OTL logfile created on: 2013-09-20 01:19:33 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\DOM\Desktop Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 8.0.7601.17514) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,13 Gb Total Physical Memory | 1,83 Gb Available Physical Memory | 58,52% Memory free 6,25 Gb Paging File | 4,69 Gb Available in Paging File | 75,08% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 73,96 Gb Total Space | 41,30 Gb Free Space | 55,85% Space Free | Partition Type: NTFS Drive D: | 390,62 Gb Total Space | 390,19 Gb Free Space | 99,89% Space Free | Partition Type: NTFS Drive F: | 931,51 Gb Total Space | 764,48 Gb Free Space | 82,07% Space Free | Partition Type: NTFS Computer Name: DOM-KOMPUTER | User Name: DOM | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013-09-20 01:18:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DOM\Desktop\OTL.exe PRC - [2013-09-15 09:08:22 | 000,344,640 | ---- | M] (Woodtale Technology Inc) -- C:\Users\DOM\AppData\Local\DProtect\DProtectSvc.exe PRC - [2013-07-12 17:34:47 | 000,217,992 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe PRC - [2013-06-25 21:47:09 | 000,308,816 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Google Toolbar\GoogleToolbarUser_32.exe PRC - [2013-05-21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\20.4.0.40\ccsvchst.exe PRC - [2013-05-21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Identity Safe\Engine\2013.4.0.10\ccsvchst.exe PRC - [2013-04-21 18:47:55 | 000,812,424 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\Macromed\Flash\FlashUtil32_11_7_700_169_ActiveX.exe PRC - [2012-06-23 08:45:00 | 002,458,984 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012-06-23 08:28:29 | 001,820,520 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe PRC - [2012-06-23 08:27:30 | 000,858,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe PRC - [2012-05-01 18:56:02 | 000,548,864 | ---- | M] (Vimicro) -- C:\Program Files\USB Camera\VM331STI.EXE PRC - [2012-02-08 10:03:36 | 000,363,800 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2012-02-08 10:03:34 | 000,277,784 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2012-02-08 10:03:28 | 000,128,280 | ---- | M] () -- C:\Program Files\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe PRC - [2012-02-08 10:03:16 | 000,161,560 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe PRC - [2012-02-02 22:25:30 | 000,458,464 | ---- | M] (Intel(R) Corporation) -- c:\Program Files\Intel\iCLS Client\HeciServer.exe PRC - [2012-01-27 17:40:46 | 000,291,608 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe PRC - [2011-11-10 20:40:06 | 000,484,648 | ---- | M] (Synaptics) -- C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe PRC - [2010-11-20 23:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010-11-20 23:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2010-11-20 23:29:10 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2009-07-14 03:14:17 | 000,008,192 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dinotify.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013-09-15 09:08:23 | 000,062,016 | ---- | M] () -- C:\Users\DOM\AppData\Local\DProtect\eBPSD.dll MOD - [2013-09-15 09:08:22 | 000,506,944 | ---- | M] () -- C:\Users\DOM\AppData\Local\DProtect\eBP.dll MOD - [2012-05-30 16:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton Identity Safe\Engine\2013.4.0.10\wincfi39.dll MOD - [2012-05-30 08:51:08 | 000,699,280 | R--- | M] () -- C:\Program Files\Norton Internet Security\Engine\20.4.0.40\wincfi39.dll MOD - [2012-01-19 07:48:24 | 000,094,208 | ---- | M] () -- C:\Windows\System32\IccLibDll.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2013-09-15 09:08:22 | 000,344,640 | ---- | M] (Woodtale Technology Inc) [Auto | Running] -- C:\Users\DOM\AppData\Local\DProtect\DProtectSvc.exe -- (DPService) SRV - [2013-05-21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe -- (NIS) SRV - [2013-05-21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Identity Safe\Engine\2013.4.0.10\ccSvcHst.exe -- (NCO) SRV - [2013-02-28 19:25:34 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2012-06-23 08:45:00 | 002,458,984 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012-02-08 10:03:36 | 000,363,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2012-02-08 10:03:34 | 000,277,784 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2012-02-08 10:03:28 | 000,128,280 | ---- | M] () [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe -- (Intel(R) SRV - [2012-02-08 10:03:16 | 000,161,560 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe -- (jhi_service) SRV - [2012-02-02 22:25:30 | 000,458,464 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- c:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) SRV - [2012-01-28 06:12:38 