Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 27-11-2016
Uruchomiony przez Dawid (administrator)  DAWID-KOMPUTER (30-11-2016 13:10:41)
Uruchomiony z C:\Users\Dawid\Desktop\LSO
Załadowane profile: Dawid (Dostępne profile: Dawid)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Solvusoft Corporation) C:\Program Files (x86)\WinThruster\WinThruster.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(TP-LINK TECHNOLOGIES CO., LTD. ) C:\Program Files (x86)\TP-LINK\Common\TWCU.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\wsc_proxy.exe
() C:\Program Files\EslWire\service\WireHelperSvc.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\TP-LINK\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\TP-LINK\Common\RaRegistry64.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(Famatech Corp.) C:\Windows\SysWOW64\rserver30\rserver3.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe
() C:\Program Files\ByteFence\rtop\bin\rtop_bg.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(AVG) C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\wsc_proxy.exe
(Microsoft Corporation) C:\Windows\System32\CompatTel\wicainventory.exe
(Famatech Corp.) C:\Windows\SysWOW64\rserver30\FamItrfc.Exe
(Famatech Corp.) C:\Windows\SysWOW64\rserver30\FamItrfc.Exe


==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-12-13] (Realtek Semiconductor)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9080768 2016-11-15] (AVAST Software)
HKLM-x32\...\Run: [] => [X]
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-520186686-253924310-3618737155-1000\...\Run: [GoogleChromeAutoLaunch_D2C73B4BE2EDB87BC4F6EB49D6696FEE] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [921192 2016-11-08] (Google Inc.)
HKU\S-1-5-21-520186686-253924310-3618737155-1000\...\MountPoints2: {d123d17e-2dfb-11e4-a547-806e6f6e6963} - D:\SETUP.EXE
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-10-09] (Microsoft Corporation)
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll [2016-09-27] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Utility.lnk [2014-10-08]
ShortcutTarget: TP-LINK Wireless Utility.lnk -> C:\Program Files (x86)\TP-LINK\Common\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD. )

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{76755AB0-0F13-4135-8B6C-354A3D73179C}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = 
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\S-1-5-21-520186686-253924310-3618737155-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {425ED333-6083-428a-92C9-0CFC28B9D1BF} URL = 
SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2488} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=101&systemid=488&v=a15007-498&apn_uid=6693905175044420&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2488} URL = hxxp://dts.search.ask.com/sr?src=ieb&gct=ds&appid=101&systemid=488&v=a15007-498&apn_uid=6693905175044420&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-10] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll [2016-10-25] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-10] (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2016-10-25] (AVAST Software)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\hff3jkg8.default [2016-11-29]
FF DefaultSearchEngine: Mozilla\Firefox\Profiles\hff3jkg8.default -> Google
FF SearchEngineOrder.1: Mozilla\Firefox\Profiles\hff3jkg8.default -> Google
FF SelectedSearchEngine: Mozilla\Firefox\Profiles\hff3jkg8.default -> Google
FF DefaultSearchUrl: Mozilla\Firefox\Profiles\hff3jkg8.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Keyword.URL: Mozilla\Firefox\Profiles\hff3jkg8.default -> hxxps://www.google.com/search?bcutc=sp-006
FF Homepage: Mozilla\Firefox\Profiles\hff3jkg8.default -> hxxps://www.google.com/?bcutc=sp-006
FF NewTab: Mozilla\Firefox\Profiles\hff3jkg8.default -> about:newtab
FF Extension: (Greasemonkey) - C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\hff3jkg8.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2016-06-13]
FF SearchPlugin: C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\hff3jkg8.default\searchplugins\delta-homes.xml [2016-06-28]
FF SearchPlugin: C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\hff3jkg8.default\searchplugins\google-avast.xml [2016-11-29]
FF HKLM\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Extension: (Avast SafePrice) - C:\Program Files\AVAST Software\Avast\SafePrice\FF [2016-10-08]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: (Avast Online Security) - C:\Program Files\AVAST Software\Avast\WebRep\FF [2016-10-08]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\Dawid\AppData\Roaming\Mozilla\Firefox\Profiles\hff3jkg8.default\extensions\arthurj8283@gmail.com => nie znaleziono
FF HKLM-x32\...\Firefox\Extensions: [sp@avast.com] - C:\Program Files\AVAST Software\Avast\SafePrice\FF
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_23_0_0_207.dll [2016-11-09] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-10] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_23_0_0_207.dll [2016-11-09] ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-14] (Google Inc.)
FF Plugin HKU\S-1-5-21-520186686-253924310-3618737155-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dawid\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-09-27] (Unity Technologies ApS)

