Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 22-01-2017
Uruchomiony przez Andrzej (administrator)  JANUSZTRAMWAJ3K (22-01-2017 19:24:00)
Uruchomiony z D:\FRST
Załadowane profile: Andrzej & UpdatusUser (Dostępne profile: Andrzej & UpdatusUser)
Platform: Windows 7 Professional Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: Chrome)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Hi-Rez Studios) Q:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe
() C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files (x86)\uRage Reaper 3090 Gaming Mouse\Monitor.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Dell Inc.) C:\Program Files (x86)\Dell Update\DellUpService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Wargaming.net) Q:\WoT\World_of_Tanks\WargamingGameUpdater.exe
(Valve Corporation) Q:\STEAM\Main\Steam.exe
(Valve Corporation) Q:\STEAM\Main\bin\cef\cef.win7\steamwebhelper.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Valve Corporation) Q:\STEAM\Main\bin\cef\cef.win7\steamwebhelper.exe
(TeamSpeak Systems GmbH) D:\TS3\ts3client_win64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6463080 2012-01-16] (Realtek Semiconductor)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [uRage Reaper 3090 Gaming Mouse] => C:\Program Files (x86)\uRage Reaper 3090 Gaming Mouse\Monitor.EXE [184320 2013-03-01] ()
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\...\Run: [World of Tanks] => Q:\WoT\World_of_Tanks\WargamingGameUpdater.exe [3135752 2016-11-18] (Wargaming.net)
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\...\MountPoints2: G - G:\MTW2_Gold_setup.exe
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\...\MountPoints2: H - H:\setup.exe
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\...\MountPoints2: {cd5abe5f-cdb8-11e6-a3af-a41f7266d3c0} - J:\HiSuiteDownLoader.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [245872 2013-01-18] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [201576 2013-01-18] (NVIDIA Corporation)

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Hosts: W pliku Hosts jest więcej niż jedno wejście. Sprawdź sekcję Hosts w Addition.txt
Tcpip\Parameters: [DhcpNameServer] 188.125.128.2 78.28.48.9
Tcpip\..\Interfaces\{22FF70DC-9542-417F-B875-7FF164F64989}: [DhcpNameServer] 188.125.128.2 78.28.48.9
Tcpip\..\Interfaces\{AFC4D902-9475-4AE5-B401-39286FE40F2F}: [DhcpNameServer] 188.125.128.2 78.28.48.9

Internet Explorer:
==================
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkID=617910&ResetID=131271597786058964&GUID=00000000-0000-0000-0000-000000000000
HKU\S-1-5-21-1434517519-2506760423-1483115134-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

FireFox:
========
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome: 
=======
CHR DefaultProfile: Default
CHR StartupUrls: Default -> "chrome://newtab/","hxxp://pl-pl.facebook.com/","hxxp://www.youtube.com/?gl=PL&hl=pl"
CHR Plugin: (Widevine Content Decryption Module) - C:\Program Files (x86)\Google\Chrome\Application\55.0.2883.87\WidevineCdm\_platform_specific\win_x64\widevinecdmadapter.dll (Google Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\pepflashplayer64_24_0_0_186.dll => Brak pliku
CHR Profile: C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default [2017-01-22]
CHR Extension: (Dysk Google) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-12-29]
CHR Extension: (YouTube) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-12-29]
CHR Extension: (Adobe Acrobat) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-01-16]
CHR Extension: (Dokumenty Google offline) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-12-29]
CHR Extension: (AdBlock) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-12-29]
CHR Extension: (Graffiti them by toxic) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbihpjecaodopfhmhmaejafejhhdfmje [2016-12-30]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-18]
CHR Extension: (Gmail) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-12-29]
CHR Extension: (Chrome Media Router) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-12-29]
CHR Profile: C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1 [2017-01-11]
CHR Extension: (Prezentacje Google) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-02]
CHR Extension: (Dokumenty Google) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-02]
CHR Extension: (Dysk Google) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-02]
CHR Extension: (YouTube) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-02]
CHR Extension: (Arkusze Google) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-02]
CHR Extension: (Dokumenty Google offline) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-11]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-01-02]
CHR Extension: (Gmail) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-02]
CHR Extension: (Chrome Media Router) - C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-01-02]
CHR Profile: C:\Users\Andrzej\AppData\Local\Google\Chrome\User Data\System Profile [2017-01-02]
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [Brak podpisu cyfrowego]
R2 DellUpdate; C:\Program Files (x86)\Dell Update\DellUpService.exe [237272 2015-08-27] (Dell Inc.)
