Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014 04 Ran by Misiołek (administrator) on POLYNESIANDREAM on 20-01-2014 20:22:30 Running from C:\Users\Misiołek\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.exe () C:\Program Files\Orange\CMSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (ASUS) C:\Program Files\P4G\BatteryLife.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (The Eraser Project) C:\Program Files\Eraser\Eraser.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1111568 2011-10-08] (Trend Micro Inc.) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-03-20] (Realtek Semiconductor) HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [197152 2011-02-10] (Trend Micro Inc.) HKLM\...\Run: [COMODO Internet Security] - C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1612504 2013-11-11] (COMODO) HKLM\...\Run: [Eraser] - C:\Program Files\Eraser\Eraser.exe [980920 2012-05-22] (The Eraser Project) HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.) HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.) HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS) HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [Nowe Gadu-Gadu] - C:\Program Files (x86)\Nowe Gadu-Gadu\gg.exe [11391592 2009-08-31] (GG Network S.A.) HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe HKCU\...\Runonce: [Uninstall C:\Users\Misiołek\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] - C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Misiołek\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64" MountPoints2: {2bb56e03-7b3d-11e2-8e8f-bcaec561c7b0} - F:\instr.bat MountPoints2: {38b852bf-6cd0-11e3-964a-bcaec561c7b0} - F:\Launcher.exe MountPoints2: {577b0b3b-6338-11e2-87d7-bcaec561c7b0} - F:\Startme.exe AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [226920 2011-03-20] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [192616 2011-03-20] (NVIDIA Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.pl/ SearchScopes: HKLM-x32 - {5BE1EB9D-1AC7-41E4-B502-0DE31371EB24} URL = http://u-search.net/?a=1&e=1&q={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.) BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe64.dll (Trend Micro Inc.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: PrivDog Extension - {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.18\trustedads.dll No File BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg32.dll (Trend Micro Inc.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.) BHO-x32: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.) BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: IEPluginBHO Class - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Users\Misiołek\AppData\Roaming\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe64.dll (Trend Micro Inc.) Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg.dll (Trend Micro Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\6.6.1010\6.6.1010\TmBpIe32.dll (Trend Micro Inc.) Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\TmIEPlg32.dll (Trend Micro Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Misiołek\AppData\Roaming\Mozilla\Firefox\Profiles\w0xgcm3r.default-1389976053230 FF Homepage: google.pl FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20004\1.5.1505\6.6.1088\firefoxextension\ [] Chrome: ======= CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll () CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Java(TM) Platform SE 7 U45) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () CHR Plugin: (iTunes Application Detector) - D:\iTunes\Mozilla Plugins\npitunes.dll () CHR Extension: (Dokumenty Google) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-20] CHR Extension: (Dysk Google) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-01-20] CHR Extension: (YouTube) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-01-20] CHR Extension: (Szukaj w Google) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-01-20] CHR Extension: (Google Wallet) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-20] CHR Extension: (Gmail) - C:\Users\Misiołek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-20] CHR HKLM-x32\...