Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-02-2014 Ran by Daniel (administrator) on DANIEL-KOMPUTER on 18-02-2014 19:47:01 Running from C:\Users\Daniel\Downloads Microsoft Windows 7 Ultimate (X86) OS Language: Polish Internet Explorer Version 8 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgwdsvc.exe () C:\Windows\system32\PnkBstrA.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\loggingserver.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG10\avgtray.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe () C:\Program Files\AVG Secure Search\vprot.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Google Inc.) C:\Users\Daniel\AppData\Local\Google\Update\1.3.22.5\GoogleCrashHandler.exe () C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe (Nokia) C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia) C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [AVG_TRAY] - C:\Program Files\AVG\AVG10\avgtray.exe [2345592 2012-08-01] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9726568 2010-09-03] (Realtek Semiconductor) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [ISUSScheduler] - C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [69632 2004-04-13] (InstallShield Software Corporation) HKLM\...\Run: [vProt] - C:\Program Files\AVG Secure Search\vprot.exe [2552856 2014-02-06] () HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated) HKLM\...\Run: [SwitchBoard] - C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AdobeCS5ServiceManager] - C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated) HKLM\...\Run: [NSU_agent] - C:\Program Files\Nokia\Nokia Software Updater\nsu3ui_agent.exe [190768 2012-02-28] () HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\Run: [Google Update] - C:\Users\Daniel\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-04-28] (Google Inc.) HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\Run: [Facebook Update] - C:\Users\Daniel\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-11-30] (Facebook Inc.) HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\Run: [PC Suite Tray] - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [1516632 2012-06-26] (Nokia) HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\Run: [AdobeBridge] - [X] HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\MountPoints2: {07c89c34-3791-11e0-9767-001fc688a0e5} - L:\Setup.exe HKU\S-1-5-21-3952292846-3212615212-848792422-1000\...\MountPoints2: {b7ccd15b-daf9-11e0-8338-001fc688a0e5} - M:\blank.exe HKU\S-1-5-21-3952292846-3212615212-848792422-1001\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - C:\Program Files\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-06-03] (AVG Secure Search) HKU\S-1-5-21-3952292846-3212615212-848792422-1001\...\MountPoints2: {76e158d8-1b67-11e0-844f-001fc688a0e5} - K:\install.exe HKU\S-1-5-21-3952292846-3212615212-848792422-500\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - C:\Program Files\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [1266712 2013-06-03] (AVG Secure Search) Startup: C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie URLSearchHook: HKCU - (No Name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={84DEF224-EB6B-4B42-83AE-8E6EA340AFC9}&mid=24004ae50d7a47d6a7f5d156806c4916-2dc6982b7568081f90c514ef7a0b89703d856f35&lang=pl&ds=AVG&pr=fr&d=2011-11-21 17:24:26&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms} SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={84DEF224-EB6B-4B42-83AE-8E6EA340AFC9}&mid=24004ae50d7a47d6a7f5d156806c4916-2dc6982b7568081f90c514ef7a0b89703d856f35&lang=pl&ds=AVG&pr=fr&d=2011-11-21 17:24:26&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms} BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\17.3.0.49\AVG Secure Search_toolbar.dll (AVG Secure Search) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKLM - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\17.3.0.49\AVG Secure Search_toolbar.dll (AVG Secure Search) Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll (AVG Secure Search) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default FF user.js: detected! => C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\user.js FF DefaultSearchEngine: Wikipedia (pl) FF SelectedSearchEngine: Wikipedia (pl) FF Homepage: hxxp://www.google.pl/ FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_43.