Zaraz wrzucę z frst. Edit: Reszta logów. Co dalej? Posty scaliłem. Proszę, byś w przypadku aktualizacji informacji używał opcji "Zmień".
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by xxx (administrator) on XXX-KOMPUTER on 17-02-2015 18:24:59
Running from C:\Users\xxx\Downloads
Loaded Profiles: xxx (Available profiles: xxx)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(SlimWare Utilities, Inc.) C:\Program Files (x86)\SlimDrivers\SlimDrivers.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
() C:\Windows\SysWOW64\srvany.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\GIGABYTE\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\GIGABYTE\Common\RaRegistry64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(KiS Software) C:\Program Files (x86)\Windows Communicator\Communicator.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(GIGABYTE TECHNOLOGY CO., LTD.) C:\Program Files (x86)\GIGABYTE\Common\GNConfig.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe
() C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mister Group) H:\System Explorer\SystemExplorer.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mister Group) H:\System Explorer\service\SystemExplorerService64.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [AmIcoSinglun64] = & gt; C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2000-01-01] (Alcor Micro Corp.)
HKLM\...\Run: [BCSSync] = & gt; C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Windows Mobile Device Center] = & gt; C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] = & gt; " C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe "
HKLM\...\Run: [ShadowPlay] = & gt; C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] = & gt; C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2201032 2014-04-02] (NVIDIA Corporation)
HKLM\...\Run: [egui] = & gt; C:\Program Files\ESET\ESET Smart Security\egui.exe [5618456 2013-09-12] (ESET)
HKLM-x32\...\Run: [EEventManager] = & gt; C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [665424 2008-12-04] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [TkBellExe] = & gt; C:\Program Files (x86)\Common Files\Real\Update_OB\realsched.exe [202256 2011-08-28] (RealNetworks, Inc.)
HKLM-x32\...\Run: [amd_dc_opt] = & gt; C:\Program Files (x86)\AMD\amd_dc_opt\amd_dc_opt.exe [106496 2006-06-28] ()
HKLM-x32\...\Run: [HTC Sync Loader] = & gt; C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe [634880 2011-12-20] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] = & gt; C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] = & gt; C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Freecorder FLV Service] = & gt; " D:\FLVSrvc.exe " /run
HKLM-x32\...\Run: [APSDaemon] = & gt; C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] = & gt; " D:\QTTask.exe " -atboottime
HKLM-x32\...\Run: [Yxhfxhrkdhvcyvvs.exe] = & gt; " C:\Users\xxx\AppData\Roaming\Yxhfxhrkdhvcyvvs.exe "
HKLM-x32\...\Run: [csrss.exe] = & gt; " C:\Users\xxx\AppData\Roaming\csrss.exe "
HKLM-x32\...\Run: [fst_pl_90] = & gt; [X]
HKLM-x32\...\Run: [AvastUI.exe] = & gt; C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-10-02] (AVAST Software)
HKLM-x32\...\Run: [SystemExplorerAutoStart] = & gt; H:\System Explorer\SystemExplorer.exe [3390688 2014-12-02] (Mister Group)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [AlcoholAutomount] = & gt; " D:\Alcohol 52\AxAutoMntSrv.exe " -automount
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [OfficeSyncProcess] = & gt; C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [908160 2010-03-16] (Microsoft Corporation)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [Expressivo] = & gt; " D:\Expressivo\expressivo.exe " -t -nosplash
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [RGSC] = & gt; C:\Program Files (x86)\Rockstar Games Social Club\RGSCLauncher.exe [306088 2008-12-13] (Take-Two Interactive Software, Inc.)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [Network Settings] = & gt; " C:\ProgramData\Network Settings\khsuvtnsd.exe "
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [EADM] = & gt; " D:\Origin\Origin.exe " -AutoStart
