Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-01-2014
Ran by Paul (administrator) on DEXTER on 07-01-2014 20:05:43
Running from H:\WindowsUpdate -rozwiazywanie problemow
Windows 7 Professional Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Dassault Systèmes) C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(SafeNet Inc.) C:\Windows\System32\hasplms.exe
(PTC) D:\Program Files (x86)\PTC\PTC Portmapper\i486_nt\obj\portmap.exe
(Acresso Software Inc.) C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Acresso Software Inc.) C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe
() C:\Program Files (x86)\UGS\UGSLicensing\ugslmd.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) D:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dassault Systèmes SolidWorks Corp.) D:\Program Files\SolidWorks Corp\SolidWorks\sldworks_fs.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2wizard.exe
(Robert Łajka & Pawel Porwisz) D:\Program Files (x86)\TC UP\TC UP.exe
(Ghisler Software GmbH) D:\Program Files (x86)\TC UP\TOTALCMD.EXE
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(OldTimer Tools) H:\WindowsUpdate -rozwiazywanie problemow\OTL.scr
(Microsoft Corporation) C:\Windows\System32\wermgr.exe


==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avgnt] - D:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [emsisoft anti-malware] - C:\Program Files (x86)\Emsisoft Anti-Malware\a2guard.exe [4329408 2013-12-04] (Emsisoft GmbH)
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
MountPoints2: {26ba5e13-03e4-11e1-bdab-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
MountPoints2: {a777a45f-f1a2-11df-9fd0-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
MountPoints2: {d5b0046e-464e-11df-bc4b-001d7d00c3e5} - "I:\WD SmartWare.exe" autoplay=true
BootExecute: 

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = http://www.google.com/search?q={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: WebCGMHlprObj Class - {56B38F40-4E70-11d4-A076-0080AD86BA2F} - C:\Windows\SysWOW64\cgmopenbho.dll (CGM Open Consortium, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 95.160.170.92 88.156.222.92

