FRST.txt

Zablokowane programy antywirusowe.

Witam Mam zainstalowanego Avasta. Dzisiaj zauwazylem ze nie wlacza sie z autostartem oraz nie moge go nawet odinstalowac. Jak chce go wlaczyc sam to wyskakuje okienko z bledem "Ten program jest blokowany przez zasady grupy". W zalaczniku logi FRST oraz OTL. Przeskanowany AdwCleaner oraz Malwarebytes - to co wykryl usuniete wszystko a dalej jest to samo.


Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-11-2014
Ran by FaNeK (administrator) on FANEK-KOMPUTER on 20-11-2014 18:36:39
Running from D:\
Loaded Profile: FaNeK (Available profiles: FaNeK & Mcx1-FANEK-KOMPUTER)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(StarWind Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Dropbox, Inc.) C:\Users\FaNeK\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
() C:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Popwire AB) C:\Program Files (x86)\Common Files\Teleca Shared\logger.exe
(Teleca AB) C:\Program Files (x86)\Common Files\Teleca Shared\Generic.exe
(Symbian Software Ltd.) C:\Program Files (x86)\Symbian\Shared\SymbianConnectRunTime\SymbianConnectRuntime.exe
(Symbian Software Ltd.) C:\Program Files (x86)\Symbian\Shared\SymbianConnectRunTime\SCBAL.exe
(Intuwave Ltd.) C:\Program Files (x86)\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
() C:\Program Files (x86)\Opera Next\26.0.1656.20\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
() D:\AdwCleaner.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe
(Opera Software) C:\Program Files (x86)\Opera Next\26.0.1656.20\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SynTPEnh] = & gt; C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [Windows Mobile Device Center] = & gt; C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] = & gt; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] = & gt; C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] = & gt; C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-11] (AVAST Software)
HKLM-x32\...\Run: [StartCCC] = & gt; C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-11-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [PC Suite for Smartphones] = & gt; C:\Program Files (x86)\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe [548864 2007-12-25] ()
HKLM-x32\...\Run: [iTunesHelper] = & gt; C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] = & gt; C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\McAfee & lt; ====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\AVAST Software & lt; ====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\AVAST Software & lt; ====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Malwarebytes & lt; ====== ATTENTION
HKU\S-1-5-21-1309965639-590198294-1705704913-1000\...\Run: [DAEMON Tools Lite] = & gt; C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3514176 2011-11-10] (DT Soft Ltd)
HKU\S-1-5-21-1309965639-590198294-1705704913-1000\...\Run: [iCloudServices] = & gt; C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-1309965639-590198294-1705704913-1000\...\Run: [ApplePhotoStreams] = & gt; C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
Startup: C:\Users\FaNeK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk - & gt; C:\Users\FaNeK\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [00avast] - & gt; {472083B0-C522-11CF-8763-00608CC02F24} = & gt; C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] - & gt; {E68D0A50-3C40-4712-B90D-DCFA93FF2534} = & gt; C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] - & gt; {E68D0A51-3C40-4712-B90D-DCFA93FF2534} = & gt; C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] - & gt; {E68D0A52-3C40-4712-B90D-DCFA93FF2534} = & gt; C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] - & gt; {E68D0A53-3C40-4712-B90D-DCFA93FF2534} = & gt; C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
GroupPolicy: Group Policy on Chrome detected & lt; ======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction & lt; ======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: [S-1-5-21-1309965639-590198294-1705704913-1000] = & gt; http=127.0.0.1:8888;https=127.0.0.1:8888
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie & ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie & ar=msnhome
HKU\S-1-5-21-1309965639-590198294-1705704913-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie & ar=iesearch
HKU\S-1-5-21-1309965639-590198294-1705704913-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=AV01
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction & lt; ======= ATTENTION
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - & gt; DefaultScope value is missing.
SearchScopes: HKLM-x32 - & gt; DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms} & FORM=AVASDF & PC=AV01
SearchScopes: HKLM-x32 - & gt; {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms} & FORM=AVASDF & PC=AV01
SearchScopes: HKU\S-1-5-21-1309965639-590198294-1705704913-1000 - & gt; DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms} & FORM=AVASDF & PC=AV01
SearchScopes: HKU\S-1-5-21-1309965639-590198294-1705704913-1000 - & gt; {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms} & FORM=AVASDF & PC=AV01
BHO: Java(tm) Plug-In SSV Helper - & gt; {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - & gt; C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - & gt; {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - & gt; C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper - & gt; {DBC80044-A445-435b-BC74-9C25C1C588A9} - & gt; C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - & gt; {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - & gt; C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - & gt; {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - & gt; C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - & gt; {DBC80044-A445-435b-BC74-9C25C1C588A9} - & gt; C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
DPF: HKLM-x32 {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab
DPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cab
Handler-x32: http - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Tcpip\Parameters: [DhcpNameServer] 178.213.95.248 194.247.0.217
Tcpip\..\Interfaces\{7856AB0A-96E0-4BA1-83FB-19F47FD6F584}: [NameServer] 213.158.199.1 213.158.199.5
Tcpip\..\Interfaces\{BD26F05A-A80E-4485-98B3-EC938AA9A05E}: [NameServer] 217.116.104.104 217.116.100.100