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [Yxhfxhrkdhvcyvvs.exe] = & gt; " C:\Users\xxx\AppData\Roaming\Yxhfxhrkdhvcyvvs.exe "
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [Tiny download manager] = & gt; " C:\Users\xxx\AppData\Local\DM\TinyDM.exe " /M
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [csrss.exe] = & gt; " C:\Users\xxx\AppData\Roaming\csrss.exe "
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [ALLUpdate] = & gt; C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3510704 2014-07-23] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [Windows Communicator] = & gt; C:\Program Files (x86)\Windows Communicator\Communicator.exe [5127168 2012-08-05] (KiS Software)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Run: [GoogleChromeAutoLaunch_0BE9D479EFB6BFFB561C6412B0EF7FA2] = & gt; C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\MountPoints2: {69076b40-2606-11e3-b48e-806e6f6e6963} - I:\SJ2_setup.exe
HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\MountPoints2: {fcc1c832-d152-11e0-99fd-001e902c7dfd} - G:\autorun.exe
HKU\S-1-5-18\...\Run: [Network Settings] = & gt; " C:\ProgramData\Network Settings\khsuvtnsd.exe "
HKU\S-1-5-18\...\RunOnce: [SPReview] = & gt; C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-20] (Microsoft Corporation)
AppInit_DLLs-x32: = & gt; " " File Not Found
ShellIconOverlayIdentifiers: [00avast] - & gt; {472083B0-C522-11CF-8763-00608CC02F24} = & gt; C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
GroupPolicy: Group Policy on Chrome detected & lt; ======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction & lt; ======= ATTENTION
CHR HKU\S-1-5-21-2351112747-926030224-389029679-1000\SOFTWARE\Policies\Google: Policy restriction & lt; ======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/#utm_source=instalki & utm_medium=installer & utm_campaign=instalki
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/#utm_source=instalki & utm_medium=installer & utm_campaign=instalki
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-21-2351112747-926030224-389029679-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=166
URLSearchHook: HKLM-x32 - (No Name) - {d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No File
URLSearchHook: HKLM-x32 - (No Name) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - No File
URLSearchHook: HKU\S-1-5-21-2351112747-926030224-389029679-1000 - (No Name) - {09ec805c-cb2e-4d53-b0d3-a75a428b81c7} - No File
SearchScopes: HKLM-x32 - & gt; {1584B1F3-0DF2-3E17-F4D2-4D6EE1018E7E} URL =
SearchScopes: HKU\.DEFAULT - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\.DEFAULT - & gt; {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL =
SearchScopes: HKU\.DEFAULT - & gt; {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
SearchScopes: HKU\S-1-5-19 - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 - & gt; DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2351112747-926030224-389029679-1000 - & gt; {121253BA-3A69-4D95-93BF-8E5F8601B574} URL = https://www.google.com/search?q={searchTerms}
BHO: Groove GFS Browser Helper - & gt; {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - & gt; C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - & gt; {9030D464-4C02-4ABF-8ECC-5164760863C6} - & gt; C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Skype Click to Call for Internet Explorer - & gt; {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - & gt; C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - & gt; {B4F3A835-0E21-4959-BA22-42B3008E02FF} - & gt; C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSS+ Identifier - & gt; {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - & gt; C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: No Name - & gt; {1392b8d2-5c05-419f-a8f6-b9f15a596612} - & gt; No File