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.) FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll (AVG Technologies) FF Plugin: @idsoftware.com/QuakeLive - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.450 - C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.448 - C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Daniel\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Daniel\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Daniel\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\Daniel\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll (LizardTech) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\avg-secure-search.xml FF Extension: Battlefield Play4Free - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\battlefieldplay4free@ea.com [2012-10-12] FF Extension: Flashblock - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2013-04-16] FF Extension: BrowseToolE0170 - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} [2013-12-12] FF Extension: WOT - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-26] FF Extension: 1-Click YouTube Video Downloader - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2013-07-28] FF Extension: Twojanuta.pl - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\zacz3k@gmail.com.xpi [2012-02-04] FF Extension: Adblock Plus - C:\Users\Daniel\AppData\Roaming\Mozilla\Firefox\Profiles\tbh2qo8u.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-08-14] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-14] FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files\AVG\AVG10\Firefox4\ FF Extension: AVG Safe Search - C:\Program Files\AVG\AVG10\Firefox4\ [] FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49 FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\17.3.0.49 [2014-01-08] Chrome: ======= CHR HomePage: hxxp://www.google.pl/ CHR RestoreOnStartup: "spdy": { "servers": [ "checkout.google.com:443", "ssl.gstatic.com:443", "fonts.googleapis.com:443", "accounts.google.com:443", "chrome.google.com:443", "googleads.g.doubleclick.net:443", "ssl.google-analytics.com:443", "toolbarqueries.google.com:443", "clients2.google.com:443", "themes.googleusercontent.com:443", "www.google.com:443", "apis.google.com:443", "www.googleadservices.com:443", "accounts.google.pl:443", "fls.doubleclick.net:443" CHR DefaultSearchKeyword: isearch.avg.com CHR DefaultSearchProvider: AVG Secure Search CHR DefaultSearchURL: http://isearch.avg.com/search?cid={84DEF224-EB6B-4B42-83AE-8E6EA340AFC9}&mid=24004ae50d7a47d6a7f5d156806c4916-2dc6982b7568081f90c514ef7a0b89703d856f35&lang=pl&ds=AVG&pr=fr&d=2011-11-21 17:24:26&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms} CHR DefaultNewTabURL: CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll No File CHR Plugin: (Battlefield Play4Free Updater) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkejhbcdagodjdndmfnhaibnealjonei\1.0.53.2_0\npBP4FUpdater.dll (EA Digital Illusions CE AB) CHR Plugin: (Battlefield Play4Free Updater) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkejhbcdagodjdndmfnhaibnealjonei\1.0.53.2_0\BP4FUpdater.exe (EA Digital Illusions CE AB) CHR Plugin: (AVG Internet Security) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1409_0\plugins/avgnpss.dll (AVG Technologies CZ, s.r.o.) CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation) CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\11.0.2\\npsitesafety.dll (AVG Technologies) CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) CHR Plugin: (QUAKE LIVE) - C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.) CHR Plugin: (Google Update) - C:\Users\Daniel\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) CHR Extension: (Angry Birds) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2012-02-16] CHR