Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-11-2014 Ran by oem (administrator) on OEM-PC on 02-11-2014 18:06:23 Running from C:\Users\oem\Desktop\dezynfekcja Loaded Profile: oem (Available profiles: oem & UpdatusUser) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Malwarebytes Corporation) H:\ Files\Malwarebytes Anti-Malware\mbamscheduler.exe () C:\Program Files\ASUS\EPU-6 Engine\SixEngine.exe (Malwarebytes Corporation) H:\ Files\Malwarebytes Anti-Malware\mbamservice.exe (Raxco Software, Inc.) C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe (Malwarebytes Corporation) H:\ Files\Malwarebytes Anti-Malware\mbam.exe () C:\Windows\System32\PSIService.exe (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Raxco Software, Inc.) C:\Program Files\Raxco\PerfectDisk\PDAgent.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmplayer.exe (Raxco Software, Inc.) C:\Program Files\Raxco\PerfectDisk\PDAgentS1.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\System32\conime.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6266880 2008-07-03] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Windows\Skytel.exe [1826816 2008-06-25] (Realtek Semiconductor Corp.) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-07] (AVAST Software) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\MountPoints2: D - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\START.html HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\MountPoints2: {a0c6dcb9-1991-11e1-8a36-00221517bcbb} - K:\Startme.exe HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\MountPoints2: {a803483a-c3cf-11dd-ade9-00221517bcbb} - K:\Setup.exe HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\MountPoints2: {b7520a45-67a0-11de-a236-00221517bcbb} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL sxs.exe HKU\S-1-5-21-1173195434-3095283291-1674841262-1001\...\MountPoints2: {f3ef73eb-cc52-11e2-a224-00221517bcbb} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\START.html ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) BootExecute: PDBoot.exeautocheck autochk * ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1401465415&from=wpc&uid=ST3320613AS_9SZ0AY34XXXX9SZ0AY34&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Backup.Old.Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1401465415&from=wpc&uid=ST3320613AS_9SZ0AY34XXXX9SZ0AY34&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com StartMenuInternet: IEXPLORE.EXE - iexplore.exe SearchScopes: HKLM - Backup.Old.DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} SearchScopes: HKLM - {768D0F96-8B0E-7DFF-8E53-5B93D52C3275} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091 SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://start.funmoods.com/results.php?f=4&q={searchTerms}&a=iron2&chnl=iron2&cd=2XzuyEtN2Y1L1QzutDtDtBtBtCyDtCyB0B0C0B0BtA0BtDyCtN0D0Tzu0CtBtAyEtN1L2XzutBtFtCtFtCtFtAtCtB&cr=1675312693 SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms} SearchScopes: HKLM - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKCU - Backup.Old.DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} SearchScopes: HKCU - 35EF8322F42D4BCD99DC083745EEFE15 URL = http://isearch.avg.com/search?cid={AF6C28BE-BD48-47D1-AE4E-3DFFA628C2C8}&mid=780cad32e5dfd6bfdeebcc3df246f663-34e985a55237710ff26fa09697eaaa4fc353a451&lang=pl&ds=AVG&pr=fr&d=2012-06-10 08:17:52&v=11.1.0.7&sap=dsp&q={searchTerms} SearchScopes: HKCU - {1F096B29-E9DA-4D64-8D63-936BE7762CC5} URL = http://search.babylon.com/?babsrc=SP_ss&q={searchTerms}&mntrId=b80f3b0600000000000000221517bcbb&tlver=1.4.19.19&ss=1&affID=17981 SearchScopes: HKCU - {28DC2F23-8DD3-4332-A7CE-BCDA9CBEC507} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms} SearchScopes: HKCU - {768D0F96-8B0E-7DFF-8E53-5B93D52C3275} URL = SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9} URL = http://www.daemon-search.com/search/web?q={searchTerms} SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = SearchScopes: HKCU - {EEE7E0A3-AE64-4dc8-84D1-F5D7BAF2DB0C} URL = http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&query={searchTerms}&invocationType=tb50winampie7 BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: No Name -> {7E853D72-626A-48EC-A868-BA8D5E23E045} -> No File BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Pomocnik rejestracji usługi Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKLM - No Name - !