Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013
Ran by Radek (administrator) on RADEK-KOMPUTER on 04-11-2013 23:26:22
Running from C:\Downloads\Software
Windows 7 Ultimate Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(cFos Software GmbH) C:\Program Files\cFosSpeed\spd.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
() C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\Smc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(O&O Software GmbH) C:\Program Files\OO Software\Defrag\oodtray.exe
() C:\Windows\SysWOW64\HsMgr.exe
() C:\Windows\system\HsMgr64.exe
(cFos Software GmbH) C:\Program Files\cFosSpeed\cfosspeed.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Update\GoogleUpdate.exe
(CMedia) C:\Program Files\ASUS Xonar DG Audio\Customapp\ASUSAUDIOCENTER.EXE
(SqueakyChocolate, LLC) C:\Program Files (x86)\SqueakyChocolate\UpdateChecker\UpdateCheckerApp.exe
(AdFender, Inc.) C:\Program Files (x86)\AdFender\AdFender.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe
(FreeDownloadManager.ORG) C:\Program Files (x86)\Free Download Manager\fdm.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12666984 2011-08-09] (Realtek Semiconductor)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE [2726728 2010-03-25] (CANON INC.)
HKLM\...\Run: [OODefragTray] - C:\Program Files\OO Software\Defrag\oodtray.exe [3838792 2010-06-21] (O&O Software GmbH)
HKLM\...\Run: [Cmaudio8788] - C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
HKLM\...\Run: [Cmaudio8788GX] - C:\Windows\SysWOW64\HsMgr.exe [200704 2008-07-11] ()
HKLM\...\Run: [Cmaudio8788GX64] - C:\Windows\system\HsMgr64.exe [282112 2008-07-11] ()
HKLM\...\Run: [cFosSpeed] - C:\Program Files\cFosSpeed\cfosspeed.exe [1343704 2009-10-30] (cFos Software GmbH)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe
HKCU\...\Run: [Google Update] - C:\Users\Radek\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-11-04] (Google Inc.)
HKCU\...\Run: [UpdateChecker] - C:\Program Files (x86)\SqueakyChocolate\UpdateChecker\UpdateCheckerApp.exe [7168 2013-08-25] (SqueakyChocolate, LLC)
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
MountPoints2: J - J:\autorun.exe
MountPoints2: {232d47d8-16dd-11e3-ab41-001c25db36df} - L:\Startme.exe
MountPoints2: {e1693fc0-6944-11e2-be4b-806e6f6e6963} - K:\Autorun.exe
MountPoints2: {e1693fc2-6944-11e2-be4b-806e6f6e6963} - M:\autorun.exe
MountPoints2: {fc58fe53-18df-11e2-a0eb-001c25db36df} - L:\Startme.exe
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-12-05] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AntiLogger] - "C:\Program Files (x86)\AntiLogger\AntiLogger.exe" /minimized
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
BootExecute: 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
BHO: SmileysWeLoveToolbar - {E4EF8A64-0A30-48F5-B3FE-5FDA978DA775} - C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader64.dll ()
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Symantec Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\IPS\IPSBHO.dll (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Free Download Manager - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files (x86)\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SmileysWeLoveToolbar - {E4EF8A64-0A30-48F5-B3FE-5FDA978DA775} - C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader.dll ()
Toolbar: HKLM - SmileysWeLove - {CF0F43AB-9C23-4D7B-8040-201B82844854} - C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader64.dll ()
