Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja:18-11-2015
Uruchomiony przez Natalia (administrator)  KUDEL (19-11-2015 21:00:47)
Uruchomiony z C:\Users\Natalia\Downloads
Załadowane profile: Natalia (Dostępne profile: Natalia)
Platform: Windows 8.1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.1.8\ToolbarUpdater.exe
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.1.8\loggingserver.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Pokki) C:\Users\Natalia\AppData\Local\SweetLabs App Platform\Engine\ServiceHostAppUpdater.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\PowerDVD10\PDVD10Serv.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Lenovo) C:\Program Files\Lenovo\Lenovo Solution Center\LSCNotify.exe
(Firebird Project) C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20911_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Realtek semiconductor) C:\Windows\RTFTrack.exe
(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Manager\utility.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
() C:\Program Files (x86)\AVG Web TuneUp\vprot.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWXConfigManager.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(AVG Secure Search) C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe


==================== Rejestr (filtrowane) ===========================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-30] (Intel Corporation)
HKLM\...\Run: [RtsFT] => C:\WINDOWS\RTFTrack.exe [6340312 2013-07-19] (Realtek semiconductor)
HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [903384 2013-07-24] (Conexant Systems, Inc.)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2012-06-13] (Conexant Systems, Inc.)
HKLM\...\Run: [Energy Manager] => C:\Program Files (x86)\Lenovo\Energy Manager\Energy Manager.exe [15813616 2014-01-02] (Lenovo(beijing) Limited)
HKLM\...\Run: [Lenovo Utility] => C:\Program Files (x86)\Lenovo\Energy Manager\Utility.exe [80880 2014-01-02] (Lenovo(beijing) Limited)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-09-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Lenovo App Shop] => C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\ismagent.exe [156000 2013-07-18] (Intel Corporation)
HKLM-x32\...\Run: [UpdateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [214312 2011-12-06] (CyberLink Corp.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [3826600 2015-10-30] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] => C:\Program Files (x86)\AVG Web TuneUp\vprot.exe [3177360 2015-09-30] ()
HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguix.exe [1136552 2015-11-12] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-524019819-3471203725-587954982-1001\...\Run: [GalaxyClient] => [X]
HKU\S-1-5-21-524019819-3471203725-587954982-1001\...\Run: [GoogleChromeAutoLaunch_CE81F14A430025FA6ADD91B16B39A428] => "C:\Users\Natalia\AppData\Local\Chromium\Application\chrome.exe" --auto-launch-at-startup --profile-directory="Default"
HKU\S-1-5-21-524019819-3471203725-587954982-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [3011152 2015-11-10] (Valve Corporation)
HKU\S-1-5-21-524019819-3471203725-587954982-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [457088 2015-09-23] (Sony)
HKU\S-1-5-21-524019819-3471203725-587954982-1001\...\MountPoints2: F - "F:\setup.exe" 
IFEO\avz.exe: [Debugger] svchost.exe
IFEO\CCleaner.exe: [Debugger] svchost.exe
IFEO\CCleaner64.exe: [Debugger] svchost.exe
IFEO\regedit.exe: [Debugger] svchost.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2014-01-02]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{96A8373F-044E-4F0A-9017-FCB97421F084}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-524019819-3471203725-587954982-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={1F4B6F8F-31E4-4954-A285-CE5E70E7C58D}&mid=8db31e635cc547d2a1d8e56ac10ac6bd-5a89edd9b3d15ab6ae8e740135072b31e3fc731c&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0915tb&pr=fr&d=2014-11-13 07:26:06&v=4.1.6.294&pid=wtu&sg=&sap=hp
HKU\S-1-5-21-524019819-3471203725-587954982-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com/?pc=LCJB