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\System32\IntelCpHeciSvc.exe -- (cphs) SRV - [2009-07-14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009-07-14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009-07-14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- System32\drivers\rdvgkmd.sys -- (VGPU) DRV - [2013-09-14 17:45:25 | 001,612,376 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130919.003\NAVEX15.SYS -- (NAVEX15) DRV - [2013-09-14 17:45:25 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130919.003\NAVENG.SYS -- (NAVENG) DRV - [2013-09-13 16:17:28 | 000,392,792 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130918.002\IDSvix86.sys -- (IDSVix86) DRV - [2013-09-03 22:41:52 | 001,097,816 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130903.002_2f8\BHDrvx86.sys -- (BHDrvx86) DRV - [2013-08-28 13:50:37 | 000,376,920 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2013-08-28 13:50:37 | 000,108,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv) DRV - [2013-06-19 12:04:16 | 000,142,496 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2013-05-23 07:25:28 | 000,934,488 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\symefa.sys -- (SymEFA) DRV - [2013-05-21 07:02:00 | 000,367,704 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\symds.sys -- (SymDS) DRV - [2013-05-16 07:02:14 | 000,603,224 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\srtsp.sys -- (SRTSP) DRV - [2013-04-25 02:43:56 | 000,339,544 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\symnets.sys -- (SymNetS) DRV - [2013-04-16 04:41:14 | 000,134,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NST\7DD04000.00A\ccsetx86.sys -- (ccSet_NST) DRV - [2013-04-16 04:41:14 | 000,134,744 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\ccsetx86.sys -- (ccSet_NIS) DRV - [2013-03-05 03:39:19 | 000,175,264 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\ironx86.sys -- (SymIRON) DRV - [2013-03-05 03:21:35 | 000,032,344 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\NIS\1404000.028\srtspx.sys -- (SRTSPX) DRV - [2012-08-24 02:08:08 | 000,929,152 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vm331avs.sys -- (vm331avs) DRV - [2012-06-23 08:45:00 | 011,469,672 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2012-06-23 08:45:00 | 000,024,936 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt) DRV - [2012-01-27 17:39:36 | 000,791,832 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\iusb3xhc.sys -- (iusb3xhc) DRV - [2012-01-27 17:39:36 | 000,348,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\iusb3hub.sys -- (iusb3hub) DRV - [2012-01-27 17:39:36 | 000,013,592 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\iusb3hcs.sys -- (iusb3hcs) DRV - [2011-12-06 19:22:02 | 000,280,576 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) DRV - [2011-11-10 16:52:02 | 000,046,080 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HECI.sys -- (MEI) DRV - [2010-11-20 23:29:34 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV - [2010-11-20 23:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010-11-20 23:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2010-11-20 23:29:03 | 000,112,640 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tsusbhub.sys -- (tsusbhub) DRV - [2010-11-20 23:29:03 | 000,077,184 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Synth3dVsc.sys -- (Synth3dVsc) DRV - [2010-11-20 23:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010-11-20 23:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2010-11-20 23:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2010-11-20 23:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2010-11-20 23:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010-11-20 23:29:03 | 000,025,600 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\terminpt.sys -- (terminpt) DRV - [2010-11-20 23:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010-11-20 23:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2010-01-20 06:14:42 | 000,023,136 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AcpiVpc.sys -- (ACPIVPC) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.v9.com/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=hp&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379228900 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.v9.com/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=hp&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379228900 IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.v9.com/web/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=ds&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379228900 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=20.4.0.40 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=20.4.0.40 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=20.4.0.40 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=20.4.0.40 