Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014 Ran by vvr0na.44 (administrator) on AKA on 04-02-2014 17:37:05 Running from C:\Users\vvr0na.44\Desktop\problem Windows 8 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe () C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe (SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [] - [X] HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13261456 2012-11-29] (Realtek Semiconductor) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2565544 2012-10-31] () HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] () HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation) HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2172816 2012-10-22] (SRS Labs, Inc.) HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-08] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7152640 2012-12-05] (Pegatron Corporation) HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) HKLM-x32\...\Run: [Plus Internet] - C:\Program Files (x86)\Plus Internet\PlusInternetChecker.exe [645040 2012-09-28] () Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-567660114-2496558772-832221798-1001\...\MountPoints2: {28cbc2a0-7126-11e3-be9f-2cd05ac7654b} - "E:\AutoRun.exe" HKU\S-1-5-21-567660114-2496558772-832221798-1001\...\MountPoints2: {28cbc2d3-7126-11e3-be9f-2cd05ac7654b} - "F:\AutoRun.exe" Startup: C:\Users\vvr0na.44\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.com SearchScopes: HKLM - DefaultScope {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM - {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - DefaultScope {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKLM-x32 - {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS SearchScopes: HKCU - DefaultScope {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = SearchScopes: HKCU - {8B8A3BE8-B2D2-4C36-96AC-C2289E9EF29E} URL = BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name - {53707962-6F74-2D53-2644-206D7942484F} - No File BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: QUICKfind BHO Object - {C08DF07A-3E49-4E25-9AB0-D3882835F153} - C:\Program Files (x86)\IDM\QUICKfind\PlugIns\IEHelp.dll (IDM) Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\vvr0na.44\AppData\Roaming\Mozilla\Firefox\Profiles\g0hkk7em.default FF Homepage: www.google.pl FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: BetterPrivacy - C:\Users\vvr0na.44\AppData\Roaming\Mozilla\Firefox\Profiles\g0hkk7em.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2013-10-26] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-12-04] FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ [] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird ==================== Services (Whitelisted) ================= R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation) R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201872 2012-12-05] (Realtek Semiconductor) R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-17] (Advanced Micro Devices) R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation) R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation) S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-09-25] (Windows (R) Win 7 DDK provider) S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-09-25] (Windows (R) Win 7 DDK provider) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-24] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-24] (Symantec Corporation) R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140203.001\IDSvia64.sys [521944 2014-01-21] (Symantec Corporation) R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140204.001\ENG64.SYS [126040 2014-01-30] (Symantec Corporation) R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140204.001\EX64.SYS [2099288 2014-01-30] (Symantec Corporation) R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON) R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics) S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation ) R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation ) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31032 2012-11-29] (Synaptics Incorporated) R3 SRTSP; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation) S0 SymELAM; C:\Windows\System32\drivers\NISx64\1501000.012\SymELAM.sys [23568 2013-09-10] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-12-04] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation) R1 SymNetS; C:\Windows\system32\drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation) R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider) S3 EraserUtilDrv11311; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11311.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-04 17:34 - 2014-02-04 17:37 - 00000000 ____D () C:\FRST 2014-02-04 17:32 - 2014-02-04 17:32 - 00000000 _____ () C:\Users\vvr0na.44\defogger_reenable 2014-02-04 17:26 - 2014-02-04 17:26 - 00001008 _____ () C:\windows\PFRO.log 2014-02-04 16:47 - 2014-02-04 17:37 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\problem 2014-02-04 16:02 - 2014-02-04 16:02 - 24859352 _____ (Microsoft Corporation) C:\Users\vvr0na.44\Downloads\Windows-KB890830-x64-V5.8.exe 2014-02-04 14:20 - 2014-02-04 16:55 - 00063165 _____ () C:\windows\WindowsUpdate.log 2014-02-04 03:07 - 2014-02-04 06:29 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\Tor Browser 2014-02-04 02:22 - 2014-01-11 12:53 - 00000224 _____ () C:\Users\vvr0na.44\Desktop\pas.txt 2014-02-04 01:06 - 2014-02-04 01:06 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\driveupcleaner 2014-02-02 16:21 - 2014-02-04 10:44 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\programowanie 2014-02-02 04:27 - 2014-02-02 04:27 - 00000808 _____ () C:\Users\vvr0na.44\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk 2014-01-27 20:46 - 2014-01-27 20:46 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\Design Science 2014-01-27 