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - SmileysWeLove - {CF0F43AB-9C23-4D7B-8040-201B82844854} - C:\Program Files (x86)\Smileys We Love Toolbar for IE\adxloader.dll ()
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Winsock: Catalog9-x64 01 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 02 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 03 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 04 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Winsock: Catalog9-x64 15 C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll File Not found ()
Tcpip\Parameters: [DhcpNameServer] 192.168.0.10

FireFox:
========
FF ProfilePath: C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\7risbyoj.default
FF NetworkProxy: "backup.ftp", "86.3.11.175"
FF NetworkProxy: "backup.ftp_port", 8085
FF NetworkProxy: "backup.socks", "86.3.11.175"
FF NetworkProxy: "backup.socks_port", 8085
FF NetworkProxy: "backup.ssl", "86.3.11.175"
FF NetworkProxy: "backup.ssl_port", 8085
FF NetworkProxy: "ftp", "193.131.185.137"
FF NetworkProxy: "ftp_port", 3128
FF NetworkProxy: "http", "193.131.185.137"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "193.131.185.137"
FF NetworkProxy: "socks_port", 3128
FF NetworkProxy: "ssl", "193.131.185.137"
FF NetworkProxy: "ssl_port", 3128
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.13.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Radek\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Radek\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Radek\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: DoNotTrackPlus - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\7risbyoj.default\Extensions\donottrackplus@abine.com
FF Extension: fdm_ffext - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\7risbyoj.default\Extensions\fdm_ffext@freedownloadmanager.org
FF Extension: jid1-vW9nopuIAJiRHw - C:\Users\Radek\AppData\Roaming\Mozilla\Firefox\Profiles\7risbyoj.default\Extensions\jid1-vW9nopuIAJiRHw@jetpack.xpi
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\IPSFF
FF Extension: Symantec Vulnerability Protection - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\IPSFF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR Extension: (DoNotTrackMe) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\amkeiedlemmabfclbdkalidkolgdphij\2.2.9.813_0
CHR Extension: (YouTube) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (New Tab) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchmpbaclbiioedakpcldenooikekokm\9.4.1.1_0
CHR Extension: (Google Wallet) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Radek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - C:\Users\Radek\AppData\Local\foxtab_speeddial.crx
CHR HKLM-x32\...\Chrome\Extension: [dchmpbaclbiioedakpcldenooikekokm] - C:\Users\Radek\AppData\Local\foxtab_speeddial.crx
CHR StartMenuInternet: Google Chrome - C:\Users\Radek\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [37280 2011-10-26] (ArcSoft Inc.)
S2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-12-05] (Advanced Micro Devices, Inc.)
S2 appdrvrem01; C:\Windows\System32\appdrvrem01.exe [551896 2011-10-05] (Protection Technology)
R2 cFosSpeedS; C:\Program Files\cFosSpeed\spd.exe [559320 2009-10-30] (cFos Software GmbH)
S2 OODefragAgent; C:\Program Files\OO Software\Defrag\oodag.exe [2532680 2010-06-21] (O&O Software GmbH)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [75136 2013-09-23] ()
R2 SepMasterService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin\ccSvcHst.exe [143928 2012-11-03] (Symantec Corporation)
