roaming\Main.dat
2017-06-26 19:52 - 2017-06-26 19:52 - 000002393 _____ () C:\Users\Admin\AppData\Local\recently-used.xbel
2016-12-04 02:38 - 2016-12-06 02:20 - 000007602 _____ () C:\Users\Admin\AppData\Local\resmon.resmoncfg
2015-08-14 17:29 - 2015-08-14 17:29 - 000000000 _____ () C:\Users\Admin\AppData\Local\{0CB03472-3927-4EEE-88EF-1CAB99F01585}
2015-06-06 12:41 - 2015-06-06 12:41 - 000000000 ____H () C:\ProgramData\DP45977C.lfl

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-07-22 17:26

==================== Koniec  FRST.txt ============================