\Chrome\Extension: [cmaiofennmphjldldcpphcechfnnohja] - C:\Program Files (x86)\AdTrustMedia\PrivDog\PrivDog_chrome.crx [2013-01-20] ==================== Services (Whitelisted) ================= R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [6254152 2013-10-20] (COMODO) S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [164056 2013-09-24] (COMODO) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 Wireless modem support.; C:\Program Files\Orange\CMSrv.exe [79360 2011-08-26] () R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 [x] ==================== Drivers (Whitelisted) ==================== S3 adusbnet; C:\Windows\System32\DRIVERS\adusbnet.sys [154112 2010-12-20] (QUALCOMM Incorporated) S3 adusbser; C:\Windows\System32\DRIVERS\adusbser.sys [123392 2010-12-20] (QUALCOMM Incorporated) R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [23168 2013-09-24] (COMODO) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [709144 2013-11-14] (COMODO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2009-11-19] (MCCI Corporation) S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2009-11-19] (MCCI Corporation) S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2009-11-19] (MCCI Corporation) S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2009-11-19] (MCCI Corporation) S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2009-11-19] (MCCI Corporation) S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2009-11-19] (MCCI Corporation) S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2009-11-19] (MCCI Corporation) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R2 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [90704 2010-09-17] (Trend Micro Inc.) R2 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [144464 2010-09-17] (Trend Micro Inc.) R2 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [67664 2010-09-17] (Trend Micro Inc.) R1 tmlwf; C:\Windows\System32\DRIVERS\tmlwf.sys [194640 2010-09-17] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105552 2010-09-17] (Trend Micro Inc.) R2 tmwfp; C:\Windows\System32\DRIVERS\tmwfp.sys [339536 2010-09-17] (Trend Micro Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-20 20:22 - 2014-01-20 20:22 - 00017300 _____ C:\Users\Misiołek\Desktop\FRST.txt 2014-01-20 20:20 - 2014-01-20 20:22 - 00000000 ____D C:\Users\Misiołek\Desktop\FRST-OlderVersion 2014-01-20 20:03 - 2014-01-20 20:03 - 00000085 _____ C:\Windows\wininit.ini 2014-01-20 19:59 - 2014-01-20 19:59 - 00000628 _____ C:\Users\Misiołek\Desktop\JRT.txt 2014-01-20 19:31 - 2014-01-20 19:31 - 00448512 _____ (OldTimer Tools) C:\Users\Misiołek\Downloads\TFC.exe 2014-01-20 19:12 - 2014-01-20 19:12 - 02076672 _____ (Farbar) C:\Users\Misiołek\Desktop\moon.exe 2014-01-20 18:57 - 2014-01-20 18:57 - 01037068 _____ (Thisisu) C:\Users\Misiołek\Downloads\JRT.exe 2014-01-20 18:55 - 2014-01-20 18:55 - 00000000 ____D C:\Users\Misiołek\Downloads\FRST-OlderVersion 2014-01-20 14:42 - 2014-01-20 14:42 - 00024878 _____ C:\Windows\DPINST.LOG 2014-01-20 14:42 - 2014-01-20 14:42 - 00000774 _____ C:\Users\Public\Desktop\Orange - Anydata ADU890-W.lnk 2014-01-20 14:41 - 2014-01-20 14:42 - 00000000 ____D C:\Windows\TEMPDIR 2014-01-20 14:40 - 2014-01-20 14:52 - 00000000 ____D C:\Users\Misiołek\AppData\Local\Orange 2014-01-20 01:46 - 2014-01-20 01:46 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2014-01-20 01:46 - 2014-01-20 01:46 - 00000000 ____D C:\Program Files (x86)\Trend Micro 2014-01-20 01:44 - 2014-01-20 01:44 - 01402880 _____ C:\Users\Misiołek\Downloads\HiJackThis.msi 2014-01-20 01:15 - 2014-01-20 01:15 - 03809280 _____ C:\Users\Misiołek\Downloads\RogueKiller.exe 2014-01-20 01:08 - 2014-01-20 01:08 - 01830768 _____ (SurfRight B.V.) C:\Users\Misiołek\Downloads\hmpalert.exe 