BHO-x32: Adobe PDF Link Helper - & gt; {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - & gt; C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper - & gt; {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - & gt; C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - & gt; {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - & gt; C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - & gt; {9030D464-4C02-4ABF-8ECC-5164760863C6} - & gt; C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Click to Call for Internet Explorer - & gt; {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - & gt; C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - & gt; {B4F3A835-0E21-4959-BA22-42B3008E02FF} - & gt; C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - & gt; {d43723ae-1ae1-4a25-a6a4-bf0929273cab} - & gt; No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - & gt; {DBC80044-A445-435b-BC74-9C25C1C588A9} - & gt; C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - !{1392b8d2-5c05-419f-a8f6-b9f15a596612} - No File
Toolbar: HKLM - No Name - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
Toolbar: HKLM - No Name - !{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No File
Toolbar: HKLM - No Name - !{d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No File
Toolbar: HKLM-x32 - No Name - !{1392b8d2-5c05-419f-a8f6-b9f15a596612} - No File
Toolbar: HKLM-x32 - No Name - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No File
Toolbar: HKLM-x32 - No Name - !{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - No File
Toolbar: HKLM-x32 - No Name - !{d43723ae-1ae1-4a25-a6a4-bf0929273cab} - No File
Toolbar: HKU\S-1-5-21-2351112747-926030224-389029679-1000 - & gt; No Name - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - No File
Toolbar: HKU\S-1-5-21-2351112747-926030224-389029679-1000 - & gt; No Name - {D43723AE-1AE1-4A25-A6A4-BF0929273CAB} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {E6F480FC-BD44-4CBA-B74A-89AF7842937D} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.4.26.0.cab
DPF: HKLM-x32 {F8E691A0-C92E-4E42-9CDA-62FC07A9483B} http://actiftp.hosting4less.com/ACTIGENERAL/AP & Manual/Live%20Demo/nvUnifiedControl.ocx
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Hosts: Hosts file not detected in the default directory
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
FireFox:
========
FF ProfilePath: C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\dz7bfcgw.default
FF Homepage: hxxp://www.gazeta.pl/0,0.html?p=166
FF Plugin: @adobe.com/FlashPlayer - & gt; C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @microsoft.com/GENUINE - & gt; disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - & gt; c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - & gt; C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - & gt; C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 - & gt; C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @java.com/DTPlugin - & gt; C:\Program Files (x86)\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - & gt; C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - & gt; disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - & gt; c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - & gt; C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - & gt; C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - & gt; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - & gt; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - & gt; C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.775 - & gt; D:\Audio\Netscape6\nppl3260.dll No File
FF Plugin-x32: @real.com/nprjplug;version=1.0.3.775 - & gt; D:\Audio\Netscape6\nprjplug.dll No File
FF Plugin-x32: @real.com/nprphtml5videoshim;version=1.0.0.0 - & gt; C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.775 - & gt; D:\Audio\Netscape6\nprpjplug.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - & gt; C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - & gt; C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wolfram.com/Mathematica - & gt; C:\Program Files (x86)\Common Files\Wolfram Research\Browser\9.0.1.4055459\npmathplugin.dll (Wolfram Research, Inc.)
FF Plugin-x32: Adobe Reader - & gt; C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2351112747-926030224-389029679-1000: pandonetworks.com/PandoWebPlugin - & gt; C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKU\S-1-5-21-2351112747-926030224-389029679-1000: ubisoft.com/uplaypc - & gt; C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: Widget context - C:\Users\xxx\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-01-16]
