Rezultaty skanowania Farbar Recovery Scan Tool (FRST) (x64) Wersja: 18-02-2017 01
Uruchomiony przez Przemek (administrator)  PRZEMEK-KOMP (19-02-2017 21:39:21)
Uruchomiony z A:\Pobrane
Załadowane profile: Przemek (Dostępne profile: Przemek)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Język: Polski (Polska)
Internet Explorer Wersja 11 (Domyślna przeglądarka: FF)
Tryb startu: Normal
Instrukcja obsługi Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Procesy (filtrowane) =================

(Załączenie wejścia w fixlist spowoduje zamknięcie procesu. Powiązany plik nie zostanie przeniesiony.)

(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Akamai Technologies, Inc.) C:\Users\Przemek\AppData\Local\Akamai\netsession_win.exe
(Palit Microsystems Ltd.) C:\Program Files (x86)\Thunder Master\THPanel.exe
(Check Point Software Technologies, Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZAPrivacyService.exe
(Flux Software LLC) C:\Users\Przemek\AppData\Local\FluxSoftware\Flux\flux.exe
(Akamai Technologies, Inc.) C:\Users\Przemek\AppData\Local\Akamai\netsession_win.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Check Point Software Technologies Ltd.) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Mozilla Corporation) A:\Programy\Thunderbird\thunderbird.exe

==================== Rejestr (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje usunięcie obiektu z rejestru lub przywrócenie jego domyślnej postaci. Powiązany plik nie zostanie przeniesiony.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2757424 2015-11-25] (NVIDIA Corporation)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [ZoneAlarm] => C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [134480 2016-07-28] (Check Point Software Technologies Ltd.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\Run: [THPanel] => C:\Program Files (x86)\Thunder Master\THPanel.exe [2197472 2015-07-22] (Palit Microsystems Ltd.)
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Przemek\AppData\Local\Akamai\netsession_win.exe [4490200 2017-01-03] (Akamai Technologies, Inc.) <===== UWAGA
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\Run: [f.lux] => C:\Users\Przemek\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\RunOnce: [Uninstall C:\Users\Przemek\AppData\Local\Microsoft\OneDrive\17.3.4604.0120_1\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Przemek\AppData\Local\Microsoft\OneDrive\17.3.4604.0120_1\amd64"
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\MountPoints2: {7accf517-f6d8-11e6-be1e-408d5c192dc4} - E:\Startme.exe

==================== Internet (filtrowane) ====================

(Załączenie wejścia w fixlist, w przypadku gdy jest to obiekt rejestru, spowoduje usunięcie go z rejestru lub przywrócenie jego domyślnej postaci.)

Tcpip\Parameters: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{43CBDC12-CAF4-4F6C-A4AE-CB660A7B7D12}: [DhcpNameServer] 37.8.214.2 31.11.202.254

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Ograniczenia <======= UWAGA
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxps://search.avira.net
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxps://search.avira.net
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = 
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid=%7BC1E6B57D-EBA1-4623-B0F3-BCA475A81C86%7D&mid=04a2e66a8b5b47ccb86f91c41afdc437-30ab0dfc91460360d51e611c879a171b398de1a7&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0615piz&pr=fr&d=2015-11-28%2010:58:37&v=4.2.1.951&pid=wtu&sg=&sap=hp
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxps://search.avira.net
HKU\S-1-5-21-1043970873-994787732-2172021387-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxps://search.avira.net
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1043970873-994787732-2172021387-1000 -> DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={C1E6B57D-EBA1-4623-B0F3-BCA475A81C86}&mid=04a2e66a8b5b47ccb86f91c41afdc437-30ab0dfc91460360d51e611c879a171b398de1a7&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1215tb&pr=fr&d=2015-11-28 10:58:37&v=4.2.1.951&pid=wtu&sg=&sap=dsp&q={searchTerms}
SearchScopes: HKU\S-1-5-21-1043970873-994787732-2172021387-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxps://mysearch.avg.com/search?cid={C1E6B57D-EBA1-4623-B0F3-BCA475A81C86}&mid=04a2e66a8b5b47ccb86f91c41afdc437-30ab0dfc91460360d51e611c879a171b398de1a7&lang=pl&ds=AVG&coid=avgtbavg&cmpid=1215tb&pr=fr&d=2015-11-28 10:58:37&v=4.2.1.951&pid=wtu&sg=&sap=dsp&q={searchTerms}
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\ssv.dll [2016-08-12] (Oracle Corporation)
BHO-x32: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files (x86)\AVG Web TuneUp\4.2.3.128\AVG Web TuneUp.dll [2015-12-10] (AVG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-12] (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.)
StartMenuInternet: IEXPLORE.EXE - iexplore.exe

