Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 02
Ran by Kuba (administrator) on KUBA-KOMPUTER on 03-09-2013 19:40:36
Running from C:\Users\Kuba\Downloads
Windows 7 Home Premium (X64) OS Language: Polish
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AMD) C:\windows\system32\atieclxx.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Sony DADC Austria AG.) C:\windows\SysWOW64\UAService7.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe
() C:\Program Files (x86)\Greenshot\Greenshot.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10810912 2010-05-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014752 2010-05-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2101032 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [SynBtnAsst] - C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe [54568 2010-05-03] (Synaptics Incorporated)
HKLM-x32\...\Winlogon: [Shell] C:\PROGRA~3\rawt.bat [x ] () <=== ATTENTION
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Greenshot] - C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] ()
HKCU\...\Run: [Facebook Update] - C:\Users\Kuba\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3674320 2013-01-08] (DT Soft Ltd)
HKCU\...\Run: [Google Update] - C:\Users\Kuba\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-10] (Google Inc.)
HKCU\...\Run: [xwidget] - C:\Program Files (x86)\XWidget\xwidget.exe [x]
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [UCam_Menu] - c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2010-02-04] (CyberLink Corp.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2011-04-08] (Sun Microsystems, Inc.)
HKU\Default\...\RunOnce: [LenovoWallpaper] - C:\Program Files\desktop\ChangeDesktop.exe [53760 2009-09-30] ()
HKU\Default\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [785744 2009-07-26] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [LenovoWallpaper] - C:\Program Files\desktop\ChangeDesktop.exe [53760 2009-09-30] ()
HKU\Default User\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [785744 2009-07-26] (Microsoft Corporation)
HKU\Gość\...\Run: [Google Update] - C:\Users\Kuba\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-03-10] (Google Inc.)
HKU\Gość\...\Run: [Gadu-Gadu 10] - C:\Program Files (x86)\Gadu-Gadu 10\gg.exe [12984928 2010-12-16] (GG Network S.A.)
HKU\Gość\...\Run: [ALLUpdate] - C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [1362944 2011-02-08] ()
HKU\Gość\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [18678376 2013-05-09] (Skype Technologies S.A.)
HKU\Gość\...\Run: [Greenshot] - C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] ()
HKU\Gość\...\Run: [4E3E0230AEBB4E96] - C:\Recycle.Bin\Recycle.Bin.exe [x]
HKU\Gość\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
Startup: C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
Startup: C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
ShortcutTarget: regmonstd.lnk -> C:\PROGRA~3\twar.dat (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://go.microsoft.com/fwlink/?LinkId=69157
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.v9.com/web/?q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear
SearchScopes: HKCU - {7AC57FAC-79A7-4C43-89D7-7706CFC5B104} URL = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=&apn_ptnrs=^FV&apn_dtid=^YYYYYY^YY^PL&apn_uid=cc25c67e-7744-480b-b716-9c2b5fcfaf25&apn_sauid=142E98D6-F12B-4A1F-863F-B73F39DEE941
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: IplexToALLPlayer - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\PROGRA~2\ALLPLA~1\Iplex\IPLEXT~1.DLL (ALLCinema Ltd.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - No Name - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.45.1
Tcpip\..\Interfaces\{3C6BEDAC-295D-4CCA-B7C0-D29B9025112B}: [NameServer]192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Kuba\AppData\Roaming\Mozilla\Firefox\Profiles\vhe0r95f.default
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandasecurity.com/activescan - C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF Plugin-x32: @real.com/nppl3260;version=6.0.12.69 - C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.69 - C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Kuba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Kuba\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Kuba\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.pl/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Panda ActiveScan 2.0) - C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Kuba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Google Update) - C:\Users\Kuba\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (SiteAdvisor) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0
CHR Extension: (Skype Extension) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.5.0.7896_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

R2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [120592 2013-05-22] (McAfee, Inc.)
S2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation)
R2 UserAccess7; C:\Windows\SysWow64\UAService7.exe [221184 2011-04-24] (Sony DADC Austria AG.)