FF Extension: HomeTab - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\dz7bfcgw.default\Extensions\{9c72a7f0-9ced-4876-80b8-2cebdc068f07} [2014-02-07]
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-04-23]
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF HKU\S-1-5-21-2351112747-926030224-389029679-1000\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: No Name - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]
FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\dz7bfcgw.default\extensions\a54e453c-130a-4769-9333-c5ec2aa914c5@9bd7cc89-9c7c-44e9-a03b-042b92d363f0.com [Not Found]
FF Extension: No Name - C:\Users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\dz7bfcgw.default\extensions\quick_start@gmail.com [Not Found]
FF Extension: No Name - C:\Program Files (x86)\BlockAndSurf Corp\158.xpi [Not Found]
FF Extension: No Name - D:\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found]
Chrome:
=======
CHR StartupUrls: Default - & gt; " hxxp://www.onet.pl/ " , " https://www.facebook.com/ " , " hxxp://google.pl/ " , " hxxp://o2.pl/ "
CHR DefaultSearchKeyword: Default - & gt; google.pl_
CHR DefaultSuggestURL: Default - & gt;
CHR Profile: C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-12]
CHR Extension: (Dysk Google) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-12]
CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-12]
CHR Extension: (Adblock Plus) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-17]
CHR Extension: (Szukaj w Google) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-12]
CHR Extension: (Krople deszczu(Non-Aero)) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\dpagcfbbmlebfnkeogkigellbgmfkjfg [2014-04-12]
CHR Extension: (AdBlock) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-17]
CHR Extension: (Google Wallet) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-10]
CHR Extension: (Adblock Pro) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcklkibdehekfnmflempfgjhbedch [2014-04-17]
CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-12]
CHR Profile: C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Docs) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-09-18]
CHR Extension: (Dysk Google) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-09-18]
CHR Extension: (YouTube) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-09-18]
CHR Extension: (Szukaj w Google) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-09-18]
CHR Extension: (Lightning Newtab) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2014-09-18]
CHR Extension: (Quick Start) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-09-18]
CHR Extension: (Gmail) - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-09-18]
CHR HKLM-x32\...\Chrome\Extension: [dkdkpmmkgdbglmfmmmmehbkmnkopingb] - C:\Users\xxx\AppData\Local\Google\Chrome\User Data\Default\Extensions\v9-toolbar.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [jinihaffgdhejchgkogpfkdmpldnmnji] - C:\Users\xxx\AppData\Local\Temp\tbch.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [naipdapbimiiikbbgjcpbgmfhnlbagpj] - C:\Users\xxx\AppData\Local\Temp\naipdapbimiiikbbgjcpbgmfhnlbagpj.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [noebaifjopccondbkcieccphcpijhdne] - C:\Users\xxx\AppData\Local\Temp\tbch.crx [Not Found]
Opera:
=======
OPR StartupUrls: " hxxp://www.gazeta.pl/0,0.html?p=166 "
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-02] (AVAST Software)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1337752 2013-09-12] (ESET)
R2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2011-08-28] () [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1615192 2014-04-02] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [20541216 2014-04-02] (NVIDIA Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [88576 2011-09-15] () [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-07-12] ()
R2 RalinkRegistryWriter; C:\Program Files (x86)\GIGABYTE\Common\RaRegistry.exe [185632 2009-08-19] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\GIGABYTE\Common\RaRegistry64.exe [212256 2009-08-19] (Ralink Technology, Corp.)
