Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 04-12-2013 01
Ran by Kacprut (administrator) on KACPRUT-DOM on 05-12-2013 16:20:23
Running from C:\Users\Kacprut\Desktop\Nowy folder (2)
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Polish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
() C:\Users\Kacprut\AppData\Roaming\Mozilla\Firefox\Profiles\l5z2wp99.default\extensions\startup.service@mozilla.com\svc.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Nalpeiron Ltd.) C:\Windows\System32\nlssrv32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(QFX Software Corporation) C:\Program Files\KeyScrambler\KeyScrambler.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Google) C:\Users\Kacprut\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Opera Software) C:\Program Files\Opera\18.0.1284.49\opera.exe
(Karol Winnicki) C:\Users\Kacprut\Desktop\BESTplayer.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10828392 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [KeyScrambler] - C:\Program Files\KeyScrambler\KeyScrambler.exe [431760 2012-06-08] (QFX Software Corporation)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [5110672 2013-09-12] (ESET)
HKLM\...\Run: [Ad Muncher] - C:\Program Files\Ad Muncher\AdMunch.exe [595144 2013-10-16] (Murray Hurps Software Pty Ltd)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKCU\...\Run: [F.lux] - C:\Users\Kacprut\AppData\Local\FluxSoftware\Flux\flux.exe [1016712 2013-10-16] (Flux Software LLC)
HKCU\...\Run: [PeerBlock] - C:\Program Files\PeerBlock\peerblock.exe [1866864 2010-11-06] (PeerBlock, LLC)
HKCU\...\Run: [uTorrent] - C:\Program Files\uTorrent\uTorrent.exe [289584 2012-02-26] (BitTorrent, Inc.)
MountPoints2: {4272db23-8711-11e0-99bf-001d7de805ac} - F:\Startme.exe
Startup: C:\Users\Kacprut\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk
ShortcutTarget: Stardock ObjectDock.lnk -> C:\Program Files\Stardock\ObjectDockPlus2\ObjectDock.exe (Stardock)

==================== Internet (Whitelisted) ====================

DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} http://quickscan.bitdefender.com/qsax/qsax.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
ShellExecuteHooks:  - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 62.179.1.62 62.179.1.63

========================== Services (Whitelisted) =================

R2 Diskeeper; C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe [2153808 2011-04-01] (Diskeeper Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1337752 2013-09-12] (ESET)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)

==================== Drivers (Whitelisted) ====================

R3 DKRtWrt; C:\Windows\System32\DRIVERS\DKRtWrt.sys [38608 2011-02-14] (Diskeeper Corporation)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [188808 2013-09-17] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [134248 2013-09-17] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [174400 2013-09-17] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [37416 2013-09-17] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [49240 2013-09-17] (ESET)
R3 KeyScrambler; C:\Windows\System32\drivers\keyscrambler.sys [173880 2011-12-15] (QFX Software Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-02-07] (Secunia)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation)
S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [104744 2009-03-25] (MCCI Corporation)
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-05 16:19 - 2013-12-05 16:20 - 00000000 ____D C:\Users\Kacprut\Desktop\Nowy folder (2)
2013-12-05 11:51 - 2013-12-05 11:52 - 00000000 ____D C:\FRST
2013-12-05 01:16 - 2013-12-05 01:16 - 00003397 _____ C:\Users\Kacprut\AppData\Local\recently-used.xbel
2013-12-03 21:22 - 2013-12-03 21:22 - 00000000 ____D C:\Users\Kacprut\Desktop\com.alk.copilot.eumarket.premiumeupan
2013-11-29 18:10 - 2013-12-05 09:05 - 00002768 _____ C:\Windows\setupact.log
2013-11-29 18:10 - 2013-11-29 18:10 - 03791696 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-29 18:10 - 2013-11-29 18:10 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 21:57 - 2013-11-27 21:57 - 00121120 _____ C:\Users\Kacprut\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-25 19:08 - 2013-11-25 19:08 - 00000000 ____D C:\Program Files\Foolish IT
2013-11-25 04:25 - 2013-11-26 02:52 - 00000000 ____D C:\Users\Kacprut\Desktop\Nowy folder
2013-11-14 19:38 - 2013-10-12 08:04 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 19:38 - 2013-10-12 08:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 19:38 - 2013-10-12 08:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 19:38 - 2013-10-12 08:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 19:38 - 2013-10-12 07:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 19:38 - 2013-10-12 06:15 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-14 19:35 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-14 19:35 - 2013-10-12 03:01 - 00679424 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-14 19:35 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-14 19:35 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-14 19:35 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-14 19:35 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-14 19:35 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-14 19:35 - 2013-10-03 02:58 - 00305152 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-14 19:35 - 2013-09-25 03:01 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-14 19:35 - 2013-09-25 03:01 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-14 19:35 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-14 19:35 - 2013-09-25 02:57 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-14 19:35 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-14 19:35 - 2013-09-25 02:56 - 01038848 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-14 19:35 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-14 19:35 - 2013-09-25 01:49 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-14 19:35 - 2013-09-25 01:49 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-14 19:35 - 2013-07-04 13:16 - 00369848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 20:48 - 2013-11-13 02:56 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\TeraCopy
2013-11-12 20:48 - 2013-11-12 20:48 - 00000000 ____D C:\Program Files\TeraCopy
2013-11-07 22:36 - 2013-11-07 22:36 - 48966155 _____ C:\Users\Kacprut\Downloads\Files_downloaded_by_AirDroid.zip