{98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKCU - No Name - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No File Toolbar: HKCU - No Name - {32099AAC-C132-4136-9E9A-4E364A424E17} - No File Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 62.179.1.60 62.179.1.61 FireFox: ======== FF ProfilePath: C:\Users\oem\AppData\Roaming\Mozilla\Firefox\Profiles\gzdw4odx.default-1414943952013 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin: @real.com/nppl3260;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.448 -> C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin HKCU: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll (LizardTech) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nprpjplug.dll (RealNetworks, Inc.) FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mystartsearch.xml FF Extension: ArcaBit Ext. - C:\Program Files\Mozilla Firefox\extensions\arcabit@www.arcabit.pl [2013-07-03] FF Extension: Babylon - C:\Program Files\Mozilla Firefox\extensions\ffxtlbr@babylon.com [2013-07-03] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-07-03] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-10] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-01-07] FF HKCU\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04] Chrome: ======= CHR Profile: C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Dokumenty Google) - C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-07] CHR Extension: (avast! Online Security) - C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-07] CHR Extension: (Google Wallet) - C:\Users\oem\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-07] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-08-07] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-08-07] (AVAST Software) S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 MBAMScheduler; h:\ Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation) R2 MBAMService; h:\ Files\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.) S3 NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [774144 2007-01-05] (Nero AG) [File not signed] S3 NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [262144 2006-12-23] (Nero AG) [File not signed] R2 PDAgent; C:\Program Files\Raxco\PerfectDisk\PDAgent.exe [2066224 2013-12-12] (Raxco Software, Inc.) R2 PDEngine; C:\Program Files\Common Files\Raxco\Shared\PDEngine.exe [2189616 2013-12-12] (Raxco Software, Inc.) R2 ProtexisLicensing; C:\Windows\system32\PSIService.exe [174656 2006-11-02] () [File not signed] R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.) S3 usnjsvc; C:\Program Files\Windows Live\Messenger\usnsvc.exe [98328 2007-10-18] (Microsoft Corporation) S3 WLSetupSvc; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [266240 2007-10-25] (Microsoft Corporation) S2 AVTasks2; C:\PROGRA~1\ArcaBit\Common\ARCATA~1.EXE [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 AsIO; C:\Windows\System32\drivers\AsIO.sys [12400 2007-12-17] () R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-08-07] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-08-07] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [55112 2014-08-07] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-08-07] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [779536 2014-08-07] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [414520 2014-08-07] (AVAST Software) R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57800 2014-08-07] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [192352 2014-08-07] () R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [278984 2008-11-07] () R2 DefragFS; C:\Windows\system32\Drivers\DefragFS.sys [104088 2012-09-11] (Raxco Software, Inc.) R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [47616 2008-02-02] (Atheros Communications, Inc.) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25416 2008-11-07] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-10-01] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-11-02] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-10-01] (Malwarebytes Corporation) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [7680 2006-10-18] () R0 mv61xx; C:\Windows\System32\DRIVERS\mv61xx.sys [143360 2007-10-19] (Marvell Semiconductor, Inc.) R2 PDFSFilter; C:\Windows\System32\DRIVERS\PDFsFilter.sys [69016 2012-08-23] (Raxco Software, Inc.) S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [124016 2009-11-19] (MCCI Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [320120 2014-11-02] (Duplex Secure Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-02 17:29 - 2014-11-02 17:30 - 00032323 _____ () C:\Users\oem\Downloads\Addition.txt 2014-11-02 17:29 - 2014-11-02 17:29 - 00085224 _____ () C:\Users\oem\Downloads\Shortcut.txt 2014-11-02 17:28 - 2014-11-02 17:30 - 00032543 _____ () C:\Users\oem\Downloads\FRST.txt 2014-11-02 17:28 - 2014-11-02 17:28 - 00602112 _____ (OldTimer Tools) C:\Users\oem\Downloads\OTL.exe 2014-11-02 17:27 - 2014-11-02 18:06 - 00000000 ___DC () C:\FRST 2014-11-02 17:27 - 2014-11-02 18:06 - 00000000 ____D () C:\Users\oem\Desktop\dezynfekcja 2014-11-02 17:18 - 2014-11-02 17:18 - 00000000 _____ () C:\Users\oem\Desktop\Nowy dokument tekstowy.txt 2014-11-02 17:16 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll 2014-11-02 17:15 - 2014-11-02 17:16 - 00000000 ___DC () C:\AdwCleaner 2014-11-02 17:15 - 2014-11-02 17:15 - 01375089 _____ () C:\Users\oem\Downloads\adwcleaner_3.311.exe 2014-11-02 16:59 - 2014-11-02 16:59 - 00000000 ____D () C:\Users\oem\Desktop\Stare dane programu Firefox 2014-11-02 16:38 - 2014-11-02 16:38 - 00000000 ____D () C:\Windows\pss 2014-11-02 14:55 - 2014-11-02 14:55 - 00000000 ____D () C:\ProgramData\Package Cache 2014-11-02 14:53 - 2014-11-02 14:53 - 00000648 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\The Sims 4.lnk 2014-10-19 19:09 - 2014-10-19 19:29 - 00000000 ____D () C:\Users\oem\AppData\Roaming\mystartsearch 2014-10-19 19:08 - 2014-10-19 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite 2014-10-18 06:52 - 2014-06-15 23:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll 2014-10-18 06:52 - 2014-06-13 19:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll 2014-10-18 06:52 - 2014-06-13 19:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll 2014-10-18 06:50 - 2014-09-28 00:29 - 02054656 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-10-18 05:32 - 2014-09-05 00:27 - 00143360 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys 2014-10-18 05:31 - 2014-09-16 17:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll 2014-10-17 20:04 - 2014-10-17 20:04 - 00000000 ____D () C:\Users\oem\Downloads\DokumentyKadrowe 2014-10-17 20:00 - 2014-10-17 20:00 - 00077694 _____ () C:\Users\oem\Downloads\DokumentyKadrowe(1).zip 2014-10-17 19:49 - 2014-10-17 19:50 - 00077694 _____ () C:\Users\oem\Downloads\DokumentyKadrowe.zip 2014-10-17 10:23 - 2014-10-17 10:23 - 00012591 _____ () C:\Users\oem\Downloads\Nie o Mary Wagner 2014 [DVDRip XviD] [PL][Torrenty.org].torrent 2014-10-17 10:21 - 2014-10-17 10:21 - 00120552 _____ () C:\Users\oem\Downloads\Posrod_Wilkow_-_Raised_By_Wolves_ 2014 _[HQ DVDRip XViD