HKU\S-1-5-21-524019819-3471203725-587954982-1001\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = about:blank
hxxp://www.lenovo.com
HKU\S-1-5-21-524019819-3471203725-587954982-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com
SearchScopes: HKLM -> DefaultScope {0959BE81-0FB4-491C-BA2F-4E90E408C5CB} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dpl%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAyCtBtAzzyB0E0EtB0FyE0DyCtCtD0BtN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StAtCtCyEtB0C0D0AtGtByC0A0EtGyC0E0EtDtGtCyEtC0CtGyC0CyBtCyB0CtDyE0AyEtAyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtCzyyDzy0CyEzytGzz0D0F0FtGyEyEzz0CtG0B0EyDyCtG0AyDzztDyE0C0ByCyC0CtBtD2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzytC%26cr%3D515578023%26a%3Dwncy_pwrisofs_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0959BE81-0FB4-491C-BA2F-4E90E408C5CB} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dpl%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAyCtBtAzzyB0E0EtB0FyE0DyCtCtD0BtN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StAtCtCyEtB0C0D0AtGtByC0A0EtGyC0E0EtDtGtCyEtC0CtGyC0CyBtCyB0CtDyE0AyEtAyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtCzyyDzy0CyEzytGzz0D0F0FtGyEyEzz0CtG0B0EyDyCtG0AyDzztDyE0C0ByCyC0CtBtD2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzytC%26cr%3D515578023%26a%3Dwncy_pwrisofs_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-524019819-3471203725-587954982-1001 -> DefaultScope {0959BE81-0FB4-491C-BA2F-4E90E408C5CB} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dpl%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAyCtBtAzzyB0E0EtB0FyE0DyCtCtD0BtN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StAtCtCyEtB0C0D0AtGtByC0A0EtGyC0E0EtDtGtCyEtC0CtGyC0CyBtCyB0CtDyE0AyEtAyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtCzyyDzy0CyEzytGzz0D0F0FtGyEyEzz0CtG0B0EyDyCtG0AyDzztDyE0C0ByCyC0CtBtD2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzytC%26cr%3D515578023%26a%3Dwncy_pwrisofs_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKU\S-1-5-21-524019819-3471203725-587954982-1001 -> {0959BE81-0FB4-491C-BA2F-4E90E408C5CB} URL = hxxp://us.yhs4.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wncy_pwrisofs_15_30&param1=1&param2=f%3D4%26b%3DIE%26cc%3Dpl%26pa%3DWincy%26cd%3D2XzuyEtN2Y1L1QzutAyCtBtAzzyB0E0EtB0FyE0DyCtCtD0BtN0D0Tzu0StCtBzyzytN1L2XzutAtFtCtBtFyDtFtAtN1L1Czu1StN1L1G1B1V1N2Y1L1Qzu2StAtCtCyEtB0C0D0AtGtByC0A0EtGyC0E0EtDtGtCyEtC0CtGyC0CyBtCyB0CtDyE0AyEtAyB2QtN1M1F1B2Z1V1N2Y1L1Qzu2StDtCzyyDzy0CyEzytGzz0D0F0FtGyEyEzz0CtG0B0EyDyCtG0AyDzztDyE0C0ByCyC0CtBtD2QtN0A0LzuyEtN1B2Z1V1T1S1NzuzzzytC%26cr%3D515578023%26a%3Dwncy_pwrisofs_15_30%26os%3DWindows%2B8.1&p={searchTerms}
SearchScopes: HKU\S-1-5-21-524019819-3471203725-587954982-1001 -> {2f23ab71-4ac6-41f2-a955-ea576e553146} URL = 
SearchScopes: HKU\S-1-5-21-524019819-3471203725-587954982-1001 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={1F4B6F8F-31E4-4954-A285-CE5E70E7C58D}&mid=8db31e635cc547d2a1d8e56ac10ac6bd-5a89edd9b3d15ab6ae8e740135072b31e3fc731c&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0915tb&pr=fr&d=2014-11-13 07:26:06&v=4.1.6.294&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-11] (Oracle Corporation)
BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.1.8.599\AVG Web TuneUp.dll [2015-09-30] (AVG)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-11] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2015-11-11] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.1.8.599\AVG Web TuneUp.dll [2015-09-30] (AVG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-11-11] (Oracle Corporation)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.3.0\ViProtocol.dll [2015-06-23] (AVG Secure Search)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-11] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-11] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\40.1.8\\npsitesafety.dll [Brak pliku]
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-08-08] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-11-11] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-11-11] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.15\npGoogleUpdate3.dll [2015-09-15] (Google Inc.)
