Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 31-08-2016 Uruchomiony przez Ryszard (administrator) NOTEBOOK (11-09-2016 15:22:28) Uruchomiony z C:\Users\Ryszard\Downloads Załadowane profile: Ryszard (Dostępne profile: Ryszard) Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska) Internet Explorer Wersja 11 (Domyślna przeglądarka: FF) Tryb startu: Normal Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Procesy (filtrowane) ================= (Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe (Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDIntelligent.exe (Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\CAudioFilterAgent64.exe (Microsoft Corporation) C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTStackServer.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe ==================== Rejestr (filtrowane) =========================== (Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.) HKLM\...\Run: [RtsFT] => C:\Windows\RTFTrack.exe [6346464 2013-01-04] (Realtek semiconductor) HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184112 2012-09-17] (Intel Corporation) HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll [7830328 2013-05-21] (Motorola Solutions, Inc.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation) HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2876816 2013-03-05] (ELAN Microelectronics Corp.) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [8079408 2015-09-17] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [6202416 2015-09-17] (Lenovo(beijing) Limited) HKLM\...\Run: [cAudioFilterAgent] => C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [899680 2013-02-04] (Conexant Systems, Inc.) HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SACpl.exe [1647616 2013-03-05] (Conexant Systems, Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-04] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291280 2012-12-21] (Intel Corporation) HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [508656 2012-08-31] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9107104 2016-09-09] (AVAST Software) HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\Run: [{7DB9971C-09E8-4266-9645-B5F140A170DF}] => powershell.exe -noprofile -windowstyle hidden -executionpolicy bypass iex ([Text.Encoding]::ASCII.GetString([Convert]::FromBase64String((gp 'HKCU:\Software\Classes\DVEDK').SRAQCMPEcNmejA))); HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\Run: [DAEMON Tools Lite Automount] => C:\Program Files\DAEMON Tools Lite\DTAgent.exe [4295360 2016-06-08] (Disc Soft Ltd) HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\Policies\Explorer: [] HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: E - E:\Autorun.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: F - F:\Autorun.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {44dcc849-7284-11e6-909a-f82fa8f2c508} - I:\Startme.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {6cf22db7-3319-11e6-a100-f82fa8f2c508} - F:\LANLauncher.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {9ce73fd3-307e-11e6-8a64-f82fa8f2c508} - E:\Autorun.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {9ce73fd7-307e-11e6-8a64-f82fa8f2c508} - I:\LANLauncher.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {fc6409d1-5eb8-11e5-aa02-f82fa8f2c508} - E:\Setup.exe HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\MountPoints2: {fc640a0c-5eb8-11e5-aa02-f82fa8f2c508} - F:\Autorun.exe Lsa: [Notification Packages] scecli C:\Program Files\Lenovo\Bluetooth Software\BtwProximityCP.dll ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-09] (AVAST Software) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2013-02-08] (Autodesk, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2016-04-18] ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.) CHR HKLM\SOFTWARE\Policies\Google: Ograniczenia <======= UWAGA ==================== Internet (filtrowane) ==================== (Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.) Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{DF46EBE4-E4C7-42A0-A677-3D207B9625B1}: [DhcpNameServer] 192.168.1.1 ManualProxies: Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank SearchScopes: HKLM-x32 -> DefaultScope {20B9D1AE-AD1A-38B4-87FE-AF278DA9861D} URL = SearchScopes: HKU\S-1-5-21-995890878-878726906-1775722255-1000 -> DefaultScope {20B9D1AE-AD1A-38B4-87FE-AF278DA9861D} URL = SearchScopes: HKU\S-1-5-21-995890878-878726906-1775722255-1000 -> {05F38020-FE92-43BA-B392-4051E769E8D7} URL = hxxps://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-09-09] (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\ssv.dll [2016-04-23] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-09-09] (AVAST Software) BHO-x32: Pomocnik logowania za pomocą konta Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2016-01-12] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\jp2ssv.dll [2016-04-23] (Oracle Corporation) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.) Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2015-08-12] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\Ryszard\AppData\Roaming\Mozilla\Firefox\Profiles\rwpeyde1.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-14] () FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-14] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\dtplugin\npDeployJava1.dll [2016-04-23] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.91.2 -> C:\Program Files (x86)\Java\jre1.8.0_91\bin\plugin2\npjp2.dll [2016-04-23] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-11] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> C:\Program Files (x86)\Winamp Detect\npwachk.dll [2013-12-13] (Nullsoft, Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-995890878-878726906-1775722255-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [Brak pliku] FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-09-23] (Adobe Systems Inc.) FF Extension: (Firefox Hotfix) - C:\Users\Ryszard\AppData\Roaming\Mozilla\Firefox\Profiles\rwpeyde1.default\Extensions\firefox-hotfix@mozilla.org.xpi [2016-09-11] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-09-09] FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-09-09] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2016-01-10] [Brak podpisu cyfrowego] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF FF HKU\S-1-5-21-995890878-878726906-1775722255-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR Profile: C:\Users\Ryszard\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avast SafePrice) - C:\Users\Ryszard\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2016-09-11] CHR Extension: (Avast Online Security) - C:\Users\Ryszard\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-09-11] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Ryszard\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-09-11] CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChromeSp.crx CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx ==================== Usługi (filtrowane) ======================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) S4 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [Brak podpisu cyfrowego] R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-09] (AVAST Software) R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [1006384 2013-05-21] (Broadcom Corporation.) R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusServiceLite.exe [1458368 2016-06-08] (Disc Soft Ltd) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego] R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-08-21] (Intel Corporation) S4 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.376\McCHSvc.exe [327944 2016-07-19] (McAfee, Inc.) S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego] S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4019304 2016-03-01] (INCA Internet Co., Ltd.) S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego] S3 Te.Service; C:\Program Files (x86)\Windows Kits\10\Testing\Runtimes\TAEF\Wex.Services.exe [134656 2015-07-09] (Microsoft Corporation) [Brak podpisu cyfrowego] S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Sterowniki (filtrowane) ========================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [36520 2012-09-14] (Advanced Micro Devices, Inc.) S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-09-09] (AVAST Software) R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-09-09] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-09-09] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-09-09] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-09] (AVAST Software) R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969560 