Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-12-2013 02
Ran by Paul (administrator) on DEXTER on 16-12-2013 11:11:09
Running from H:\WindowsUpdate -rozwiazywanie problemow
Windows 7 Professional Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dassault Systèmes) C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(PTC) D:\Program Files (x86)\PTC\PTC Portmapper\i486_nt\obj\portmap.exe
(Acresso Software Inc.) C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Acresso Software Inc.) C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe
() C:\Program Files (x86)\UGS\UGSLicensing\ugslmd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dassault Systèmes SolidWorks Corp.) D:\Program Files\SolidWorks Corp\SolidWorks\sldworks_fs.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Robert Łajka & Pawel Porwisz) D:\Program Files (x86)\TC UP\TC UP.exe
(Ghisler Software GmbH) D:\Program Files (x86)\TC UP\TOTALCMD.EXE

==================== Registry (Whitelisted) ==================

HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
MountPoints2: {26ba5e13-03e4-11e1-bdab-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
MountPoints2: {a777a45f-f1a2-11df-9fd0-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
MountPoints2: {d5b0046e-464e-11df-bc4b-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
HKLM-x32\...\Run: [avgnt] - D:\Program Files\Avira\AntiVir Desktop\avgnt.exe [683576 2013-11-14] (Avira Operations GmbH & Co. KG)
BootExecute: 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: WebCGMHlprObj Class - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\Windows\SysWOW64\cgmopenbho.dll (CGM Open Consortium, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 95.160.170.92 88.156.222.92

FireFox:
========
FF ProfilePath: C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\F:\ Paul\Firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @ganymede/GanymedeNetPlugin,version=1.0 - d:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( )
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ptc.com/ProductViewLite - C:\Program Files (x86)\Common Files\PTC\np6_pvapplite9.dll (PTC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - D:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; D:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
S3 CoordinatorServiceHost; D:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [77352 2013-03-28] (Dassault Systèmes SolidWorks Corp.)
R2 DraftSight API Service; C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe [123392 2013-08-30] (Dassault Systèmes)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
S4 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [563424 2009-11-10] (MKS Software Inc.)
R2 PortmapperService; D:\Program Files (x86)\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [677376 2013-08-21] (PTC)
S4 RemoteSolverDispatcher; D:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe [218248 2013-02-22] (Mentor Graphics Corporation)
R2 UGS License Server (ugslmd); C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe [1510152 2009-07-07] (Acresso Software Inc.)

==================== Drivers (Whitelisted) ====================

S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [107416 2013-12-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132600 2013-11-14] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
S3 dgderdrv; No ImagePath
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-02-03] ()
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [30112 2013-03-27] (REALiX(tm))
S2 mcamvusb; C:\Windows\System32\DRIVERS\mcamvusb.sys [40960 2013-04-01] (Chingachguk & Denger2k)
S2 mcamvusb; C:\Windows\SysWow64\DRIVERS\mcamvusb.sys [41984 2013-06-26] (Chingachguk & Denger2k)
S3 mirrorv3; C:\Windows\System32\DRIVERS\rminiv3.sys [5632 2009-10-09] (Famatech International Corp.)
S3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
S4 PortTalk; C:\Windows\SysWow64\Drivers\PortTalk.sys [3567 2002-01-12] (Beyond Logic http://www.beyondlogic.org)
S4 Ser2pl; No ImagePath
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2011-01-24] ()
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [30312 2011-01-26] (CaptainFlint Software)
R0 vidsflt61; C:\Windows\System32\DRIVERS\vsflt61.sys [142944 2012-02-04] (Acronis)
U5 ET5Drv; C:\Windows\ET5Drv.sys [24896 2006-12-12] (Windows (R) Codename Longhorn DDK provider)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\rsit
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\Program Files\trend micro
2013-12-16 09:51 - 2013-12-16 09:51 - 00127771 ____C C:\Users\Paul\Desktop\hosts.txt
2013-12-16 09:50 - 2013-12-09 11:48 - 00166628 ____C C:\Windows\system32\Drivers\etc\hosts.bak
2013-12-12 23:53 - 2013-12-12 23:53 - 00000522 ____C C:\Windows\LsPlugin.ini
2013-12-12 20:14 - 2013-12-12 20:14 - 00000850 ____C C:\Users\Paul\Desktop\Auslogics DiskDefrag.lnk
2013-12-12 15:05 - 2013-12-12 15:05 - 00000000 ___DC C:\FRST
2013-12-12 13:57 - 2013-12-16 10:17 - 00000504 ____C C:\Windows\setupact.log
2013-12-12 13:57 - 2013-12-12 22:50 - 00001668 ____C C:\Windows\PFRO.log
2013-12-12 13:57 - 2013-12-12 13:57 - 00000000 ____C C:\Windows\setuperr.log
2013-12-10 12:37 - 2013-06-26 08:39 - 00041984 ____C (Chingachguk & Denger2k) C:\Windows\SysWOW64\Drivers\mcamvusb.sys
2013-12-10 09:52 - 2013-12-10 09:52 - 00000000 ___DC C:\ProgramData\SafeNet Sentinel
2013-12-10 09:30 - 2013-12-10 19:13 - 00000000 ___DC C:\Users\Public\Documents\SolidCAM
2013-12-06 21:09 - 2013-12-06 21:01 - 01110034 ____C C:\Users\Paul\Desktop\AdwCleaner.pl 3.014.exe

