Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 20.06.2018 Uruchomiony przez Jurek (administrator) JUREK-KOMPUTER (05-07-2018 12:53:18) Uruchomiony z C:\Users\Jurek\Downloads\Programs Załadowane profile: Jurek (Dostępne profile: Jurek) Platform: Windows 7 Ultimate (X64) Język: Polski (Polska) Internet Explorer Wersja 8 (Domyślna przeglądarka: Opera) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microvirt Software Technology Co. Ltd.) C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Gigabyte Technology CO., LTD.) C:\Program Files (x86)\GIGABYTE\smart6\timelock\TimeMgmtDaemon.exe (DEVGURU Co., LTD.) C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe () C:\Program Files (x86)\GIGABYTE\smart6\dbios\SDBMSG.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserver.exe (Wondershare) C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe (RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncagent.exe (RealVNC Ltd) C:\Program Files\RealVNC\VNC Server\vncserverui.exe (Wondershare) C:\Program Files (x86)\Wondershare\dr.fone\Library\DriverInstaller\DriverInstall.exe (Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Windows\system\CMGxMon.exe () C:\Program Files\Everything\Everything.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (CMedia) C:\Program Files\ASUS Xonar DX Audio\Customapp\AsusAudioCenter.exe (Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (BitTorrent, Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe (Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (Mister Group) C:\Program Files (x86)\System Explorer\SystemExplorer.exe (AdFender, Inc.) C:\Program Files (x86)\AdFender\AdFender.exe (4t Niagara Software) C:\Program Files (x86)\4t Tray Minimizer\4t-min.exe (Mister Group) C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe (Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe (4t Niagara Software) C:\Program Files (x86)\4t Tray Minimizer\4t-min64.exe (Gigabyte Technology CO., LTD.) C:\Program Files (x86)\GIGABYTE\smart6\timelock\AlarmClock.exe () C:\Program Files\ASUS Xonar DX Audio\Customapp\MXmon.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe (Opera Software) C:\Program Files\Opera\53.0.2907.110\opera.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [ShadowPlay] => "C:\Windows\system32\rundll32.exe" C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12632168 2011-07-21] (Realtek Semiconductor) HKLM\...\Run: [Cmaudio8788] => C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.cpl,CMICtrlWnd HKLM\...\Run: [Cmaudio8788GX] => C:\Windows\system\CmGxMon.exe [20480 2007-12-19] () HKLM\...\Run: [Everything] => C:\Program Files\Everything\Everything.exe [1441792 2014-08-06] () HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\Run: [SystemExplorerAutoStart] => "C:\Program Files (x86)\System Explorer\SystemExplorer.exe" /TRAY HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [525344 2018-03-24] (BlueStack Systems, Inc.) HKLM-x32\...\RunOnce: [SDBOK] => C:\Program Files (x86)\GIGABYTE\smart6\dbios\run.exe [207400 2009-07-06] () HKLM-x32\...\Winlogon: [Userinit] userinit.exe,C:\Program Files (x86)\nsxkcpel\vypwmsnc.exe HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8698584 2016-04-15] (Piriform Ltd) HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited) HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Run: [uTorrent] => C:\Program Files (x86)\uTorrent\uTorrent.exe [399736 2017-08-05] (BitTorrent, Inc.) HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Run: [ares] => "C:\Program Files (x86)\Ares\Ares.exe" -h HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Run: [IDMan] => C:\Program Files (x86)\Internet Download Manager\IDMan.exe [4105328 2018-01-11] (Tonec Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AdFender.lnk [2017-08-05] ShortcutTarget: AdFender.lnk -> C:\Program Files (x86)\AdFender\AdFender.exe (AdFender, Inc.) Startup: C:\Users\Jurek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4t Tray Minimizer.lnk [2017-08-05] ShortcutTarget: 4t Tray Minimizer.lnk -> C:\Program Files (x86)\4t Tray Minimizer\4t-min.exe (4t Niagara Software) ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{4324B7B3-DC53-4889-84D6-FAA1C087837F}: [NameServer] 8.8.8.8,8.8.4.4 Tcpip\..