==================== Drivers (Whitelisted) ====================

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2013-02-18] (DT Soft Ltd)
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [30312 2011-01-26] (CaptainFlint Software)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 BcmSqlStartupSvc; 
S3 btwaudio; system32\drivers\btwaudio.sys [x]
S3 btwavdt; system32\DRIVERS\btwavdt.sys [x]
S3 btwl2cap; system32\DRIVERS\btwl2cap.sys [x]
S3 btwrchid; system32\DRIVERS\btwrchid.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
U2 IviRegMgr; 
U2 RichVideo; 
S3 wdmirror; system32\DRIVERS\WDMirror.sys [x]
U3 afrcaaoc; \??\C:\Users\Kuba\AppData\Local\Temp\afrcaaoc.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-03 19:38 - 2013-09-03 19:38 - 01950412 _____ (Farbar) C:\Users\Kuba\Downloads\FRST64.exe
2013-09-03 15:55 - 2013-09-03 15:55 - 00081254 _____ C:\Users\Kuba\Downloads\Extras.Txt
2013-09-03 15:53 - 2013-09-03 15:53 - 00096700 _____ C:\Users\Kuba\Downloads\OTL.Txt
2013-09-03 15:49 - 2013-09-03 15:49 - 00002100 _____ C:\Users\Kuba\Downloads\GMER.log
2013-09-03 15:14 - 2013-09-03 15:14 - 00368554 _____ C:\Users\Kuba\Downloads\gmer.zip
2013-09-03 10:18 - 2013-09-03 10:18 - 00000000 ____D C:\_OTL
2013-09-03 10:07 - 2013-09-03 10:07 - 00602112 _____ (OldTimer Tools) C:\Users\Kuba\Downloads\OTL.com
2013-09-03 09:59 - 2013-09-03 10:00 - 00000000 ____D C:\AdwCleaner
2013-09-03 09:58 - 2013-09-03 09:58 - 01037134 _____ C:\Users\Kuba\Downloads\adwcleaner.exe
2013-09-03 09:58 - 2013-09-03 09:58 - 01037134 _____ C:\Users\Kuba\Downloads\adwcleaner (1).exe
2013-09-02 16:17 - 2013-09-02 16:18 - 00000000 ____D C:\Simplicity Info-Chainzjackass
2013-09-02 16:17 - 2013-09-02 16:17 - 02713711 _____ C:\Users\Kuba\Downloads\Simplicity Info-Chainzjackass.rar
2013-09-02 15:44 - 2013-09-02 15:44 - 00000000 ____D C:\Eclipse Dock II
2013-09-02 15:43 - 2013-09-02 15:43 - 10880278 _____ C:\Users\Kuba\Downloads\EclipseDock_by_hotiron.zip
2013-09-02 15:27 - 2013-09-02 15:27 - 01096647 _____ C:\Users\Kuba\Downloads\circuitoustwo_by_flyinghyrax-d688ypz.rmskin
2013-09-02 14:48 - 2013-09-02 15:54 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Users\Kuba\Documents\Rainmeter
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\Rainmeter
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Program Files\Rainmeter
2013-09-02 14:20 - 2013-09-02 14:20 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-02 14:19 - 2013-09-02 14:19 - 01386624 _____ C:\Users\Kuba\Downloads\Rainmeter-2.5.exe
2013-09-02 14:18 - 2013-09-02 14:18 - 00685248 _____ C:\Users\Kuba\Downloads\Rainmeter(18721).exe
2013-09-01 22:59 - 2013-09-03 10:01 - 00002834 _____ C:\windows\PFRO.log
2013-09-01 22:05 - 2013-09-01 22:05 - 00894600 _____ (CNET Download.com) C:\Users\Kuba\Downloads\cbsidlm-cbsi134-XWidget-ORG-75609200 (1).exe
2013-09-01 22:03 - 2013-09-02 16:08 - 00000000 ____D C:\Program Files (x86)\XWidget
2013-09-01 22:02 - 2013-09-01 22:02 - 00894600 _____ (CNET Download.com) C:\Users\Kuba\Downloads\cbsidlm-cbsi134-XWidget-ORG-75609200.exe
2013-09-01 20:39 - 2013-09-02 10:29 - 00000000 ___RD C:\Users\Kuba\Desktop\notatki
2013-09-01 19:56 - 2013-09-01 19:56 - 00002337 _____ C:\Users\Kuba\Downloads\Animatrix_-_The_Second_Renaissance_Part_1_(NAPISY-23555).NS.zip
2013-09-01 06:35 - 2013-09-03 12:36 - 00000672 _____ C:\windows\setupact.log
2013-09-01 06:35 - 2013-09-01 06:35 - 00000000 _____ C:\windows\setuperr.log
2013-08-24 10:19 - 2013-08-24 10:19 - 00000000 ____D C:\Program Files (x86)\3DO
2013-08-24 10:19 - 1998-10-07 12:54 - 00327168 _____ (InstallShield Software Corporation) C:\windows\IsUn0415.exe
2013-08-23 11:23 - 2013-08-23 11:23 - 01650167 _____ C:\Users\Kuba\Downloads\klasa4.uwagi ostatnie.odt
2013-08-05 15:46 - 2013-08-05 15:46 - 01094246 _____ C:\Users\Kuba\Downloads\Scan10002.BMP
2013-08-05 15:46 - 2013-08-05 15:46 - 01094246 _____ C:\Users\Kuba\Downloads\Scan10001.BMP