Chrome: 
=======
CHR DefaultProfile: Default
CHR HomePage: Default -> hxxp://www.delta-homes.com/?type=hp&ts=1434044799&z=f2e20c3c95e5902245642b6g5z0cbz1e2z2zcm7tcb&from=ient06110&uid=WDCXWD1003FZEX-00MK2A0_WD-WCC3F130353403534
CHR StartupUrls: Default -> "hxxp://www.delta-homes.com/?type=hp&ts=1434044799&z=f2e20c3c95e5902245642b6g5z0cbz1e2z2zcm7tcb&from=ient06110&uid=WDCXWD1003FZEX-00MK2A0_WD-WCC3F130353403534"
CHR Profile: C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default [2016-11-30]
CHR Extension: (Dokumenty Google) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-09]
CHR Extension: (Dysk Google) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-10-21]
CHR Extension: (Galaxy Aero 1440p) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\baobdjafbehnhgceapbejnfcfebhoafb [2016-06-10]
CHR Extension: (YouTube) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24]
CHR Extension: (Google Search) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-10-27]
CHR Extension: (Clipchamp - convert, compress, record video) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\delkpojpfkkfgmknffmblbhmlamkjioi [2016-11-25]
CHR Extension: (Tampermonkey) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2016-11-27]
CHR Extension: (Dokumenty Google offline) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-11-25]
CHR Extension: (Zapisz na Dysku Google) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmbmikajjgmnabiglmofipeabaddhgne [2014-11-12]
CHR Extension: (Avast Online Security) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2016-11-01]
CHR Extension: (Mogicons.com) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkdlcejbjnnmjgajjjfenejacioiimpp [2016-06-26]
CHR Extension: (Auto Replay for YouTube™) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\kanbnempkjnhadplbfgdaagijdbdbjeb [2016-06-08]
CHR Extension: (Google Play) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\komhbcfkdcgmcdoenjcjheifdiabikfi [2015-02-10]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-10]
CHR Extension: (RaFoNiX Is Back! - YouTube Gaming) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\nobjfchfjpknckfjcnofmnmmkhianodn [2016-01-18]
CHR Extension: (Mój motyw Chrome) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\oehpjpccmlcalbenfhnacjeocbjdonic [2015-08-26]
CHR Extension: (Speedtest by Ookla) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\pgjjikdiikihdfpoppgaidccahalehjh [2016-11-01]
CHR Extension: (Gmail) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-28]
CHR Extension: (Chrome Media Router) - C:\Users\Dawid\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-10-26]
CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - C:\Program Files (x86)\Internet Download Manager\IDMGCExt.crx <nie znaleziono>
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx <nie znaleziono>