\Interfaces\{4324B7B3-DC53-4889-84D6-FAA1C087837F}: [DhcpNameServer] 192.168.1.1 Internet Explorer: ================== HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp SearchScopes: HKU\S-1-5-21-4073930929-1170455140-3034316454-1000 -> DefaultScope {96D1D9BC-3452-451e-91B2-631C55D5D0B1} URL = hxxp://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV SearchScopes: HKU\S-1-5-21-4073930929-1170455140-3034316454-1000 -> {96D1D9BC-3452-451e-91B2-631C55D5D0B1} URL = hxxp://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBDSV SearchScopes: HKU\S-1-5-21-4073930929-1170455140-3034316454-1000 -> {EA3D47FD-688A-4719-A46C-2A1FD057D740} URL = hxxp://www.google.com/cse?cx=partner-pub-3794288947762788%3A7941509802&ie=UTF-8&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A7941509802&q={searchTerms} SearchScopes: HKU\S-1-5-21-4073930929-1170455140-3034316454-1000 -> {F508A6E3-5554-4485-A330-536B8BA35E71} URL = hxxp://www.bing.com/search?q={searchTerms}&form=SPLBR1&pc=SPLH BHO: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll [2017-12-14] (Internet Download Manager, Tonec Inc.) BHO: GBHO.BHO -> {45d30484-7ded-43d9-957a-d2fd1f046511} -> C:\Windows\system32\mscoree.dll [2009-11-25] (Microsoft Corporation) BHO-x32: IDM integration (IDMIEHlprObj Class) -> {0055C089-8582-441B-A0BF-17B458C2A3A8} -> C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll [2017-12-14] (Internet Download Manager, Tonec Inc.) BHO-x32: Brak nazwy -> {45d30484-7ded-43d9-957a-d2fd1f046511} -> Brak pliku BHO-x32: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll [2009-01-26] (Safer Networking Limited) Toolbar: HKLM - Smart Recovery 2 - {1d09c093-f71e-43c3-b948-19316cbd695e} - C:\Windows\system32\mscoree.dll [2009-11-25] (Microsoft Corporation) Toolbar: HKU\S-1-5-21-4073930929-1170455140-3034316454-1000 -> Brak nazwy - {4853DF44-7D6B-48E9-9258-D800EEE54AF6} - Brak pliku Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2009-07-14] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation) FireFox: ======== FF DefaultProfile: FF DefaultProfile: 9eg7eorv.dev-edition-default-1527634353803 FF ProfilePath: C:\Users\Jurek\AppData\Roaming\Mozilla\Firefox\Profiles\fgrmpt96.default-1527633364257 [2018-07-05] FF ProfilePath: C:\Users\Jurek\AppData\Roaming\Mozilla\Firefox\Profiles\9eg7eorv.dev-edition-default-1527634353803 [2018-07-05] FF ProfilePath: C:\Users\Jurek\AppData\Roaming\FossaMail\Profiles\by84jn47.default [2018-04-12] FF Extension: (Provider for Google Calendar) - C:\Users\Jurek\AppData\Roaming\FossaMail\Profiles\by84jn47.default\Extensions\{a62ef8ec-5fdc-40c2-873c-223b8a6925cc} [2018-04-12] [Przestarzałe] [Brak podpisu cyfrowego] FF HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\Firefox\Extensions: [mozilla_cc3@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc3.xpi FF Extension: (IDM Integration Module) - C:\Program Files (x86)\Internet Download Manager\idmmzcc3.xpi [2018-01-13] FF HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Jurek\AppData\Roaming\IDM\idmmzcc5 FF Extension: (IDM CC) - C:\Users\Jurek\AppData\Roaming\IDM\idmmzcc5 [2018-01-29] [Przestarzałe] [Brak podpisu cyfrowego] FF HKU\S-1-5-21-4073930929-1170455140-3034316454-1000\...