R3 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\Smc.exe [2294112 2012-11-03] (Symantec Corporation)
S3 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\snac64.exe [334288 2012-11-03] (Symantec Corporation)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580648 2012-07-17] (WiseCleaner.com)
R2 Wybór systemu operacyjnego; C:\Program Files (x86)\Acronis\DiskDirector\OSS\reinstall_svc.exe [2155736 2010-07-05] ()
S2 hmpalert; 

==================== Drivers (Whitelisted) ====================

R2 AODDriver4.01; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [55424 2011-06-24] (Advanced Micro Devices)
R1 appdrv01; C:\Windows\System32\Drivers\appdrv01.sys [3852976 2011-10-05] (Protection Technology)
R1 BHDrvx64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\BASHDefs\20131024.011\BHDrvx64.sys [1524824 2013-10-21] (Symantec Corporation)
R1 ccSettings_{60835C41-C832-4374-9ABF-8943075D8D73}; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\ccSetx64.sys [168096 2012-11-03] (Symantec Corporation)
R3 cFosSpeed; C:\Windows\System32\DRIVERS\cfosspeed.sys [1222360 2009-10-30] (cFos Software GmbH)
R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-01] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-09-01] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\IPSDefs\20131101.011\IDSvia64.sys [521816 2013-10-17] (Symantec Corporation)
S3 IT9135BDA; C:\Windows\System32\Drivers\IT9135BDA.sys [113280 2010-02-03] (ITE                      )
R4 KProcessHacker2; C:\Users\Radek\AppData\Local\Temp\Rar$EX00.375\x64\kprocesshacker.sys [40088 2013-10-30] (wj32)
R3 NAVENG; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\VirusDefs\20131104.003\ENG64.SYS [126040 2013-09-01] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Data\Definitions\VirusDefs\20131104.003\EX64.SYS [2099288 2013-09-01] (Symantec Corporation)
S3 smsbda; C:\Windows\System32\drivers\smsbda.sys [63520 2009-09-18] (Siano)
R1 SRTSP; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\SRTSP64.SYS [776352 2012-11-03] (Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\SRTSPX64.SYS [37496 2012-11-03] (Symantec Corporation)
S3 SyDvCtrl; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.2015.2015.105\Bin64\SyDvCtrl64.sys [34352 2012-11-03] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMDS64.SYS [493216 2012-11-03] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMEFA64.SYS [1133216 2012-11-03] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-09-01] (Symantec Corporation)
R1 SymIRON; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\Ironx64.SYS [224416 2012-11-03] (Symantec Corporation)
R1 SYMNETS; C:\Windows\System32\Drivers\SEP\0C0107DF\07DF.105\x64\SYMNETS.SYS [432800 2012-11-03] (Symantec Corporation)
R1 SysPlant; C:\Windows\System32\Drivers\SysPlant.sys [154904 2013-09-01] (Symantec Corporation)
R1 Teefer2; C:\Windows\System32\DRIVERS\Teefer.sys [95616 2012-11-03] (Symantec Corporation)
S1 AntiLog32; \??\C:\Windows\system32\drivers\AntiLog64.sys [x]
S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
U2 TMAgent; 
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-04 23:25 - 2013-11-04 23:25 - 00000000 ____D C:\FRST
2013-11-04 23:22 - 2013-11-04 23:22 - 00000000 ____D C:\Users\Radek\AppData\Roaming\Process Hacker 2
2013-11-04 23:15 - 2013-11-04 23:15 - 02697417 _____ C:\Users\Radek\Downloads\processhacker-2.32-bin.zip
2013-11-04 23:05 - 2013-11-04 23:05 - 00065232 _____ (Malwarebytes) C:\Users\Radek\Downloads\regassassin-setup-1.03.exe
2013-11-04 22:49 - 2013-11-04 23:24 - 00006235 _____ C:\Windows\WindowsUpdate.log