FireFox:
========
FF ProfilePath: C:\Users\FaNeK\AppData\Roaming\Mozilla\Firefox\Profiles\hyqoxv4v.default
FF Homepage: hxxp://www.msn.com/?pc=AV01
FF SelectedSearchEngine: Microsoft (Bing)
FF DefaultSearchEngine: Microsoft (Bing)
FF DefaultSearchUrl: hxxp://www.bing.com/search
FF SearchEngineOrder.1: Microsoft (Bing)
FF Keyword.URL: hxxp://www.bing.com/search
FF NewTab: about:newtab
FF Plugin: @adobe.com/FlashPlayer - & gt; C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @java.com/DTPlugin,version=10.10.2 - & gt; C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.10.2 - & gt; C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - & gt; disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - & gt; C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: 4game.com/plugin - & gt; C:\Program Files (x86)\4game\4game\npplugin4game.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer - & gt; C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - & gt; C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 - & gt; C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 - & gt; C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - & gt; disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - & gt; C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - & gt; C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - & gt; C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 - & gt; C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: Adobe Reader - & gt; C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1309965639-590198294-1705704913-1000: @Skype Limited.com/Facebook Video Calling Plugin - & gt; C:\Users\FaNeK\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKU\S-1-5-21-1309965639-590198294-1705704913-1000: @unity3d.com/UnityPlayer,version=1.0 - & gt; C:\Users\FaNeK\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Battlefield Play4Free - C:\Users\FaNeK\AppData\Roaming\Mozilla\Firefox\Profiles\hyqoxv4v.default\Extensions\battlefieldplay4free@ea.com [2013-05-05]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-06]
FF HKLM-x32\...\Firefox\Extensions: [fiddlerhook@fiddler2.com] - C:\Program Files (x86)\Fiddler2\FiddlerHook
FF Extension: FiddlerHook - C:\Program Files (x86)\Fiddler2\FiddlerHook [2013-06-01]

Chrome:
=======
CHR dev: Chrome dev build detected! & lt; ======= ATTENTION
CHR Profile: C:\Users\FaNeK\AppData\Local\Google\Chrome\User Data\Default