\SeaMonkey\Extensions: [mozilla_cc2@internetdownloadmanager.com] - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi FF Extension: (IDM integration) - C:\Program Files (x86)\Internet Download Manager\idmmzcc2.xpi [2017-12-20] [Przestarzałe] FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_26_0_0_151.dll [2017-08-16] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_26_0_0_151.dll [2017-08-16] () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2017-05-01] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2017-05-01] (NVIDIA Corporation) FF Plugin HKU\S-1-5-21-4073930929-1170455140-3034316454-1000: @my.com/Games -> C:\Users\Jurek\AppData\Local\MyComGames\NPMyComDetector.dll [2017-09-20] (MY.COM B.V.) Chrome: ======= CHR Profile: C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default [2018-07-05] CHR Extension: (Brak nazwy) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2018-06-20] CHR Extension: (Brak nazwy) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2018-06-20] CHR Extension: (Dysk Google) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2018-06-20] CHR Extension: (YouTube) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2018-06-20] CHR Extension: (Disable HTML5 Autoplay) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\efdhoaajjjgckpbkoglidkeendpkolai [2018-07-04] CHR Extension: (Brak nazwy) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2018-06-20] CHR Extension: (Nano Adblocker) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gabbbocakeomblphkmmnoamkioajlkfo [2018-07-04] CHR Extension: (Nano Defender) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggolfgbegefeeoocgjbmkembbncoadlb [2018-07-01] CHR Extension: (Dokumenty Google offline) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2018-06-20] CHR Extension: (Youtube to MP3) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgfahbjckdlmmfebdmpgfjbedmkgbghe [2018-07-04] CHR Extension: (Vysor.com) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdphpklacmlhmooodiekhpbepcdlaghl [2018-06-27] CHR Extension: (IDM Integration Module) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2018-06-23] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-06-20] CHR Extension: (Gmail) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2018-06-20] CHR Extension: (Chrome Media Router) - C:\Users\Jurek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-06-20] CHR HKLM\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2018-01-13] CHR HKLM-x32\...\Chrome\Extension: [ngpampappnmepgilojfohadhhmbhlaek] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx [2018-01-13] Opera: ======= OPR Extension: (Extension source viewer) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\ddlapbbeiljnagpkdmfegipfkeebgmnm [2018-07-04] OPR Extension: (Disable HTML5 Autoplay) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\efdhoaajjjgckpbkoglidkeendpkolai [2018-07-04] OPR Extension: (Nano Adblocker) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\gabbbocakeomblphkmmnoamkioajlkfo [2018-07-04] OPR Extension: (Nano Defender) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\ggolfgbegefeeoocgjbmkembbncoadlb [2018-07-05] OPR Extension: (Download with Internet Download Manager (IDM)) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\kajaikkhnmegmfnlifeklklaienhdekb [2018-07-04] OPR Extension: (Install Chrome Extensions) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\kipjbhgniklcnglfaldilecjomjaddfi [2018-07-04] OPR Extension: (IDM Integration Module) - C:\Users\Jurek\AppData\Roaming\Opera Software\Opera Stable\Extensions\ngpampappnmepgilojfohadhhmbhlaek [2018-07-05] ==================== Usługi (filtrowane) ==================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2018-07-05] (Adobe Systems) [Brak podpisu cyfrowego] S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] () S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1530888 2017-09-20] () S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2018-07-05] (Macrovision Corporation) [Brak podpisu cyfrowego] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [399432 2012-09-07] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [676936 2012-09-07] (Malwarebytes Corporation) R2 MEmusvc; C:\Program Files (x86)\Microvirt\MEmu\MemuService.exe [269480 2017-05-26] (Microvirt Software Technology Co. Ltd.) S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [7205544 2017-07-02] (INCA Internet Co., Ltd.) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2018-02-08] () R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.) R2 Smart TimeLock; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [114688 2009-10-13] (Gigabyte Technology CO., LTD.) [Brak podpisu cyfrowego] R2 ss_conn_service; C:\Program Files\Samsung\USB Drivers\27_ssconn\conn\ss_conn_service.exe [754784 2016-07-22] (DEVGURU Co., LTD.) R3 SystemExplorerHelpService; C:\Program Files (x86)\System Explorer\service\SystemExplorerService64.exe [820960 2014-12-20] (Mister Group) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10945776 2017-12-15] (TeamViewer GmbH) R2 vncserver; C:\Program Files\RealVNC\VNC Server\vncserver.exe [5960272 2017-08-03] (RealVNC Ltd) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) R2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.4.3.231\WsAppService.exe [493792 2017-10-24] (Wondershare) R2 WsDrvInst; C:\Program Files (x86)\Wondershare\dr.fone\Library\DriverInstaller\DriverInstall.exe [120096 2017-10-25] (Wondershare) S3 NvContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe" -s NvContainerLocalSystem -a -f "C:\ProgramData\NVIDIA\NvContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\LocalSystem" -r -p 30000 S3 NvContainerNetworkService; "C:\Program Files\NVIDIA Corporation\NvContainer\nvcontainer.exe" -s NvContainerNetworkService -f "C:\ProgramData\NVIDIA\NvContainerNetworkService.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\NvContainer\plugins\NetworkService" -r -p 30000 R2 NVDisplay.ContainerLocalSystem; "C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe" -s NVDisplay.ContainerLocalSystem -f "C:\ProgramData\NVIDIA\NVDisplay.ContainerLocalSystem.log" -l 3 -d "C:\Program Files\NVIDIA Corporation\Display.NvContainer\plugins\LocalSystem" -r -p 30000 R2 NvTelemetryContainer; "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe" -s NvTelemetryContainer -f "C:\ProgramData\NVIDIA\NvTelemetryContainer.log" -l 3 -d "C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\plugin" ===================== Sterowniki (filtrowane) ====================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21104 2011-01-10] () S3 BstkDrv; C:\Program Files (x86)\BlueStacks\BstkDrv.sys [269408 2018-02-23] (Bluestack System Inc. ) R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [1197568 2008-01-18] (C-Media Inc) S3 dg_ssudbus; C:\Windows\System32\DRIVERS\ssudbus.sys [131984 2017-05-18] (Samsung Electronics Co., Ltd.) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2017-08-05] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2012-09-07] (Malwarebytes Corporation) R2 memudrv; C:\Program Files (x86)\Microvirt\MEmuHyperv\MEmuDrv.sys [260368 2015-11-02] (Microvirt Corporation) S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [31800 2017-05-02] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [49208 2017-05-02] (NVIDIA Corporation) R3 nvvhci; C:\Windows\System32\DRIVERS\nvvhci.sys [59448 2017-05-02] (NVIDIA Corporation) S3 ssudmdm; C:\Windows\System32\DRIVERS\ssudmdm.sys [166288 2017-05-18] (Samsung Electronics Co., Ltd.) U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] () ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2018-07-05 11:02 - 2018-07-05 11:48 - 000000000 ____D C:\KVRT_Data 2018-07-05 00:01 - 2018-07-05 00:05 - 000000000 ____D C:\Users\Jurek\Downloads\The Girl Next Door 2007 720p BluRay x264 AAC - Ozlem 2018-07-04 22:41 - 2018-07-04 22:41 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker 2018-07-04 22:41 - 2018-07-04 22:41 - 000000000 ____D C:\Program Files\Unlocker 2018-07-04 22:32 - 2018-07-05 12:53 - 000000000 ____D C:\FRST 2018-07-04 21:44 - 2018-07-04 21:47 - 000000000 ____D C:\Users\Jurek\Desktop\Nowy folder (4) 2018-07-04 18:31 - 2018-07-04 18:31 - 000003878 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1530721879 2018-07-04 18:31 - 2018-07-04 18:31 - 000000946 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Przeglądarka Opera.lnk 2018-07-04 07:34 - 2018-07-04 18:31 - 000000000 ____D C:\Users\Jurek\AppData\Local\Vivaldi 2018-07-01 11:17 - 2018-07-01 11:17 - 000000000 ____D C:\Users\Jurek\Desktop\Nowy