==================== One Month Modified Files and Folders =======

2013-09-03 19:39 - 2013-09-03 19:39 - 00000000 ____D C:\FRST
2013-09-03 19:38 - 2013-09-03 19:38 - 01950412 _____ (Farbar) C:\Users\Kuba\Downloads\FRST64.exe
2013-09-03 19:24 - 2010-11-03 12:09 - 01790263 _____ C:\windows\WindowsUpdate.log
2013-09-03 19:07 - 2012-03-27 18:57 - 00001074 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000UA.job
2013-09-03 18:51 - 2013-03-10 18:24 - 00001054 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000UA.job
2013-09-03 15:55 - 2013-09-03 15:55 - 00081254 _____ C:\Users\Kuba\Downloads\Extras.Txt
2013-09-03 15:53 - 2013-09-03 15:53 - 00096700 _____ C:\Users\Kuba\Downloads\OTL.Txt
2013-09-03 15:49 - 2013-09-03 15:49 - 00002100 _____ C:\Users\Kuba\Downloads\GMER.log
2013-09-03 15:14 - 2013-09-03 15:14 - 00368554 _____ C:\Users\Kuba\Downloads\gmer.zip
2013-09-03 12:44 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 12:44 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 12:36 - 2013-09-01 06:35 - 00000672 _____ C:\windows\setupact.log
2013-09-03 12:36 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-03 10:18 - 2013-09-03 10:18 - 00000000 ____D C:\_OTL
2013-09-03 10:07 - 2013-09-03 10:07 - 00602112 _____ (OldTimer Tools) C:\Users\Kuba\Downloads\OTL.com
2013-09-03 10:01 - 2013-09-01 22:59 - 00002834 _____ C:\windows\PFRO.log
2013-09-03 10:00 - 2013-09-03 09:59 - 00000000 ____D C:\AdwCleaner
2013-09-03 09:58 - 2013-09-03 09:58 - 01037134 _____ C:\Users\Kuba\Downloads\adwcleaner.exe
2013-09-03 09:58 - 2013-09-03 09:58 - 01037134 _____ C:\Users\Kuba\Downloads\adwcleaner (1).exe
2013-09-03 08:59 - 2010-11-03 12:15 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-03 08:43 - 2013-04-07 17:26 - 00000000 ____D C:\Program Files (x86)\War Thunder
2013-09-03 08:21 - 2011-07-09 08:48 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\Skype
2013-09-03 01:07 - 2012-03-27 18:57 - 00001052 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000Core.job
2013-09-03 01:03 - 2013-03-10 18:24 - 00001002 _____ C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000Core.job
2013-09-03 00:15 - 2011-04-30 08:22 - 00000000 ___RD C:\Users\Kuba\Desktop\zdjecia
2013-09-02 16:31 - 2012-05-12 22:21 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-02 16:20 - 2011-04-07 23:32 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\SoftGrid Client
2013-09-02 16:18 - 2013-09-02 16:17 - 00000000 ____D C:\Simplicity Info-Chainzjackass
2013-09-02 16:17 - 2013-09-02 16:17 - 02713711 _____ C:\Users\Kuba\Downloads\Simplicity Info-Chainzjackass.rar
2013-09-02 16:08 - 2013-09-01 22:03 - 00000000 ____D C:\Program Files (x86)\XWidget
2013-09-02 15:54 - 2013-09-02 14:48 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-02 15:44 - 2013-09-02 15:44 - 00000000 ____D C:\Eclipse Dock II
2013-09-02 15:43 - 2013-09-02 15:43 - 10880278 _____ C:\Users\Kuba\Downloads\EclipseDock_by_hotiron.zip
2013-09-02 15:27 - 2013-09-02 15:27 - 01096647 _____ C:\Users\Kuba\Downloads\circuitoustwo_by_flyinghyrax-d688ypz.rmskin
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Users\Kuba\Documents\Rainmeter
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\Rainmeter
2013-09-02 14:21 - 2013-09-02 14:21 - 00000000 ____D C:\Program Files\Rainmeter
2013-09-02 14:21 - 2011-04-06 17:54 - 00000000 ___RD C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-02 14:20 - 2013-09-02 14:20 - 00000000 ____D C:\ProgramData\Package Cache
2013-09-02 14:19 - 2013-09-02 14:19 - 01386624 _____ C:\Users\Kuba\Downloads\Rainmeter-2.5.exe