==================== One Month Modified Files and Folders =======

2013-12-05 16:20 - 2013-12-05 16:19 - 00000000 ____D C:\Users\Kacprut\Desktop\Nowy folder (2)
2013-12-05 16:19 - 2013-10-29 04:20 - 00000000 ____D C:\Users\Kacprut\Desktop\programy do logów
2013-12-05 11:52 - 2013-12-05 11:51 - 00000000 ____D C:\FRST
2013-12-05 11:52 - 2012-02-26 13:50 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\uTorrent
2013-12-05 09:53 - 2011-12-26 12:05 - 01942880 _____ C:\Windows\WindowsUpdate.log
2013-12-05 09:16 - 2011-05-08 02:37 - 00001496 _____ C:\Users\Kacprut\AppData\Local\Adobe Zapisz dla Internetu 12.0 Prefs
2013-12-05 09:13 - 2009-07-14 05:34 - 00021024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-05 09:13 - 2009-07-14 05:34 - 00021024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-05 09:05 - 2013-11-29 18:10 - 00002768 _____ C:\Windows\setupact.log
2013-12-05 09:05 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-05 01:16 - 2013-12-05 01:16 - 00003397 _____ C:\Users\Kacprut\AppData\Local\recently-used.xbel
2013-12-05 01:16 - 2013-08-05 01:15 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\inkscape
2013-12-04 02:12 - 2011-05-04 17:59 - 00000000 ____D C:\Program Files\PeerBlock
2013-12-03 21:22 - 2013-12-03 21:22 - 00000000 ____D C:\Users\Kacprut\Desktop\com.alk.copilot.eumarket.premiumeupan
2013-12-02 00:22 - 2011-06-28 22:19 - 03335684 _____ C:\Windows\system32\perfh019.dat
2013-12-02 00:22 - 2011-06-28 22:19 - 02670758 _____ C:\Windows\system32\perfc019.dat
2013-12-02 00:22 - 2011-05-04 09:41 - 00005462 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-02 00:22 - 2009-07-14 09:07 - 08424854 _____ C:\Windows\system32\perfh015.dat
2013-12-02 00:22 - 2009-07-14 09:07 - 02761960 _____ C:\Windows\system32\perfc015.dat
2013-11-29 18:10 - 2013-11-29 18:10 - 03791696 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-29 18:10 - 2013-11-29 18:10 - 00000000 _____ C:\Windows\setuperr.log
2013-11-27 21:57 - 2013-11-27 21:57 - 00121120 _____ C:\Users\Kacprut\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-27 21:54 - 2011-07-27 09:01 - 00000969 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-11-27 21:54 - 2011-05-04 11:12 - 00000000 ____D C:\Program Files\CCleaner
2013-11-27 19:17 - 2011-05-04 11:52 - 00000000 ____D C:\ProgramData\Adobe
2013-11-27 18:54 - 2013-10-28 13:03 - 00000000 ____D C:\Users\Kacprut\Doctor Web
2013-11-27 18:46 - 2011-05-04 12:36 - 00000000 ____D C:\ProgramData\Skype
2013-11-27 04:39 - 2011-07-22 14:41 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\vlc
2013-11-26 04:11 - 2011-05-04 10:30 - 00000000 ____D C:\Windows\Panther
2013-11-26 02:52 - 2013-11-25 04:25 - 00000000 ____D C:\Users\Kacprut\Desktop\Nowy folder
2013-11-25 19:08 - 2013-11-25 19:08 - 00000000 ____D C:\Program Files\Foolish IT
2013-11-23 12:53 - 2013-03-11 14:03 - 00000000 ____D C:\Program Files\Opera
2013-11-22 23:18 - 2011-08-02 01:39 - 00000000 ____D C:\Users\Kacprut\Documents\Pliki programu Outlook
2013-11-22 23:18 - 2011-05-08 13:05 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\TeamViewer
2013-11-21 04:59 - 2011-05-07 00:28 - 00000132 _____ C:\Users\Kacprut\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG
2013-11-16 22:36 - 2011-05-04 11:52 - 00000000 ____D C:\Users\Kacprut\AppData\Local\Adobe
2013-11-16 22:35 - 2012-04-08 11:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-11-16 22:35 - 2011-06-10 12:11 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-11-16 00:38 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-11-15 19:01 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\th-TH
2013-11-15 19:01 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-11-15 19:01 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\pl-PL
2013-11-15 01:57 - 2011-05-04 11:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 19:38 - 2013-08-02 01:25 - 00000000 ____D C:\Windows\system32\MRT
2013-11-14 19:32 - 2011-05-04 10:08 - 80340640 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 02:56 - 2013-11-12 20:48 - 00000000 ____D C:\Users\Kacprut\AppData\Roaming\TeraCopy
2013-11-12 20:48 - 2013-11-12 20:48 - 00000000 ____D C:\Program Files\TeraCopy
2013-11-07 22:36 - 2013-11-07 22:36 - 48966155 _____ C:\Users\Kacprut\Downloads\Files_downloaded_by_AirDroid.zip

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe
[2011-05-04 10:06] - [2011-05-04 11:48] - 2590720 ____A (Microsoft Corporation) ABED2CCF4E3614DB350253546C91896F

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-30 01:11

==================== End Of Log ============================