FireFox:
========
FF ProfilePath: C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default [2017-02-19]
FF user.js: detected! => C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\user.js [2017-02-19]
FF Extension: (Avira Browser Safety) - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\Extensions\abs@avira.com.xpi [2017-02-09]
FF Extension: (BetterTTV) - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\Extensions\firefox@betterttv.net.xpi [2017-02-06]
FF Extension: (MEGA) - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\Extensions\firefox@mega.co.nz.xpi [2017-02-17]
FF Extension: (Adblock Plus) - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-11-23]
FF Extension: (SHA-1 deprecation staged rollout) - C:\Users\Przemek\AppData\Roaming\Mozilla\Firefox\Profiles\HXptn7gg.default\features\{fab5c158-a079-4575-9ebd-6e6a7cb11c4e}\disableSHA1rollout@mozilla.org.xpi [2017-02-17]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: (HP Smart Web Printing) - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2015-12-08] [Brak podpisu cyfrowego]
FF HKU\S-1-5-21-1043970873-994787732-2172021387-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_24_0_0_221.dll [2017-02-14] ()
FF Plugin: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_24_0_0_221.dll [2017-02-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-12] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files (x86)\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-12] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [Brak pliku]
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.50901.0\npctrl.dll [2016-08-31] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-10-25] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-10-25] (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-12-23] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default [2016-09-26]
CHR Extension: (Prezentacje Google) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-11-28]
CHR Extension: (BetterTTV) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajopnjidmegmdimjlfnijceegpefgped [2016-06-03]
CHR Extension: (Dokumenty Google) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-11-28]
CHR Extension: (Dysk Google) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-11-28]
CHR Extension: (YouTube) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-11-28]
CHR Extension: (Google Search) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-11-28]
CHR Extension: (Slither.io) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\dmplapbomebhmdffmlhgbelgcnfajapj [2016-04-24]
CHR Extension: (Arkusze Google) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-11-28]
CHR Extension: (Avira Browser Safety) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2016-07-19]
CHR Extension: (Dokumenty Google offline) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-15]
CHR Extension: (AdBlock) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-07-19]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Oddshot) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\olnoeeagkgpkplnhmnnlgodjnjgckhja [2016-07-19]
CHR Extension: (Gmail) - C:\Users\Przemek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-11-28]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
StartMenuInternet: Google Chrome - Chrome.exe

==================== Usługi (filtrowane) ====================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

S3 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156400 2015-11-25] (NVIDIA Corporation)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego]
R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [Brak podpisu cyfrowego]
S4 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hewlett-Packard\HP Support Solutions\HPSupportSolutionsFrameworkService.exe [31776 2016-12-07] (HP Inc.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [355232 2015-08-09] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Brak podpisu cyfrowego]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego]
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [3916368 2016-01-29] (INCA Internet Co., Ltd.)
R2 NVDisplay.ContainerLocalSystem; C:\Program Files\NVIDIA Corporation\Display.NvContainer\NVDisplay.Container.exe [458176 2016-10-25] (NVIDIA Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872688 2015-11-25] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [8133424 2015-11-25] (NVIDIA Corporation)
S3 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [5915440 2015-11-25] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [Brak podpisu cyfrowego]
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [3746584 2016-07-28] (Check Point Software Technologies Ltd.)
S4 vToolbarUpdater40.2.3; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\40.2.3\ToolbarUpdater.exe [1923984 2015-12-10] (AVG Secure Search)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1164688 2015-12-10] ()
R2 ZAPrivacyService; C:\Program Files (x86)\CheckPoint\ZoneAlarm\ZaPrivacyService.exe [114424 2016-06-30] (Check Point Software Technologies, Ltd.)
S2 HiPatchService; A:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [X]

===================== Sterowniki (filtrowane) ======================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [554416 2016-07-23] (AO Kaspersky Lab)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [180560 2016-07-23] (AO Kaspersky Lab)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [292176 2016-07-23] (AO Kaspersky Lab)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [1015120 2016-07-23] (AO Kaspersky Lab)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19760 2015-11-25] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-11-25] (NVIDIA Corporation)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [462296 2016-07-27] (Check Point Software Technologies Ltd.)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S3 X6va063; \??\C:\Windows\SysWOW64\Drivers\X6va063 [X]

==================== NetSvcs (filtrowane) ===================

(Załączenie wejścia w fixlist spowoduje jego usunięcie z rejestru. Powiązany plik nie zostanie przeniesiony, o ile nie zostanie załączony z osobna.)