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-09-11] (Advanced Micro Devices, Inc.) [Brak podpisu cyfrowego]
S3 AppIDSvc; C:\Windows\System32\appidsvc.dll [32256 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [83768 2016-09-22] (Apple Inc.)
R2 AudioEndpointBuilder; C:\Windows\System32\Audiosrv.dll [680960 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 AudioSrv; C:\Windows\System32\Audiosrv.dll [680960 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-27] (AVAST Software)
S2 ByteFenceService; C:\Program Files\ByteFence\ByteFenceService.exe [146912 2016-11-01] (Byte Technologies LLC)
R2 EslWireHelper; C:\Program Files\EslWire\service\WireHelperSvc.exe [663056 2016-04-12] ()
S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2014-11-19] () [Brak podpisu cyfrowego]
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.427\McCHSvc.exe [329480 2016-10-13] (McAfee, Inc.)
S3 OverwolfUpdater; C:\Program Files (x86)\Overwolf\OverwolfUpdater.exe [1316080 2016-11-23] (Overwolf LTD)
R2 PcaSvc; C:\Windows\System32\pcasvc.dll [188416 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
R2 RalinkRegistryWriter; C:\Program Files (x86)\TP-LINK\Common\RaRegistry.exe [185632 2010-03-01] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\TP-LINK\Common\RaRegistry64.exe [212256 2010-03-01] (Ralink Technology, Corp.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [187048 2015-06-23] ()
R2 RServer3; C:\Windows\SysWOW64\rserver30\RServer3.exe [1154752 2012-12-19] (Famatech Corp.)
R2 rtop; C:\Program Files\ByteFence\rtop\bin\rtop_svc.exe [254280 2016-11-27] ()
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesService64.exe [2183992 2014-03-22] (AVG)
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [42240 2013-07-31] (Advanced Micro Devices)
S3 AppID; C:\Windows\system32\drivers\appid.sys [61440 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [37656 2016-09-27] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [37144 2016-09-27] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [108816 2016-09-27] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [103064 2016-09-27] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [74544 2016-09-27] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [969184 2016-09-27] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [513632 2016-09-27] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [163416 2016-09-27] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [293352 2016-10-13] (AVAST Software)
R3 mirrorv3; C:\Windows\System32\DRIVERS\rminiv3.sys [5632 2012-12-18] (Famatech International Corp.)
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [663552 2015-02-03] (Microsoft Corporation) [Brak podpisu cyfrowego]
R1 raddrvv3; C:\Windows\SysWOW64\rserver30\raddrvv3.sys [71576 2012-12-19] (Famatech Corp.)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-06-12] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [129472 2015-06-27] (Razer, Inc.)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver64.sys [14112 2014-02-10] (TuneUp Software)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-11-29 21:14 - 2016-11-29 21:14 - 00000000 ____D C:\Windows\pss
2016-11-29 20:26 - 2016-11-29 20:26 - 00001773 _____ C:\Users\Dawid\Desktop\FarCry4 — skrót.lnk
2016-11-28 17:14 - 2016-11-28 17:17 - 00000000 ____D C:\Users\Dawid\Desktop\Metiny
2016-11-28 17:12 - 2016-11-28 17:14 - 00000000 ____D C:\Users\Dawid\Downloads\[R.G. Mechanics] Mafia III
2016-11-27 19:49 - 2016-11-27 19:54 - 00000000 ____D C:\Users\Dawid\Documents\Witcher 2
2016-11-27 19:49 - 2016-11-27 19:49 - 00000000 ____D C:\Users\Dawid\AppData\Local\The Witcher 2
2016-11-27 19:47 - 2016-11-27 19:47 - 00000000 ____D C:\Users\Dawid\AppData\Local\Crashpad
2016-11-27 19:47 - 2016-11-27 19:47 - 00000000 ____D C:\Users\Dawid\AppData\Local\AliExpress
2016-11-27 19:29 - 2016-11-27 19:29 - 00002041 _____ C:\Users\Dawid\Desktop\The Witcher 2 - Assassins of Kings - Enhanced Edition.lnk
2016-11-27 19:29 - 2016-11-27 19:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst
2016-11-27 19:07 - 2016-11-27 19:07 - 00000000 ____D C:\R.G. Catalyst
2016-11-27 13:39 - 2016-11-27 14:28 - 00000000 ____D C:\Users\Dawid\Downloads\Witcher 2_RU.EN.PL_[R.G. Catalyst]
2016-11-27 12:53 - 2016-11-27 12:53 - 00003016 _____ C:\Windows\System32\Tasks\{578CFFC4-6F25-4403-BC25-98385BD8D2C1}
2016-11-27 02:13 - 2016-11-27 02:13 - 00000000 ____D C:\ProgramData\ByteFence
2016-11-26 21:19 - 2016-11-29 21:32 - 00000236 _____ C:\Windows\Tasks\AliExpress_helper.job
2016-11-26 21:19 - 2016-11-26 21:19 - 00003188 _____ C:\Windows\System32\Tasks\AliExpress_helper
2016-11-26 21:19 - 2016-11-26 21:19 - 00001149 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AliExpress.lnk
2016-11-26 21:19 - 2016-11-26 21:19 - 00001137 _____ C:\Users\Public\Desktop\AliExpress.lnk
2016-11-26 21:19 - 2016-11-26 21:19 - 00000000 ___HD C:\Users\Dawid\AppData\Roaming\AliExpress_helper
2016-11-26 21:19 - 2016-11-26 21:19 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AliExpress
2016-11-26 21:19 - 2016-11-26 21:19 - 00000000 ____D C:\Program Files (x86)\AliExpress
2016-11-26 21:13 - 2016-11-30 13:08 - 00000000 ____D C:\Program Files\ByteFence
2016-11-26 21:13 - 2016-11-29 21:32 - 00000242 _____ C:\Windows\Tasks\Booking_helper.job
2016-11-26 21:13 - 2016-11-26 21:19 - 00000000 ___HD C:\Users\Dawid\AppData\Roaming\GoldenGate
2016-11-26 21:13 - 2016-11-26 21:13 - 00003488 _____ C:\Windows\System32\Tasks\ByteFence Scan
2016-11-26 21:13 - 2016-11-26 21:13 - 00003396 _____ C:\Windows\System32\Tasks\ByteFence
2016-11-26 21:13 - 2016-11-26 21:13 - 00003194 _____ C:\Windows\System32\Tasks\Booking_helper
2016-11-26 21:13 - 2016-11-26 21:13 - 00001865 _____ C:\Users\Dawid\Desktop\BitLord.lnk
2016-11-26 21:13 - 2016-11-26 21:13 - 00001045 _____ C:\Users\Public\Desktop\Booking.com.lnk
2016-11-26 21:13 - 2016-11-26 21:13 - 00001023 _____ C:\Users\Dawid\Desktop\ByteFence Anti-Malware.lnk
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ___HD C:\Users\Dawid\AppData\Roaming\Booking_helper
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\Documents\BitLord
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BitLord
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\Microsoft\Windows\Start Menu\ByteFence
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\BitLord
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\AppData\Local\BitLord
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\.QtWebEngineProcess
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Users\Dawid\.BitLord
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Booking.com
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Program Files (x86)\Booking.com
2016-11-26 21:13 - 2016-11-26 21:13 - 00000000 ____D C:\Program Files (x86)\BitLord
2016-11-26 21:12 - 2016-11-26 21:12 - 00003698 _____ C:\Windows\System32\Tasks\WorldofTanks2
2016-11-26 21:12 - 2016-11-26 21:12 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\WorldofTanks
2016-11-26 21:12 - 2016-11-26 21:12 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks
2016-11-25 17:41 - 2016-11-25 17:41 - 00000000 ____D C:\Users\Dawid\Desktop\NA KOTA
2016-11-20 10:01 - 2016-11-20 10:01 - 00000000 ____D C:\Users\Dawid\AppData\Local\Chromium
2016-11-13 17:53 - 2016-11-30 13:10 - 00000000 ____D C:\FRST
2016-11-11 15:02 - 2016-11-11 15:15 - 00000000 ____D C:\Users\Dawid\Desktop\ds
2016-11-11 13:58 - 2016-11-11 13:58 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2016-11-11 13:58 - 2016-11-11 13:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2016-11-11 13:58 - 2016-11-11 13:58 - 00000000 ____D C:\Program Files\iTunes
2016-11-11 13:58 - 2016-11-11 13:58 - 00000000 ____D C:\Program Files\iPod
2016-11-11 13:47 - 2016-11-11 13:47 - 00000000 ____D C:\Users\Dawid\Desktop\Nowy folder
2016-11-07 20:02 - 2016-11-04 13:39 - 00000000 ____D C:\Users\Dawid\Desktop\MultiH4ck
2016-11-07 19:28 - 2016-11-07 19:41 - 00000000 ____D C:\Users\Dawid\Desktop\Wh Injector
2016-11-07 19:15 - 2016-11-07 19:15 - 00000006 _____ C:\Users\Dawid\Desktop\11213.txt
2016-11-07 19:08 - 2016-11-07 19:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ClassicMT2
2016-11-05 19:39 - 2016-11-05 19:39 - 00000708 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Debestia.lnk
2016-11-05 16:43 - 2016-11-05 19:36 - 00000000 ____D C:\Program Files (x86)\Debestia
2016-11-02 17:37 - 2016-11-07 16:25 - 00000000 ____D C:\Users\Dawid\Documents\METIN2