folder (5) 2018-06-29 21:42 - 2018-06-29 21:42 - 000003514 _____ C:\Windows\System32\Tasks\BlueStacksHelper 2018-06-27 19:59 - 2018-06-27 19:59 - 001861175 _____ C:\Users\Jurek\Downloads\com.koushikdutta.vysor_1.0.0.0-1467572400_minAPI16(nodpi)_apkmirror.com.apk 2018-06-27 19:53 - 2018-06-27 19:53 - 000000000 ____D C:\Users\Jurek\AppData\Local\Android 2018-06-27 19:52 - 2018-06-27 20:10 - 000000000 ____D C:\Windows\hsperfdata_Jurek 2018-06-27 19:51 - 2018-06-27 19:51 - 000000000 ____D C:\Users\Jurek\.AndroidStudio3.1 2018-06-27 19:48 - 2018-06-27 19:48 - 000000000 ____D C:\Users\Jurek\AppData\Local\FonePaw 2018-06-27 19:46 - 2018-06-27 19:46 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Android Studio 2018-06-27 19:44 - 2018-07-01 11:19 - 000000000 ____D C:\Program Files\Android 2018-06-27 19:37 - 2018-06-27 19:37 - 000000000 ____D C:\Users\Jurek\Desktop\platform-tools 2018-06-27 19:37 - 2018-06-27 19:37 - 000000000 ____D C:\ProgramData\wsr 2018-06-27 19:36 - 2018-06-27 19:36 - 000000000 ____D C:\Program Files\DIFX 2018-06-27 19:35 - 2018-06-27 20:22 - 000000000 ____D C:\adb 2018-06-27 19:29 - 2018-07-01 11:20 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare 2018-06-27 19:29 - 2018-06-27 19:29 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Wondershare 2018-06-27 19:28 - 2018-07-01 11:20 - 000000000 ____D C:\ProgramData\Wondershare 2018-06-27 19:28 - 2018-06-27 19:28 - 000000000 ____D C:\Program Files (x86)\Wondershare 2018-06-27 19:28 - 2017-09-27 17:29 - 000000232 _____ C:\Windows\SysWOW64\dllhost.exe.config 2018-06-27 19:14 - 2018-06-27 19:14 - 013393989 _____ C:\Users\Jurek\Downloads\twrp-3.0.2.0-20161005-j5nltexx.tar (1).md5 2018-06-27 12:22 - 2018-06-27 12:35 - 000000000 ____D C:\AdwCleaner 2018-06-27 02:39 - 2018-06-27 02:39 - 000000000 ____D C:\Users\Jurek\Nowy folder 2018-06-26 16:22 - 2018-06-26 16:22 - 000012761 _____ C:\Users\Jurek\Downloads\[agusiq-torrents.pl] - Kobiety mafii _2018_ [S01E04] [480p] [WEBRip] [AC3] [XviD-KiT] [Serial PL] [AgusiQ].torrent 2018-06-25 14:52 - 2018-06-25 15:42 - 000000000 ____D C:\Users\Jurek\Downloads\HellRaiser Hellbound UNCUT (1988) 2018-06-25 14:11 - 2018-06-25 14:35 - 000000000 ____D C:\Users\Jurek\Downloads\HellRaiser UNCUT (1987) 2018-06-19 07:44 - 2018-06-26 01:33 - 000000000 ____D C:\Users\Jurek\Desktop\Nowy folder (3) ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2018-07-05 12:52 - 2017-08-05 03:27 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\uTorrent 2018-07-05 12:44 - 2018-01-29 16:33 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\DMCache 2018-07-05 12:08 - 2009-07-14 06:45 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2018-07-05 12:08 - 2009-07-14 06:45 - 000016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2018-07-05 12:05 - 2009-07-14 19:55 - 000739694 _____ C:\Windows\system32\perfh015.dat 2018-07-05 12:05 - 2009-07-14 19:55 - 000155268 _____ C:\Windows\system32\perfc015.dat 2018-07-05 12:05 - 2009-07-14 07:13 - 001668226 _____ C:\Windows\system32\PerfStringBackup.INI 2018-07-05 12:05 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\inf 2018-07-05 12:01 - 2017-08-05 02:59 - 000000000 ____D C:\Program Files (x86)\4t Tray Minimizer 2018-07-05 12:00 - 2018-01-29 16:33 - 000000000 ____D C:\Program Files (x86)\Internet Download Manager 2018-07-05 12:00 - 2017-09-06 00:01 - 000003034 _____ C:\Windows\System32\Tasks\MSIAfterburner 2018-07-05 12:00 - 2017-08-22 09:16 - 000000000 ____D C:\Program Files (x86)\Aegisub 2018-07-05 12:00 - 2017-08-05 15:07 - 000000000 ____D C:\Program Files (x86)\Mp3tag 2018-07-05 12:00 - 2017-08-05 03:05 - 000000000 ____D C:\Program Files (x86)\SubEdit-Player 2018-07-05 12:00 - 2017-08-05 02:44 - 000025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys 2018-07-05 12:00 - 2017-08-05 02:21 - 000000000 ____D C:\ProgramData\NVIDIA 2018-07-05 12:00 - 2009-07-14 07:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT 2018-07-05 11:59 - 2017-08-05 03:00 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Everything 