Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 27-10-2014 01 Ran by Gosia (administrator) on GOSIA-PC on 28-10-2014 18:26:00 Running from C:\Users\Gosia\Downloads Loaded Profile: Gosia (Available profiles: Gosia) Platform: Microsoft® Windows Vista™ Home Basic (X86) OS Language: Polski (Polska) Internet Explorer Version 7 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Agere Systems) C:\Windows\System32\agrsmsvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgfws.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe () C:\Program Files\Canon\IJPLM\ijplmsvc.exe () C:\Program Files\LG Software\System Control Manager\edd.exe (O2Micro International) C:\Program Files\O2Micro Oz128 Driver\o2flash.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (SaveSense) C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe (BIT LEADER) C:\Program Files\lg_swupdate\GiljabiStart.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Google Inc.) C:\Program Files\Google\Update\1.3.25.5\GoogleCrashHandler.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (MSI) C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe (Nuance Communications, Inc.) C:\Program Files\ScanSoft\OmniPageSE4\OpWareSE4.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\conime.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1006264 2013-01-22] (Microsoft Corporation) HKLM\...\Run: [iPlusManager] => C:\Program Files\iPlus\iPlusChecker.exe [446464 2009-12-21] () HKLM\...\Run: [LG Intelligent Update] => C:\Program Files\lg_swupdate\giljabistart.exe [247088 2007-09-28] (BIT LEADER) HKLM\...\Run: [MGSysCtrl] => C:\Program Files\LG Software\System Control Manager\MGSysCtrl.exe [565248 2007-07-06] (MSI) HKLM\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe [644696 2007-04-03] (CANON INC.) HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [1603152 2007-04-03] (CANON INC.) HKLM\...\Run: [SSBkgdUpdate] => C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.) HKLM\...\Run: [OpwareSE4] => C:\Program Files\ScanSoft\OmniPageSE4\OpwareSE4.exe [79400 2007-02-04] (Nuance Communications, Inc.) HKLM\...\Run: [mobilegeni daemon] => C:\Program Files\Mobogenie\DaemonProcess.exe HKLM\...\Run: [AVG_UI] => C:\Program Files\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Run: [Jet Screenshot] => C:\Program Files\Jet Screenshot\jetScreenshot.exe [1954056 2013-01-11] (ArcticLine Software) HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Run: [LiveSupport] => "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-08-17] (Google Inc.) HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Run: [IPLA!] => C:\Program Files\ipla\ipla.exe [21353568 2014-10-20] (Redefine Sp z o.o.) HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [22041192 2014-08-27] (Skype Technologies S.A.) HKU\S-1-5-21-559585761-812252448-234664116-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000 HKU\S-1-5-21-559585761-812252448-234664116-1000\...\MountPoints2: {d3865cea-d104-11e2-91fd-fbb37fab426d} - E:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\dll32.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=41460&tid=2938&st=bs&q= HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ HKCU\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&st=home&tid=2938 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=41460&tid=2938&st=bs&q= HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=41460&tid=2938&st=bs&q= HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www2.delta-search.com/?babsrc=HP_ss&mntrId=D6E10015AF704DD2&affID=119357&tsp=5009 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sweet-page.com/?type=hp&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Default_Page_URL = http://search.certified-toolbar.com?si=41460&st=home&tid=2938 HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=41460&tid=2938&st=bs&q= URLSearchHook: HKCU - (No Name) - {D8278076-BC68-4484-9233-6E7F1628B56C} - No File SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.certified-toolbar.com?si=41460&st=bs&tid=2938&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.buenosearch.com/?q={searchTerms}&babsrc=SP_ss&mntrId=D6E10015AF704DD2&affID=127886&tsp=5180 SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://www.search.ask.com/web?tpid=ORJ-V7-SAT&o=APN11461&pf=V7&p2=%5EBE7%5EOSJ000%5EYY%5EPL&gct=sb&itbv=12.10.6.53&apn_uid=6AAFB0B1-AC35-474F-9FB3-0551CF6D6FF4&apn_ptnrs=BE7&apn_dtid=%5EOSJ000%5EYY%5EPL&apn_dbr=Opera.exe_0_12.17.1863.0&doi=2014-05-22&trgb=IE&q={searchTerms}&psv= SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1394463553&from=cor&uid=HitachiXHTS542516K9A300_071224BB0300WCJ7HXUCX&q={searchTerms} SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://www.yd.delta-search.com/?q={searchTerms}&affID=119535&tt=030213_yd&babsrc=SP_ss&mntrId=d6e1c958000000000000000000000000 BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Babylon toolbar helper -> {2EECD738-5844-4a99-B4B6-146BF802613B} -> C:\Program Files\BabylonToolbar\BabylonToolbar\1.8.11.10\bh\BabylonToolbar.dll (Babylon BHO) BHO: SaveSense -> {71e129ff-6c2a-4984-818c-7e2c998b8d99} -> C:\Users\Gosia\AppData\Local\SaveSense\SaveSenseIE.dll (SaveSense) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.7.9012.1008\swg.dll (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files\BabylonToolbar\BabylonToolbar\1.8.11.10\BabylonToolbarTlbr.dll (Babylon Ltd.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Toolbar: HKCU - No Name - {434D452D-5637-006A-76A7-7A786E7484D7} - No File Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - No Name - {4F524A2D-5637-2D53-4154-7A786E7484D7} - No File DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense) FF Plugin: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense) FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin: @vividas.com/npVividasPlayer -> C:\Program Files\Vividas\Player\npVividasPlayer.dll ( ) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\sweet-page.xml FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-01-24] FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\Gosia\AppData\Roaming\Mozilla\Firefox\Profiles\pcpq7n9y.default\extensions\quick_start@gmail.com Chrome: ======= CHR Profile: C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Prezentacje Google) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-25] CHR Extension: (Buenosearch Toolbar) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\acfoobbgoakpihljnfedbcfaipcdlfhk [2014-10-25] CHR Extension: (Dokumenty Google) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-25] CHR Extension: (Dysk Google) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-25] CHR Extension: (YouTube) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-25] CHR Extension: (Szukaj w Google) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-25] CHR Extension: (Arkusze Google) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-25] CHR Extension: (Google Wallet) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-25] CHR Extension: (Gmail) - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-25] CHR HKLM\...\Chrome\Extension: [acfoobbgoakpihljnfedbcfaipcdlfhk] - C:\Users\Gosia\AppData\Roaming\BabSolution\CR\bueno.crx [2014-03-08] CHR HKLM\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files\HDvidCodec.com\HDvidCodec10.crx [2013-06-30] CHR HKLM\...