R2 RtVOsdService; C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [315392 2010-06-24] (Realtek Semiconductor Corp.) [File not signed]
S2 SetupARService; C:\Program Files (x86)\Realtek\Audio\SetupAfterRebootService.exe [24576 2014-04-17] (Realtek Semiconductor.) [File not signed]
R3 SystemExplorerHelpService; H:\System Explorer\service\SystemExplorerService64.exe [820960 2014-12-02] (Mister Group)
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S3 G Data Tuner Service; C:\Program Files (x86)\G Data\TotalCare\AVKTuner\AVKTunerService.exe [X]
S2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [X]
S2 StarWindServiceAE; D:\Alcohol 52\StarWind\StarWindServiceAE.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R1 66584591; C:\Windows\System32\DRIVERS\66584591.sys [157712 2014-04-15] (Kaspersky Lab)
R0 66584592; C:\Windows\System32\DRIVERS\66584592.sys [40464 2014-04-15] (Kaspersky Lab)
R3 AmdTools64; C:\Windows\System32\DRIVERS\AmdTools64.sys [47616 2006-06-27] (AMD, Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-02] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-10-02] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-02] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-02] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-11-21] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-02] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-10-02] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2014-02-02] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-10-02] ()
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [239320 2013-09-17] (ESET)
U5 edevmon; C:\Windows\System32\Drivers\edevmon.sys [239296 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [168256 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [220232 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [44120 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [62136 2013-09-17] (ESET)
S3 Loader; C:\Windows\SysWOW64\Loader.sys [8704 2012-11-08] () [File not signed]
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [42016 2013-11-27] (Visicom Media Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-17] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35232 2013-12-06] (Visicom Media Inc.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-21] (NVIDIA Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [564824 2013-09-25] (Duplex Secure Ltd.)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2015-02-17] ()
U3 atrj2xq1; No ImagePath
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]
S3 HidNt; system32\DRIVERS\HIDNt.sys [X]
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [X]
S3 Mac606; system32\DRIVERS\Mac606.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-17 18:24 - 2015-02-17 18:27 - 00032216 _____ () C:\Users\xxx\Downloads\FRST.txt
2015-02-17 18:24 - 2015-02-17 18:25 - 00000000 ____D () C:\FRST
2015-02-17 18:23 - 2015-02-17 18:24 - 02085888 _____ (Farbar) C:\Users\xxx\Downloads\FRST64.exe
2015-02-17 18:22 - 2015-02-17 18:23 - 02112512 _____ () C:\Users\xxx\Downloads\adwcleaner_4.110 (2).exe
2015-02-17 18:11 - 2015-02-17 18:21 - 00000000 ____D () C:\AdwCleaner
2015-02-17 18:09 - 2015-02-17 18:09 - 02112512 _____ () C:\Users\xxx\Downloads\adwcleaner_4.110 (1).exe
2015-02-17 18:08 - 2015-02-17 18:08 - 00027218 _____ () C:\Users\xxx\Desktop\17.txt
2015-02-17 18:00 - 2015-02-17 18:09 - 00000000 ____D () C:\UsbFix
2015-02-17 18:00 - 2015-02-17 18:00 - 03909928 _____ (El Desaparecido - SosVirus.net - UsbFix.net) C:\Users\xxx\Downloads\UsbFix_7.812.exe
2015-02-17 18:00 - 2015-02-17 18:00 - 02112512 _____ () C:\Users\xxx\Downloads\adwcleaner_4.110.exe
2015-02-17 18:00 - 2015-02-17 18:00 - 00001448 _____ () C:\Users\xxx\Desktop\UsbFix.lnk
2015-02-17 17:52 - 2015-02-17 18:21 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-17 17:52 - 2015-02-17 17:52 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-02-17 17:52 - 2015-02-17 17:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-02-17 17:52 - 2015-02-17 17:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-17 17:52 - 2015-02-17 17:52 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-02-17 17:52 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-17 17:52 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-17 17:52 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-17 17:42 - 2015-02-17 17:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam-setup-2.0.4.1028 (1).exe