Extension: (YouTube) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16] CHR Extension: (Szukaj w Google) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16] CHR Extension: (Battlefield Play4Free) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkejhbcdagodjdndmfnhaibnealjonei [2011-07-15] CHR Extension: (AVG Safe Search) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2011-05-24] CHR Extension: (AVG Security Toolbar) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2012-09-04] CHR Extension: (Google Wallet) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-05] CHR Extension: (Gmail) - C:\Users\Daniel\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16] CHR HKLM\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files\AVG\AVG10\Chrome\safesearch.crx [2011-09-09] CHR HKLM\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\17.3.0.49\avg.crx [2014-01-08] CHR StartMenuInternet: Google Chrome - C:\Users\Daniel\AppData\Local\Google\Chrome\Application\chrome.exe ========================== Services (Whitelisted) ================= S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] () S2 AVGIDSAgent; C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe [7391072 2012-01-31] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG10\avgwdsvc.exe [269520 2011-02-08] (AVG Technologies CZ, s.r.o.) S4 KMService; C:\Windows\system32\srvany.exe [8192 2011-01-08] () R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2012-05-15] () S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) R2 vToolbarUpdater17.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [1771544 2014-01-08] (AVG Secure Search) ==================== Drivers (Whitelisted) ==================== R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-01-17] () R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\AVGIDSDriver.Sys [134480 2011-05-27] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSEH; C:\Windows\System32\DRIVERS\AVGIDSEH.Sys [22992 2011-02-22] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\AVGIDSFilter.Sys [24144 2011-02-10] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSShim; C:\Windows\System32\DRIVERS\AVGIDSShim.Sys [21968 2011-02-10] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [255968 2012-11-12] (AVG Technologies CZ, s.r.o.) R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [34896 2011-03-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [32592 2011-03-16] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [297168 2011-04-04] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-11-10] (AVG Technologies) S3 Axtmvflt; C:\Windows\System32\DRIVERS\Axtmvflt.sys [3456 2009-04-21] (Axesstel) S3 Axtmvmdm; C:\Windows\System32\DRIVERS\Axtmvmdm.sys [40064 2009-04-21] (Axesstel) S3 Axtmvprt; C:\Windows\System32\Drivers\Axtmvprt.sys [38784 2009-04-21] (Axesstel) S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-01-17] () R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () S1 prodrv06; C:\Windows\System32\drivers\prodrv06.sys [51744 2003-09-06] (Protection Technology) S0 prohlp02; C:\Windows\System32\drivers\prohlp02.sys [62656 2003-09-06] (Protection Technology) S0 prosync1; C:\Windows\System32\drivers\prosync1.sys [6944 2003-09-06] (Protection Technology) S0 sfhlp01; C:\Windows\System32\drivers\sfhlp01.sys [4832 2003-09-06] (Protection Technology) S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [X] S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X] S4 sptd; System32\Drivers\sptd.sys [X] S3 XDva397; \??\C:\Windows\system32\XDva397.