\Chrome\Extension: [ieadcoanfjloocmfafkebdnfefmohngj] - C:\Program Files\BonanzaDeals\BonanzaDeals.crx [2013-06-30] CHR HKLM\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Gosia\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2013-06-30] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgfws; C:\Program Files\AVG\AVG2014\avgfws.exe [1417160 2014-08-25] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.) R2 IJPLMSVC; C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE [97432 2007-04-13] () [File not signed] R2 NishService; C:\Program Files\LG Software\System Control Manager\edd.exe [40960 2006-03-02] () [File not signed] R2 o2flash; C:\Program Files\O2Micro Oz128 Driver\o2flash.exe [65536 2007-02-12] (O2Micro International) [File not signed] S2 savesenselive; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-03-10] (SaveSense) S3 savesenselivem; C:\Program Files\SaveSenseLive\Update\SaveSenseLive.exe [146920 2014-03-10] (SaveSense) S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.) R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [47928 2013-09-26] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [200984 2014-07-21] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-08-06] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.) S2 E4LOADER; C:\Windows\System32\Drivers\e4ldr.sys [69656 2007-01-04] (Analog Deivces) S3 e4usbaw; C:\Windows\System32\DRIVERS\e4usbaw.sys [104344 2007-01-04] (Analog Devices Inc.) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-11-13] (Symantec Corporation) R3 MGHwCtrl; C:\Windows\system32\drivers\MGHwCtrl.sys [9088 2006-07-03] (Windows (R) 2000 DDK provider) [File not signed] R1 {c83c7c03-36f9-4f8f-aa6d-c837575d4eca}t; C:\Windows\System32\drivers\{c83c7c03-36f9-4f8f-aa6d-c837575d4eca}t.sys [55232 2014-04-24] (StdLib) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 cpuz134; \??\C:\Users\Gosia\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X] S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-28 18:26 - 2014-10-28 18:26 - 00020516 _____ () C:\Users\Gosia\Downloads\FRST.txt 2014-10-28 18:24 - 2014-10-28 18:26 - 00000000 ____D () C:\FRST 2014-10-28 18:23 - 2014-10-28 18:23 - 01104896 _____ (Farbar) C:\Users\Gosia\Downloads\FRST.exe 2014-10-28 18:16 - 2014-10-28 18:20 - 00000670 _____ () C:\Users\Gosia\Desktop\opis.txt 2014-10-28 17:59 - 2014-10-28 17:59 - 00000666 _____ () C:\Users\Gosia\Desktop\komunikat po bluescreen.txt 2014-10-28 17:55 - 2014-10-28 17:55 - 00138504 _____ () C:\Windows\Minidump\Mini102814-01.dmp 2014-10-28 17:30 - 2014-10-28 17:30 - 00000000 ____D () C:\Program Files\Common Files\Java 2014-10-28 17:29 - 2014-10-28 17:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-10-28 17:29 - 2014-10-28 17:28 - 00272808 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-10-28 17:29 - 2014-10-28 17:28 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-10-28 17:29 - 2014-10-28 17:28 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-10-28 17:29 - 2014-10-28 17:28 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-10-28 17:28 - 2014-10-28 17:28 - 00000000 ____D () C:\Program Files\Java 2014-10-25 17:41 - 2014-10-25 17:42 - 00138504 _____ () C:\Windows\Minidump\Mini102514-02.dmp 2014-10-25 05:17 - 2014-10-25 05:17 - 00000000 ____D () C:\Program Files\Common Files\Java(1) 2014-10-25 05:15 - 2014-10-25 05:15 - 00000000 ____D () C:\Program Files\Java(3) 2014-10-25 05:02 - 2014-10-25 05:02 - 00001983 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-10-25 05:02 - 2014-10-25 05:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-10-25 04:58 - 2014-10-25 04:58 - 00138504 _____ () C:\Windows\Minidump\Mini102514-01.dmp 2014-09-30 13:54 - 2014-09-30 14:00 - 498580680 _____ (Microsoft Corporation) C:\Users\Gosia\Downloads\Windows6.0-KB948465-X86.exe 2014-09-30 13:25 - 2014-09-30 13:37 - 781443488 _____ (Microsoft Corporation) C:\Users\Gosia\Downloads\Windows6.0-KB948465-X64.exe 2014-09-30 13:14 - 2014-09-30 13:15 - 00138504 _____ () C:\Windows\Minidump\Mini093014-02.dmp 2014-09-30 05:43 - 2014-09-30 05:44 - 00138504 _____ () C:\Windows\Minidump\Mini093014-01.dmp 2014-09-29 21:56 - 2014-09-29 21:56 - 00138504 _____ () C:\Windows\Minidump\Mini092914-01.dmp 2014-09-29 21:39 - 2014-09-29 21:39 - 00000000 ___RD () C:\Program Files\Skype 2014-09-29 21:39 - 2014-09-29 21:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2014-09-29 21:39 - 2014-09-29 21:39 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-09-29 05:26 - 2014-09-29 05:28 - 00004477 _____ () C:\Windows\system32\jupdate-1.7.0_67-b01.log 2014-09-28 23:05 - 2014-09-28 23:05 - 00868512 _____ (Opera Software) C:\Users\Gosia\Downloads\Opera_NI_stable.