FireFox:
========
FF ProfilePath: C:\Users\Paul\AppData\Roaming\Mozilla\Firefox\F:\ Paul\Firefox
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @ganymede/GanymedeNetPlugin,version=1.0 - d:\Program Files (x86)\Ganymede\Plugins\npganymedenet.dll ( )
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @ptc.com/ProductViewLite - C:\Program Files (x86)\Common Files\PTC\np6_pvapplite9.dll (PTC)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - D:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF StartMenuInternet: FIREFOX.EXE - d:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4161512 2013-12-04] (Emsisoft GmbH)
R2 AntiVirSchedulerService; D:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; D:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-14] (Avira Operations GmbH & Co. KG)
S3 CoordinatorServiceHost; D:\Program Files\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe [77352 2013-03-28] (Dassault Systèmes SolidWorks Corp.)
R2 DraftSight API Service; C:\Program Files\Dassault Systemes\DraftSight\bin\dsHttpApiService.exe [123392 2013-08-30] (Dassault Systèmes)
S2 e81a9dc1; C:\Windows\system32\rundll32.exe [45568 2009-07-14] (Microsoft Corporation)
S2 e81a9dc1; C:\Windows\SysWow64\rundll32.exe [44544 2009-07-14] (Microsoft Corporation)
R2 hasplms; C:\Windows\system32\hasplms.exe [4609928 2013-08-01] (SafeNet Inc.)
S4 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [563424 2009-11-10] (MKS Software Inc.)
R2 PortmapperService; D:\Program Files (x86)\PTC/PTC Portmapper/i486_nt/obj/portmap.exe [677376 2013-08-21] (PTC)
S4 RemoteSolverDispatcher; D:\Program Files\SolidWorks Corp\SolidWorks Flow Simulation\binCFW\remotesolverdispatcherservice.exe [218248 2013-02-22] (Mentor Graphics Corporation)
R2 UGS License Server (ugslmd); C:\Program Files (x86)\UGS\UGSLicensing\lmgrd.exe [1510152 2009-07-07] (Acresso Software Inc.)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [70960 2013-08-24] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [60488 2013-03-15] (SafeNet Inc.)
S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [303368 2013-03-15] (SafeNet Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-18] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 cleanhlp; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
S3 dgderdrv; No ImagePath
S4 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2012-02-03] ()
R2 hardlock; C:\Windows\system32\drivers\hardlock.sys [331328 2013-08-01] (SafeNet Inc.)
R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [30112 2013-03-27] (REALiX(tm))
S2 mcamvusb; C:\Windows\System32\DRIVERS\mcamvusb.sys [40960 2013-04-01] (Chingachguk & Denger2k)
S2 mcamvusb; C:\Windows\SysWow64\DRIVERS\mcamvusb.sys [41984 2013-06-26] (Chingachguk & Denger2k)
S3 mirrorv3; C:\Windows\System32\DRIVERS\rminiv3.sys [5632 2009-10-09] (Famatech International Corp.)
S3 Ph3xIB64; C:\Windows\System32\DRIVERS\Ph3xIB64.sys [1627520 2009-06-10] (NXP Semiconductors)
S4 PortTalk; C:\Windows\SysWow64\Drivers\PortTalk.sys [3567 2002-01-12] (Beyond Logic http://www.beyondlogic.org)
S4 Ser2pl; No ImagePath
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2011-01-24] (Duplex Secure Ltd.)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] ()
R1 VD_FileDisk; C:\Windows\System32\Drivers\VD_FileDisk.sys [30312 2011-01-26] (CaptainFlint Software)
R0 vidsflt61; C:\Windows\System32\DRIVERS\vsflt61.sys [142944 2012-02-04] (Acronis)
U5 ET5Drv; C:\Windows\ET5Drv.sys [24896 2006-12-12] (Windows (R) Codename Longhorn DDK provider)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys 797E1068EE061C5DEE668F0DC6B3C601
C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys D27A8B7BB0E15DFBFC6B4E774EE17AD9
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\System32\Drivers\adfs.sys 2F0683FD2DF1D92E891CACA14B45A8C1