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2016-11-30 13:09 - 2016-06-19 16:25 - 00003106 _____ C:\Windows\System32\Tasks\WinThruster
2016-11-30 13:04 - 2014-11-12 18:16 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-11-30 13:03 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-11-29 21:30 - 2016-09-05 21:53 - 00000000 ____D C:\Users\Dawid\Desktop\LSO
2016-11-29 21:16 - 2014-11-12 18:16 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-11-29 21:14 - 2016-08-17 20:32 - 00000000 ____D C:\Users\Dawid\AppData\Local\ElevatedDiagnostics
2016-11-29 21:10 - 2016-03-29 20:07 - 00000837 _____ C:\Users\Dawid\Desktop\Start Tor Browser.lnk
2016-11-29 21:10 - 2014-08-27 17:53 - 00001135 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-11-29 20:41 - 2014-10-29 17:49 - 00000000 ____D C:\Program Files (x86)\Steam
2016-11-29 20:36 - 2014-10-27 18:09 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-11-29 20:26 - 2015-08-14 16:50 - 00000000 ____D C:\Users\Dawid\AppData\Local\CrashDumps
2016-11-29 20:19 - 2009-07-14 05:45 - 00017472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-11-29 20:19 - 2009-07-14 05:45 - 00017472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-11-29 20:09 - 2014-10-13 10:06 - 00000000 ____D C:\Program Files (x86)\Opera
2016-11-29 20:03 - 2016-08-16 03:21 - 00000000 ____D C:\Users\Dawid\AppData\Local\ESL Wire Game Client
2016-11-29 18:04 - 2015-08-30 00:04 - 00000000 ____D C:\Program Files (x86)\Overwolf
2016-11-29 17:58 - 2014-08-27 17:55 - 00004180 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-11-28 18:05 - 2016-06-28 18:05 - 00000002 _____ C:\END
2016-11-28 15:02 - 2016-06-19 16:25 - 00000274 _____ C:\Windows\Tasks\WinThruster_DEFAULT.job
2016-11-27 13:36 - 2015-08-18 20:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-11-27 13:36 - 2015-08-18 20:42 - 00000000 ____D C:\GOG Games
2016-11-27 13:35 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-11-26 21:17 - 2014-11-22 13:48 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\uTorrent
2016-11-26 21:13 - 2014-08-27 17:12 - 00000000 ____D C:\Users\Dawid
2016-11-26 11:08 - 2015-02-19 16:41 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\TS3Client
2016-11-25 20:51 - 2014-11-23 15:25 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\Skype
2016-11-25 20:49 - 2016-06-15 19:29 - 00000000 ____D C:\Users\Dawid\AppData\Roaming\.minecraft
2016-11-23 21:34 - 2016-01-17 15:24 - 00000000 ___RD C:\Program Files (x86)\Skype
2016-11-23 21:34 - 2014-11-23 15:25 - 00000000 ____D C:\ProgramData\Skype
2016-11-20 11:29 - 2014-10-26 08:55 - 00000000 ____D C:\Games
2016-11-19 21:45 - 2014-12-04 20:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics
2016-11-16 17:25 - 2016-06-19 16:25 - 00000282 _____ C:\Windows\Tasks\WinThruster_UPDATES.job
2016-11-11 14:18 - 2014-11-12 18:18 - 00002425 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-11-11 13:58 - 2016-09-05 22:00 - 00000000 ____D C:\Program Files\Common Files\Apple
2016-11-09 16:36 - 2014-10-27 18:09 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-11-09 16:36 - 2014-10-27 18:09 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-11-09 16:36 - 2014-10-27 18:09 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-11-09 16:36 - 2014-10-27 18:09 - 00000000 ____D C:\Windows\system32\Macromed
2016-11-09 16:36 - 2014-10-13 10:13 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-11-07 19:07 - 2016-03-29 14:27 - 00000000 ____D C:\Gry
2016-11-01 18:04 - 2014-11-12 18:16 - 00000000 ____D C:\Users\Dawid\AppData\Local\Google
2016-10-31 23:15 - 2015-02-19 19:01 - 00000000 ____D C:\Users\Dawid\AppData\Local\Steam