2013-11-04 22:47 - 2013-11-04 22:52 - 00000112 _____ C:\Windows\setupact.log
2013-11-04 22:47 - 2013-11-04 22:47 - 00000000 _____ C:\Windows\setuperr.log
2013-11-04 19:20 - 2013-11-04 19:20 - 00347304 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\MicrosoftFixit.wu.LB.34307014971165053.1.1.Run.exe
2013-11-04 19:20 - 2013-11-04 19:20 - 00162010 _____ C:\Users\Radek\Downloads\DIAG_MATS_NETWORK_global.DiagCab
2013-11-04 18:29 - 2013-11-04 18:40 - 947070088 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\windows6.1-KB976932-X64 (1).exe
2013-11-04 18:19 - 2013-11-04 18:23 - 247034857 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\windows6.1-KB976932-X64.exe
2013-11-04 17:44 - 2013-11-04 17:46 - 167164267 _____ C:\Users\Radek\Downloads\Windows6.1-KB947821-v28-x86.msu
2013-11-04 15:49 - 2013-11-04 15:49 - 00006678 _____ C:\Users\Radek\Desktop\Raport zgodności z systemem Windows.htm
2013-11-04 12:50 - 2013-11-04 12:50 - 00000000 ____D C:\Users\Radek\AppData\Roaming\ImgBurn
2013-11-04 12:46 - 2013-11-04 12:46 - 00364318 _____ C:\Users\Radek\AppData\Local\foxtab_speeddial.crx
2013-11-04 12:46 - 2013-11-04 12:46 - 00032237 _____ C:\Users\Radek\Downloads\ImgBurn_2.5.7.0_pl(dobreprogramy.pl).zip
2013-11-04 12:46 - 2013-11-04 12:46 - 00000000 ____D C:\Users\Radek\AppData\Roaming\FoxTab
2013-11-04 12:46 - 2013-11-04 12:46 - 00000000 ____D C:\Program Files (x86)\Foxtab
2013-11-04 12:44 - 2013-11-04 15:49 - 00000000 ____D C:\Users\Radek\Documents\Add-in Express
2013-11-04 12:44 - 2013-11-04 12:44 - 00001865 _____ C:\Users\Public\Desktop\ImgBurn.lnk
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Users\Radek\AppData\Roaming\OpenCandy
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\SqueakyChocolate
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\Smileys We Love Toolbar for IE
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2013-11-02 17:00 - 2013-11-02 17:00 - 00000000 ____D C:\Users\Radek\Documents\Pobieranie
2013-11-02 13:19 - 2013-11-02 13:19 - 00009514 _____ C:\Users\Radek\Desktop\Wykres w programie Microsoft Office PowerPoint STUDIA.xlsx
2013-11-02 13:01 - 2013-11-02 13:30 - 02578249 _____ C:\Users\Radek\Desktop\prezentacja inv analysis Echo Investment1.pptx
2013-11-01 16:30 - 2013-11-02 13:00 - 02569286 _____ C:\Users\Radek\Desktop\prezentacja inv analysis Echo Investment.pptx
2013-11-01 15:23 - 2013-11-01 15:23 - 06975894 _____ C:\Users\Radek\Downloads\Echo Investment.pptx
2013-10-28 19:30 - 2013-10-28 19:30 - 00000000 ____D C:\DVR215D
2013-10-28 19:28 - 2013-10-28 19:28 - 00237568 _____ (TODO: <Company name>) C:\Users\Radek\Downloads\183982208DeviceInfo.exe
2013-10-27 20:52 - 2013-11-02 17:00 - 00000000 ____D C:\Users\Radek\AppData\Roaming\qBittorrent
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Users\Radek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\qBittorrent
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Users\Radek\AppData\Local\qBittorrent
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Program Files (x86)\qBittorrent
2013-10-19 14:57 - 2013-10-19 14:57 - 00000220 _____ C:\Users\Radek\Desktop\Sid Meier's Civilization V.url
2013-10-18 23:53 - 2013-10-18 23:54 - 23473896 _____ (Acresso Software Inc.) C:\Users\Radek\Downloads\Assassins_Creed_III_DLC_1.exe
2013-10-16 21:20 - 2013-10-16 21:21 - 00020557 _____ C:\Users\Radek\Downloads\pobrane.htm
2013-10-16 15:20 - 2013-10-16 15:38 - 00000000 ____D C:\Users\Radek\Downloads\[FILEKING.PL] Auto Świat Katalog 02 2013