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-02-18 19:47 - 2014-02-18 19:47 - 00021763 _____ () C:\Users\Daniel\Downloads\FRST.txt 2014-02-18 19:46 - 2014-02-18 19:47 - 00000000 ____D () C:\FRST 2014-02-18 19:43 - 2014-02-18 19:43 - 00204328 _____ () C:\Users\Daniel\Downloads\Extras.Txt 2014-02-18 19:41 - 2014-02-18 19:41 - 00106766 _____ () C:\Users\Daniel\Downloads\OTL.Txt 2014-02-18 19:19 - 2014-02-18 19:19 - 01141248 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2014-02-17 17:26 - 2006-11-01 13:06 - 00162616 _____ (Sysinternals - www.sysinternals.com) C:\Windows\system32\RegDelNull.exe 2014-02-17 17:25 - 2014-02-17 17:25 - 00065232 _____ (Malwarebytes) C:\Users\Daniel\Downloads\regassassin-setup-1.03.exe 2014-02-17 17:07 - 2014-02-17 17:07 - 00286720 _____ (SteelWerX) C:\Windows\system32\swreg.exe 2014-02-17 17:03 - 2014-02-17 17:03 - 00522360 _____ (Duplex Secure Ltd.) C:\Users\Daniel\Downloads\SPTDinst-v186-x86.exe 2014-02-17 17:01 - 2014-02-17 17:01 - 02203889 _____ (El Desaparecido - SosVirus.net - UsbFix.net) C:\Users\Daniel\Downloads\usbfix0.exe 2014-02-17 17:00 - 2014-02-17 17:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe 2014-02-16 18:42 - 2014-02-16 18:42 - 05120005 _____ () C:\Users\Daniel\Downloads\5mb(1).gts 2014-02-16 14:33 - 2014-02-16 14:33 - 05120005 _____ () C:\Users\Daniel\Downloads\5mb.gts 2014-02-15 18:55 - 2014-02-15 18:55 - 00964447 _____ (GeoVid ) C:\Users\Daniel\Downloads\video-mp3-extractor.exe 2014-02-15 18:55 - 2014-02-15 18:55 - 00000000 ____D () C:\Program Files\Video mp3 Extractor 2014-02-15 16:11 - 2014-02-15 16:11 - 00000000 ____D () C:\Program Files\MSXML 4.0 2014-02-15 16:10 - 2014-02-15 16:10 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nokia 2014-02-15 16:10 - 2014-02-15 16:10 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Nokia 2014-02-15 15:47 - 2014-02-15 15:48 - 50285192 _____ () C:\Users\Daniel\Downloads\NokiaSoftwareUpdaterSetup_PL.exe 2014-02-14 16:25 - 2014-02-14 16:25 - 00000000 ____D () C:\visual 2014-02-14 12:36 - 2014-02-14 12:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-02-10 19:26 - 2014-02-13 17:17 - 00000000 ____D () C:\Users\Daniel\Documents\REAPER Media 2014-02-08 20:47 - 2014-02-08 21:43 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\FontCreator 2014-02-08 20:47 - 2014-02-08 20:47 - 00000000 ____D () C:\Users\Daniel\AppData\Local\FontCreator 2014-02-03 15:52 - 2014-02-18 17:39 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\AIMP3 2014-02-03 15:52 - 2014-02-03 15:52 - 00000000 ____D () C:\Program Files\AIMP3 2014-01-31 19:01 - 2014-01-31 19:01 - 00000000 ____D () C:\Users\Daniel\Documents\Atari 2014-01-23 21:55 - 2014-01-23 21:55 - 00000000 ____D () C:\Program Files\Synth1 2014-01-23 21:54 - 2014-01-23 21:54 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Daichi 2014-01-21 18:37 - 2014-01-21 18:38 - 00000000 ___RD () C:\Users\Daniel\Desktop\musiccc 2014-01-20 21:05 - 2014-01-20 21:05 - 00111750 _____ () C:\Users\Daniel\Downloads\Apocalypto_ 2006 _[BRRip XviD]_[Lektor_PL][Torrenty.org].torrent ==================== One Month Modified Files and Folders ======= 2014-02-18 19:47 - 2014-02-18 19:47 - 00021763 _____ () C:\Users\Daniel\Downloads\FRST.txt 2014-02-18 19:47 - 2014-02-18 19:46 - 00000000 ____D () C:\FRST 2014-02-18 19:46 - 2011-01-08 21:08 - 01774421 _____ () C:\Windows\WindowsUpdate.log 2014-02-18 19:43 - 2014-02-18 19:43 - 00204328 _____ () C:\Users\Daniel\Downloads\Extras.Txt 2014-02-18 19:41 - 2014-02-18 19:41 - 00106766 _____ () C:\Users\Daniel\Downloads\OTL.Txt 2014-02-18 19:33 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing 2014-02-18 19:30 - 2013-11-05 16:47 - 00000000 ____D () C:\Program Files\osu! 2014-02-18 19:22 - 2011-04-28 16:50 - 00001062 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3952292846-3212615212-848792422-1000UA.job 2014-02-18 19:19 - 2014-02-18 19:19 - 01141248 _____ (Farbar) C:\Users\Daniel\Downloads\FRST.exe 2014-02-18 19:19 - 2011-01-08 21:33 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\AIMP 2014-02-18 19:12 - 2012-11-30 19:07 - 00000932 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3952292846-3212615212-848792422-1000UA.job 2014-02-18 19:12 - 2012-11-30 19:07 - 00000910 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3952292846-3212615212-848792422-1000Core.job 2014-02-18 18:27 - 2011-01-08 21:43 - 00000000 ____D () C:\Windows\system32\Drivers\AVG 2014-02-18 18:22 - 2011-04-28 16:50 - 00001010 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3952292846-3212615212-848792422-1000Core.job 