2014-01-20 01:03 - 2014-01-20 01:03 - 10264904 _____ (SurfRight B.V.) C:\Users\Misiołek\Downloads\hitmanpro_x64.exe 2014-01-20 00:48 - 2014-01-20 00:48 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Misiołek\Downloads\tdsskiller.exe 2014-01-20 00:36 - 2014-01-20 12:28 - 00000000 ____D C:\Users\Misiołek\Desktop\trash 2014-01-19 23:09 - 2014-01-19 23:09 - 00000000 ____D C:\Users\Misiołek\AppData\Local\Eraser 6 2014-01-19 23:07 - 2014-01-19 23:07 - 00000000 ____D C:\Program Files\Eraser 2014-01-19 21:42 - 2014-01-19 21:43 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Misiołek\Downloads\rkill.com 2014-01-19 19:56 - 2014-01-19 19:56 - 00033719 _____ C:\Users\Misiołek\Downloads\FRST.txt 2014-01-19 19:56 - 2014-01-19 19:56 - 00030882 _____ C:\Users\Misiołek\Downloads\Addition.txt 2014-01-19 18:26 - 2014-01-19 18:26 - 00656338 _____ C:\Users\Misiołek\Downloads\gmer.txt 2014-01-19 17:41 - 2014-01-19 17:42 - 00379904 _____ C:\Users\Misiołek\Downloads\u9x0060s.exe 2014-01-19 17:24 - 2014-01-19 17:24 - 00110032 _____ C:\Users\Misiołek\Downloads\OTL.Txt 2014-01-19 17:24 - 2014-01-19 17:24 - 00082058 _____ C:\Users\Misiołek\Downloads\Extras.Txt 2014-01-19 17:00 - 2014-01-20 20:22 - 02076672 _____ (Farbar) C:\Users\Misiołek\Desktop\FRST64.exe 2014-01-19 16:29 - 2014-01-20 20:04 - 00006912 _____ C:\Windows\PFRO.log 2014-01-19 15:50 - 2014-01-19 15:50 - 00602112 _____ (OldTimer Tools) C:\Users\Misiołek\Downloads\OTL.exe 2014-01-19 15:41 - 2014-01-20 20:22 - 00000000 ____D C:\FRST 2014-01-19 15:40 - 2014-01-20 18:55 - 02076672 _____ (Farbar) C:\Users\Misiołek\Downloads\fin.exe 2014-01-19 02:00 - 2014-01-20 20:04 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-01-19 02:00 - 2014-01-19 02:00 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2014-01-19 01:46 - 2014-01-19 14:34 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2014-01-19 01:00 - 2014-01-20 20:07 - 00001064 _____ C:\Windows\setupact.log 2014-01-19 01:00 - 2014-01-19 01:00 - 00000000 _____ C:\Windows\setuperr.log 2014-01-17 12:26 - 2014-01-17 12:26 - 00016407 _____ C:\Users\Misiołek\Downloads\wieszykii.txt 2014-01-16 23:31 - 2014-01-17 14:57 - 04406784 _____ C:\Users\Misiołek\Downloads\RogueKillerX64.exe 2014-01-15 11:08 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 11:08 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 11:08 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 11:08 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-11 22:37 - 2014-01-11 22:37 - 00000000 ____D C:\Program Files (x86)\ESET 2014-01-11 21:37 - 2014-01-11 21:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-11 21:17 - 2014-01-11 21:17 - 00000000 ____D C:\Program Files\HitmanPro 2014-01-11 21:16 - 2014-01-11 21:23 - 00000000 ____D C:\ProgramData\HitmanPro 2014-01-01 16:24 - 2014-01-01 16:24 - 00000000 ____D C:\Users\Misiołek\Downloads\RichardLawther-UB4 2014-01-01 16:21 - 2014-01-01 16:23 - 175548870 _____ C:\Users\Misiołek\Downloads\RichardLawther-UB4.zip 2013-12-30 23:17 - 2013-12-30 23:17 - 00000000 ____D C:\Users\Misiołek\Documents\GTA San Andreas User Files - Kopia 2013-12-27 21:45 - 2013-12-27 21:45 - 00000000 ____D C:\ProgramData\Auslogics 2013-12-27 21:45 - 2013-12-27 21:45 - 00000000 ____D C:\Program Files (x86)\Auslogics 2013-12-24 20:28 - 2014-01-20 14:42 - 00000000 ____D C:\Program Files\Orange 2013-12-24 20:28 - 2013-12-24 20:28 - 00000000 ____D C:\Program Files\DIFX 2013-12-24 20:28 - 2010-12-20 14:04 - 00154112 _____ (QUALCOMM Incorporated) C:\Windows\system32\Drivers\adusbnet.sys 2013-12-24 20:28 - 2010-12-20 14:03 - 00123392 _____ (QUALCOMM Incorporated) C:\Windows\system32\Drivers\adusbser.sys ==================== One Month Modified Files and Folders ======= 2014-01-20 20:24 - 2014-01-20 20:22 - 00017300 _____ C:\Users\Misiołek\Desktop\FRST.txt 2014-01-20 20:22 - 2014-01-20 20:20 - 00000000 ____D C:\Users\Misiołek\Desktop\FRST-OlderVersion 2014-01-20 20:22 - 2014-01-19 17:00 - 02076672 _____ (Farbar) C:\Users\Misiołek\Desktop\FRST64.exe 2014-01-20 20:22 - 2014-01-19 15:41 - 00000000 ____D C:\FRST 2014-01-20 20:21 - 2011-03-20 09:25 - 00001062 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-20 20:17 - 2013-12-16 10:15 - 01474832 _____ C:\Windows\system32\Drivers\sfi.dat 2014-01-20 20:16 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-20 20:16 - 2009-07-14 05:45 - 00010240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-20 20:08 - 2013-01-20 15:43 - 00058288 _____ (Absolute Software Corp.) C:\Windows\SysWOW64\rpcnet.dll 2014-01-20 20:08 - 2011-03-20 10:38 - 00045056 _____ C:\Windows\system32\acovcnt.exe 2014-01-20 20:08 - 2011-03-20 09:25 - 00001058 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-20 20:08 - 2011-03-20 08:35 - 00017920 _____ C:\Windows\system32\rpcnetp.exe 2014-01-20 20:08 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-20 20:07 - 2014-01-19 01:00 - 00001064 _____ C:\Windows\setupact.log 2014-01-20 20:04 - 2014-01-19 16:29 - 00006912 _____ C:\Windows\PFRO.log 2014-01-20 20:04 - 2014-01-19 02:00 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2 2014-01-20 20:03 - 2014-01-20 20:03 - 00000085 _____ C:\Windows\wininit.ini 2014-01-20 20:03 - 2011-03-20 08:40 - 01719367 _____ C:\Windows\WindowsUpdate.log 2014-01-20 19:59 - 2014-01-20 19:59 - 00000628 _____ C:\Users\Misiołek\Desktop\JRT.txt 2014-01-20 19:31 - 2014-01-20 19:31 - 00448512 _____ (OldTimer Tools) C:\Users\Misiołek\Downloads\TFC.exe 2014-01-20 19:27 - 2013-02-11 13:09 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-20 19:12 - 2014-01-20 19:12 - 02076672 _____ (Farbar) C:\Users\Misiołek\Desktop\moon.exe 2014-01-20 18:57 - 2014-01-20 18:57 - 01037068 _____ (Thisisu) C:\Users\Misiołek\Downloads\JRT.exe 2014-01-20 18:55 - 2014-01-20 18:55 - 00000000 ____D C:\Users\Misiołek\Downloads\FRST-OlderVersion 2014-01-20 18:55 - 2014-01-19 15:40 - 02076672 _____ (Farbar) C:\Users\Misiołek\Downloads\fin.exe 2014-01-20 18:50 - 2013-06-09 20:15 - 00000000 ____D C:\Users\Misiołek\AppData\Local\Adobe 2014-01-20 18:42 - 2013-02-11 13:09 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-01-20 18:41 - 2013-01-20 22:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-01-20 18:41 - 2013-01-20 22:39 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-20 14:54 - 2009-08-03 20:55 - 00709558 _____ C:\Windows\system32\perfh015.dat 2014-01-20 14:54 - 2009-08-03 20:55 - 00138976 _____ C:\Windows\system32\perfc015.dat 2014-01-20 14:54 - 2009-07-14 06:13 - 01580896 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-20 14:52 - 2014-01-20 14:40 - 00000000 ____D C:\Users\Misiołek\AppData\Local\Orange 2014-01-20 14:42 - 2014-01-20 14:42 - 00024878 _____ C:\Windows\DPINST.LOG 2014-01-20 14:42 - 2014-01-20 14:42 - 00000774 _____ C:\Users\Public\Desktop\Orange - Anydata ADU890-W.lnk 2014-01-20 14:42 - 2014-01-20 14:41 - 00000000 ____D C:\Windows\TEMPDIR 2014-01-20 14:42 - 2013-12-24 20:28 - 00000000 ____D C:\Program Files\Orange 2014-01-20 12:28 - 2014-01-20 00:36 - 00000000 ____D C:\Users\Misiołek\Desktop\trash 2014-01-20 09:33 - 2013-02-15 14:55 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Audacity 2014-01-20 09:18 - 2011-03-20 10:33 - 00002494 _____ C:\Windows\system32\AutoRunFilter.ini 2014-01-20 02:40 - 2013-01-20 21:18 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Winamp 2014-01-20 01:48 - 2013-01-20 15:40 - 00000000 ____D C:\Users\Misiołek\AppData\Local\VirtualStore 2014-01-20 01:47 - 2013-10-11 14:13 - 00000000 ____D C:\AdwCleaner 2014-01-20 01:46 - 2014-01-20 01:46 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2014-01-20 01:46 - 2014-01-20 01:46 - 00000000 ____D C:\Program Files (x86)\Trend Micro 2014-01-20 01:44 - 2014-01-20 01:44 - 01402880 _____ C:\Users\Misiołek\Downloads\HiJackThis.msi 2014-01-20 01:15 - 2014-01-20 01:15 - 03809280 _____ C:\Users\Misiołek\Downloads\RogueKiller.exe 2014-01-20 01:08 - 2014-01-20 01:08 - 01830768 _____ (SurfRight B.V.) C:\Users\Misiołek\Downloads\hmpalert.exe 