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-11-29] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-31] (AVAST Software)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S3 npggsvc; C:\Windows\SysWOW64\GameMon.des [4323256 2011-03-28] (INCA Internet Co., Ltd.) [File not signed]
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [87040 2011-08-12] () [File not signed]
S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2013-09-03] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-06] ()
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed]
S2 gupdate; " C:\Program Files (x86)\Google\Update\GoogleUpdate.exe " /svc [X]
S3 gupdatem; " C:\Program Files (x86)\Google\Update\GoogleUpdate.exe " /medsvc [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 adusbser; C:\Windows\System32\DRIVERS\adusbser.sys [154112 2009-11-06] (AnyDATA.NET INC.)
S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2013-04-18] (Google Inc)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-31] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-31] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-31] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-31] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-31] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-31] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-31] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-31] ()
S3 Axtmvflt; C:\Windows\System32\DRIVERS\Axtmvflt.sys [6144 2009-02-25] (Axesstel)
S3 Axtmvmdm; C:\Windows\System32\DRIVERS\Axtmvmdm.sys [54272 2009-02-25] (Axesstel)
S3 Axtmvprt; C:\Windows\System32\Drivers\Axtmvprt.sys [52224 2009-02-25] (Axesstel)
S3 cyclonebox; C:\Windows\System32\DRIVERS\cyclonebox.sys [25408 2011-03-01] (http://libusb-win32.sourceforge.net)
S3 eGateUSB; C:\Windows\System32\Drivers\eGateUSB.sys [98816 2007-05-09] (Gemalto)
S3 eustub; C:\Windows\System32\DRIVERS\eusbstub.sys [15944 2010-09-29] (ELTIMA Software)
S3 HTCAND64; C:\Windows\System32\Drivers\ANDROIDUSB.sys [32768 2010-04-29] (Google Inc)
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [212992 2013-09-03] (Huawei Technologies Co., Ltd.)
R3 LgBttPort; C:\Windows\System32\DRIVERS\lgbtpt64.sys [16384 2009-09-29] (LG Electronics Inc.)
R3 lgbusenum; C:\Windows\System32\DRIVERS\lgbtbs64.sys [14848 2009-09-29] (LG Electronics Inc.)
R3 LGVMODEM; C:\Windows\System32\DRIVERS\lgvmdm64.sys [17408 2009-09-29] (LG Electronics Inc.)
S3 Netaapl; C:\Windows\System32\DRIVERS\netaapl64.sys [23040 2013-08-06] (Apple Inc.) [File not signed]
S3 NPPTNT2; C:\Windows\SysWOW64\npptNT2.sys [4682 2005-01-02] (INCA Internet Co., Ltd.) [File not signed]
S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [530488 2011-11-23] () [File not signed]
S3 UFS2XX; C:\Windows\System32\drivers\UFS2XX.sys [82528 2013-08-19] (FTDI Ltd.)
S3 vuhub; C:\Windows\System32\DRIVERS\vuhub.sys [61512 2010-09-29] (ELTIMA Software)
S2 WnsDrvr; C:\Windows\SysWow64\Drivers\WnsDrvr.sys [25952 2011-08-18] (Microsoft Corporation) [File not signed]
R3 zebrceb; C:\Windows\System32\DRIVERS\zebrceb.sys [81280 2008-01-15] (MCCI)
U3 abhl7mk0; C:\Windows\System32\Drivers\abhl7mk0.sys [0 ] (Advanced Micro Devices)
U3 aw5gr3z0; C:\Windows\System32\Drivers\aw5gr3z0.sys [0 ] (Advanced Micro Devices)
S3 Andbus; system32\DRIVERS\lgandbus64.sys [X]
S3 AndDiag; system32\DRIVERS\lganddiag64.sys [X]
S3 AndGps; system32\DRIVERS\lgandgps64.sys [X]
S3 ANDModem; system32\DRIVERS\lgandmodem64.sys [X]
S3 AndNetDiag; system32\DRIVERS\lgandnetdiag64.sys [X]
S3 ANDNetModem; system32\DRIVERS\lgandnetmodem64.sys [X]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dump_wmimmc; \??\D:\gry\NCSoft\Lineage 2\system\GameGuard\dump_wmimmc.sys [X]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 usbbus; system32\DRIVERS\lgx64bus.sys [X]
S3 UsbDiag; system32\DRIVERS\lgx64diag.sys [X]
S3 USBModem; system32\DRIVERS\lgx64modem.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnet; system32\DRIVERS\ZTEusbnet.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-20 18:33 - 2014-09-26 18:36 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-11-20 18:32 - 2014-09-26 18:42 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-11-20 18:32 - 2014-09-26 18:36 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-11-20 18:32 - 2014-09-26 18:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-11-20 18:31 - 2014-11-20 18:32 - 00004250 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_71-b14.log
2014-11-20 17:58 - 2014-11-20 18:36 - 00000000 ____D () C:\FRST
2014-11-20 17:40 - 2014-11-20 18:28 - 00000000 ____D () C:\AdwCleaner
2014-11-20 17:34 - 2014-11-20 17:34 - 00001062 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-20 17:34 - 2014-11-20 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-20 17:34 - 2014-11-20 17:34 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-20 17:34 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-11-20 17:34 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-11-20 17:34 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-11-20 16:13 - 2014-11-20 18:16 - 00003426 _____ () C:\Windows\PFRO.log
2014-11-20 13:04 - 2014-11-20 13:04 - 00087573 _____ () C:\ComboFix.txt
2014-11-20 12:47 - 2014-11-20 12:40 - 05598306 ____R (Swearware) C:\ComboFix.exe
2014-11-09 00:31 - 2014-11-20 12:21 - 00003409 _____ () C:\Windows\SysWOW64\debug.log
2014-11-09 00:17 - 2014-11-09 00:22 - 00000000 ____D () C:\ProgramData\ipla
2014-11-09 00:17 - 2014-11-09 00:17 - 00000911 _____ () C:\Users\Public\Desktop\ipla.lnk
2014-11-09 00:17 - 2014-11-09 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ipla
2014-11-04 20:47 - 2014-11-04 21:30 - 00000000 ____D () C:\Users\FaNeK\Desktop\x72j