==================== Jeden miesiąc - utworzone pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-19 21:38 - 2017-02-19 21:39 - 00000000 ____D C:\FRST
2017-02-19 20:47 - 2017-02-19 20:47 - 00000000 ____D C:\Users\Przemek\.android
2017-02-19 20:25 - 2017-02-19 20:25 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2017-02-19 18:18 - 2017-02-19 18:18 - 44244992 _____ C:\Windows\system32\config\components.blues
2017-02-19 18:17 - 2017-02-19 18:17 - 00003160 _____ C:\Windows\System32\Tasks\JetBoost_AutoUpdate
2017-02-19 18:17 - 2017-02-19 18:17 - 00001157 _____ C:\Users\Public\Desktop\Quick Boost.lnk
2017-02-19 18:17 - 2017-02-19 18:17 - 00001145 _____ C:\Users\Public\Desktop\JetBoost.lnk
2017-02-19 18:17 - 2017-02-19 18:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JetBoost
2017-02-19 18:17 - 2017-02-19 18:17 - 00000000 ____D C:\ProgramData\BlueSprig
2017-02-19 18:17 - 2017-02-19 18:17 - 00000000 ____D C:\Program Files (x86)\BlueSprig
2017-02-19 15:48 - 2017-02-19 15:48 - 00000645 _____ C:\Users\Public\Desktop\Heroes of the Storm.lnk
2017-02-19 15:48 - 2017-02-19 15:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heroes of the Storm
2017-02-19 15:36 - 2017-02-19 16:34 - 00000000 ____D C:\Users\Przemek\Documents\Heroes of the Storm
2017-02-15 23:33 - 2017-02-15 23:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2017-02-15 23:33 - 2017-02-15 23:33 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2017-02-15 23:33 - 2017-02-15 23:33 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2017-02-15 23:15 - 2017-02-15 23:15 - 00000000 ____D C:\Users\Przemek\AppData\Roaming\Kodi
2017-02-15 23:06 - 2017-02-15 23:40 - 00000000 ____D C:\Users\Przemek\AppData\Roaming\ipla
2017-02-15 23:06 - 2017-02-15 23:06 - 00000000 ____D C:\ProgramData\RDRM
2017-02-15 23:05 - 2017-02-15 23:05 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2017-02-14 21:01 - 2017-02-14 21:01 - 00000623 _____ C:\Users\Public\Desktop\Hearthstone.lnk
2017-02-14 21:01 - 2017-02-14 21:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hearthstone
2017-02-14 17:12 - 2017-02-14 17:12 - 00000629 _____ C:\Users\Public\Desktop\Steam.lnk
2017-02-14 17:12 - 2017-02-14 17:12 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam
2017-02-06 22:42 - 2017-02-06 22:42 - 00000000 ____D C:\Users\Przemek\Documents\My Games
2017-02-06 19:05 - 2017-02-06 19:31 - 00000000 ____D C:\GOG Games
2017-02-04 21:09 - 2017-02-04 21:09 - 00002992 _____ C:\Windows\System32\Tasks\{A97709B4-8316-43ED-B891-50F75D94C5D4}
2017-02-04 18:00 - 2017-02-04 18:00 - 00000000 ____D C:\Users\Przemek\Documents\League of Legends
2017-02-04 17:55 - 2017-02-04 20:03 - 00000957 _____ C:\Users\Public\Desktop\League of Legends.lnk
2017-02-04 17:55 - 2017-02-04 17:55 - 00000000 ____D C:\Users\Przemek\AppData\Roaming\Riot Games
2017-02-04 17:55 - 2017-02-04 17:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
2017-02-04 00:25 - 2017-02-04 00:25 - 00000000 ____D C:\Users\Przemek\Documents\Mszaki & paprotniki + reszta na botanikę
2017-02-04 00:23 - 2017-02-04 00:26 - 00000000 ____D C:\Users\Przemek\Documents\Studia

==================== Jeden miesiąc - zmodyfikowane pliki i foldery ========

(Załączenie wejścia w fixlist spowoduje przeniesienie pliku/folderu.)