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=76D6089E01330E64&affID=119357&tsp=4950 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.v9.com/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=hp&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379626091 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.v9.com/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=hp&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379626091 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86} IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=76D6089E01330E64&affID=119357&tsp=4950 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.v9.com/web/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=ds&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379569433 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3506508921-75840604-2200199539-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=pl&pid=NIS&pvid=20.4.0.40 [color=#E56717]========== FireFox ==========[/color] FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\DOM\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F04D2D30-776C-4d02-8627-8E4385ECA58D}: C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn\ FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\ [2013-09-19 23:26:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFFPlgn\ [2013-09-15 03:13:21 | 000,000,000 | ---D | M] [2013-04-21 20:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DOM\AppData\Roaming\mozilla\Extensions [2013-07-21 13:29:06 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: v9 (Enabled) CHR - default_search_provider: search_url = http://search.v9.com/web/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=ds&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379362788&type=default&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: http://en.v9.com/?utm_source=b&utm_medium=bnd&utm_campaign=eXQ&utm_content=hp&from=bnd&uid=WDCXWD5000BPVT-24HXZT3_WD-WXU1EB1LKUKCLKUKC&ts=1379362788 CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll CHR - Extension: Dokumenty Google = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Dysk Google = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: YouTube = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Szukaj w Google = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: Delta Toolbar = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.4_0\ CHR - Extension: No name found = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.5.2_0\ CHR - Extension: Norton Identity Protection = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_0\ CHR - Extension: Chrome In-App Payments service = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0\ CHR - Extension: Norton Identity Protection = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\nppllibpnmahfaklnpggkibhkapjkeob\2013.4.0.10_0\ CHR - Extension: Gmail = C:\Users\DOM\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2013-04-21 18:39:14 | 000,000,864 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 validation.sls.microsoft.com O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.) O2 - BHO: (delta Helper Object) - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation) O3 - HKLM\..\Toolbar: (Delta Toolbar) - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com) O3 - HKU\S-1-5-21-3506508921-75840604-2200199539-1000\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\20.4.0.40\coieplg.dll (Symantec Corporation) O4 - HKLM..\Run: [331BigDog] C:\Program Files\USB Camera\VM331STI.EXE (Vimicro) O4 - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics) O4 - HKLM..\Run: [USB3MON] C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (Intel Corporation) O4 - HKU\S-1-5-21-3506508921-75840604-2200199539-1000..\Run: [Facebook Update] C:\Users\DOM\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-3506508921-75840604-2200199539-1003..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O13 - gopher Prefix: missing O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 82.160.137.110 82.160.137.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9A1D4F19-F13B-4FED-B585-DD0C2E42941B}: DhcpNameServer = 82.160.137.110 82.160.137.126 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2DCDF45-636F-4B98-A6B2-D5C11DB04337}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - AppInit_DLLs: (C:\Users\DOM\AppData\Local\DProtect\eBP.dll) - C:\Users\DOM\AppData\Local\DProtect\eBP.dll () O20 - AppInit_DLLs: (C:\Users\DOM\AppData\Local\DProtect\eBPSD.dll䈀誘偁䱐䍉ㅾ) - C:\Users\DOM\AppData\Local\DProtect\eBPSD.dll () O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-06-10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O32 - AutoRun File - [2013-08-29 18:26:00 | 000,000,000 | -H-D | M] - F:\Autorun(2).inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013-09-20 