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [392480 2017-01-20] (EasyAntiCheat Ltd)
U2 HiPatchService; Q:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9728 2016-12-09] (Hi-Rez Studios) [Brak podpisu cyfrowego]
R2 HuaweiHiSuiteService64.exe; C:\Program Files (x86)\HiSuite\HandSetService\HuaweiHiSuiteService64.exe [192200 2016-11-25] () [Brak podpisu cyfrowego]
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe [73728 2012-02-08] (Atheros) [Brak podpisu cyfrowego]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

R3 GM3090Fltr; C:\Windows\System32\drivers\GM3090Fltr.sys [10752 2013-03-01] (LXD Development, Inc.)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [27552 2016-12-25] (REALiX(tm))
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2016-11-25] (Huawei Technologies Co., Ltd.)
S3 MBAMProtection; \??\C:\Windows\system32\drivers\mbam.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-01-22 19:24 - 2017-01-22 19:24 - 00000000 ____D C:\Users\Andrzej\Desktop\Nowy folder
2017-01-22 19:23 - 2017-01-22 19:23 - 00002460 _____ C:\Users\Andrzej\Desktop\FSS.txt
2017-01-22 17:21 - 2017-01-22 17:21 - 00000000 ____D C:\Users\Andrzej\AppData\Local\M2TWLauncher
2017-01-22 16:48 - 2017-01-22 16:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Medieval 2 Total War Gold
2017-01-22 16:26 - 2017-01-22 16:26 - 00000000 ____D C:\933900542ab6971618517da6
2017-01-22 14:36 - 2017-01-22 14:36 - 00000000 ____D C:\c3369c025d2397a7cc306469
2017-01-21 19:40 - 2017-01-21 19:40 - 00000000 ____D C:\49206d406398e7448391
2017-01-20 21:39 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2017-01-20 21:39 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2017-01-20 21:39 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll
2017-01-20 21:39 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll
2017-01-20 21:39 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2017-01-20 21:39 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll
2017-01-20 21:39 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00530776 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_6.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_6.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00078680 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_4.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00024920 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll
2017-01-20 21:39 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\X3DAudio1_7.dll
2017-01-20 17:19 - 2017-01-20 17:19 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mem Reduct
2017-01-20 17:19 - 2017-01-20 17:19 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\Henry++
2017-01-20 13:00 - 2017-01-20 13:00 - 00002972 _____ C:\Windows\System32\Tasks\{84C788BF-519B-4729-A343-A6E5FC5334E9}
2017-01-20 13:00 - 2017-01-20 13:00 - 00002972 _____ C:\Windows\System32\Tasks\{026C96AE-63F4-45EB-A632-85AA3D27D4C8}
2017-01-20 12:59 - 2017-01-20 12:59 - 00002972 _____ C:\Windows\System32\Tasks\{CAA5966D-FD77-4E4B-A017-D43D4DD0C647}
2017-01-19 21:36 - 2017-01-20 21:57 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2017-01-19 01:27 - 2017-01-19 01:27 - 00000019 _____ C:\Users\Andrzej\Desktop\Klan TS3.txt
2017-01-17 10:46 - 2017-01-17 10:46 - 00001015 _____ C:\Users\Andrzej\Desktop\nativelog.txt
2017-01-16 22:44 - 2017-01-16 22:44 - 00002988 _____ C:\Windows\System32\Tasks\{C75A67CD-734C-4EE7-870C-F54BAA765606}
2017-01-16 22:42 - 2017-01-16 22:42 - 00002988 _____ C:\Windows\System32\Tasks\{51ADDFEE-F0FB-4500-946E-D3DF46F2362A}
2017-01-16 22:41 - 2017-01-16 22:41 - 00000000 ____D C:\Users\Andrzej\Documents\GTA San Andreas User Files
2017-01-16 22:38 - 2017-01-16 22:38 - 00002988 _____ C:\Windows\System32\Tasks\{3AE7D89A-6A21-4982-A70B-5A2C3C4FF28D}