2013-10-15 17:32 - 2013-10-15 17:32 - 00012288 _____ C:\Users\Radek\Downloads\Grafik_Apteka (101287, Bytom, KOLEJOWA 18)_10.2013.xls
2013-10-12 14:44 - 2013-10-12 14:44 - 00001006 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-555651962-1182861564-167744798-1001Core1cec7512a34169b.job

==================== One Month Modified Files and Folders =======

2013-11-04 23:25 - 2013-11-04 23:25 - 00000000 ____D C:\FRST
2013-11-04 23:24 - 2013-11-04 22:49 - 00006235 _____ C:\Windows\WindowsUpdate.log
2013-11-04 23:22 - 2013-11-04 23:22 - 00000000 ____D C:\Users\Radek\AppData\Roaming\Process Hacker 2
2013-11-04 23:22 - 2012-01-03 14:55 - 00000000 ____D C:\Program Files\cFosSpeed
2013-11-04 23:15 - 2013-11-04 23:15 - 02697417 _____ C:\Users\Radek\Downloads\processhacker-2.32-bin.zip
2013-11-04 23:05 - 2013-11-04 23:05 - 00065232 _____ (Malwarebytes) C:\Users\Radek\Downloads\regassassin-setup-1.03.exe
2013-11-04 22:59 - 2009-07-14 05:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-04 22:59 - 2009-07-14 05:45 - 00017168 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-04 22:56 - 2009-07-14 18:55 - 00741290 _____ C:\Windows\system32\perfh015.dat
2013-11-04 22:56 - 2009-07-14 18:55 - 00155886 _____ C:\Windows\system32\perfc015.dat
2013-11-04 22:56 - 2009-07-14 06:13 - 01672096 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-04 22:52 - 2013-11-04 22:47 - 00000112 _____ C:\Windows\setupact.log
2013-11-04 22:52 - 2009-07-14 06:08 - 00032520 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-04 22:52 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-04 22:51 - 2011-09-30 19:09 - 00000000 ___HD C:\Users\Radek\AppData\Roaming\Free Download Manager
2013-11-04 22:47 - 2013-11-04 22:47 - 00000000 _____ C:\Windows\setuperr.log
2013-11-04 22:09 - 2013-09-01 19:37 - 00000000 ____D C:\ProgramData\Symantec
2013-11-04 19:30 - 2011-10-05 19:19 - 00000000 ___HD C:\Users\Radek\AppData\Roaming\uTorrent
2013-11-04 19:20 - 2013-11-04 19:20 - 00347304 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\MicrosoftFixit.wu.LB.34307014971165053.1.1.Run.exe
2013-11-04 19:20 - 2013-11-04 19:20 - 00162010 _____ C:\Users\Radek\Downloads\DIAG_MATS_NETWORK_global.DiagCab
2013-11-04 18:40 - 2013-11-04 18:29 - 947070088 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\windows6.1-KB976932-X64 (1).exe
2013-11-04 18:23 - 2013-11-04 18:19 - 247034857 _____ (Microsoft Corporation) C:\Users\Radek\Downloads\windows6.1-KB976932-X64.exe
2013-11-04 17:46 - 2013-11-04 17:44 - 167164267 _____ C:\Users\Radek\Downloads\Windows6.1-KB947821-v28-x86.msu
2013-11-04 15:50 - 2012-09-15 09:48 - 00002562 _____ C:\Windows\diagwrn.xml
2013-11-04 15:50 - 2012-09-15 09:48 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-04 15:49 - 2013-11-04 15:49 - 00006678 _____ C:\Users\Radek\Desktop\Raport zgodności z systemem Windows.htm
2013-11-04 15:49 - 2013-11-04 12:44 - 00000000 ____D C:\Users\Radek\Documents\Add-in Express
2013-11-04 12:50 - 2013-11-04 12:50 - 00000000 ____D C:\Users\Radek\AppData\Roaming\ImgBurn
2013-11-04 12:46 - 2013-11-04 12:46 - 00364318 _____ C:\Users\Radek\AppData\Local\foxtab_speeddial.crx
2013-11-04 12:46 - 2013-11-04 12:46 - 00032237 _____ C:\Users\Radek\Downloads\ImgBurn_2.5.7.0_pl(dobreprogramy.pl).zip
2013-11-04 12:46 - 2013-11-04 12:46 - 00000000 ____D C:\Users\Radek\AppData\Roaming\FoxTab
2013-11-04 12:46 - 2013-11-04 12:46 - 00000000 ____D C:\Program Files (x86)\Foxtab
2013-11-04 12:46 - 2012-12-18 11:00 - 00333824 ___SH C:\Users\Radek\Downloads\Thumbs.db
2013-11-04 12:44 - 2013-11-04 12:44 - 00001865 _____ C:\Users\Public\Desktop\ImgBurn.lnk