2014-02-18 17:39 - 2014-02-03 15:52 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\AIMP3 2014-02-18 16:42 - 2009-07-14 05:34 - 00010016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-02-18 16:42 - 2009-07-14 05:34 - 00010016 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-02-18 16:34 - 2013-06-03 14:29 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2014-02-18 16:33 - 2011-01-15 10:54 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-18 16:33 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-02-18 16:33 - 2009-07-14 05:39 - 00304299 _____ () C:\Windows\setupact.log 2014-02-17 19:47 - 2011-12-30 09:38 - 00000000 ____D () C:\Program Files\Steam 2014-02-17 19:01 - 2011-01-08 21:40 - 00712864 _____ () C:\Windows\PFRO.log 2014-02-17 17:25 - 2014-02-17 17:25 - 00065232 _____ (Malwarebytes) C:\Users\Daniel\Downloads\regassassin-setup-1.03.exe 2014-02-17 17:07 - 2014-02-17 17:07 - 00286720 _____ (SteelWerX) C:\Windows\system32\swreg.exe 2014-02-17 17:03 - 2014-02-17 17:03 - 00522360 _____ (Duplex Secure Ltd.) C:\Users\Daniel\Downloads\SPTDinst-v186-x86.exe 2014-02-17 17:01 - 2014-02-17 17:01 - 02203889 _____ (El Desaparecido - SosVirus.net - UsbFix.net) C:\Users\Daniel\Downloads\usbfix0.exe 2014-02-17 17:00 - 2014-02-17 17:00 - 00602112 _____ (OldTimer Tools) C:\Users\Daniel\Downloads\OTL.exe 2014-02-17 16:32 - 2011-01-08 21:24 - 01669916 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-17 16:32 - 2009-07-14 09:07 - 00740590 _____ () C:\Windows\system32\perfh015.dat 2014-02-17 16:32 - 2009-07-14 09:07 - 00155186 _____ () C:\Windows\system32\perfc015.dat 2014-02-16 18:42 - 2014-02-16 18:42 - 05120005 _____ () C:\Users\Daniel\Downloads\5mb(1).gts 2014-02-16 17:43 - 2013-07-14 13:19 - 00000000 ____D () C:\Users\Daniel\Downloads\LFS 2014-02-16 16:04 - 2012-10-20 22:55 - 00001552 _____ () C:\Windows\Sidplay2w.ini 2014-02-16 15:51 - 2013-12-24 14:46 - 00000000 ____D () C:\vst 2014-02-16 14:33 - 2014-02-16 14:33 - 05120005 _____ () C:\Users\Daniel\Downloads\5mb.gts 2014-02-15 21:11 - 2012-06-17 17:32 - 00000000 ____D () C:\Users\Daniel\Desktop\VGHS 2014-02-15 18:56 - 2011-01-17 17:12 - 00006144 _____ () C:\Users\Daniel\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-02-15 18:55 - 2014-02-15 18:55 - 00964447 _____ (GeoVid ) C:\Users\Daniel\Downloads\video-mp3-extractor.exe 2014-02-15 18:55 - 2014-02-15 18:55 - 00000000 ____D () C:\Program Files\Video mp3 Extractor 2014-02-15 16:27 - 2013-10-24 15:56 - 00000000 ____D () C:\Users\Daniel\Desktop\W.D 2014-02-15 16:27 - 2013-06-12 20:41 - 00000000 ____D () C:\Users\Daniel\Desktop\Nowy folder (5) 2014-02-15 16:27 - 2012-12-25 15:35 - 00000000 ____D () C:\Users\Daniel\Desktop\zd 2014-02-15 16:27 - 2012-06-10 18:54 - 00000000 ____D () C:\Users\Daniel\Desktop\ekk 2014-02-15 16:11 - 2014-02-15 16:11 - 00000000 ____D () C:\Program Files\MSXML 4.0 2014-02-15 16:10 - 2014-02-15 16:10 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Nokia 2014-02-15 16:10 - 2014-02-15 16:10 - 00000000 ____D () C:\Users\Daniel\AppData\Local\Nokia 2014-02-15 16:10 - 2013-02-17 17:46 - 00000000 ____D () C:\Program Files\Nokia 2014-02-15 16:10 - 2013-02-17 17:46 - 00000000 ____D () C:\Program Files\Common Files\Nokia 2014-02-15 15:56 - 2013-02-17 17:49 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Nokia 2014-02-15 15:48 - 2014-02-15 15:47 - 50285192 _____ () C:\Users\Daniel\Downloads\NokiaSoftwareUpdaterSetup_PL.exe 2014-02-15 09:02 - 2012-06-18 20:11 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-02-14 20:13 - 2013-12-24 15:57 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\RenPy 2014-02-14 16:27 - 2012-10-14 18:11 - 00000000 ____D () C:\Users\Daniel\Documents\do szkoły 2014-02-14 16:25 - 2014-02-14 16:25 - 00000000 ____D () C:\visual 2014-02-14 12:36 - 2014-02-14 12:36 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-02-14 12:25 - 2013-10-24 20:27 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\GG 2014-02-13 17:17 - 2014-02-10 19:26 - 00000000 ____D () C:\Users\Daniel\Documents\REAPER Media 2014-02-12 14:55 - 