FF Plugin HKU\S-1-5-21-524019819-3471203725-587954982-1001: intel.com/AppUp -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp.dll [2013-07-18] (Intel)
FF Plugin HKU\S-1-5-21-524019819-3471203725-587954982-1001: intel.com/AppUpx64 -> C:\Program Files (x86)\Lenovo\LenovoAppShop\bin\npAppUp_x64.dll [2013-07-18] (Intel)

Chrome: 
=======
CHR Profile: C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-19]
CHR Extension: (Dokumenty Google) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-19]
CHR Extension: (Dysk Google) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-19]
CHR Extension: (YouTube) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-19]
CHR Extension: (Google Search) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-19]
CHR Extension: (Arkusze Google) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-11-19]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-11-19]
CHR Extension: (Gmail) - C:\Users\Natalia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-19]
StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://www.istartsurf.com/?type=sc&ts=1447950524&z=49a9510cc1eefbef9450373g1z5z1m1t6w1eeo1g5c&from=cor&uid=WDCXWD10JPCX-24UE4T0_WD-WX31E73EXSM5EXSM5

==================== Usługi (filtrowane) ========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [595376 2015-10-30] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagent.exe [3815648 2015-10-30] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1046952 2015-11-12] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvcx.exe [579776 2015-10-30] (AVG Technologies CZ, s.r.o.)
S2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-07] (Broadcom Corporation.)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-10-15] (BitRaider, LLC)
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-10-09] (BitRaider, LLC)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [976600 2013-09-25] (Broadcom Corporation.)
R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbguard.exe [155136 2015-03-27] (Firebird Project) [Brak podpisu cyfrowego]
R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_5\bin\fbserver.exe [5803008 2015-03-27] (Firebird Project) [Brak podpisu cyfrowego]
S3 fussvc; C:\Program Files (x86)\Windows Kits\8.1\App Certification Kit\fussvc.exe [142336 2014-02-19] (Microsoft Corporation) [Brak podpisu cyfrowego]
S3 GalaxyClientService; C:\Program Files (x86)\GalaxyClient\GalaxyClientService.exe [1616440 2015-11-03] (GOG.com)
S3 GalaxyCommunication; C:\ProgramData\GOG.com\Galaxy\redists\GalaxyCommunication.exe [6952504 2015-11-03] (GOG.com)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-30] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [344168 2015-04-21] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
U2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-08-08] (Intel Corporation)
S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [272440 2015-03-09] (Lenovo)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2099208 2015-10-26] (Electronic Arts)
R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [75136 2014-09-23] ()
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [390632 2012-04-24] ()
S3 Te.Service; C:\Program Files (x86)\Windows Kits\8.1\Testing\Runtimes\TAEF\Wex.Services.exe [119808 2013-08-22] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 VeriFaceSrv; C:\Program Files (x86)\Lenovo\Lenovo VeriFace\VfConnectorService.exe [68368 2014-01-02] ()
S3 VSStandardCollectorService140; C:\Program Files (x86)\Microsoft Visual Studio 14.0\Team Tools\DiagnosticsHub\Collector\StandardCollector.Service.exe [50408 2015-04-23] (Microsoft Corporation)
R2 vToolbarUpdater40.1.8; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.1.8\ToolbarUpdater.exe [1875856 2015-09-30] (AVG Secure Search)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1205136 2015-09-30] ()

===================== Sterowniki (filtrowane) ==========================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
S0 Avgboota; C:\Windows\System32\DRIVERS\avgboota.sys [23152 2015-09-09] (AVG Technologies CZ, s.r.o.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [197040 2015-08-10] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [313776 2015-10-19] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [298416 2015-08-20] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [284080 2015-10-21] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [398256 2015-08-14] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [255408 2015-10-21] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [42416 2015-08-10] (AVG Technologies CZ, s.r.o.)
R1 Avgwfpa; C:\Windows\system32\DRIVERS\avgwfpa.sys [306608 2015-10-08] (AVG Technologies CZ, s.r.o.)
R3 bcbtums; C:\Windows\system32\drivers\bcbtums.sys [170712 2013-08-07] (Broadcom Corporation.)
R3 BCM43XX; C:\Windows\system32\DRIVERS\bcmwl63a.sys [7474864 2013-08-07] (Broadcom Corporation)
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2014-10-23] (BitRaider)
R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)
S3 ggsomc; C:\Windows\System32\drivers\ggsomc.sys [30424 2015-08-08] (Sony Mobile Communications)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-08-08] (Intel Corporation)
S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3344352 2013-07-08] (Intel Corporation)
R3 ptun0901; C:\Windows\system32\DRIVERS\ptun0901.sys [27136 2014-08-08] (The OpenVPN Project)
R3 rtsuvc; C:\Windows\system32\DRIVERS\rtsuvc.sys [8247640 2013-07-19] (Realtek Semiconductor Corp.)