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 314C17917AC8523EC77A710215012A65
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aksdf.sys 59069329A89025B01708F3DAF9929C58
C:\Windows\system32\drivers\aksfridge.sys 0EF3D7B35431030FFC85F7EF45A64E0C
C:\Windows\System32\DRIVERS\akshasp.sys 35E43EE8FE28CFD581E8CE42847DFE2B
C:\Windows\System32\DRIVERS\aksusb.sys A25C21F6C040832B016F592B50F0259F
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgntflt.sys 7806BFCD1D7FA5EC23F7324D4EAFD25B
C:\Windows\System32\DRIVERS\avipbb.sys C3A58DBD18786C338126D30BF8C33D72
C:\Windows\System32\DRIVERS\avkmgr.sys 390184FAD8FCC1B6DA25AEBAE928C3B6
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\cleanhlp64.sys B794DCF38C965FA2F93C45A7C3D582C5
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys AAFCB52FE0037207FB6FBEA070D25EFE
C:\Windows\system32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys 88612F1CE3BF42256913BF6E61C70D52
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fltsrv.sys E94E042BC24BB301767A8125D529B705
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\gdrv.sys 7907E14F9BCF3A4689C9A74A1A873CB6
C:\Windows\GVTDrv64.sys 8126331FBD4ED29EB3B356F9C905064D
C:\Windows\system32\drivers\hardlock.sys 445BA8C1553D4F3BDE84E80213BC17B5
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\system32\drivers\HWiNFO64A.SYS 51ACD072EC7863BFDE2B5B6A5383F945
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ivusb.sys BD5BF20EC242E003A2F570B8754A56D1
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 7EFB9333E4ECCE6AE4AE9D777D9E553E
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mcamvusb.sys 1A599E146AAA854F2916A97476BFE59F
C:\Windows\SysWow64\DRIVERS\mcamvusb.sys 4A8152DD2B0579BBB545FFDC9DE7FA81
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rminiv3.sys 090EE52AFDFF9932909C480BDDA0C8CE
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys 1A4F75E63C9FB84B85DFFC6B63FD5404
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nvlddmkm.sys 0A2F27B5BCC45B64E152DD6AE0815198
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\System32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Ph3xIB64.sys 1E81496AFF9D7FA2B4C4032B746DE5B9
C:\Windows\SysWow64\Drivers\PortTalk.sys 7D5A2D755B6C6579F63657B527D6FF1B
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt64win7.sys 7F4F11527AF5A7E4526CB6A146B3E40C
C:\Windows\System32\DRIVERS\RtNdPt60.sys 2B38C905492F36FE42B59DA52D6B4EB7
C:\Windows\System32\DRIVERS\RtTeam60.sys 8DF706A5A12A4832A3291A1FF26A7CC1
C:\Windows\System32\DRIVERS\RtVlan60.sys 8B6B42D782202363A562F82B0E13B1C0
C:\Windows\system32\drivers\vms3cap.sys ==> MD5 is legit
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\sptd.sys 34F974F8B3C86DE03A30DCBE79091C97
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\System32\DRIVERS\ss_bbus.sys EF806D212D34B0E173BAEB3564D53E37
C:\Windows\System32\DRIVERS\ss_bmdfl.sys 08B1B34ABEBEB6AC2DEA06900C56411E
C:\Windows\System32\DRIVERS\ss_bmdm.sys 71A9DA6BEAA4CB54DFB827FB78600A5D
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\drivers\vmstorfl.sys ==> MD5 is legit
C:\Windows\system32\drivers\storvsc.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\DRIVERS\tcpip.sys 40AF23633D197905F03AB5628C558C51
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RtTeam60.sys 8DF706A5A12A4832A3291A1FF26A7CC1
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\SysWow64\Drivers\TFsExDisk.sys 48D9D00C2E0E72C3D4F52772C80355F6
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys 17C6B51CBCCDED95B3CC14E22791F85E
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys ACCEA6BC68D0C9A78EB97EE159028B4E
C:\Windows\system32\drivers\usbcir.sys 80B0F7D5CCF86CEB5D402EAAF61FEC31