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-10-28 18:25 - 2013-07-10 21:42 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-10-28 18:24 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\tracing 2014-10-28 18:21 - 2013-01-22 23:32 - 00000000 ____D () C:\Users\Gosia\AppData\Roaming\Skype 2014-10-28 18:06 - 2014-05-27 17:15 - 00000000 ____D () C:\ProgramData\MFAData 2014-10-28 18:04 - 2014-03-10 15:59 - 00000918 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job 2014-10-28 17:59 - 2014-03-10 15:58 - 00000292 _____ () C:\Windows\Tasks\SaveSense.job 2014-10-28 17:59 - 2013-01-22 10:43 - 01176675 _____ () C:\Windows\WindowsUpdate.log 2014-10-28 17:58 - 2013-02-04 00:02 - 00000000 ____D () C:\Users\Gosia\AppData\Roaming\ipla 2014-10-28 17:56 - 2014-03-10 15:59 - 00000914 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job 2014-10-28 17:56 - 2013-09-03 23:46 - 00001200 _____ () C:\Windows\Tasks\HDvid Codec V1-updater.job 2014-10-28 17:56 - 2013-09-03 23:46 - 00001194 _____ () C:\Windows\Tasks\HDvid Codec V1-codedownloader.job 2014-10-28 17:56 - 2013-09-03 23:46 - 00001104 _____ () C:\Windows\Tasks\HDvid Codec V1-enabler.job 2014-10-28 17:56 - 2013-07-10 21:42 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-10-28 17:56 - 2013-06-23 23:33 - 00065536 _____ () C:\Windows\system32\Ikeext.etl 2014-10-28 17:56 - 2013-06-04 10:53 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2014-10-28 17:55 - 2013-09-06 07:28 - 00000000 ____D () C:\Windows\Minidump 2014-10-28 17:55 - 2013-09-06 07:27 - 194173381 _____ () C:\Windows\MEMORY.DMP 2014-10-28 17:55 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-10-28 17:55 - 2006-11-02 13:45 - 00003072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-10-28 17:55 - 2006-11-02 13:45 - 00003072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-10-28 17:49 - 2006-11-02 13:58 - 00032508 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-10-28 17:48 - 2007-02-04 04:32 - 00000012 _____ () C:\Windows\bthservsdp.dat 2014-10-28 17:47 - 2014-03-10 16:00 - 00000000 ____D () C:\ProgramData\WPM 2014-10-28 17:45 - 2014-03-10 16:00 - 00000000 ____D () C:\Program Files\SupTab 2014-10-28 17:31 - 2013-10-05 23:16 - 00000000 ____D () C:\ProgramData\Oracle 2014-10-28 17:27 - 2014-02-12 22:27 - 00000292 _____ () C:\Windows\Tasks\Digital Sites.job 2014-10-28 17:27 - 2013-07-09 15:27 - 00000286 _____ () C:\Windows\Tasks\DSite.job 2014-10-28 16:49 - 2013-01-22 02:30 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-10-28 15:31 - 2013-01-22 02:01 - 00000000 ____D () C:\Users\Gosia\Documents\Dokumenty moje 2014-10-28 15:19 - 2013-03-04 12:12 - 00000000 ____D () C:\ProgramData\CanonIJPLM 2014-10-28 14:56 - 2007-02-03 11:20 - 00535568 _____ () C:\Windows\system32\perfh015.dat 2014-10-28 14:56 - 2007-02-03 11:20 - 00086416 _____ () C:\Windows\system32\perfc015.dat 2014-10-28 14:56 - 2006-11-02 11:33 - 01326240 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-10-25 21:42 - 2013-01-22 01:55 - 00001356 _____ () C:\Users\Gosia\AppData\Local\d3d9caps.dat 2014-10-25 17:08 - 2013-01-22 01:55 - 00000000 ____D () C:\Users\Gosia 2014-10-25 17:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\spool 2014-10-25 17:05 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\registration 2014-10-25 17:05 - 2006-11-02 11:22 - 29097984 _____ () C:\Windows\system32\config\software_previous 2014-10-25 17:05 - 2006-11-02 11:22 - 23068672 _____ () C:\Windows\system32\config\components_previous 2014-10-25 17:05 - 2006-11-02 11:22 - 14680064 _____ () C:\Windows\system32\config\system_previous 2014-10-25 17:05 - 2006-11-02 11:22 - 00262144 _____ () C:\Windows\system32\config\default_previous 2014-10-25 17:05 - 2006-11-02 11:22 - 00053248 _____ () C:\Windows\system32\config\sam_previous 