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-09-13] (Synaptics Incorporated)
S3 tapoas; C:\Windows\system32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)
S3 wsvd; C:\Windows\system32\DRIVERS\wsvd.sys [102376 2012-06-13] ("CyberLink)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]
S1 wafd_1_10_0_19; system32\drivers\wafd_1_10_0_19.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-11-19 21:00 - 2015-11-19 21:00 - 00025029 _____ C:\Users\Natalia\Downloads\FRST.txt
2015-11-19 20:55 - 2015-11-19 20:55 - 00342032 _____ C:\WINDOWS\Minidump\111915-66890-01.dmp
2015-11-19 20:55 - 2015-11-19 20:55 - 00000000 ____D C:\WINDOWS\Minidump
2015-11-19 20:54 - 2015-11-19 20:54 - 726602650 _____ C:\WINDOWS\MEMORY.DMP
2015-11-19 20:19 - 2015-11-19 20:19 - 00380416 _____ C:\Users\Natalia\Downloads\dim59126.exe
2015-11-19 20:09 - 2015-11-19 21:00 - 00000000 ____D C:\FRST
2015-11-19 20:07 - 2015-11-19 20:07 - 02008576 _____ (Farbar) C:\Users\Natalia\Downloads\FRST64.exe
2015-11-19 19:48 - 2015-11-19 19:49 - 00000000 ____D C:\ProgramData\KMSAuto
2015-11-19 18:52 - 2015-11-19 19:20 - 00000000 ____D C:\Users\Natalia\AppData\LocalLow\uTorrent
2015-11-19 17:52 - 2015-11-19 20:00 - 00000000 ____D C:\Users\Natalia\AppData\Local\MSfree Inc
2015-11-19 17:29 - 2015-11-19 17:29 - 00000000 ____D C:\winproductkey
2015-11-19 17:28 - 2015-11-19 17:40 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\istartsurf
2015-11-19 17:28 - 2015-11-19 17:40 - 00000000 ____D C:\ProgramData\UWMiniProU
2015-11-19 17:28 - 2015-11-19 17:28 - 00000098 _____ C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
2015-11-18 20:28 - 2015-11-18 20:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wiedźmin 3® - Dziki Gon [GOG.com]
2015-11-18 19:44 - 2014-05-25 01:36 - 00015360 _____ C:\WINDOWS\system32\SppExtComObjHook.dll
2015-11-18 19:44 - 2014-05-25 01:36 - 00004608 _____ C:\WINDOWS\system32\SppExtComObjPatcher.exe
2015-11-18 19:43 - 2014-08-08 17:31 - 00027136 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\ptun0901.sys
2015-11-18 19:43 - 2012-07-15 06:18 - 00030720 _____ (The OpenVPN Project) C:\WINDOWS\system32\Drivers\tapoas.sys
2015-11-18 19:34 - 2015-11-19 06:49 - 00003094 _____ C:\WINDOWS\System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-524019819-3471203725-587954982-1001
2015-11-18 19:34 - 2015-11-19 06:49 - 00000000 ___RD C:\Users\Natalia\OneDrive
2015-11-18 19:34 - 2015-11-18 19:34 - 00000000 ____D C:\ProgramData\Microsoft OneDrive
2015-11-18 18:44 - 2015-11-18 19:19 - 00000000 ____D C:\Users\Natalia\Downloads\Office!
2015-11-15 20:58 - 2015-11-15 20:58 - 00000000 ____D C:\Users\Natalia\AppData\Local\Fallout4
2015-11-15 19:20 - 2015-11-15 19:20 - 00001077 _____ C:\Users\Natalia\Desktop\Fallout 4.lnk
2015-11-15 19:02 - 2015-11-15 21:06 - 00000000 ____D C:\Program Files (x86)\Fallout 4
2015-11-15 14:25 - 2015-11-15 18:55 - 00002284 _____ C:\Users\Natalia\Desktop\interfejs_statki.fxml
2015-11-13 21:19 - 2015-11-13 21:19 - 00002049 _____ C:\Users\Natalia\Desktop\SceneBuilder.lnk
2015-11-11 15:42 - 2015-11-11 15:42 - 00110176 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll
2015-11-11 15:42 - 2015-11-11 15:42 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2015-11-11 15:41 - 2015-11-11 15:42 - 00000000 ____D C:\Program Files\Java
2015-11-11 15:34 - 2015-11-11 15:42 - 00000000 ____D C:\Users\Natalia\.oracle_jre_usage
2015-11-11 15:34 - 2015-11-11 15:34 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\Sun
2015-11-11 15:33 - 2015-11-11 15:33 - 00000000 ____D C:\Users\Natalia\AppData\LocalLow\Oracle
2015-11-11 15:05 - 2015-11-13 21:19 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gluon
2015-11-11 15:05 - 2015-11-11 15:05 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\Scene Builder
2015-11-11 15:05 - 2015-11-11 15:05 - 00000000 ____D C:\Users\Natalia\AppData\Local\SceneBuilder
2015-11-11 10:44 - 2015-10-31 00:46 - 25818624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2015-11-11 10:44 - 2015-10-31 00:25 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2015-11-11 10:44 - 2015-10-31 00:24 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2015-11-11 10:44 - 2015-10-31 00:11 - 05990912 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2015-11-11 10:44 - 2015-10-31 00:11 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll
2015-11-11 10:44 - 2015-10-30 23:52 - 20331520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2015-11-11 10:44 - 2015-10-30 23:47 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2015-11-11 10:44 - 2015-10-30 23:42 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2015-11-11 10:44 - 2015-10-30 23:39 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll
2015-11-11 10:44 - 2015-10-30 23:36 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll
2015-11-11 10:44 - 2015-10-30 23:32 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2015-11-11 10:44 - 2015-10-30 23:31 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2015-11-11 10:44 - 2015-10-30 23:22 - 14457856 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2015-11-11 10:44 - 2015-10-30 23:17 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2015-11-11 10:44 - 2015-10-30 23:16 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2015-11-11 10:44 - 2015-10-30 23:14 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll
2015-11-11 10:44 - 2015-10-30 23:10 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2015-11-11 10:44 - 2015-10-30 23:09 - 12854272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2015-11-11 10:44 - 2015-10-30 23:04 - 01547264 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2015-11-11 10:44 - 2015-10-30 22:53 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2015-11-11 10:44 - 2015-10-30 22:51 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2015-11-11 10:44 - 2015-10-30 22:48 - 01311744 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2015-11-11 10:44 - 2015-10-30 22:46 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2015-11-11 10:44 - 2015-10-20 22:54 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2015-11-11 10:44 - 2015-10-20 15:53 - 03705856 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2015-11-11 10:44 - 2015-10-20 15:36 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2015-11-11 10:44 - 2015-10-20 15:35 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2015-11-11 10:44 - 2015-10-20 15:34 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2015-11-11 10:44 - 2015-10-20 15:34 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll
2015-11-11 10:44 - 2015-10-20 15:34 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe
2015-11-11 10:44 - 2015-10-20 15:33 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2015-11-11 10:44 - 2015-10-20 15:14 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2015-11-11 10:44 - 2015-10-20 15:13 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll
2015-11-11 10:44 - 2015-10-20 15:13 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2015-11-11 10:44 - 2015-10-20 15:13 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe
2015-11-11 10:44 - 2015-10-15 17:08 - 00990208 _____ (Microsoft Corporation) C:\WINDOWS\system32\kerberos.dll
2015-11-11 10:44 - 2015-10-15 16:46 - 00803328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kerberos.dll
2015-11-11 10:44 - 2015-10-15 00:02 - 07455064 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2015-11-11 10:44 - 2015-10-15 00:02 - 01659560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2015-11-11 10:44 - 2015-10-15 00:02 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2015-11-11 10:44 - 2015-10-15 00:02 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2015-11-11 10:44 - 2015-10-15 00:02 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2015-11-11 10:44 - 2015-10-13 18:10 - 00559616 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys
2015-11-11 10:44 - 2015-10-13 18:10 - 00108032 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tdx.sys
2015-11-11 10:44 - 2015-10-13 16:59 - 00397224 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2015-11-11 10:44 - 2015-10-13 16:59 - 00340872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2015-11-11 10:44 - 2015-10-13 16:59 - 00137960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncrypt.dll
2015-11-11 10:44 - 2015-10-13 16:59 - 00120376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncrypt.dll
2015-11-11 10:44 - 2015-10-13 16:59 - 00106952 _____ (Microsoft Corporation) C:\WINDOWS\system32\ncryptsslp.dll
2015-11-11 10:44 - 2015-10-13 16:59 - 00091416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ncryptsslp.dll