2011-01-15 11:19 - 00119352 _____ () C:\Users\Daniel\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-12 13:31 - 2009-07-14 05:33 - 03787848 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-10 19:44 - 2012-03-18 20:04 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\REAPER 2014-02-09 14:19 - 2011-02-20 17:54 - 00007596 _____ () C:\Users\Daniel\AppData\Local\resmon.resmoncfg 2014-02-08 21:43 - 2014-02-08 20:47 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\FontCreator 2014-02-08 21:42 - 2012-10-05 15:04 - 00000000 ____D () C:\Users\Daniel\Documents\3dsMax 2014-02-08 21:20 - 2012-02-05 14:45 - 00000000 ____D () C:\Program Files\BASin 2014-02-08 20:47 - 2014-02-08 20:47 - 00000000 ____D () C:\Users\Daniel\AppData\Local\FontCreator 2014-02-08 11:30 - 2012-10-05 14:59 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared 2014-02-08 11:26 - 2009-07-14 03:04 - 00017582 _____ () C:\Windows\system32\Drivers\etc\services 2014-02-08 11:24 - 2012-10-05 15:18 - 00000000 ____D () C:\ProgramData\FLEXnet 2014-02-07 14:24 - 2011-12-29 17:29 - 00000000 ____D () C:\Program Files\Common Files\Steam 2014-02-06 01:59 - 2011-11-21 17:24 - 00000000 ____D () C:\Program Files\AVG Secure Search 2014-02-05 11:54 - 2013-01-25 15:41 - 00000000 ____D () C:\Users\Daniel\Documents\Max Payne 2 Savegames 2014-02-03 18:09 - 2011-01-08 21:37 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Adobe 2014-02-03 15:52 - 2014-02-03 15:52 - 00000000 ____D () C:\Program Files\AIMP3 2014-02-01 00:01 - 2012-01-13 20:55 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-01-31 23:30 - 2009-07-14 03:04 - 00000530 _____ () C:\Windows\win.ini 2014-01-31 22:22 - 2013-12-31 23:32 - 00157012 ____H () C:\Windows\system32\mlfcache.dat 2014-01-31 19:01 - 2014-01-31 19:01 - 00000000 ____D () C:\Users\Daniel\Documents\Atari 2014-01-27 18:19 - 2012-04-25 13:42 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\TS3Client 2014-01-26 23:26 - 2012-10-26 10:15 - 00000000 ____D () C:\Users\Daniel\Desktop\Nowy folder 2014-01-26 10:03 - 2009-07-14 05:53 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-01-24 23:15 - 2013-03-20 15:37 - 00000000 ____D () C:\Users\Daniel\Desktop\dadmuz nowa 2014-01-23 21:55 - 2014-01-23 21:55 - 00000000 ____D () C:\Program Files\Synth1 2014-01-23 21:54 - 2014-01-23 21:54 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\Daichi 2014-01-21 18:38 - 2014-01-21 18:37 - 00000000 ___RD () C:\Users\Daniel\Desktop\musiccc 2014-01-20 21:06 - 2013-03-29 21:28 - 00000000 ____D () C:\Users\Daniel\AppData\Roaming\uTorrent 2014-01-20 21:05 - 2014-01-20 21:05 - 00111750 _____ () C:\Users\Daniel\Downloads\Apocalypto_ 2006 _[BRRip XviD]_[Lektor_PL][Torrenty.org].torrent Files to move or delete: ==================== C:\Users\Daniel\jagex_cl_runescape_LIVE.dat C:\Users\Daniel\jagex_runescape_preferences.dat C:\Users\Daniel\jagex_runescape_preferences2.dat Some content of TEMP: ==================== C:\Users\Daniel\AppData\Local\Temp\AcDeltree.exe C:\Users\Daniel\AppData\Local\Temp\FNP_ACT_InstallerCA.dll C:\Users\Daniel\AppData\Local\Temp\ggdrive-menu.exe C:\Users\Daniel\AppData\Local\Temp\ggdrive-overlay.exe C:\Users\Daniel\AppData\Local\Temp\installstats.exe C:\Users\Daniel\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe C:\Users\Daniel\AppData\Local\Temp\Medal of Honor_uninst.exe C:\Users\Daniel\AppData\Local\Temp\RDtemp.exe C:\Users\Daniel\AppData\Local\Temp\_is148.exe C:\Users\Daniel\AppData\Local\Temp\_is2FF6.exe C:\Users\Daniel\AppData\Local\Temp\_is4AF4.exe C:\Users\Daniel\AppData\Local\Temp\_is70FA.exe C:\Users\Daniel\AppData\Local\Temp\_isB8D4.exe C:\Users\Daniel\AppData\Local\Temp\_isB921.exe C:\Users\Daniel\AppData\Local\Temp\_isC1BE.exe C:\Users\Daniel\AppData\Local\Temp\_isD1A1.exe C:\Users\Daniel\AppData\Local\Temp\_isDFB5.exe C:\Users\Daniel\AppData\Local\Temp\_isE511.exe C:\Users\Daniel\AppData\Local\Temp\_isEC04.exe C:\Users\Daniel\AppData\Local\Temp\_isFE1F.exe ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-02-09 20:20 ==================== End Of Log ============================