2016-09-09] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513496 2016-09-09] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-09-09] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [292704 2016-09-09] (AVAST Software) R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170200 2013-03-27] (Broadcom Corporation.) R3 btmaudio; C:\Windows\System32\drivers\btmaud.sys [88376 2013-03-18] (Motorola Solutions, Inc.) R3 btmaux; C:\Windows\System32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.) S3 DFX11_1; C:\Windows\System32\drivers\dfx11_1x64.sys [28008 2015-08-31] (Windows (R) Win 7 DDK provider) S3 DFX12; C:\Windows\System32\drivers\dfx12x64.sys [28344 2015-10-13] (Windows (R) Win 7 DDK provider) R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-06-12] (Disc Soft Ltd) R3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-06-12] (Disc Soft Ltd) S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2016-02-18] () R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28656 2013-01-31] (Intel Corporation) R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [117912 2012-11-19] (Qualcomm Atheros Co., Ltd.) R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8239456 2013-01-04] (Realtek Semiconductor Corp.) S4 secdrv; C:\Windows\SysWow64\Drivers\secdrv.sys [163644 2015-12-06] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Brak podpisu cyfrowego] S0 irjup; System32\drivers\pyga.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] U3 kxtdqpow; \??\C:\Users\Ryszard\AppData\Local\Temp\kxtdqpow.sys [X] ==================== NetSvcs (filtrowane) =================== (Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.) ==================== Jeden miesiąc - utworzone pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-09-11 15:22 - 2016-09-11 15:23 - 00022383 _____ C:\Users\Ryszard\Downloads\FRST.txt 2016-09-11 15:21 - 2016-09-11 15:22 - 00000000 ____D C:\FRST 2016-09-11 15:18 - 2016-09-11 15:18 - 00380928 _____ C:\Users\Ryszard\Downloads\mtl8n8el.exe 2016-09-11 15:17 - 2016-09-11 15:18 - 02397696 _____ (Farbar) C:\Users\Ryszard\Downloads\FRST64.exe 2016-09-11 13:43 - 2016-09-11 13:43 - 00001159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2016-09-11 13:43 - 2016-09-11 13:43 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2016-09-11 13:43 - 2016-09-11 13:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-09-11 13:41 - 2016-09-11 13:41 - 00242240 _____ C:\Users\Ryszard\Downloads\Firefox Setup Stub 48.0.2 (1).exe 2016-09-11 13:38 - 2016-09-11 13:39 - 00242240 _____ C:\Users\Ryszard\Downloads\Firefox Setup Stub 48.0.2.exe 2016-09-10 16:28 - 2016-09-10 16:28 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2016-09-10 16:28 - 2016-09-10 16:28 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk 2016-09-10 16:13 - 2016-09-11 13:27 - 00000000 ____D C:\Program Files (x86)\McAfee 2016-09-09 18:39 - 2016-09-09 13:13 - 05823295 ____N C:\Users\Ryszard\Desktop\MOV_1621.mp4 2016-09-09 18:36 - 2016-09-09 13:14 - 10111522 ____N C:\Users\Ryszard\Desktop\MOV_1622.mp4 2016-09-09 18:35 - 2016-09-09 13:15 - 16214726 ____N C:\Users\Ryszard\Desktop\MOV_1623.mp4 2016-09-09 18:34 - 2016-09-09 13:27 - 16289414 ____N C:\Users\Ryszard\Desktop\MOV_1626.mp4 2016-09-09 16:02 - 2016-09-09 16:02 - 00391496 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2016-09-09 16:01 - 2016-09-09 16:01 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr 2016-09-05 17:51 - 2016-09-05 18:43 - 00000000 ____D C:\Program Files\Rockstar Games 2016-09-05 16:50 - 2016-09-05 16:50 - 00000000 ____D C:\Users\Ryszard\AppData\LocalLow\uTorrent 2016-09-04 20:23 - 2016-09-05 19:21 - 77344076 _____ (BDIP ) C:\Users\Ryszard\Downloads\L.A. Noire - spolszczenie [1].exe 2016-09-04 16:23 - 2016-09-04 16:23 - 00000000 ____D C:\Users\Ryszard\AppData\Local\Chromium 2016-09-04 11:55 - 2016-09-04 11:55 - 00000000 ____D C:\ProgramData\Rockstar Games 2016-09-01 12:38 - 2016-09-01 12:38 - 00000000 ____D C:\Users\Ryszard\AppData\Local\WinSweeper 2016-08-31 12:42 - 2016-08-31 12:43 - 00322636 _____ C:\Users\Ryszard\Documents\pl.scribd.com_doc_245146222_ksiega-zwiazkow-podrywu-i-s.pdf 2016-08-31 12:40 - 2016-08-31 12:40 - 00000000 ____D C:\Users\Ryszard\AppData\Roaming\Softland 2016-08-31 12:38 - 2016-08-31 12:38 - 00000000 ____D C:\ProgramData\Softland 2016-08-29 12:29 - 2016-09-10 16:28 - 00000000 ____D C:\Program Files (x86)\Adobe 2016-08-29 12:12 - 2016-09-10 