2017-02-19 21:31 - 2016-07-06 17:40 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2017-02-19 20:48 - 2009-07-14 05:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2017-02-19 20:48 - 2009-07-14 05:45 - 00022736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2017-02-19 20:47 - 2015-11-28 03:35 - 00000000 ____D C:\Users\Przemek
2017-02-19 20:24 - 2010-11-21 13:53 - 00836196 _____ C:\Windows\system32\perfh015.dat
2017-02-19 20:24 - 2010-11-21 13:53 - 00211752 _____ C:\Windows\system32\perfc015.dat
2017-02-19 20:24 - 2009-07-14 06:13 - 01825240 _____ C:\Windows\system32\PerfStringBackup.INI
2017-02-19 20:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\inf
2017-02-19 20:22 - 2016-11-18 20:38 - 00000000 ____D C:\Users\Przemek\AppData\LocalLow\Mozilla
2017-02-19 20:20 - 2016-11-10 22:57 - 00000000 ____D C:\ProgramData\NVIDIA
2017-02-19 20:20 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2017-02-18 13:23 - 2015-11-27 21:14 - 00000000 __SHD C:\Users\Przemek\IntelGraphicsProfiles
2017-02-14 16:31 - 2016-07-06 17:40 - 00802904 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2017-02-14 16:31 - 2016-07-06 17:40 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2017-02-14 16:31 - 2016-07-06 17:39 - 00000000 ____D C:\Windows\system32\Macromed
2017-02-14 16:31 - 2015-11-28 13:25 - 00144472 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2017-02-14 16:31 - 2015-11-28 13:25 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2017-02-07 15:59 - 2016-01-03 17:05 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2017-02-07 14:18 - 2016-01-03 10:15 - 00000000 ____D C:\Windows\erdnt
2017-02-06 19:31 - 2009-07-14 06:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2017-02-04 17:54 - 2016-02-16 17:31 - 00000000 __SHD C:\AI_RecycleBin
2017-01-31 19:23 - 2016-06-25 21:28 - 00000000 ____D C:\Users\Przemek\AppData\Roaming\.minecraft
2017-01-29 10:30 - 2016-11-18 17:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2017-01-29 10:30 - 2016-07-06 16:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2017-01-28 14:00 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2017-01-28 11:18 - 2016-06-08 08:01 - 00000000 ____D C:\Users\Przemek\Documents\Overwatch
2017-01-27 21:33 - 2015-11-27 21:57 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2017-01-24 20:11 - 2015-11-28 13:15 - 00000000 ____D C:\ProgramData\Package Cache
2017-01-22 12:53 - 2016-07-06 16:55 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2017-01-22 12:42 - 2009-07-14 06:08 - 00032604 _____ C:\Windows\Tasks\SCHEDLGU.TXT

==================== Pliki w katalogu głównym wybranych folderów =======

2016-07-05 21:57 - 2016-07-05 22:07 - 0000117 _____ () C:\Users\Przemek\AppData\Roaming\D2Info0
2016-07-05 21:57 - 2016-07-05 22:07 - 0000008 _____ () C:\Users\Przemek\AppData\Roaming\DofusAppId0_1
2016-07-05 22:07 - 2016-07-05 22:27 - 0000008 _____ () C:\Users\Przemek\AppData\Roaming\DofusAppId0_2
2016-05-20 13:26 - 2016-11-10 22:33 - 0007679 _____ () C:\Users\Przemek\AppData\Local\Resmon.ResmonCfg
2015-11-27 21:02 - 2015-11-27 21:02 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-12-08 23:27 - 2015-12-08 23:40 - 0008819 _____ () C:\ProgramData\hpzinstall.log
2016-08-24 15:45 - 2016-08-24 15:45 - 0000016 _____ () C:\ProgramData\mntemp

Pliki do przeniesienia lub usunięcia:
====================
C:\Users\Przemek\AppData\Local\Akamai\netsession_win.exe


==================== Bamital & volsnap ======================

(Brak automatycznej naprawy dla plików które nie przeszły weryfikacji.)

C:\Windows\system32\winlogon.exe => Plik podpisany cyfrowo
C:\Windows\system32\wininit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\wininit.exe => Plik podpisany cyfrowo
C:\Windows\explorer.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\explorer.exe => Plik podpisany cyfrowo
C:\Windows\system32\svchost.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\svchost.exe => Plik podpisany cyfrowo
C:\Windows\system32\services.exe => Plik podpisany cyfrowo
C:\Windows\system32\User32.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\User32.dll => Plik podpisany cyfrowo
C:\Windows\system32\userinit.exe => Plik podpisany cyfrowo
C:\Windows\SysWOW64\userinit.exe => Plik podpisany cyfrowo
C:\Windows\system32\rpcss.dll => Plik podpisany cyfrowo
C:\Windows\system32\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\SysWOW64\dnsapi.dll => Plik podpisany cyfrowo
C:\Windows\system32\Drivers\volsnap.sys => Plik podpisany cyfrowo

LastRegBack: 2017-01-28 13:52

==================== Koniec  FRST.txt ============================