AC3-NOiSE]_[Lektor_PL][Torrenty.org].torrent 2014-10-17 10:19 - 2014-10-17 10:19 - 00015008 _____ () C:\Users\oem\Downloads\Jestem_twoja_-_I_Am_Yours_ 2013 _[BRRip]_[XViD-MX]_[Lektor_PL][Torrenty.org].torrent 2014-10-17 10:19 - 2014-10-17 10:19 - 00014744 _____ () C:\Users\oem\Downloads\Pustynne_pieklo_-_Heatstroke_ 2013 _[BDRip]_[XviD-KiT]_[Lektor_PL][marcinc33][Torrenty.org].torrent 2014-10-17 10:19 - 2014-10-17 10:19 - 00000000 _____ () C:\Users\oem\Downloads\Tammy_ 2014 _[WEB-DL]_[XviD-KiT]_[Napisy_PL][Torrenty.org].torrent 2014-10-17 10:18 - 2014-10-17 10:18 - 00057153 _____ () C:\Users\oem\Downloads\Leprechaun_Origins_ 2014 _[BRRip XviD-M4RULEK]_[Napisy_PL][Torrenty.org].torrent 2014-10-17 10:18 - 2014-10-17 10:18 - 00015012 _____ () C:\Users\oem\Downloads\The_Anomaly_ 2014 _[DVDRip]_[AC3]_[XviD-M4RULEK]_[Napisy_PL][Torrenty.org].torrent 2014-10-17 10:18 - 2014-10-17 10:18 - 00000000 _____ () C:\Users\oem\Downloads\Zycie_Adeli_-_Rozdzial_1_i_2_-_Blue_Is_the_Warmest_Color_ 2013 _[480p BRRip XviD AC3-azjatycki]_[5 1]_[Lektor_PL]_[AT-TEAM][Torrenty.org].torrent 2014-10-17 10:17 - 2014-10-17 10:17 - 00014877 _____ () C:\Users\oem\Downloads\Zbaw_nas_ode_zlego_-_Deliver_us_From_Evil_ 2014 _[BRRip]_[XViD-K12]_[ENG]_[Napisy_PL]_[marcinc33][Torrenty.org].torrent 2014-10-17 06:40 - 2014-09-19 23:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-10-17 06:40 - 2014-09-19 23:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-10-17 06:40 - 2014-09-19 23:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-10-17 06:40 - 2014-09-19 23:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-10-17 06:40 - 2014-09-19 23:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-10-17 06:40 - 2014-09-19 23:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-10-17 06:40 - 2014-09-19 23:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-10-17 06:40 - 2014-09-19 23:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-10-17 06:40 - 2014-09-19 23:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-10-17 06:40 - 2014-09-19 23:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-10-17 06:40 - 2014-09-19 23:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-10-17 06:40 - 2014-09-19 23:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-10-17 06:40 - 2014-09-19 23:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-10-17 06:40 - 2014-09-19 23:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-10-17 06:40 - 2014-09-19 23:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-10-17 06:40 - 2014-09-19 23:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-10-17 06:40 - 2014-09-19 23:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-10-17 06:40 - 2014-09-19 23:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-10-17 06:40 - 2014-09-19 23:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-10-17 06:40 - 2014-09-19 23:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-10-17 06:40 - 2014-09-19 23:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-10-12 12:49 - 2014-10-12 12:49 - 10350624 _____ (Azureus Software, Inc.) C:\Users\oem\Downloads\Vuze_5400_Installer32.exe 2014-10-11 18:14 - 2014-10-11 18:14 - 00015200 _____ () C:\Users\oem\Downloads\Ta_ostatnia_noc_-_About_Last_Night_ 2014 _[BRRip]_[XviD]_[Lektor_PL][Torrenty.org].torrent ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-11-02 18:03 - 2013-05-05 12:25 - 00000000 ____D () C:\Windows\Minidump 2014-11-02 18:03 - 2011-11-28 15:26 - 00000000 ____D () C:\Users\oem\AppData\Roaming\Azureus 2014-11-02 18:03 - 2008-10-03 10:27 - 00000000 ____D () C:\Users\oem\AppData\Roaming\Media Player Classic 2014-11-02 17:45 - 2008-01-21 07:24 - 04634740 _____ () C:\Windows\system32\perfh015.dat 2014-11-02 17:45 - 2008-01-21 07:24 - 01511290 _____ () C:\Windows\system32\perfc015.dat 2014-11-02 17:45 - 2008-01-21 07:24 - 00004926 