2014-10-30 22:59 - 2014-10-30 23:13 - 00000099 _____ () C:\Users\FaNeK\Desktop\Nowy dokument tekstowy.txt
2014-10-30 18:12 - 2014-10-30 18:12 - 00001134 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk
2014-10-30 18:12 - 2014-10-30 18:12 - 00001122 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-10-28 09:12 - 2014-10-28 09:12 - 00001044 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera beta.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-20 18:33 - 2013-10-18 05:47 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-20 18:32 - 2013-08-11 08:20 - 00000000 ____D () C:\Program Files (x86)\Java
2014-11-20 18:30 - 2013-07-22 21:03 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-20 18:24 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-20 18:24 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-20 18:22 - 2011-08-10 23:51 - 01995514 _____ () C:\Windows\WindowsUpdate.log
2014-11-20 18:18 - 2014-04-18 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\4game
2014-11-20 18:17 - 2014-04-02 22:24 - 00000000 ___RD () C:\Users\FaNeK\Dropbox
2014-11-20 18:17 - 2014-04-02 22:22 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\Dropbox
2014-11-20 18:16 - 2014-10-07 06:22 - 00006344 _____ () C:\Windows\setupact.log
2014-11-20 18:16 - 2012-01-20 17:01 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-11-20 18:16 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-20 18:15 - 2014-06-03 20:56 - 00000000 ____D () C:\ProgramData\Application fields Software
2014-11-20 18:15 - 2011-08-11 10:09 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-11-20 17:54 - 2009-07-14 18:55 - 07802074 _____ () C:\Windows\system32\perfh015.dat
2014-11-20 17:54 - 2009-07-14 18:55 - 02635734 _____ () C:\Windows\system32\perfc015.dat
2014-11-20 17:54 - 2009-07-14 06:13 - 00006252 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-20 17:48 - 2014-05-07 18:28 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-20 16:33 - 2014-08-24 21:28 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1309965639-590198294-1705704913-1000UA.job
2014-11-20 13:04 - 2013-11-09 18:31 - 00000000 ____D () C:\Qoobox
2014-11-20 13:04 - 2013-10-05 06:59 - 00000000 ____D () C:\Users\FaNeK\AppData\Local\Apps\2.0
2014-11-20 13:02 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-11-20 11:40 - 2011-08-11 00:41 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{828545D3-5BA8-4613-BB43-110961BFA745}
2014-11-20 11:33 - 2011-08-11 21:45 - 00000005 _____ () C:\Program Files (x86)\is.dat
2014-11-20 11:18 - 2011-09-11 10:59 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\ipla
2014-11-19 22:33 - 2014-08-24 21:28 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1309965639-590198294-1705704913-1000Core.job
2014-11-19 10:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2014-11-18 15:11 - 2012-08-16 18:33 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\Patcher
2014-11-17 15:15 - 2014-05-19 17:41 - 00003902 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1377171117
2014-11-17 15:15 - 2013-08-22 12:31 - 00000000 ____D () C:\Program Files (x86)\Opera Next
2014-11-17 15:09 - 2009-07-14 06:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-11-16 23:03 - 2011-09-14 14:59 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\uTorrent
2014-11-16 20:14 - 2014-04-02 22:24 - 00001023 _____ () C:\Users\FaNeK\Desktop\Dropbox.lnk
2014-11-16 20:14 - 2014-04-02 22:23 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-11-12 16:30 - 2013-07-22 21:03 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-11-12 16:30 - 2012-04-11 06:56 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-11-12 16:30 - 2011-08-11 10:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-09 00:17 - 2011-09-11 10:59 - 00000000 ____D () C:\Program Files (x86)\ipla
2014-11-09 00:14 - 2013-02-06 12:01 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-11-05 09:49 - 2014-06-12 14:03 - 00000224 _____ () C:\Users\FaNeK\BullseyeCoverageError.txt
2014-10-30 22:46 - 2011-08-11 00:05 - 00088200 _____ () C:\Users\FaNeK\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-30 22:45 - 2009-07-14 05:45 - 04983504 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-30 19:08 - 2012-07-18 11:39 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\Skype
2014-10-30 18:12 - 2012-01-23 11:09 - 00000000 ____D () C:\Users\FaNeK\AppData\Roaming\TeamViewer
2014-10-30 18:12 - 2012-01-20 16:42 - 00000000 ____D () C:\Program Files (x86)\TeamViewer

Some content of TEMP:
====================
C:\Users\FaNeK\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpu3758q.dll
C:\Users\FaNeK\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\FaNeK\AppData\Local\Temp\Quarantine.exe
C:\Users\FaNeK\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe = & gt; File is digitally signed
C:\Windows\System32\wininit.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\wininit.exe = & gt; File is digitally signed
C:\Windows\explorer.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\explorer.exe = & gt; File is digitally signed
C:\Windows\System32\svchost.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\svchost.exe = & gt; File is digitally signed
C:\Windows\System32\services.exe = & gt; File is digitally signed
C:\Windows\System32\User32.dll = & gt; File is digitally signed
C:\Windows\SysWOW64\User32.dll = & gt; File is digitally signed
C:\Windows\System32\userinit.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\userinit.exe = & gt; File is digitally signed
C:\Windows\System32\rpcss.dll = & gt; File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys = & gt; File is digitally signed


LastRegBack: 2014-11-16 21:21

==================== End Of Log ============================


Download file - link to post