2014-01-20 01:03 - 2014-01-20 01:03 - 10264904 _____ (SurfRight B.V.) C:\Users\Misiołek\Downloads\hitmanpro_x64.exe 2014-01-20 00:48 - 2014-01-20 00:48 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\Misiołek\Downloads\tdsskiller.exe 2014-01-19 23:09 - 2014-01-19 23:09 - 00000000 ____D C:\Users\Misiołek\AppData\Local\Eraser 6 2014-01-19 23:07 - 2014-01-19 23:07 - 00000000 ____D C:\Program Files\Eraser 2014-01-19 21:43 - 2014-01-19 21:42 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Misiołek\Downloads\rkill.com 2014-01-19 21:13 - 2011-03-20 08:36 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.dll 2014-01-19 21:12 - 2011-03-20 08:35 - 00017920 _____ C:\Windows\SysWOW64\rpcnetp.exe 2014-01-19 19:56 - 2014-01-19 19:56 - 00033719 _____ C:\Users\Misiołek\Downloads\FRST.txt 2014-01-19 19:56 - 2014-01-19 19:56 - 00030882 _____ C:\Users\Misiołek\Downloads\Addition.txt 2014-01-19 19:50 - 2013-01-20 22:01 - 00000000 ____D C:\Windows\pss 2014-01-19 18:26 - 2014-01-19 18:26 - 00656338 _____ C:\Users\Misiołek\Downloads\gmer.txt 2014-01-19 17:42 - 2014-01-19 17:41 - 00379904 _____ C:\Users\Misiołek\Downloads\u9x0060s.exe 2014-01-19 17:24 - 2014-01-19 17:24 - 00110032 _____ C:\Users\Misiołek\Downloads\OTL.Txt 2014-01-19 17:24 - 2014-01-19 17:24 - 00082058 _____ C:\Users\Misiołek\Downloads\Extras.Txt 2014-01-19 16:29 - 2009-07-14 06:08 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2014-01-19 15:50 - 2014-01-19 15:50 - 00602112 _____ (OldTimer Tools) C:\Users\Misiołek\Downloads\OTL.exe 2014-01-19 14:34 - 2014-01-19 01:46 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2014-01-19 14:23 - 2011-03-20 10:33 - 00001467 _____ C:\Windows\system32\ServiceFilter.ini 2014-01-19 02:00 - 2014-01-19 02:00 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking 2014-01-19 01:00 - 2014-01-19 01:00 - 00000000 _____ C:\Windows\setuperr.log 2014-01-17 14:57 - 2014-01-16 23:31 - 04406784 _____ C:\Users\Misiołek\Downloads\RogueKillerX64.exe 2014-01-17 12:26 - 2014-01-17 12:26 - 00016407 _____ C:\Users\Misiołek\Downloads\wieszykii.txt 2014-01-15 21:23 - 2013-05-10 06:38 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Mp3tag 2014-01-15 18:50 - 2013-03-09 22:52 - 00000000 ____D C:\Users\Misiołek\AppData\Roaming\Apple Computer 2014-01-15 17:31 - 2009-07-14 05:45 - 00295264 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-15 17:01 - 2013-08-12 09:32 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 16:57 - 2013-01-21 12:13 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-11 22:37 - 2014-01-11 22:37 - 00000000 ____D C:\Program Files (x86)\ESET 2014-01-11 21:37 - 2014-01-11 21:37 - 00000000 ____D C:\Windows\ERUNT 2014-01-11 21:23 - 2014-01-11 21:16 - 00000000 ____D C:\ProgramData\HitmanPro 2014-01-11 21:17 - 2014-01-11 21:17 - 00000000 ____D C:\Program Files\HitmanPro 2014-01-01 19:46 - 2013-05-10 16:54 - 00000000 ____D C:\Users\Misiołek\Documents\GTA San Andreas User Files 2014-01-01 16:24 - 2014-01-01 16:24 - 00000000 ____D C:\Users\Misiołek\Downloads\RichardLawther-UB4 2014-01-01 16:23 - 2014-01-01 16:21 - 175548870 _____ C:\Users\Misiołek\Downloads\RichardLawther-UB4.zip 2013-12-30 23:17 - 2013-12-30 23:17 - 00000000 ____D C:\Users\Misiołek\Documents\GTA San Andreas User Files - Kopia 2013-12-27 21:45 - 2013-12-27 21:45 - 00000000 ____D C:\ProgramData\Auslogics 2013-12-27 21:45 - 2013-12-27 21:45 - 00000000 ____D C:\Program Files (x86)\Auslogics 2013-12-27 17:45 - 2009-07-29 07:03 - 00000000 ____D C:\Windows\Panther 2013-12-27 17:41 - 2013-03-04 09:54 - 00000000 ____D C:\Program Files\CCleaner 2013-12-27 17:31 - 2013-03-04 11:24 - 00000000 ____D C:\Program Files (x86)\Steam 2013-12-24 20:28 - 2013-12-24 20:28 - 00000000 ____D C:\Program Files\DIFX 2013-12-21 09:38 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\LiveKernelReports 2013-12-21 08:58 - 2013-01-20 18:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-09 21:42 ==================== End Of Log ============================