2015-11-11 10:44 - 2015-10-11 07:36 - 00561952 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys
2015-11-11 10:44 - 2015-10-11 07:36 - 00177496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ksecpkg.sys
2015-11-11 10:44 - 2015-10-10 19:40 - 00202240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2015-11-11 10:44 - 2015-10-10 19:39 - 00401408 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb.sys
2015-11-11 10:44 - 2015-10-10 19:07 - 00445440 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2015-11-11 10:44 - 2015-10-10 18:33 - 01441280 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2015-11-11 10:44 - 2015-10-10 18:27 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2015-11-11 10:44 - 2015-10-10 18:11 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2015-11-11 10:44 - 2015-10-10 17:45 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2015-11-11 10:44 - 2015-09-29 13:24 - 00155480 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tpm.sys
2015-11-11 10:44 - 2015-09-12 14:47 - 00414559 _____ C:\WINDOWS\system32\ApnDatabase.xml
2015-11-11 10:44 - 2015-09-07 17:22 - 00477184 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2015-11-11 10:44 - 2015-09-07 16:54 - 00367104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2015-11-11 10:44 - 2015-09-07 16:30 - 01091584 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2015-11-11 10:44 - 2015-09-04 20:24 - 00154112 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tunnel.sys
2015-11-11 10:44 - 2015-08-28 23:20 - 00183368 _____ (Microsoft Corporation) C:\WINDOWS\system32\AuthHost.exe
2015-11-11 10:44 - 2015-08-20 21:45 - 01380048 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdi32.dll
2015-11-11 10:44 - 2015-08-20 18:48 - 01096704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gdi32.dll
2015-11-11 10:44 - 2014-11-05 02:41 - 00558080 _____ (Microsoft Corporation) C:\WINDOWS\system32\untfs.dll
2015-11-11 10:44 - 2014-11-05 02:18 - 00507392 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\untfs.dll
2015-11-11 10:43 - 2015-10-17 15:19 - 04176384 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2015-11-11 10:43 - 2015-10-08 17:08 - 01083904 _____ (Microsoft Corporation) C:\WINDOWS\system32\IKEEXT.DLL
2015-11-11 10:43 - 2015-08-10 19:15 - 00845312 _____ (Microsoft Corporation) C:\WINDOWS\system32\BFE.DLL
2015-11-11 10:43 - 2015-08-10 19:06 - 00422400 _____ (Microsoft Corporation) C:\WINDOWS\system32\FWPUCLNT.DLL
2015-11-11 10:43 - 2015-08-10 18:49 - 00713216 _____ (Microsoft Corporation) C:\WINDOWS\system32\nshwfp.dll
2015-11-11 10:43 - 2015-08-10 17:56 - 00272384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\FWPUCLNT.DLL
2015-11-11 10:43 - 2015-08-10 17:46 - 00561664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\nshwfp.dll
2015-11-11 10:43 - 2014-11-10 19:06 - 00136512 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\wfplwfs.sys
2015-11-09 17:35 - 2015-11-09 17:35 - 00000000 ____D C:\Users\Natalia\Desktop\Sounds
2015-11-09 17:35 - 2015-11-09 17:35 - 00000000 ____D C:\Users\Natalia\Desktop\mobilempk
2015-11-09 17:35 - 2015-11-09 17:35 - 00000000 ____D C:\Users\Natalia\Desktop\DCIM
2015-11-05 18:28 - 2015-11-17 22:51 - 00000429 _____ C:\Users\Natalia\Desktop\bla.txt
2015-11-03 15:12 - 2015-11-03 15:12 - 00003300 _____ C:\WINDOWS\System32\Tasks\SweetLabs App Platform
2015-10-25 18:42 - 2015-10-25 18:42 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\AVG
2015-10-25 18:41 - 2015-11-12 06:51 - 00000963 _____ C:\Users\Public\Desktop\AVG Protection.lnk
2015-10-25 18:37 - 2015-10-25 18:39 - 00000000 ____D C:\ProgramData\Avg
2015-10-25 18:32 - 2015-10-25 18:37 - 00000000 ____D C:\Users\Natalia\AppData\Local\AvgSetupLog
2015-10-21 16:16 - 2015-10-21 16:16 - 00284080 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgldx64.sys
2015-10-21 16:15 - 2015-10-21 16:15 - 00255408 _____ (AVG Technologies CZ, s.r.o.) C:\WINDOWS\system32\Drivers\avgmfx64.sys

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2015-11-19 21:01 - 2014-09-20 21:03 - 00000000 __RDO C:\Users\Natalia\SkyDrive
2015-11-19 21:00 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru
2015-11-19 20:59 - 2015-08-06 17:39 - 00000000 ____D C:\Program Files (x86)\Steam
2015-11-19 20:58 - 2014-09-20 16:56 - 00000000 ____D C:\Users\Natalia\AppData\Local\SweetLabs App Platform