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-11-02 17:44 - 2008-08-29 10:46 - 01352075 ____N () C:\Windows\WindowsUpdate.log 2014-11-02 17:41 - 2014-06-05 19:37 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-11-02 17:39 - 2013-06-08 12:10 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job 2014-11-02 17:39 - 2013-05-31 19:11 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2014-11-02 17:39 - 2008-07-19 11:28 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-11-02 17:39 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-11-02 17:39 - 2006-11-02 13:47 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-11-02 17:39 - 2006-11-02 13:47 - 00003664 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-11-02 17:38 - 2012-10-13 14:26 - 00000012 _____ () C:\Windows\bthservsdp.dat 2014-11-02 17:38 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-11-02 17:36 - 2008-10-22 21:30 - 00320120 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys 2014-11-02 17:29 - 2013-03-07 12:07 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-11-02 16:45 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\Performance 2014-11-02 16:41 - 2008-07-19 11:36 - 00000000 ____D () C:\Program Files\Windows Live Toolbar 2014-11-02 16:24 - 2014-06-05 19:37 - 00000662 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-11-02 15:56 - 2008-11-19 23:34 - 00007916 _____ () C:\Users\oem\AppData\Local\d3d9caps.dat 2014-11-02 15:55 - 2010-03-16 14:18 - 00000000 ____D () C:\ProgramData\ipla 2014-11-02 08:53 - 2008-10-03 06:39 - 00030720 _____ () C:\Users\oem\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-11-01 21:52 - 2012-11-25 20:17 - 00000000 ____D () C:\Users\oem\AppData\Roaming\Skype 2014-11-01 07:44 - 2014-07-22 12:05 - 00000000 ____D () C:\Users\oem\Desktop\pierwszy wypadek 2014-11-01 06:54 - 2010-03-16 14:18 - 00000000 ____D () C:\Users\oem\AppData\Roaming\ipla 2014-10-30 16:36 - 2013-07-03 07:35 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-10-27 05:13 - 2006-11-02 12:18 - 00000000 ___RD () C:\Windows\Offline Web Pages 2014-10-26 12:07 - 2014-06-05 19:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-10-24 21:46 - 2014-09-01 13:17 - 00000000 ____D () C:\Users\oem\AppData\Roaming\Systweak 2014-10-19 19:09 - 2011-05-12 12:22 - 00001145 _____ () C:\Users\oem\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-10-19 19:09 - 2011-05-09 11:11 - 00001042 _____ () C:\Users\oem\Desktop\Mozilla Firefox.lnk 2014-10-18 12:21 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2014-10-18 11:43 - 2006-11-02 13:47 - 00372792 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-10-18 06:52 - 2008-07-19 11:50 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-10-18 06:47 - 2013-08-16 02:05 - 00000000 ____D () C:\Windows\system32\MRT 2014-10-18 05:33 - 2006-11-02 11:24 - 100290944 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-10-17 20:00 - 2008-07-19 11:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2014-10-16 18:28 - 2012-11-25 20:17 - 00000000 ___RD () C:\Program Files\Skype 2014-10-16 18:28 - 2012-11-25 20:17 - 00000000 ____D () C:\ProgramData\Skype 2014-10-13 18:29 - 2009-03-05 08:49 - 00000000 _____ () C:\Users\oem\AppData\Roaming\AVSMediaPlayer.m3u 2014-10-12 12:51 - 2011-11-28 15:26 - 00000000 ____D () C:\Program Files\Vuze 2014-10-12 12:50 - 2011-11-28 15:26 - 00001593 _____ () C:\Users\Public\Desktop\Vuze.lnk 2014-10-12 12:50 - 2011-11-28 15:26 - 00001593 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Vuze.lnk 2014-10-11 16:02 - 2008-08-29 10:53 - 00000000 ____D () C:\Users\oem 2014-10-06 14:17 - 2014-07-22 10:14 - 00000000 ____D () C:\Users\oem\Desktop\drugi wypadek Files to move or delete: ==================== C:\ProgramData\pswi_preloaded.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-11-02 17:45 ==================== End Of Log ============================