C:\Windows\System32\DRIVERS\usbehci.sys 311C1DD1088E55BEAE15954D17F50646
C:\Windows\System32\DRIVERS\usbhub.sys 280E90CBF4B2DDD169F0728CB44D726F
C:\Windows\System32\DRIVERS\usbohci.sys 9406D801042FAF859CF81B2C886413DC
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbscan.sys 9661DA76B4531B2DA272ECCE25A8AF24
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys A83D0EC9AE4C31704442099D40BA2471
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\Drivers\VD_FileDisk.sys 00CAFFC109C09D6F26425F5E0838495B
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vsflt61.sys 2DFD1EB9DE564460003DE1605A275E8D
C:\Windows\System32\drivers\vmbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\VMBusHID.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wdcsam64.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys E2C933EDBC389386EBE6D2BA953F43D8
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-07 18:59 - 2014-01-07 20:06 - 00000000 ___DC C:\Program Files (x86)\Emsisoft Anti-Malware
2014-01-07 18:59 - 2014-01-07 18:59 - 00001097 ____C C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-01-07 18:59 - 2014-01-07 18:59 - 00000000 ___DC C:\Users\Paul\Documents\Anti-Malware
2014-01-07 18:32 - 2014-01-07 18:32 - 00001636 ____C C:\Users\Paul\Desktop\JRT.txt
2014-01-07 18:25 - 2014-01-07 18:25 - 00000000 ___DC C:\Windows\ERUNT
2014-01-06 22:22 - 2014-01-06 22:24 - 00004512 ____C C:\Users\Paul\Desktop\Rkill.txt
2014-01-06 22:10 - 2014-01-06 22:10 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Malwarebytes
2014-01-06 22:10 - 2014-01-06 22:10 - 00000000 ___DC C:\ProgramData\Malwarebytes
2014-01-06 22:10 - 2013-04-04 14:50 - 00025928 ____C (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-06 13:56 - 2014-01-06 13:56 - 00003656 ____N C:\bootsqm.dat
2014-01-04 20:18 - 2014-01-04 20:17 - 01233962 ____C C:\Users\Paul\Desktop\AdwCleaner.exe
2014-01-04 20:10 - 2014-01-04 20:10 - 00000000 ___DC C:\ProgramData\SoftWarehouse
2014-01-04 20:08 - 2014-01-04 20:10 - 00000000 ___DC C:\ProgramData\InstallMate
2014-01-01 23:06 - 2014-01-01 23:06 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\e-Deklaracje
2013-12-29 12:59 - 2013-12-29 12:59 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\f-secure
2013-12-29 12:58 - 2013-12-29 12:59 - 00000000 ___DC C:\ProgramData\F-Secure
2013-12-29 12:52 - 2013-12-29 12:52 - 00000000 ___DC C:\Program Files (x86)\Secunia
2013-12-28 18:55 - 2013-12-28 18:55 - 00178953 ____C C:\Users\Paul\Desktop\Proj1.zip
2013-12-28 18:51 - 2013-12-28 18:51 - 00008428 ____C C:\Users\Paul\Desktop\Nowy OpenDocument Rysunek.odg
2013-12-28 13:55 - 2013-12-28 13:56 - 00017062 ____C C:\Windows\DirectX.log
2013-12-17 19:00 - 2013-12-17 12:39 - 00001527 ____C C:\Users\Paul\Documents\indexfile.txt
2013-12-16 11:25 - 2013-12-16 11:25 - 00000061 ____C C:\Users\Paul\Desktop\httpwww.sendspace.plfiledelete51d87d00dc8ac64acb7d41e
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\rsit
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\Program Files\trend micro
2013-12-16 09:50 - 2013-12-09 11:48 - 00166628 ____C C:\Windows\system32\Drivers\etc\hosts.bak
2013-12-12 23:53 - 2013-12-12 23:53 - 00000522 ____C C:\Windows\LsPlugin.ini
2013-12-12 15:05 - 2013-12-12 15:05 - 00000000 ___DC C:\FRST
2013-12-12 13:57 - 2014-01-07 18:28 - 00004428 ____C C:\Windows\setupact.log
2013-12-12 13:57 - 2014-01-06 12:54 - 00003872 ____C C:\Windows\PFRO.log
2013-12-12 13:57 - 2013-12-12 13:57 - 00000000 ____C C:\Windows\setuperr.log
2013-12-10 12:37 - 2013-06-26 08:39 - 00041984 ____C (Chingachguk & Denger2k) C:\Windows\SysWOW64\Drivers\mcamvusb.sys
2013-12-10 09:52 - 2013-12-10 09:52 - 00000000 ___DC C:\ProgramData\SafeNet Sentinel
2013-12-10 09:30 - 2013-12-10 19:13 - 00000000 ___DC C:\Users\Public\Documents\SolidCAM