==================== One Month Modified Files and Folders =======

2013-12-16 10:30 - 2013-10-04 20:14 - 00001044 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-16 10:24 - 2009-07-14 05:45 - 00026400 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-16 10:24 - 2009-07-14 05:45 - 00026400 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-16 10:21 - 2009-07-14 18:55 - 10475014 ____C C:\Windows\system32\perfh015.dat
2013-12-16 10:21 - 2009-07-14 18:55 - 03487510 ____C C:\Windows\system32\perfc015.dat
2013-12-16 10:21 - 2009-07-14 06:13 - 00005752 ____C C:\Windows\system32\PerfStringBackup.INI
2013-12-16 10:18 - 2013-10-04 20:14 - 00001040 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-16 10:17 - 2013-12-12 13:57 - 00000504 ____C C:\Windows\setupact.log
2013-12-16 10:17 - 2013-06-24 17:26 - 08405015 ____C C:\Windows\TmpFile1
2013-12-16 10:17 - 2013-02-24 12:46 - 00000006 ___HC C:\Windows\Tasks\SA.DAT
2013-12-16 10:16 - 2013-03-25 14:01 - 02088534 ____C C:\Windows\WindowsUpdate.log
2013-12-16 09:57 - 2010-01-04 23:26 - 00000000 ___DC C:\Users\Paul
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\rsit
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\Program Files\trend micro
2013-12-16 09:51 - 2013-12-16 09:51 - 00127771 ____C C:\Users\Paul\Desktop\hosts.txt
2013-12-12 23:53 - 2013-12-12 23:53 - 00000522 ____C C:\Windows\LsPlugin.ini
2013-12-12 22:50 - 2013-12-12 13:57 - 00001668 ____C C:\Windows\PFRO.log
2013-12-12 20:25 - 2013-10-04 20:14 - 00004040 ____C C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-12 20:25 - 2013-10-04 20:14 - 00003788 ____C C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-12 20:14 - 2013-12-12 20:14 - 00000850 ____C C:\Users\Paul\Desktop\Auslogics DiskDefrag.lnk
2013-12-12 20:10 - 2013-03-25 14:18 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Wise Disk Cleaner
2013-12-12 15:05 - 2013-12-12 15:05 - 00000000 ___DC C:\FRST
2013-12-12 13:57 - 2013-12-12 13:57 - 00000000 ____C C:\Windows\setuperr.log
2013-12-12 13:57 - 2013-02-21 12:28 - 00000000 ___DC C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-12 13:33 - 2013-10-31 19:58 - 00000000 ___DC C:\ProgramData\Auslogics
2013-12-11 19:46 - 2009-07-14 04:20 - 00000000 ___DC C:\Windows\registration
2013-12-11 18:37 - 2013-06-05 19:55 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\SolidWorks
2013-12-11 10:15 - 2013-06-25 17:07 - 00000052 ____C C:\Windows\mwMSimApp.INI
2013-12-11 09:19 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-10 19:13 - 2013-12-10 09:30 - 00000000 ___DC C:\Users\Public\Documents\SolidCAM
2013-12-10 13:12 - 2013-06-25 16:30 - 00000000 ___DC C:\USB-Emul_Win64
2013-12-10 09:52 - 2013-12-10 09:52 - 00000000 ___DC C:\ProgramData\SafeNet Sentinel
2013-12-10 09:44 - 2009-07-14 05:45 - 05270088 ____C C:\Windows\system32\FNTCACHE.DAT
2013-12-10 09:32 - 2009-07-14 04:20 - 00000000 ___DC C:\Windows\system32\Setup
2013-12-10 09:30 - 2010-05-11 13:09 - 00000000 __HDC C:\Program Files (x86)\InstallShield Installation Information
2013-12-09 19:35 - 2013-02-14 19:12 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\uTorrent
2013-12-09 11:48 - 2013-12-16 09:50 - 00166628 ____C C:\Windows\system32\Drivers\etc\hosts.bak
2013-12-06 21:04 - 2013-10-02 19:04 - 00000000 ___DC C:\AdwCleaner
2013-12-06 21:01 - 2013-12-06 21:09 - 01110034 ____C C:\Users\Paul\Desktop\AdwCleaner.pl 3.014.exe
2013-12-06 09:27 - 2013-10-04 20:16 - 00002191 ____C C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-05 17:44 - 2013-03-27 23:52 - 00107416 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-30 20:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!


LastRegBack: 2013-12-12 14:27

==================== End Of Log ============================