20:44 - 2014-01-27 20:44 - 00000000 ____D () C:\Program Files (x86)\MathType 2014-01-25 23:55 - 2013-11-18 06:28 - 04121952 _____ (Kaspersky Lab ZAO) C:\Users\vvr0na.44\Downloads\TDSSKiller.exe 2014-01-25 22:55 - 2014-01-25 22:56 - 132799408 _____ () C:\Users\vvr0na.44\Downloads\setup_11.0.1.1245.x01_2014_01_25_23_37.exe 2014-01-11 21:10 - 2014-02-03 16:37 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\ang ==================== One Month Modified Files and Folders ======= 2014-02-04 17:37 - 2014-02-04 17:34 - 00000000 ____D () C:\FRST 2014-02-04 17:37 - 2014-02-04 16:47 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\problem 2014-02-04 17:32 - 2014-02-04 17:32 - 00000000 _____ () C:\Users\vvr0na.44\defogger_reenable 2014-02-04 17:32 - 2013-10-26 14:04 - 00003594 _____ () C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-567660114-2496558772-832221798-1001 2014-02-04 17:32 - 2013-10-26 13:57 - 00000000 ____D () C:\Users\vvr0na.44 2014-02-04 17:31 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\sru 2014-02-04 17:27 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\AUInstallAgent 2014-02-04 17:26 - 2014-02-04 17:26 - 00001008 _____ () C:\windows\PFRO.log 2014-02-04 17:26 - 2012-07-26 08:22 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-02-04 17:21 - 2013-10-26 20:35 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\temporal 2014-02-04 16:55 - 2014-02-04 14:20 - 00063165 _____ () C:\windows\WindowsUpdate.log 2014-02-04 16:02 - 2014-02-04 16:02 - 24859352 _____ (Microsoft Corporation) C:\Users\vvr0na.44\Downloads\Windows-KB890830-x64-V5.8.exe 2014-02-04 13:58 - 2013-10-27 01:05 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Local\Adobe 2014-02-04 13:45 - 2013-10-26 19:59 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\vba 2014-02-04 10:44 - 2014-02-02 16:21 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\programowanie 2014-02-04 07:27 - 2013-10-26 19:56 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\KURsY 2014-02-04 06:48 - 2013-10-26 22:50 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\uTorrent 2014-02-04 06:29 - 2014-02-04 03:07 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\Tor Browser 2014-02-04 06:28 - 2013-10-26 20:31 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\SofT 2014-02-04 01:06 - 2014-02-04 01:06 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\driveupcleaner 2014-02-04 01:04 - 2013-12-10 06:07 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\polski 2014-02-04 01:03 - 2012-08-02 08:05 - 00794920 _____ () C:\windows\system32\perfh015.dat 2014-02-04 01:03 - 2012-08-02 08:05 - 00159530 _____ () C:\windows\system32\perfc015.dat 2014-02-04 01:03 - 2012-07-26 08:28 - 01793398 _____ () C:\windows\system32\PerfStringBackup.INI 2014-02-04 00:36 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\BBI 2014-02-03 16:37 - 2014-01-11 21:10 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\ang 2014-02-03 00:40 - 2013-10-26 13:57 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Local\Packages 2014-02-02 22:45 - 2013-11-22 17:18 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\Skype 2014-02-02 21:15 - 2012-07-26 06:26 - 00262144 ___SH () C:\windows\system32\config\ELAM 2014-02-02 04:27 - 2014-02-02 04:27 - 00000808 _____ () C:\Users\vvr0na.44\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk 2014-02-01 03:16 - 2013-11-20 18:08 - 00000000 ____D () C:\Users\vvr0na.44\Documents\gretl 2014-02-01 03:16 - 2013-11-20 18:08 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\gretl 2014-01-28 08:42 - 2013-11-30 17:21 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\Winamp 2014-01-28 06:41 - 2013-12-15 15:08 - 00442552 _____ () C:\windows\system32\FNTCACHE.DAT 2014-01-28 01:23 - 2013-10-27 19:47 - 00118048 _____ () C:\Users\vvr0na.44\AppData\Local\GDIPFONTCACHEV1.DAT 2014-01-27 20:46 - 2014-01-27 20:46 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\Design Science 2014-01-27 20:44 - 2014-01-27 20:44 - 00000000 ____D () C:\Program Files (x86)\MathType 2014-01-26 06:24 - 2013-10-29 18:08 - 00000000 ____D () C:\windows\system32\MRT 2014-01-25 23:57 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\system32\restore 2014-01-25 23:53 - 2013-10-26 13:58 - 00000000 ___RD () C:\Users\vvr0na.44\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-01-25 22:56 - 2014-01-25 22:55 - 132799408 _____ () C:\Users\vvr0na.44\Downloads\setup_11.0.1.1245.x01_2014_01_25_23_37.exe 2014-01-25 22:18 - 2012-07-26 09:12 - 00000000 ____D () C:\windows\LiveKernelReports 2014-01-23 23:18 - 2013-10-30 02:49 - 00000000 ____D () C:\ProgramData\HP 2014-01-20 08:09 - 2013-10-26 22:27 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Local\Microsoft Help 2014-01-11 12:53 - 2014-02-04 02:22 - 00000224 _____ () C:\Users\vvr0na.44\Desktop\pas.txt 2014-01-09 09:02 - 2013-10-29 19:10 - 00694240 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2014-01-09 09:02 - 2013-10-29 19:10 - 00078296 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-01-08 13:20 - 2013-12-02 04:21 - 00000000 ____D () C:\Users\vvr0na.44\AppData\Roaming\vlc 2014-01-08 09:17 - 2013-12-09 08:50 - 00000000 ____D () C:\Users\vvr0na.44\Desktop\dokumenty 2014-01-06 16:20 - 2013-10-29 18:08 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe Some content of TEMP: ==================== C:\Users\Administrator\AppData\Local\Temp\PresentationCore.dll C:\Users\Administrator\AppData\Local\Temp\PresentationFramework.dll C:\Users\Administrator\AppData\Local\Temp\ReachFramework.dll C:\Users\Administrator\AppData\Local\Temp\UIAutomationProvider.dll C:\Users\Administrator\AppData\Local\Temp\UIAutomationTypes.dll C:\Users\Administrator\AppData\Local\Temp\WindowsBase.dll C:\Users\Administrator\AppData\Local\Temp\WindowsFormsIntegration.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-27 10:01 ==================== End Of Log ============================