==================== One Month Modified Files and Folders =======

2014-01-07 20:06 - 2014-01-07 18:59 - 00000000 ___DC C:\Program Files (x86)\Emsisoft Anti-Malware
2014-01-07 20:05 - 2013-03-25 14:01 - 02034588 ____C C:\Windows\WindowsUpdate.log
2014-01-07 19:30 - 2013-10-04 20:14 - 00001044 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-07 18:59 - 2014-01-07 18:59 - 00001097 ____C C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-01-07 18:59 - 2014-01-07 18:59 - 00000000 ___DC C:\Users\Paul\Documents\Anti-Malware
2014-01-07 18:36 - 2009-07-14 05:45 - 00026400 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-07 18:36 - 2009-07-14 05:45 - 00026400 ___HC C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-07 18:34 - 2009-07-14 18:55 - 11241540 ____C C:\Windows\system32\perfh015.dat
2014-01-07 18:34 - 2009-07-14 18:55 - 03754080 ____C C:\Windows\system32\perfc015.dat
2014-01-07 18:34 - 2009-07-14 06:13 - 00005752 ____C C:\Windows\system32\PerfStringBackup.INI
2014-01-07 18:32 - 2014-01-07 18:32 - 00001636 ____C C:\Users\Paul\Desktop\JRT.txt
2014-01-07 18:29 - 2013-10-04 20:14 - 00001040 ____C C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-07 18:28 - 2013-12-12 13:57 - 00004428 ____C C:\Windows\setupact.log
2014-01-07 18:28 - 2013-06-24 17:26 - 08405015 ____C C:\Windows\TmpFile1
2014-01-07 18:28 - 2013-02-24 12:46 - 00000006 ___HC C:\Windows\Tasks\SA.DAT
2014-01-07 18:25 - 2014-01-07 18:25 - 00000000 ___DC C:\Windows\ERUNT
2014-01-06 22:24 - 2014-01-06 22:22 - 00004512 ____C C:\Users\Paul\Desktop\Rkill.txt
2014-01-06 22:10 - 2014-01-06 22:10 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Malwarebytes
2014-01-06 22:10 - 2014-01-06 22:10 - 00000000 ___DC C:\ProgramData\Malwarebytes
2014-01-06 14:01 - 2013-03-25 14:18 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Wise Disk Cleaner
2014-01-06 13:56 - 2014-01-06 13:56 - 00003656 ____N C:\bootsqm.dat
2014-01-06 12:54 - 2013-12-12 13:57 - 00003872 ____C C:\Windows\PFRO.log
2014-01-06 12:35 - 2010-08-07 15:24 - 00000000 ___DC C:\Windows\Minidump
2014-01-05 20:06 - 2013-06-05 19:55 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\SolidWorks
2014-01-04 20:19 - 2013-10-02 19:04 - 00000000 ___DC C:\AdwCleaner
2014-01-04 20:17 - 2014-01-04 20:18 - 01233962 ____C C:\Users\Paul\Desktop\AdwCleaner.exe
2014-01-04 20:10 - 2014-01-04 20:10 - 00000000 ___DC C:\ProgramData\SoftWarehouse
2014-01-04 20:10 - 2014-01-04 20:08 - 00000000 ___DC C:\ProgramData\InstallMate
2014-01-04 19:35 - 2013-10-17 15:38 - 00620504 ____C (SpeedyFox) C:\Users\Paul\Desktop\speedyfox.exe
2014-01-02 21:45 - 2010-08-30 17:46 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Notepad++
2014-01-01 23:06 - 2014-01-01 23:06 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\e-Deklaracje
2014-01-01 23:06 - 2013-04-04 15:07 - 00000676 ____C C:\Users\Public\Desktop\e-Deklaracje.lnk
2013-12-29 21:41 - 2013-09-17 09:30 - 00002761 ____C C:\Users\Public\Desktop\DraftSight x64.lnk
2013-12-29 12:59 - 2013-12-29 12:59 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\f-secure
2013-12-29 12:59 - 2013-12-29 12:58 - 00000000 ___DC C:\ProgramData\F-Secure
2013-12-29 12:52 - 2013-12-29 12:52 - 00000000 ___DC C:\Program Files (x86)\Secunia
2013-12-28 18:55 - 2013-12-28 18:55 - 00178953 ____C C:\Users\Paul\Desktop\Proj1.zip
2013-12-28 18:51 - 2013-12-28 18:51 - 00008428 ____C C:\Users\Paul\Desktop\Nowy OpenDocument Rysunek.odg
2013-12-28 13:56 - 2013-12-28 13:55 - 00017062 ____C C:\Windows\DirectX.log
2013-12-26 10:45 - 2013-06-25 17:07 - 00000103 ____C C:\Windows\mwMSimApp.INI
2013-12-26 10:00 - 2009-07-14 04:20 - 00000000 ___DC C:\Windows\registration
2013-12-21 13:01 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-18 15:24 - 2013-05-08 12:20 - 00084720 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-12-18 15:24 - 2013-03-27 23:52 - 00131576 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-12-18 15:24 - 2013-03-27 23:52 - 00108440 ____C (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-12-17 18:47 - 2010-01-05 00:02 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\Mozilla
2013-12-17 18:08 - 2009-07-14 04:20 - 00000000 ___DC C:\Windows\system32\NDF
2013-12-17 13:30 - 2010-05-06 19:44 - 00000000 ____D C:\Users\Ola\AppData\Roaming\Mozilla
2013-12-17 12:39 - 2013-12-17 19:00 - 00001527 ____C C:\Users\Paul\Documents\indexfile.txt
2013-12-16 18:31 - 2012-05-20 12:21 - 00000000 ___DC C:\Program Files (x86)\Google
2013-12-16 18:14 - 2013-02-21 12:28 - 00000000 ___DC C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-16 11:25 - 2013-12-16 11:25 - 00000061 ____C C:\Users\Paul\Desktop\httpwww.sendspace.plfiledelete51d87d00dc8ac64acb7d41e
2013-12-16 09:57 - 2010-01-04 23:26 - 00000000 ___DC C:\Users\Paul
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\rsit
2013-12-16 09:56 - 2013-12-16 09:56 - 00000000 ___DC C:\Program Files\trend micro
2013-12-12 23:53 - 2013-12-12 23:53 - 00000522 ____C C:\Windows\LsPlugin.ini
2013-12-12 20:25 - 2013-10-04 20:14 - 00004040 ____C C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-12 20:25 - 2013-10-04 20:14 - 00003788 ____C C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-12 15:05 - 2013-12-12 15:05 - 00000000 ___DC C:\FRST
2013-12-12 13:57 - 2013-12-12 13:57 - 00000000 ____C C:\Windows\setuperr.log
2013-12-12 13:56 - 2013-02-21 00:24 - 00000000 ___DC C:\Windows\SysWOW64\catroot2.bak
2013-12-12 13:33 - 2013-10-31 19:58 - 00000000 ___DC C:\ProgramData\Auslogics
2013-12-11 09:19 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-10 19:13 - 2013-12-10 09:30 - 00000000 ___DC C:\Users\Public\Documents\SolidCAM
2013-12-10 13:12 - 2013-06-25 16:30 - 00000000 ___DC C:\USB-Emul_Win64
2013-12-10 09:52 - 2013-12-10 09:52 - 00000000 ___DC C:\ProgramData\SafeNet Sentinel
2013-12-10 09:44 - 2009-07-14 05:45 - 05270088 ____C C:\Windows\system32\FNTCACHE.DAT
2013-12-10 09:32 - 2009-07-14 04:20 - 00000000 ___DC C:\Windows\system32\Setup
2013-12-10 09:30 - 2010-05-11 13:09 - 00000000 __HDC C:\Program Files (x86)\InstallShield Installation Information
2013-12-09 19:35 - 2013-02-14 19:12 - 00000000 ___DC C:\Users\Paul\AppData\Roaming\uTorrent
2013-12-09 11:48 - 2013-12-16 09:50 - 00166628 ____C C:\Windows\system32\Drivers\etc\hosts.bak
2013-12-09 11:48 - 2013-02-12 10:04 - 00166628 ____C C:\Windows\system32\Drivers\etc\hostsOLD