2018-07-05 11:54 - 2017-09-20 03:10 - 000000000 ____D C:\Users\Jurek\AppData\Local\MyComGames 2018-07-05 11:54 - 2017-09-06 00:00 - 000000000 ____D C:\Program Files (x86)\MSI Afterburner 2018-07-05 10:53 - 2017-09-20 02:45 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Crossout 2018-07-05 10:41 - 2017-09-06 00:00 - 000000000 ____D C:\Program Files (x86)\RivaTuner Statistics Server 2018-07-05 10:40 - 2017-10-19 20:31 - 000000000 ____D C:\Program Files\Opera 2018-07-05 00:26 - 2017-08-05 03:29 - 000000000 ____D C:\Users\Jurek\Downloads\Video 2018-07-04 22:24 - 2017-10-20 02:47 - 000000000 ____D C:\Users\Jurek\AppData\LocalLow\Mozilla 2018-07-04 21:53 - 2017-08-05 03:01 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\foobar2000 2018-07-04 21:52 - 2017-08-05 15:07 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Mp3tag 2018-07-04 21:45 - 2017-09-14 23:42 - 000000000 ____D C:\Users\Jurek\Documents\YouTubeDownloads 2018-07-04 21:28 - 2017-09-19 11:25 - 000099827 _____ C:\Users\Jurek\AppData\Roaming\downloads.json 2018-07-04 20:07 - 2018-01-29 16:33 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\IDM 2018-07-04 19:57 - 2017-08-26 16:15 - 000000000 ____D C:\Program Files (x86)\Google 2018-07-04 18:31 - 2017-10-19 20:32 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\Opera Software 2018-07-04 18:31 - 2017-10-19 20:32 - 000000000 ____D C:\Users\Jurek\AppData\Local\Opera Software 2018-07-04 13:45 - 2018-04-24 13:17 - 000001165 _____ C:\Windows\VPlayer.INI 2018-07-04 13:45 - 2018-04-24 13:17 - 000000137 _____ C:\Windows\VplayerINI.vpl 2018-07-01 11:22 - 2017-09-20 01:36 - 000000000 ____D C:\Users\Jurek\AppData\Local\Glyph 2018-07-01 11:22 - 2017-09-20 01:36 - 000000000 ____D C:\Program Files (x86)\Glyph 2018-07-01 11:21 - 2017-09-20 01:36 - 000000000 ____D C:\ProgramData\Glyph 2018-07-01 11:21 - 2017-09-19 12:59 - 000000000 ____D C:\ProgramData\Kaspersky Lab 2018-07-01 11:19 - 2017-08-05 02:15 - 000000000 ____D C:\Users\Jurek 2018-07-01 11:17 - 2018-01-30 22:15 - 000000000 ____D C:\Users\Jurek\Downloads\Compressed 2018-06-28 12:32 - 2017-09-10 00:20 - 000000000 ____D C:\Users\Jurek\AppData\Local\ElevatedDiagnostics 2018-06-28 12:32 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\system32\NDF 2018-06-27 20:23 - 2018-04-12 14:12 - 000000000 ____D C:\Users\Jurek\.MemuHyperv 2018-06-27 20:16 - 2009-07-14 06:45 - 000278928 _____ C:\Windows\system32\FNTCACHE.DAT 2018-06-27 20:03 - 2018-04-12 14:12 - 000000000 ____D C:\Users\Jurek\Downloads\MEmu Download 2018-06-27 19:29 - 2017-08-05 02:42 - 000058840 _____ C:\Users\Jurek\AppData\Local\GDIPFONTCACHEV1.DAT 2018-06-27 12:37 - 2018-01-26 17:25 - 000000000 ____D C:\Program Files (x86)\TeamViewer 2018-06-27 12:36 - 2017-08-05 13:24 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavasoft 2018-06-27 02:27 - 2009-07-14 04:34 - 000000448 _____ C:\Windows\win.ini 2018-06-27 02:27 - 2009-07-14 04:34 - 000000262 _____ C:\Windows\system.ini 2018-06-26 01:17 - 2017-08-05 02:39 - 000000000 ____D C:\Users\Jurek\AppData\Local\CrashDumps 2018-06-20 19:06 - 2017-08-26 16:15 - 000000000 ____D C:\Users\Jurek\AppData\Local\Google 2018-06-19 07:43 - 2009-07-14 05:20 - 000000000 ____D C:\Windows\ModemLogs 2018-06-11 22:57 - 2017-08-05 03:10 - 000000000 ____D C:\Users\Jurek\AppData\Roaming\MPC-HC 2018-06-05 17:04 - 2018-02-05 18:58 - 000000000 ____D C:\Users\Jurek\Desktop\Nowy folder 2018-06-05 16:49 - 2018-06-01 15:09 - 000000462 _____ C:\Users\Jurek\Desktop\Nowy dokument tekstowy (3).txt ==================== Pliki w katalogu głównym wybranych folderów ======= 2017-09-19 11:25 - 2018-07-04 21:28 - 000099827 _____ () C:\Users\Jurek\AppData\Roaming\downloads.json 2018-04-24 12:54 - 2018-04-24 12:54 - 000003584 _____ () C:\Users\Jurek\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini ==================== Bamital & volsnap ====================== (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2018-06-27 11:49 ==================== Koniec FRST.txt ============================