01:18:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\DOM\Desktop\OTL.exe [2013-09-15 09:08:24 | 000,000,000 | ---D | C] -- C:\ProgramData\eSafe [2013-09-15 09:08:22 | 000,000,000 | ---D | C] -- C:\Users\DOM\AppData\Local\DProtect [2013-09-15 09:06:15 | 000,000,000 | ---D | C] -- C:\Users\DOM\AppData\Roaming\uTorrent [2013-09-09 11:51:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013-09-09 11:51:31 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2013-09-04 19:48:19 | 000,000,000 | ---D | C] -- C:\Users\DOM\Desktop\bizzu [2013-09-02 13:34:45 | 000,000,000 | ---D | C] -- C:\Users\DOM\AppData\Local\ElevatedDiagnostics [2013-09-01 14:47:17 | 000,000,000 | ---D | C] -- C:\Users\DOM\AppData\Roaming\.minecraft [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013-09-20 01:22:46 | 000,002,427 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2013-09-20 01:18:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DOM\Desktop\OTL.exe [2013-09-20 00:39:01 | 000,001,030 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013-09-20 00:08:02 | 000,000,920 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3506508921-75840604-2200199539-1000UA.job [2013-09-19 23:33:33 | 000,687,828 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2013-09-19 23:33:33 | 000,607,190 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013-09-19 23:33:33 | 000,131,382 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2013-09-19 23:33:33 | 000,103,568 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013-09-19 23:33:08 | 000,021,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013-09-19 23:33:08 | 000,021,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013-09-19 23:25:54 | 000,000,816 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job [2013-09-19 23:25:52 | 000,001,026 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013-09-19 23:25:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013-09-19 23:25:38 | 2517,667,840 | -HS- | M] () -- C:\hiberfil.sys [2013-09-17 22:13:22 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3506508921-75840604-2200199539-1000Core.job [2013-09-17 17:50:16 | 000,000,818 | ---- | M] () -- C:\Windows\tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job [2013-09-15 22:10:53 | 000,000,954 | ---- | M] () -- C:\Users\DOM\Desktop\GG dysk.lnk [2013-09-15 09:07:55 | 000,000,853 | ---- | M] () -- C:\Users\DOM\Desktop\µTorrent.lnk [2013-09-15 09:01:43 | 000,001,093 | ---- | M] () -- C:\Users\DOM\Desktop\Dokumenty — skrót.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013-09-15 09:07:55 | 000,000,853 | ---- | C] () -- C:\Users\DOM\Desktop\µTorrent.lnk [2013-09-15 09:01:43 | 000,001,093 | ---- | C] () -- C:\Users\DOM\Desktop\Dokumenty — skrót.lnk [2013-07-04 22:52:24 | 000,178,688 | ---- | C] () -- C:\Windows\System32\unrar.dll [2013-04-21 19:22:00 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2013-04-21 19:16:55 | 002,664,857 | ---- | C] () -- C:\Windows\System32\nvcoproc.bin [2013-04-21 19:04:45 | 000,734,772 | ---- | C] () -- C:\Windows\System32\igkrng700.bin [2013-04-21 19:04:45 | 000,559,780 | ---- | C] () -- C:\Windows\System32\igfcg700m.bin [2013-04-21 19:04:45 | 000,009,216 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll [2013-04-21 19:04:43 | 013,001,728 | ---- | C] () -- C:\Windows\System32\ig7icd32.dll [2013-04-21 19:04:43 | 000,058,880 | ---- | C] () -- C:\Windows\System32\igdde32.dll [2013-04-21 19:04:42 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll [2013-04-21 19:04:42 | 000,000,264 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config [2013-04-21 19:02:40 | 000,015,128 | ---- | C] () -- C:\Windows\System32\drivers\IntelMEFWVer.dll [2013-04-21 18:54:14 | 000,001,897 | ---- | C] () -- C:\Windows\vm331Rmv.ini [2013-04-21 18:54:14 | 000,001,897 | ---- | C] () -- C:\Windows\System32\vm331Rmv.ini [2013-04-21 18:38:12 | 000,006,656 | ---- | C] () -- C:\Windows\System32\bcmwlrc.dll [2012-02-02 22:08:06 | 000,001,536 | ---- | C] () -- C:\Windows\System32\IusEventLog.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2010-11-20 23:29:11 | 012,872,192 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 23:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009-07-14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2013-09-01 14:47:17 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\.minecraft [2013-07-21 13:29:10 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\BabSolution [2013-07-21 13:28:15 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\Babylon [2013-07-21 13:29:06 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\Delta [2013-09-15 22:10:51 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\GG [2013-09-18 08:10:43 | 000,000,000 | ---D | M] -- C:\Users\DOM\AppData\Roaming\uTorrent [color=#E56717]========== Purity Check ==========[/color] < End of report >