16:27 - 38966928 _____ (Adobe Systems Incorporated) C:\Users\Ryszard\Downloads\AdbeRdr11000_pl_PL.exe 2016-08-22 15:22 - 2016-08-22 15:22 - 00000000 ____D C:\Users\Ryszard\Documents\Games for Windows - LIVE Demos 2016-08-22 15:18 - 2016-08-22 15:18 - 00000000 ____D C:\Windows\SysWOW64\xlive 2016-08-22 15:17 - 2016-08-22 15:18 - 00000000 ____D C:\Program Files (x86)\Microsoft Games for Windows - LIVE 2016-08-22 15:17 - 2016-08-22 15:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace 2016-08-22 15:11 - 2016-08-22 15:13 - 73850656 _____ (Microsoft® Corporation) C:\Users\Ryszard\Downloads\gfwlivesetup.exe 2016-08-21 22:25 - 2016-08-21 22:25 - 08227032 _____ (Piriform Ltd) C:\Users\Ryszard\Downloads\ccsetup521.exe 2016-08-21 22:25 - 2016-08-21 22:25 - 00002794 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC 2016-08-21 22:25 - 2016-08-21 22:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2016-08-21 22:25 - 2016-08-21 22:25 - 00000000 ____D C:\Program Files\CCleaner 2016-08-21 22:14 - 2016-08-21 22:14 - 00000000 ____D C:\Windows\pss 2016-08-21 16:42 - 2016-08-21 16:42 - 00002054 _____ C:\Users\Ryszard\Desktop\GTA EFLC by nehm.lnk 2016-08-21 16:42 - 2016-08-21 16:42 - 00000000 ____D C:\Users\Ryszard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GTA Episodes From Liberty City 2016-08-20 18:06 - 2016-09-04 20:13 - 00000000 ___RD C:\Users\Ryszard\Desktop\Muzyka 2016-08-19 19:12 - 2016-08-20 19:26 - 00000000 ____D C:\Users\Ryszard\Desktop\Fizyka 2016-08-13 21:25 - 2016-08-13 22:05 - 00000000 ____D C:\Users\Ryszard\Documents\VirtualDJ 2016-08-13 21:25 - 2016-08-13 21:25 - 00000000 ____D C:\Users\Ryszard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VirtualDJ 2016-08-13 21:25 - 2016-08-13 21:25 - 00000000 ____D C:\Program Files (x86)\VirtualDJ 2016-08-13 21:03 - 2016-08-13 21:03 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2016-08-12 21:35 - 2016-09-10 12:59 - 00000000 ____D C:\Users\Ryszard\Desktop\Nowy folder (4) ==================== Jeden miesiąc - zmodyfikowane pliki i foldery ======== (Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.) 2016-09-11 15:07 - 2015-09-23 15:52 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-09-11 15:02 - 2016-02-20 11:28 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-09-11 13:43 - 2016-04-14 12:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-09-11 13:38 - 2009-07-14 06:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-09-11 13:38 - 2009-07-14 06:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-09-11 13:29 - 2016-04-23 16:08 - 00003958 _____ C:\Windows\System32\Tasks\SafeZone scheduled Autoupdate 1461420503 2016-09-11 13:28 - 2015-09-23 15:52 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-09-11 13:27 - 2016-04-23 16:04 - 00000000 ____D C:\Program Files\Common Files\AV 2016-09-11 13:27 - 2015-09-17 19:51 - 00000000 ____D C:\Program Files\Common Files\McAfee 2016-09-11 13:27 - 2015-09-16 23:34 - 00000000 ____D C:\Program Files\Intel 2016-09-11 13:27 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-09-11 13:24 - 2016-04-13 18:39 - 00000000 ____D C:\AdwCleaner 2016-09-11 12:55 - 2011-02-04 19:55 - 00741386 _____ C:\Windows\system32\perfh015.dat 2016-09-11 12:55 - 2011-02-04 19:55 - 00156426 _____ C:\Windows\system32\perfc015.dat 2016-09-11 12:55 - 2009-07-14 07:13 - 01672612 _____ C:\Windows\system32\PerfStringBackup.INI 2016-09-11 12:55 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf 2016-09-10 19:06 - 2015-10-25 14:45 - 00000000 ___RD C:\Users\Ryszard\Desktop\KSIĄŻKI 2016-09-10 16:31 - 2015-09-17 19:51 - 00000000 ____D C:\ProgramData\McAfee 2016-09-10 16:28 - 2015-09-17 00:34 - 00000000 ____D C:\ProgramData\Adobe 2016-09-10 16:14 - 2015-10-09 17:05 - 00000000 ____D C:\ProgramData\Package Cache 2016-09-10 16:09 - 2015-09-17 00:33 - 00000000 ____D C:\Users\Ryszard\AppData\Local\Adobe 2016-09-09 16:05 - 2015-09-23 15:53 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-09-09 16:03 - 2016-04-23 16:04 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2016-09-09 16:02 - 2016-04-23 16:04 - 00513496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00292704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00163416 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00108816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00103064 