==================== Pliki w katalogu głównym wybranych folderów =======

2013-12-12 20:04 - 2013-12-12 20:04 - 0001061 _____ () C:\Program Files\Common Files\bpk.dat
2013-12-12 23:58 - 2013-12-12 23:58 - 0000996 _____ () C:\Program Files\Common Files\inst.dat
2013-12-13 03:15 - 2013-12-13 03:15 - 0004204 _____ () C:\Program Files\Common Files\pk.bin
2015-09-05 20:22 - 2015-09-05 20:22 - 0003584 _____ () C:\Users\Dawid\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-02-26 21:27 - 2016-02-26 21:27 - 0002227 _____ () C:\Users\Dawid\AppData\Local\recently-used.xbel
2014-10-10 18:38 - 2014-10-10 18:38 - 0007597 _____ () C:\Users\Dawid\AppData\Local\Resmon.ResmonCfg
2016-03-26 15:50 - 2016-03-26 15:50 - 0000000 _____ () C:\Users\Dawid\AppData\Local\{9064E0D0-FAFB-45CF-8105-923A9A7DE393}

Niektóre pliki w TEMP:
====================
C:\Users\Dawid\AppData\Local\Temp\0Kraken0502DevProps.dll
C:\Users\Dawid\AppData\Local\Temp\EslWireSetup-1.19.0.8229-x64.exe
C:\Users\Dawid\AppData\Local\Temp\Quarantine.exe
C:\Users\Dawid\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Dawid\AppData\Local\Temp\sqlite3.dll
C:\Users\Dawid\AppData\Local\Temp\utils.dll
C:\Users\Dawid\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Dawid\AppData\Local\Temp\_Uninstall_0.exe


==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo


LastRegBack: 2016-11-27 00:15

==================== Koniec  FRST.txt ============================