2017-01-16 22:26 - 2017-01-16 22:26 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2017-01-16 22:20 - 2017-01-16 22:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
2017-01-15 13:14 - 2017-01-15 13:14 - 00000000 ____D C:\Users\Andrzej\AppData\Local\TeamSpeak 3
2017-01-15 13:14 - 2017-01-15 13:14 - 00000000 ____D C:\Users\Andrzej\.TeamSpeak 3
2017-01-15 13:14 - 2017-01-15 13:14 - 00000000 ____D C:\Users\Andrzej\.QtWebEngineProcess
2016-12-31 19:48 - 2017-01-01 00:26 - 00524288 ___SH C:\Users\UpdatusUser\ntuser.dat{677b93f9-cf89-11e6-8c37-a41f7266d3c0}.TMContainer00000000000000000002.regtrans-ms
2016-12-31 19:48 - 2017-01-01 00:26 - 00524288 ___SH C:\Users\UpdatusUser\ntuser.dat{677b93f9-cf89-11e6-8c37-a41f7266d3c0}.TMContainer00000000000000000001.regtrans-ms
2016-12-31 19:48 - 2017-01-01 00:26 - 00065536 ___SH C:\Users\UpdatusUser\ntuser.dat{677b93f9-cf89-11e6-8c37-a41f7266d3c0}.TM.blf
2016-12-31 15:13 - 2016-12-31 15:13 - 00000000 ____D C:\Users\Andrzej\AppData\Local\Arktos Entertainment
2016-12-31 15:05 - 2016-12-31 15:05 - 00000000 ____D C:\Users\Andrzej\Documents\FredaikisAB
2016-12-31 15:05 - 2016-12-31 15:05 - 00000000 ____D C:\Users\Andrzej\AppData\Local\FredaikisAB
2016-12-31 15:05 - 2016-12-31 15:05 - 00000000 ____D C:\Users\Andrzej\AppData\Local\CrashRpt
2016-12-30 10:27 - 2017-01-21 20:17 - 02574775 ____H C:\Users\Andrzej\AppData\Local\IconCache.db
2016-12-30 09:57 - 2017-01-22 19:24 - 00000000 ____D C:\FRST
2016-12-29 16:19 - 2016-12-30 10:11 - 00001516 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-12-29 16:19 - 2016-12-29 16:25 - 00003480 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-12-29 16:19 - 2016-12-29 16:25 - 00003352 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-12-29 15:56 - 2016-12-30 10:11 - 00001228 _____ C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-29 14:46 - 2016-12-29 14:46 - 00000000 ____D C:\Users\Andrzej\Documents\BioWare
2016-12-29 14:15 - 2016-12-29 14:34 - 00000252 _____ C:\Windows\SysWOW64\PARTIZAN.TXT
2016-12-29 14:13 - 2016-12-29 14:13 - 00000000 ____D C:\@RestoreQuarantine
2016-12-29 14:03 - 2016-12-29 14:09 - 00000000 ____D C:\ProgramData\RegRun
2016-12-29 14:02 - 2016-12-29 14:02 - 00000002 RSHOT C:\Windows\winstart.bat
2016-12-29 14:02 - 2016-12-29 14:02 - 00000002 RSHOT C:\Windows\SysWOW64\CONFIG.NT
2016-12-29 14:02 - 2016-12-29 14:02 - 00000002 RSHOT C:\Windows\SysWOW64\AUTOEXEC.NT
2016-12-29 13:23 - 2016-12-29 13:23 - 00000000 ____D C:\Users\Andrzej\.android
2016-12-29 13:15 - 2016-12-29 13:27 - 00000000 ____D C:\Users\Andrzej\Documents\HiSuite
2016-12-29 13:15 - 2016-12-29 13:15 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2016-12-29 13:15 - 2016-12-29 13:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HiSuite
2016-12-29 13:15 - 2016-12-29 13:15 - 00000000 ____D C:\Program Files (x86)\HiSuite
2016-12-29 13:15 - 2016-11-25 07:15 - 02152176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFUpdate_01009.dll
2016-12-29 13:15 - 2016-11-25 07:15 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfCoInstaller01009.dll
2016-12-29 13:15 - 2016-11-25 07:15 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\winusbcoinstaller2.dll
2016-12-29 13:15 - 2016-11-25 07:15 - 00287232 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\hw_quusbnet.sys
2016-12-29 13:15 - 2016-11-25 07:15 - 00223232 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\hw_quusbmdm.sys
2016-12-29 13:15 - 2016-11-25 07:15 - 00126592 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\hw_cdcacm.sys
2016-12-29 13:15 - 2016-11-25 07:15 - 00116864 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\hw_usbdev.sys