2015-02-17 17:41 - 2015-02-17 17:42 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\xxx\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-17 17:41 - 2015-02-17 17:41 - 00029918 _____ () C:\Users\xxx\Downloads\extras.txt
2015-02-17 17:40 - 2015-02-17 17:40 - 00037705 _____ () C:\Users\xxx\Downloads\otl1.txt
2015-02-16 10:59 - 2015-02-16 10:59 - 00066892 _____ () C:\Users\xxx\Downloads\potwierdzenie (1)
2015-02-16 10:57 - 2015-02-16 10:57 - 00066893 _____ () C:\Users\xxx\Downloads\potwierdzenie
2015-02-16 10:52 - 2015-02-16 10:52 - 00003344 _____ () C:\Windows\System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2351112747-926030224-389029679-1000
2015-02-16 10:52 - 2015-02-16 10:52 - 00003206 _____ () C:\Windows\System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2351112747-926030224-389029679-1000
2015-02-14 17:18 - 2015-02-14 17:18 - 00344825 _____ () C:\Users\xxx\Downloads\teksty___r__d__owe_spadki.rar
2015-02-10 12:16 - 2015-02-17 18:21 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d045231073f0b0.job
2015-02-10 12:16 - 2015-02-10 12:16 - 00004044 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1d045231073f0b0
2015-01-28 17:35 - 2015-01-28 17:35 - 00000202 _____ () C:\Users\xxx\Desktop\Unturned.url
2015-01-26 16:50 - 2015-01-27 15:46 - 00000000 ____D () C:\Users\xxx\Desktop\PompaMT2
2015-01-25 22:33 - 2015-01-26 01:09 - 942538612 _____ () C:\Users\xxx\Downloads\PompaMT2.rar
2015-01-25 21:50 - 2015-01-25 21:50 - 00000643 _____ () C:\Users\Public\Desktop\Metin2.lnk
2015-01-25 21:50 - 2015-01-25 21:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Metin2
2015-01-25 21:10 - 2015-02-03 15:24 - 00000000 ____D () C:\Users\xxx\Downloads\Gameforge Live
2015-01-25 21:10 - 2015-01-25 21:10 - 00000604 _____ () C:\Users\Public\Desktop\Gameforge Live.lnk
2015-01-25 21:09 - 2015-01-25 21:10 - 20252472 _____ (Gameforge ) C:\Users\xxx\Downloads\Metin2_GameforgeLiveSetup (1).exe
2015-01-25 21:09 - 2015-01-25 21:09 - 20252472 _____ (Gameforge ) C:\Users\xxx\Downloads\Metin2_GameforgeLiveSetup.exe
2015-01-25 21:09 - 2015-01-25 21:09 - 00272896 _____ () C:\Users\xxx\Downloads\335760899d86e28193b9138385bf32e5 (8).ppt
2015-01-25 21:08 - 2015-01-25 21:08 - 03891937 _____ () C:\Users\xxx\Downloads\Problemy_i_rozwoj_miast_na_swiecie (9).pptx
2015-01-25 21:08 - 2015-01-25 21:08 - 00272896 _____ () C:\Users\xxx\Downloads\335760899d86e28193b9138385bf32e5 (7).ppt
2015-01-21 16:26 - 2015-01-21 16:26 - 01993728 _____ () C:\Users\xxx\Downloads\Problem Globalizacji (5).ppt
2015-01-21 16:24 - 2015-01-21 16:25 - 03891937 _____ () C:\Users\xxx\Downloads\Problemy_i_rozwoj_miast_na_swiecie (8).pptx
2015-01-21 16:24 - 2015-01-21 16:25 - 00272896 _____ () C:\Users\xxx\Downloads\335760899d86e28193b9138385bf32e5 (6).ppt
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-02-17 18:25 - 2009-07-14 05:45 - 00019792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-17 18:25 - 2009-07-14 05:45 - 00019792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-17 18:22 - 2011-08-26 14:29 - 00002828 _____ () C:\Windows\System32\Tasks\SlimDrivers Startup
2015-02-17 18:22 - 2011-08-26 14:29 - 00000406 _____ () C:\Windows\Tasks\SlimDrivers Startup.job
2015-02-17 18:21 - 2014-10-02 09:49 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-17 18:20 - 2014-11-09 20:19 - 00000000 ____D () C:\ProgramData\firebird
2015-02-17 18:20 - 2011-10-19 18:28 - 00000000 ____D () C:\Users\xxx\AppData\Local\Htc
2015-02-17 18:20 - 2011-08-26 14:29 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2015-02-17 18:20 - 2011-08-24 22:10 - 00000000 ____D () C:\Users\xxx\AppData\Local\VirtualStore
2015-02-17 18:19 - 2014-04-12 10:39 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-17 18:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-17 18:19 - 2009-07-14 05:51 - 00226415 _____ () C:\Windows\setupact.log
2015-02-17 18:18 - 2011-08-26 15:10 - 00940504 _____ () C:\Windows\PFRO.log