2014-10-25 17:05 - 2006-11-02 11:22 - 00020480 _____ () C:\Windows\system32\config\security_previous 2014-10-25 05:04 - 2013-01-22 02:17 - 00243932 _____ () C:\Windows\PFRO.log 2014-10-25 05:02 - 2013-07-10 21:41 - 00000000 ____D () C:\Users\Gosia\AppData\Local\Google 2014-10-25 05:01 - 2013-07-10 21:41 - 00000000 ____D () C:\Program Files\Google 2014-10-25 04:56 - 2013-01-22 01:56 - 00000955 _____ () C:\Users\Gosia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-10-25 04:46 - 2013-02-04 00:01 - 00000000 ____D () C:\Program Files\ipla 2014-10-25 04:45 - 2014-02-06 15:41 - 00000000 ____D () C:\ProgramData\ipla 2014-10-23 20:15 - 2013-01-22 04:06 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-10-23 20:13 - 2013-07-11 04:49 - 00000000 ____D () C:\Windows\system32\MRT 2014-10-23 19:54 - 2006-11-02 11:24 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-10-05 22:32 - 2014-08-26 15:30 - 00000000 ____D () C:\Users\Gosia\AppData\Local\Adobe 2014-10-05 22:21 - 2013-02-25 10:29 - 00000000 ____D () C:\Users\Gosia\Documents\Kościół 2014-09-30 15:17 - 2013-03-17 21:32 - 00000000 ____D () C:\Users\Gosia\AppData\Roaming\vlc 2014-09-30 13:22 - 2014-08-13 23:34 - 00000155 _____ () C:\Windows\Reimage.ini 2014-09-30 13:21 - 2013-02-07 19:51 - 00000000 ____D () C:\Program Files\Protected Search 2014-09-30 13:19 - 2014-01-18 22:06 - 00000000 ____D () C:\Program Files\RegClean Pro 2014-09-30 13:19 - 2013-01-23 09:06 - 00000000 ____D () C:\Users\Gosia\AppData\Roaming\Systweak 2014-09-29 21:39 - 2014-02-27 23:23 - 00001880 _____ () C:\Users\Public\Desktop\Skype.lnk 2014-09-29 21:39 - 2013-01-22 23:31 - 00000000 ____D () C:\ProgramData\Skype 2014-09-29 21:31 - 2014-02-06 15:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ipla 2014-09-29 21:31 - 2013-01-22 21:18 - 00000000 ____D () C:\Program Files\Opera 2014-09-29 07:46 - 2014-02-06 15:41 - 00000754 _____ () C:\Users\Public\Desktop\ipla.lnk 2014-09-28 23:49 - 2013-01-22 02:30 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-09-28 23:49 - 2013-01-22 02:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-09-28 23:15 - 2014-08-16 19:08 - 00043457 _____ () C:\Windows\system32\ScanResults.xml 2014-09-28 23:09 - 2014-08-16 19:03 - 00000464 _____ () C:\Windows\system32\ScannerSettings 2014-09-28 22:51 - 2014-05-27 17:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Files to move or delete: ==================== C:\Users\Gosia\Adobe-Reader(12627).exe C:\Users\Gosia\SaveAsPDFandXPS.exe Some content of TEMP: ==================== C:\Users\Gosia\AppData\Local\Temp\APNSetup.exe C:\Users\Gosia\AppData\Local\Temp\app.exe C:\Users\Gosia\AppData\Local\Temp\AskSLib.dll C:\Users\Gosia\AppData\Local\Temp\avguidx.dll C:\Users\Gosia\AppData\Local\Temp\dotnetfx35setup.exe C:\Users\Gosia\AppData\Local\Temp\iplC2A2.tmp.exe C:\Users\Gosia\AppData\Local\Temp\iplDECB.tmp.exe C:\Users\Gosia\AppData\Local\Temp\iplE13.tmp.exe C:\Users\Gosia\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe C:\Users\Gosia\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\Gosia\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe C:\Users\Gosia\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe C:\Users\Gosia\AppData\Local\Temp\LiveSupport_setup.exe C:\Users\Gosia\AppData\Local\Temp\MachineIdCreator.exe C:\Users\Gosia\AppData\Local\Temp\mgsqlite3.dll C:\Users\Gosia\AppData\Local\Temp\oi_{1CB3CACD-A4FC-4097-B2B0-31EF3294D47F}.exe C:\Users\Gosia\AppData\Local\Temp\ose00000.exe C:\Users\Gosia\AppData\Local\Temp\ReimageExpressSetup.exe C:\Users\Gosia\AppData\Local\Temp\ReimagePackage.exe C:\Users\Gosia\AppData\Local\Temp\SkypeSetup.exe C:\Users\Gosia\AppData\Local\Temp\sqlite3.exe C:\Users\Gosia\AppData\Local\Temp\UNINSTALL.EXE C:\Users\Gosia\AppData\Local\Temp\vcredist_x86.exe C:\Users\Gosia\AppData\Local\Temp\vsdel.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-10-28 18:02 ==================== End Of Log ============================