2016-12-29 13:15 - 2016-11-25 07:15 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbser.sys
2016-12-29 13:15 - 2016-11-25 07:15 - 00018816 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ew_usbccgpfilter.sys
2016-12-29 13:14 - 2016-12-29 13:23 - 00000000 ____D C:\Users\Andrzej\AppData\Local\Hisuite
2016-12-25 19:21 - 2016-12-25 19:21 - 570206581 _____ C:\Windows\MEMORY.DMP
2016-12-25 19:21 - 2016-12-25 19:21 - 00331872 _____ C:\Windows\Minidump\122516-14102-01.dmp
2016-12-25 19:21 - 2016-12-25 19:21 - 00063986 _____ C:\Windows\ntbtlog.txt
2016-12-25 19:21 - 2016-12-25 19:21 - 00000000 ____D C:\Windows\Minidump
2016-12-25 19:18 - 2016-12-30 09:54 - 00000000 ____D C:\AdwCleaner
2016-12-25 18:16 - 2016-12-25 18:16 - 00001048 _____ C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-12-25 18:16 - 2016-12-25 18:16 - 00000000 ____D C:\ProgramData\{4465F24C-F94E-4197-9176-A6E9B91A59EA}.tmp
2016-12-25 18:15 - 2016-12-25 18:15 - 00000000 ____D C:\Users\Public\Thunder Network
2016-12-25 18:15 - 2016-11-09 15:55 - 00778752 _____ C:\Windows\system32\chtbrkg.dll
2016-12-25 18:15 - 2016-11-09 15:55 - 00590848 _____ C:\Windows\SysWOW64\chtbrkg.dll
2016-12-25 18:14 - 2016-12-25 18:18 - 00000000 ____D C:\ProgramData\ProductData
2016-12-25 18:14 - 2016-12-25 18:14 - 00027552 _____ (REALiX(tm)) C:\Windows\SysWOW64\Drivers\HWiNFO64A.SYS
2016-12-25 18:14 - 2016-12-25 18:14 - 00000000 ____D C:\Windows\IObit
2016-12-25 18:14 - 2016-12-25 18:14 - 00000000 ____D C:\Users\Andrzej\AppData\LocalLow\IObit
2016-12-25 18:14 - 2016-12-25 18:14 - 00000000 ____D C:\ProgramData\IObit
2016-12-25 18:13 - 2016-12-25 18:13 - 00099678 _____ C:\Users\Andrzej\Downloads\Play WarThunder.ico
2016-12-25 15:18 - 2016-12-25 15:18 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_xusb21_01009.Wdf
2016-12-25 15:18 - 2016-12-25 15:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Xbox 360 Accessories
2016-12-25 15:18 - 2016-12-25 15:18 - 00000000 ____D C:\Program Files\Microsoft Xbox 360 Accessories
2016-12-25 12:03 - 2017-01-22 18:45 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-12-25 12:03 - 2017-01-21 19:52 - 00000992 _____ C:\Windows\Tasks\Adobe Flash Player PPAPI Notifier.job
2016-12-25 12:03 - 2017-01-10 15:45 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2016-12-25 12:03 - 2017-01-10 15:45 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2016-12-25 12:03 - 2017-01-10 15:45 - 00004004 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2016-12-25 12:03 - 2017-01-10 15:45 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2016-12-25 12:03 - 2017-01-10 15:45 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2016-12-25 12:03 - 2017-01-10 15:45 - 00000000 ____D C:\Windows\system32\Macromed

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-01-22 19:21 - 2016-09-25 22:33 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\TS3Client
2017-01-22 12:36 - 2009-07-14 05:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-01-22 12:36 - 2009-07-14 05:45 - 00021312 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-01-22 12:28 - 2016-09-25 13:10 - 00000000 ____D C:\ProgramData\NVIDIA
2017-01-22 12:28 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-01-21 18:41 - 2016-09-25 14:02 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-20 12:51 - 2016-09-25 22:30 - 00392480 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe
2017-01-19 02:13 - 2016-09-25 08:57 - 00081472 _____ C:\Users\Andrzej\AppData\Local\GDIPFONTCACHEV1.DAT
2017-01-19 02:12 - 2009-07-14 05:45 - 00365160 _____ C:\Windows\system32\FNTCACHE.DAT
2017-01-17 10:47 - 2016-12-15 14:09 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\.minecraft
2017-01-16 22:48 - 2016-09-25 14:21 - 00000000 ____D C:\ProgramData\MTA San Andreas All