2015-11-19 20:55 - 2014-09-20 17:02 - 00001064 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-11-19 20:55 - 2013-08-22 15:46 - 00176234 _____ C:\WINDOWS\setupact.log
2015-11-19 20:55 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2015-11-19 20:54 - 2013-10-07 19:23 - 00035252 _____ C:\WINDOWS\PFRO.log
2015-11-19 20:48 - 2014-09-20 21:03 - 11861958 _____ C:\Users\Public\CAFADEBUG.log
2015-11-19 20:48 - 2014-09-20 16:56 - 00000000 ____D C:\Users\Natalia
2015-11-19 20:48 - 2014-01-02 18:18 - 00016896 _____ C:\WINDOWS\system32\VfService.trf
2015-11-19 20:45 - 2014-09-20 17:02 - 00001068 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-11-19 20:29 - 2014-09-20 17:03 - 00003596 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-524019819-3471203725-587954982-1001
2015-11-19 20:08 - 2014-01-02 17:53 - 01779751 _____ C:\WINDOWS\WindowsUpdate.log
2015-11-19 19:55 - 2014-01-02 18:08 - 00000000 ____D C:\Program Files (x86)\Microsoft Office
2015-11-19 19:20 - 2014-09-20 17:07 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\uTorrent
2015-11-19 19:19 - 2015-05-20 18:00 - 00000000 ____D C:\Users\Natalia\Documents\The Witcher 3
2015-11-19 18:59 - 2013-08-22 15:44 - 00485552 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2015-11-19 18:53 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\BBI
2015-11-19 18:52 - 2015-01-23 00:20 - 00000000 ____D C:\Users\Natalia\Downloads\SERIALE
2015-11-19 18:49 - 2014-11-12 23:50 - 00000000 ____D C:\ProgramData\MFAData
2015-11-19 17:31 - 2014-10-09 21:31 - 00000861 _____ C:\Users\Public\Desktop\Star Wars - The Old Republic.lnk
2015-11-19 17:31 - 2014-09-20 17:03 - 00002220 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-11-19 17:31 - 2014-09-20 16:57 - 00001473 _____ C:\Users\Natalia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-11-19 17:13 - 2014-01-03 02:38 - 00846774 _____ C:\WINDOWS\system32\perfh015.dat
2015-11-19 17:13 - 2014-01-03 02:38 - 00182712 _____ C:\WINDOWS\system32\perfc015.dat
2015-11-19 17:13 - 2013-10-07 19:27 - 01936752 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2015-11-18 20:06 - 2014-09-20 16:57 - 00000000 ____D C:\Users\Natalia\AppData\Local\Packages
2015-11-18 20:05 - 2014-11-17 16:37 - 00000000 ____D C:\Users\Natalia\AppData\Roaming\Skype
2015-11-18 19:20 - 2013-08-22 16:36 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2015-11-17 20:04 - 2014-09-29 12:58 - 00001727 _____ C:\Users\Natalia\Desktop\MPC-HC x64.lnk
2015-11-17 20:04 - 2014-09-29 12:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MPC-HC x64
2015-11-17 20:04 - 2014-09-29 12:58 - 00000000 ____D C:\Program Files\MPC-HC
2015-11-16 20:02 - 2014-11-13 17:30 - 00000000 ___RD C:\Users\Natalia\Desktop\STUDIA
2015-11-15 20:58 - 2014-09-30 17:16 - 00000000 ____D C:\Users\Natalia\Documents\My Games
2015-11-15 11:58 - 2015-01-23 00:20 - 00000000 ____D C:\Users\Natalia\Downloads\GRY
2015-11-14 21:50 - 2015-01-23 00:20 - 00000000 ____D C:\Users\Natalia\Downloads\FILMY
2015-11-13 18:58 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache
2015-11-13 06:47 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
2015-11-12 06:51 - 2014-11-12 23:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-11-12 06:49 - 2014-11-12 23:54 - 00000000 ___HD C:\$AVG
2015-11-12 06:48 - 2015-05-28 11:52 - 00000000 ____D C:\Users\Natalia\AppData\Local\Avg
2015-11-11 23:38 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData
2015-11-11 15:44 - 2014-11-13 17:32 - 00000000 ____D C:\Users\Natalia\Desktop\eclipse
2015-11-11 15:42 - 2014-11-13 18:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-11-11 15:35 - 2014-11-13 18:14 - 00000000 ____D C:\ProgramData\Oracle
2015-11-11 15:34 - 2014-11-13 18:15 - 00097888 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2015-11-11 15:34 - 2014-11-13 18:14 - 00000000 ____D C:\Program Files (x86)\Java
2015-11-11 14:16 - 2014-09-21 00:00 - 00353131 _____ C:\WINDOWS\DirectX.log
2015-11-11 11:37 - 2013-08-22 16:20 - 00000000 ____D C:\WINDOWS\CbsTemp
2015-11-11 11:36 - 2014-09-22 10:11 - 00000000 ____D C:\WINDOWS\system32\MRT
2015-11-11 11:28 - 2014-09-22 10:11 - 145617392 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2015-11-08 11:02 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness
2015-11-06 23:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\NDF
2015-11-05 21:20 - 2014-11-17 10:52 - 00000000 ____D C:\ProgramData\Skype
2015-11-03 15:14 - 2014-09-20 17:01 - 00002409 _____ C:\Users\Natalia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PC App Store.lnk
2015-11-03 15:11 - 2014-09-20 21:08 - 00002391 _____ C:\Users\Natalia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Menu.lnk
2015-11-03 01:23 - 2013-08-22 16:38 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2015-11-03 01:23 - 2013-08-22 16:38 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2015-10-27 23:22 - 2014-10-11 19:37 - 00000000 ____D C:\ProgramData\Origin
2015-10-26 11:50 - 2015-05-19 21:41 - 00000000 ____D C:\Users\Natalia\Documents\Visual Studio 2015
2015-10-26 10:22 - 2015-08-22 18:00 - 00000000 ____D C:\Program Files (x86)\Origin
2015-10-25 18:42 - 2014-11-12 23:54 - 00000000 ____D C:\ProgramData\AVG2015
2015-10-25 18:42 - 2014-11-12 23:54 - 00000000 ____D C:\Program Files (x86)\AVG
2015-10-25 18:41 - 2015-06-21 10:17 - 00000000 ____D C:\Program Files\Common Files\AV
2015-10-25 18:41 - 2013-08-22 16:36 - 00000000 ___HD C:\WINDOWS\ELAMBKUP

==================== Pliki w katalogu głównym wybranych folderów =======

2015-01-06 19:44 - 2014-06-21 20:53 - 0000228 _____ () C:\Program Files (x86)\update-DragonAge2.bat
2015-01-06 19:44 - 2013-10-12 20:47 - 0000732 _____ () C:\Program Files (x86)\visit-www.nosteam.ro.html
2015-06-25 12:17 - 2015-09-09 06:07 - 0000132 _____ () C:\Users\Natalia\AppData\Roaming\Adobe PNG Format CS6 Prefs
2014-01-02 17:56 - 2014-01-02 17:56 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-11-19 17:28 - 2015-11-19 17:28 - 0000098 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Pliki do przeniesienia lub usunięcia:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Niektóre pliki w TEMP:
====================
C:\Users\Natalia\AppData\Local\Temp\avg-64f9ae6e-3a2e-4741-b2af-cc59d199472f.exe
C:\Users\Natalia\AppData\Local\Temp\drm_dyndata_7370014.dll
C:\Users\Natalia\AppData\Local\Temp\drm_dyndata_7380014.dll
C:\Users\Natalia\AppData\Local\Temp\drm_dyndata_7410004.dll
C:\Users\Natalia\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Natalia\AppData\Local\Temp\jre-8u65-windows-au.exe
C:\Users\Natalia\AppData\Local\Temp\JSE_install_app-1436027264042.exe
C:\Users\Natalia\AppData\Local\Temp\oct2344.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct3515.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct4C15.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct4E48.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct50F.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct61A3.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct67BB.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct6892.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct7EB4.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct801B.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct81AB.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct8F43.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct9345.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\oct9846.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octA179.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octA517.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octA6B8.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octC5BE.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octCDBC.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\octE37E.tmp.exe
C:\Users\Natalia\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Natalia\AppData\Local\Temp\sfextra.dll
C:\Users\Natalia\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Natalia\AppData\Local\Temp\ubi1896.tmp.exe


==================== Bamital & volsnap =================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\WINDOWS\system32\winlogon.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\wininit.exe => Plik podpisany cyfrowo
C:\WINDOWS\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\services.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\WINDOWS\system32\rpcss.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\WINDOWS\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2015-11-13 21:12

==================== Koniec  FRST.txt ============================