2015-02-17 18:18 - 2011-08-24 22:18 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-17 18:17 - 2011-08-24 22:05 - 01526363 _____ () C:\Windows\WindowsUpdate.log
2015-02-17 18:16 - 2014-11-05 17:18 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WorldofTanks
2015-02-17 18:16 - 2014-11-05 17:18 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InfiniteCrisis
2015-02-17 18:16 - 2012-08-10 08:03 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-17 18:16 - 2011-08-24 22:10 - 00000000 ____D () C:\Users\xxx
2015-02-17 18:14 - 2014-06-21 18:55 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8d7af069590.job
2015-02-17 18:05 - 2014-02-02 22:12 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-17 17:34 - 2014-04-22 14:17 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\x86
2015-02-17 17:34 - 2014-04-22 14:17 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\x64
2015-02-17 17:34 - 2012-06-01 17:39 - 00000000 ____D () C:\Program Files (x86)\Freecorder
2015-02-17 17:34 - 2011-12-18 10:54 - 00000000 ____D () C:\Program Files (x86)\Ashampoo_PO
2015-02-17 17:34 - 2011-09-08 16:38 - 00000000 ____D () C:\Users\xxx\AppData\Local\BrotherSoft_Extreme
2015-02-17 17:34 - 2011-08-26 10:08 - 00000000 ___RD () C:\Users\xxx\Desktop\Senses Fail
2015-02-17 17:34 - 2011-08-26 08:54 - 00000000 ___RD () C:\Users\xxx\Desktop\Rzeczy
2015-02-17 17:24 - 2014-10-02 09:49 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\FLV and Media Player
2015-02-17 17:23 - 2009-07-14 18:55 - 00743770 _____ () C:\Windows\system32\perfh015.dat
2015-02-17 17:23 - 2009-07-14 18:55 - 00157252 _____ () C:\Windows\system32\perfc015.dat
2015-02-17 17:23 - 2009-07-14 06:13 - 01679266 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-13 11:57 - 2014-11-09 14:49 - 00003880 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1397569514
2015-02-13 11:57 - 2014-04-15 14:45 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-10 12:23 - 2014-04-12 10:40 - 00002189 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-10 12:16 - 2014-11-13 21:09 - 00004044 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cfff7dc125f1b0
2015-02-10 12:16 - 2014-11-13 21:09 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cfff7dc125f1b0.job
2015-02-10 12:16 - 2014-04-12 10:39 - 00003792 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-10 12:05 - 2014-02-02 22:12 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-10 12:05 - 2014-02-02 22:12 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-10 12:05 - 2011-09-07 15:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-01 13:37 - 2013-08-20 11:11 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\.minecraft
2015-01-29 22:10 - 2012-10-09 11:24 - 00000000 ____D () C:\Users\xxx\AppData\Roaming\Skype
2015-01-25 21:10 - 2014-02-17 17:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Gameforge Live
==================== Files in the root of some directories =======
2013-08-20 08:29 - 2013-08-20 08:29 - 4188160 _____ () C:\Program Files (x86)\GUTA544.tmp
2014-04-08 18:19 - 2014-04-17 16:48 - 0117248 __RSH (b embitter) C:\Users\xxx\AppData\Roaming\adobereade.exe
2014-01-15 21:08 - 2013-06-09 15:59 - 0192584 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\atl110.dll
2014-04-17 18:02 - 2014-04-17 18:02 - 0108032 ___RH (pocket quitter) C:\Users\xxx\AppData\Roaming\Feqtouyngfifoftd.exe
2014-01-15 21:08 - 2014-01-15 21:55 - 0002101 _____ () C:\Users\xxx\AppData\Roaming\FoundShares.log
2014-09-06 11:14 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Fxtwobefqihmcwxg.exe
2014-01-15 21:08 - 2014-01-15 19:26 - 0052224 _____ () C:\Users\xxx\AppData\Roaming\hd.exe
2014-09-06 06:28 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Jnhksbzqleciztmv.exe
2014-04-22 18:59 - 2014-04-22 18:59 - 0196608 ___RH () C:\Users\xxx\AppData\Roaming\lsm.exe
2014-06-07 15:32 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Lykeduchcqawackr.exe
2014-01-15 21:08 - 2014-01-03 16:34 - 0468480 _____ () C:\Users\xxx\AppData\Roaming\mpir.dll
2014-01-15 21:08 - 2014-01-03 16:34 - 0522752 _____ () C:\Users\xxx\AppData\Roaming\msdtce.exe