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Users\Radek\AppData\Roaming\OpenCandy
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\SqueakyChocolate
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\Smileys We Love Toolbar for IE
2013-11-04 12:44 - 2013-11-04 12:44 - 00000000 ____D C:\Program Files (x86)\ImgBurn
2013-11-03 23:26 - 2011-10-06 14:45 - 00000000 ____D C:\Program Files (x86)\The KMPlayer
2013-11-03 11:27 - 2012-02-24 08:37 - 00000000 ____D C:\ProgramData\OpenFM
2013-11-02 17:00 - 2013-11-02 17:00 - 00000000 ____D C:\Users\Radek\Documents\Pobieranie
2013-11-02 17:00 - 2013-10-27 20:52 - 00000000 ____D C:\Users\Radek\AppData\Roaming\qBittorrent
2013-11-02 13:30 - 2013-11-02 13:01 - 02578249 _____ C:\Users\Radek\Desktop\prezentacja inv analysis Echo Investment1.pptx
2013-11-02 13:19 - 2013-11-02 13:19 - 00009514 _____ C:\Users\Radek\Desktop\Wykres w programie Microsoft Office PowerPoint STUDIA.xlsx
2013-11-02 13:00 - 2013-11-01 16:30 - 02569286 _____ C:\Users\Radek\Desktop\prezentacja inv analysis Echo Investment.pptx
2013-11-01 15:23 - 2013-11-01 15:23 - 06975894 _____ C:\Users\Radek\Downloads\Echo Investment.pptx
2013-10-28 19:30 - 2013-10-28 19:30 - 00000000 ____D C:\DVR215D
2013-10-28 19:28 - 2013-10-28 19:28 - 00237568 _____ (TODO: <Company name>) C:\Users\Radek\Downloads\183982208DeviceInfo.exe
2013-10-28 18:36 - 2012-07-20 11:24 - 00000000 ___HD C:\Users\Radek\AppData\Roaming\Wise Care 365
2013-10-27 20:54 - 2011-09-30 20:15 - 00000000 ___HD C:\Users\Radek\Desktop\PROGRAMY
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Users\Radek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\qBittorrent
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Users\Radek\AppData\Local\qBittorrent
2013-10-27 20:52 - 2013-10-27 20:52 - 00000000 ____D C:\Program Files (x86)\qBittorrent
2013-10-24 21:55 - 2011-10-07 14:39 - 00000000 ____D C:\Program Files (x86)\Steam
2013-10-19 15:02 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-10-19 14:57 - 2013-10-19 14:57 - 00000220 _____ C:\Users\Radek\Desktop\Sid Meier's Civilization V.url
2013-10-18 23:54 - 2013-10-18 23:53 - 23473896 _____ (Acresso Software Inc.) C:\Users\Radek\Downloads\Assassins_Creed_III_DLC_1.exe
2013-10-17 22:53 - 2012-05-30 21:33 - 00000000 ____D C:\Program Files\HitmanPro
2013-10-17 22:43 - 2012-12-15 17:45 - 00000000 ____D C:\Program Files\SecurityKISS Tunnel
2013-10-16 21:21 - 2013-10-16 21:20 - 00020557 _____ C:\Users\Radek\Downloads\pobrane.htm
2013-10-16 15:38 - 2013-10-16 15:20 - 00000000 ____D C:\Users\Radek\Downloads\[FILEKING.PL] Auto Świat Katalog 02 2013
2013-10-16 15:26 - 2013-01-11 12:52 - 00000000 ____D C:\Users\Radek\Desktop\Nowy folder
2013-10-15 17:32 - 2013-10-15 17:32 - 00012288 _____ C:\Users\Radek\Downloads\Grafik_Apteka (101287, Bytom, KOLEJOWA 18)_10.2013.xls
2013-10-12 14:44 - 2013-10-12 14:44 - 00001006 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-555651962-1182861564-167744798-1001Core1cec7512a34169b.job
2013-10-10 16:30 - 2012-05-13 08:02 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-09 17:08 - 2012-05-13 08:02 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-10-09 17:08 - 2011-09-30 18:33 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Files to move or delete:
====================
C:\Users\Radek\AppData\Roaming\mBot.ini


Some content of TEMP:
====================
C:\Users\Radek\AppData\Local\Temp\KMP_3.7.0.113.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-01 19:19

==================== End Of Log ============================