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00074544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2016-09-09 16:02 - 2016-04-23 16:04 - 00037656 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys 2016-09-09 16:01 - 2016-04-23 16:07 - 00037144 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2016-09-09 16:01 - 2016-04-23 16:04 - 00969560 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2016-09-08 20:25 - 2015-09-16 22:09 - 00000000 ____D C:\Users\Ryszard 2016-09-08 09:51 - 2016-04-14 20:56 - 00000000 ____D C:\Users\Ryszard\Desktop\Nowy folder (2) 2016-09-05 21:29 - 2015-09-18 19:53 - 00000000 ____D C:\Users\Ryszard\AppData\Roaming\uTorrent 2016-09-05 18:44 - 2015-12-25 23:39 - 00000000 ____D C:\Program Files (x86)\Rockstar Games 2016-09-05 16:03 - 2015-10-13 13:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games 2016-09-05 15:36 - 2015-09-16 23:29 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2016-09-04 16:23 - 2015-12-26 00:50 - 00000000 ____D C:\Users\Ryszard\Documents\Rockstar Games 2016-09-03 13:36 - 2015-10-14 20:42 - 00000000 ____D C:\Program Files (x86)\EA Games 2016-09-01 12:54 - 2016-05-05 22:42 - 00029184 ___SH C:\Users\Ryszard\Thumbs.db 2016-09-01 12:44 - 2015-09-17 00:45 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2016-09-01 12:40 - 2009-07-14 04:34 - 00000462 _____ C:\Windows\win.ini 2016-08-30 14:05 - 2015-09-16 21:39 - 00000000 ____D C:\Windows\Panther 2016-08-26 12:57 - 2016-02-21 17:09 - 00000000 ____D C:\Users\Ryszard\Desktop\Wspolnotowe 2016-08-22 21:26 - 2015-10-29 19:39 - 00000000 ____D C:\Users\Ryszard\Desktop\Firmowe 2016-08-22 15:17 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2016-08-21 16:53 - 2015-12-26 00:48 - 00000000 ____D C:\Users\Ryszard\AppData\Local\Rockstar Games 2016-08-19 13:05 - 2016-04-26 18:54 - 00000000 _____ C:\Windows\SysWOW64\last.dump 2016-08-15 20:10 - 2016-08-03 17:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\City Interactive 2016-08-15 20:10 - 2016-08-03 16:53 - 00000000 ____D C:\Program Files (x86)\City Interactive 2016-08-13 21:03 - 2015-11-17 15:17 - 00000000 ____D C:\Program Files\McAfee Security Scan ==================== Pliki w katalogu głównym wybranych folderów ======= 2016-02-16 13:29 - 2016-02-16 13:29 - 7950848 _____ () C:\Users\Ryszard\AppData\Roaming\agent.dat 2016-02-16 13:29 - 2016-02-16 13:29 - 0126976 _____ () C:\Users\Ryszard\AppData\Roaming\Installer.dat 2016-02-16 13:29 - 2016-02-16 13:29 - 0018432 _____ () C:\Users\Ryszard\AppData\Roaming\Main.dat 2015-09-16 23:33 - 2015-09-16 23:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl 2016-01-10 22:07 - 2016-04-16 11:09 - 0001834 _____ () C:\ProgramData\hpzinstall.log 2015-09-27 12:17 - 2015-09-27 12:17 - 0000016 _____ () C:\ProgramData\mntemp 2015-09-17 01:29 - 2015-06-15 23:42 - 72814208 ___SH () C:\ProgramData\msrzdf.exe Pliki do przeniesienia lub usunięcia: ==================== C:\ProgramData\msrzdf.exe C:\Users\Ryszard\Instalator_Testy_ABCDT.exe Niektóre pliki w TEMP: ==================== C:\Users\Ryszard\AppData\Local\Temp\drm_dialogs.dll C:\Users\Ryszard\AppData\Local\Temp\drm_dyndata_7380015.dll C:\Users\Ryszard\AppData\Local\Temp\drm_dyndata_7410004.dll C:\Users\Ryszard\AppData\Local\Temp\ICReinstall_Grand Theft Auto IV The Lost and Damned.exe C:\Users\Ryszard\AppData\Local\Temp\libeay32.dll C:\Users\Ryszard\AppData\Local\Temp\msvcr120.dll C:\Users\Ryszard\AppData\Local\Temp\sqlite3.dll C:\Users\Ryszard\AppData\Local\Temp\tmp2BA3.exe C:\Users\Ryszard\AppData\Local\Temp\tmpA5B4.exe C:\Users\Ryszard\AppData\Local\Temp\xcsFD34.tmp.exe ==================== Bamital & volsnap ================= (Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.) C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo C:\Windows\explorer.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo C:\Windows\system32\services.exe => Plik podpisany cyfrowo C:\Windows\system32\User32.dll => Plik podpisany cyfrowo C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo C:\Windows\system32\dnsapi.dll [2015-09-17 01:29] - [2015-09-17 01:29] - 0357888 ____N (Microsoft Corporation) 6D89F3E7356920E0554CD8F80BDD648B C:\Windows\SysWOW64\dnsapi.dll [2015-09-17 01:29] - [2015-09-17 01:29] - 0270336 ____N (Microsoft Corporation) 8245D208DB4CE15F15B460CE09E689BE C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo LastRegBack: 2016-08-26 11:41 ==================== Koniec FRST.txt ============================