2013-09-02 14:18 - 2013-09-02 14:18 - 00685248 _____ C:\Users\Kuba\Downloads\Rainmeter(18721).exe
2013-09-02 13:47 - 2012-09-23 15:00 - 00000000 ___RD C:\Users\Kuba\Desktop\CS
2013-09-02 13:23 - 2011-11-22 20:32 - 00000000 ___RD C:\Users\Kuba\Desktop\LY
2013-09-02 10:50 - 2011-11-15 01:42 - 00007626 _____ C:\Users\Kuba\AppData\Local\Resmon.ResmonCfg
2013-09-02 10:34 - 2013-02-18 19:52 - 00000000 ___RD C:\Users\Kuba\Desktop\EuroPlus - Angielski
2013-09-02 10:34 - 2012-05-25 07:26 - 00000000 ___RD C:\Users\Kuba\Desktop\Bezpieczeństwo publiczne
2013-09-02 10:33 - 2012-12-31 20:00 - 00000000 ___RD C:\Users\Kuba\Desktop\od Anety
2013-09-02 10:32 - 2012-12-06 23:37 - 00000000 ___RD C:\Users\Kuba\Desktop\tatuaz
2013-09-02 10:29 - 2013-09-01 20:39 - 00000000 ___RD C:\Users\Kuba\Desktop\notatki
2013-09-02 10:27 - 2013-01-14 13:58 - 00000000 ___RD C:\Users\Kuba\Desktop\C
2013-09-02 10:23 - 2012-07-10 22:30 - 00000000 ___RD C:\Users\Kuba\Desktop\ASG
2013-09-02 10:21 - 2011-05-08 21:36 - 00000000 ___RD C:\Users\Kuba\Desktop\novision
2013-09-02 10:12 - 2012-11-05 19:21 - 00000000 ___RD C:\Users\Kuba\Desktop\stary dysk
2013-09-02 10:09 - 2012-06-19 01:25 - 00000000 ___RD C:\Users\Kuba\Desktop\ODE
2013-09-02 10:06 - 2011-04-19 23:54 - 00000000 ___RD C:\Users\Kuba\Desktop\Q
2013-09-02 10:04 - 2012-11-22 12:21 - 00000000 ___RD C:\Users\Kuba\Desktop\Marcyś
2013-09-01 22:05 - 2013-09-01 22:05 - 00894600 _____ (CNET Download.com) C:\Users\Kuba\Downloads\cbsidlm-cbsi134-XWidget-ORG-75609200 (1).exe
2013-09-01 22:03 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-09-01 22:02 - 2013-09-01 22:02 - 00894600 _____ (CNET Download.com) C:\Users\Kuba\Downloads\cbsidlm-cbsi134-XWidget-ORG-75609200.exe
2013-09-01 20:49 - 2012-12-02 00:04 - 00000000 ___RD C:\Users\Kuba\Desktop\wot
2013-09-01 20:44 - 2013-02-16 02:05 - 00000000 ___RD C:\Users\Kuba\Desktop\egzamin
2013-09-01 19:56 - 2013-09-01 19:56 - 00002337 _____ C:\Users\Kuba\Downloads\Animatrix_-_The_Second_Renaissance_Part_1_(NAPISY-23555).NS.zip
2013-09-01 06:35 - 2013-09-01 06:35 - 00000000 _____ C:\windows\setuperr.log
2013-08-31 10:06 - 2010-11-03 19:55 - 00804832 _____ C:\windows\system32\perfh015.dat
2013-08-31 10:06 - 2010-11-03 19:55 - 00180320 _____ C:\windows\system32\perfc015.dat
2013-08-31 10:06 - 2009-07-14 07:13 - 01851762 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-24 10:22 - 2011-04-22 19:12 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-08-24 10:19 - 2013-08-24 10:19 - 00000000 ____D C:\Program Files (x86)\3DO
2013-08-23 11:23 - 2013-08-23 11:23 - 01650167 _____ C:\Users\Kuba\Downloads\klasa4.uwagi ostatnie.odt
2013-08-20 06:21 - 2012-03-26 20:29 - 00000000 ____D C:\Program Files (x86)\StarCraft II
2013-08-15 00:57 - 2013-08-02 01:51 - 00000000 ____D C:\windows\system32\MRT
2013-08-15 00:54 - 2011-08-15 21:58 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-06 12:21 - 2013-04-27 18:48 - 00000000 ____D C:\Users\Kuba\AppData\Roaming\TS3Client
2013-08-05 15:46 - 2013-08-05 15:46 - 01094246 _____ C:\Users\Kuba\Downloads\Scan10002.BMP
2013-08-05 15:46 - 2013-08-05 15:46 - 01094246 _____ C:\Users\Kuba\Downloads\Scan10001.BMP

Files to move or delete:
====================
C:\ProgramData\rawt.bat
C:\ProgramData\rawt.reg
C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regmonstd.lnk
C:\Users\Kuba\AppData\Local\Temp\Temp1_gmer.zip\gmer.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-22 15:24

==================== End Of Log ============================