2014-01-15 21:08 - 2011-06-10 18:15 - 0608080 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\msvcp100.dll
2014-01-15 21:08 - 2012-10-01 17:59 - 0661448 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\msvcp110.dll
2014-01-15 21:08 - 2011-06-10 18:15 - 0829264 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\msvcr100.dll
2014-01-15 21:08 - 2012-10-01 17:59 - 0828872 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\msvcr110.dll
2014-06-14 09:50 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Pcipncidwcnmxxit.exe
2014-11-11 14:02 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Uehchspzbanzzmbg.exe
2014-01-15 21:08 - 2012-11-05 23:26 - 0354264 _____ (Microsoft Corporation) C:\Users\xxx\AppData\Roaming\vccorlib110.dll
2014-07-12 13:25 - 2014-05-26 19:32 - 0114688 ___RH (ASUSTek Computer Inc.) C:\Users\xxx\AppData\Roaming\Vdjjqxkwmfhkofzh.exe
2013-09-11 16:18 - 2014-04-05 11:18 - 0000181 _____ () C:\Users\xxx\AppData\Roaming\WB.CFG
2014-04-22 14:17 - 2014-04-22 08:51 - 0048128 _____ () C:\Users\xxx\AppData\Roaming\wrapper.exe
2014-01-21 23:22 - 2014-01-21 23:22 - 0000000 __RSH () C:\Users\xxx\AppData\Roaming\wuzsd.tmp~
2014-04-24 06:32 - 2014-04-17 18:02 - 0108032 ___RH (pocket quitter) C:\Users\xxx\AppData\Roaming\Zvdgqpjalwyhoplt.exe
2012-01-20 20:04 - 2013-10-16 15:11 - 0007168 _____ () C:\Users\xxx\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-04-15 14:58 - 2014-04-15 14:58 - 1097384 _____ (AnyProtect.com) C:\Users\xxx\AppData\Local\nsvEFD6.tmp
2014-05-21 15:08 - 2014-05-21 15:08 - 0001789 _____ () C:\Users\xxx\AppData\Local\recently-used.xbel
2011-08-28 09:00 - 2011-08-28 09:01 - 0007625 _____ () C:\Users\xxx\AppData\Local\resmon.resmoncfg
2013-09-10 19:22 - 2013-09-10 19:21 - 0333348 _____ () C:\Users\xxx\AppData\Local\searchya-speeddial.crx
2012-01-19 16:41 - 2012-01-19 16:41 - 2161160 _____ (DownVision ) C:\Users\xxx\AppData\Local\setup.exe
2014-01-09 16:38 - 2014-01-09 16:38 - 0000000 _____ () C:\Users\xxx\AppData\Local\{359BE985-5A4F-4CC5-AE7D-EA4296C95E44}
2014-01-19 15:00 - 2014-01-19 15:00 - 0000000 _____ () C:\Users\xxx\AppData\Local\{3C516446-F008-4B9A-9FA5-6017C29C0D8C}
2014-01-10 10:40 - 2014-01-10 10:41 - 0000000 _____ () C:\Users\xxx\AppData\Local\{450C576E-73E5-4099-AAE8-D09D70FFAD15}
2014-01-20 10:32 - 2014-01-20 10:32 - 0000000 _____ () C:\Users\xxx\AppData\Local\{6410277F-7F3F-44EF-A6B9-AA1292B8D299}
2014-01-16 22:14 - 2014-01-16 22:14 - 0000000 _____ () C:\Users\xxx\AppData\Local\{76FE128B-E07A-4B43-B70B-2F06C7023D61}
2014-01-21 15:44 - 2014-01-21 15:44 - 0000000 _____ () C:\Users\xxx\AppData\Local\{7BED8FB6-734F-4C0F-91E1-0942AD315A99}
2014-12-07 11:34 - 2014-12-07 11:34 - 0000000 _____ () C:\Users\xxx\AppData\Local\{8C8C56BE-A2F2-4055-9554-5E68606E535F}
2013-10-02 18:08 - 2013-10-02 18:08 - 0000000 _____ () C:\Users\xxx\AppData\Local\{92EDB874-E442-4A02-A3B6-82A6A0B15D83}
2013-09-28 12:59 - 2013-09-28 12:59 - 0000000 _____ () C:\Users\xxx\AppData\Local\{D2C9B797-B576-480E-ADDD-CBC5B46CD199}
2013-11-08 14:33 - 2013-11-08 14:33 - 0000000 _____ () C:\Users\xxx\AppData\Local\{DB141521-8235-4DE4-B61C-A470B6D3786E}
Some content of TEMP:
====================
C:\Users\xxx\AppData\Local\Temp\Quarantine.exe
C:\Users\xxx\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe = & gt; File is digitally signed
C:\Windows\System32\wininit.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\wininit.exe = & gt; File is digitally signed
C:\Windows\explorer.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\explorer.exe = & gt; File is digitally signed
C:\Windows\System32\svchost.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\svchost.exe = & gt; File is digitally signed
C:\Windows\System32\services.exe = & gt; File is digitally signed
C:\Windows\System32\User32.dll = & gt; File is digitally signed
C:\Windows\SysWOW64\User32.dll = & gt; File is digitally signed
C:\Windows\System32\userinit.exe = & gt; File is digitally signed
C:\Windows\SysWOW64\userinit.exe = & gt; File is digitally signed
C:\Windows\System32\rpcss.dll = & gt; File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys = & gt; File is digitally signed
LastRegBack: 2015-02-13 13:52
==================== End Of Log ============================