2017-01-16 22:41 - 2016-09-27 11:46 - 00000000 ____D C:\Windows\SysWOW64\directx
2017-01-16 22:41 - 2016-09-25 14:15 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-16 22:20 - 2016-09-25 08:56 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2017-01-16 22:19 - 2016-09-25 13:38 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\uTorrent
2017-01-15 13:14 - 2016-09-25 08:42 - 00000000 ____D C:\Users\Andrzej
2017-01-14 01:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2017-01-11 21:24 - 2016-09-25 14:02 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-12-31 19:48 - 2016-09-25 13:11 - 00000000 ____D C:\Users\UpdatusUser
2016-12-31 11:41 - 2016-09-25 18:34 - 00739694 _____ C:\Windows\system32\perfh015.dat
2016-12-31 11:41 - 2016-09-25 18:34 - 00155268 _____ C:\Windows\system32\perfc015.dat
2016-12-31 11:41 - 2009-07-14 06:13 - 01668226 _____ C:\Windows\system32\PerfStringBackup.INI
2016-12-31 11:41 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2016-12-31 11:41 - 2009-07-14 03:36 - 00653526 _____ C:\Windows\system32\perfh009.dat
2016-12-31 11:41 - 2009-07-14 03:36 - 00121398 _____ C:\Windows\system32\perfc009.dat
2016-12-31 11:27 - 2009-07-14 04:20 - 00000000 ___HD C:\ProgramData
2016-12-30 10:24 - 2016-11-18 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gwent [GOG.com]
2016-12-30 00:53 - 2016-11-18 15:33 - 00000000 ____D C:\Program Files (x86)\GOG Galaxy
2016-12-29 22:35 - 2010-11-21 04:47 - 00351152 _____ C:\Windows\PFRO.log
2016-12-29 16:25 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Tasks
2016-12-29 16:19 - 2016-09-25 08:57 - 00000000 ____D C:\Users\Andrzej\AppData\Local\Google
2016-12-29 16:19 - 2016-09-25 08:57 - 00000000 ____D C:\Program Files (x86)\Google
2016-12-29 15:56 - 2016-09-25 08:42 - 00000476 ___SH C:\Users\Andrzej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini
2016-12-29 14:48 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Documents
2016-12-29 14:48 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\drivers
2016-12-29 14:46 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\winsxs
2016-12-29 14:34 - 2009-07-14 04:20 - 00000000 ___RD C:\Program Files
2016-12-29 14:34 - 2009-07-14 03:34 - 00000888 _____ C:\Windows\system32\Drivers\etc\hosts
2016-12-29 14:06 - 2016-09-25 14:17 - 00000000 ____D C:\Users\Andrzej\AppData\Local\tkdata
2016-12-29 13:17 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-12-29 13:15 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\DriverStore
2016-12-26 12:14 - 2016-09-27 10:01 - 00000000 ____D C:\Program Files\Intel Security
2016-12-26 12:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\wdi
2016-12-25 18:16 - 2016-09-25 13:11 - 00000000 ____D C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
2016-12-25 18:15 - 2009-07-14 04:20 - 00000000 ___SD C:\ProgramData\Microsoft
2016-12-25 18:15 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public
2016-12-25 18:13 - 2016-09-25 14:02 - 00000000 ____D C:\Users\Andrzej\AppData\Roaming\Adobe
2016-12-25 15:11 - 2016-09-25 15:12 - 00000000 ____D C:\Users\Andrzej\AppData\Local\ElevatedDiagnostics
2016-12-25 12:02 - 2016-09-25 14:01 - 00000000 ____D C:\Users\Andrzej\AppData\Local\Adobe
2016-12-24 19:40 - 2016-09-25 14:02 - 00000000 ____D C:\ProgramData\McAfee
2016-12-24 01:02 - 2009-07-14 05:54 - 00524288 ___SH C:\Windows\system32\config\COMPONENTS{016888b9-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
2016-12-24 01:02 - 2009-07-14 05:54 - 00065536 ___SH C:\Windows\system32\config\COMPONENTS{016888b9-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf

==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2016-12-04 10:54

==================== Koniec  FRST.txt ============================