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


testsigning: ==> Check for possible unsigned rootkit driver <===== ATTENTION!

==================== BCD ================================

Menedľer rozruchu systemu Windows
---------------------------------
Identyfikator              {bootmgr}
device                  partition=C:
description             Windows Boot Manager
locale                  pl-PL
inherit                 {globalsettings}
default                 {current}
resumeobject            {d86ec2ed-f97e-11de-ba37-d873baba18a5}
displayorder            {current}
toolsdisplayorder       {memdiag}
timeout                 2

Moduˆ ˆadujĄcy rozruchu systemu Windows
---------------------------------------
Identyfikator              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  pl-PL
inherit                 {bootloadersettings}
recoverysequence        {d86ec2ef-f97e-11de-ba37-d873baba18a5}
recoveryenabled         Yes
testsigning             Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {d86ec2ed-f97e-11de-ba37-d873baba18a5}
nx                      OptOut
sos                     No

Moduˆ ˆadujĄcy rozruchu systemu Windows
---------------------------------------
Identyfikator              {d86ec2ef-f97e-11de-ba37-d873baba18a5}
device                  ramdisk=[C:]\Recovery\d86ec2ef-f97e-11de-ba37-d873baba18a5\Winre.wim,{d86ec2f0-f97e-11de-ba37-d873baba18a5}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\d86ec2ef-f97e-11de-ba37-d873baba18a5\Winre.wim,{d86ec2f0-f97e-11de-ba37-d873baba18a5}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wznawianie ze stanu hibernacji
------------------------------
Identyfikator              {d86ec2ed-f97e-11de-ba37-d873baba18a5}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  pl-PL
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Moduˆ testujĄcy pami©† systemu Windows
--------------------------------------
Identyfikator              {memdiag}
device                  partition=C:
path                    \boot\memtest.exe
description             Diagnostyka pami©ci systemu Windows
locale                  pl-PL
inherit                 {globalsettings}
badmemoryaccess         Yes

Ustawienia usˆug EMS
--------------------
Identyfikator              {emssettings}
bootems                 Yes

Ustawienia debugera
-------------------
Identyfikator              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

Uszkodzenia pami©ci RAM
-----------------------
Identyfikator              {badmemory}

Ustawienia globalne
-------------------
Identyfikator              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Ustawienia moduˆu ˆadujĄcego rozruchu
-------------------------------------
Identyfikator              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Ustawienia funkcji hypervisor
-----------------------------
Identyfikator              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Ustawienia moduˆu ˆadujĄcego wznawiania
---------------------------------------
Identyfikator              {resumeloadersettings}
inherit                 {globalsettings}

Opcje urzĄdzenia
----------------
Identyfikator              {d86ec2f0-f97e-11de-ba37-d873baba18a5}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\d86ec2ef-f97e-11de-ba37-d873baba18a5\boot.sdi



LastRegBack: 2014-01-02 20:34

==================== End Of Log ============================