Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-01-2015 01 Ran by GRAD (administrator) on SERVER on 15-01-2015 20:48:41 Running from C:\Users\GRAD\Downloads Loaded Profiles: GRAD (Available profiles: Projektant & GRAD & Gość) Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Polski (Polska) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Safe Mode (with Networking) Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (TeamViewer GmbH) C:\Users\GRAD\AppData\Local\Temp\TeamViewer\TeamViewer.exe (TeamViewer GmbH) C:\Users\GRAD\AppData\Local\Temp\TeamViewer\TeamViewer_Desktop.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [LogMeIn GUI] => "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [ToolBoxFX] => C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe [53248 2010-01-27] (HP) HKLM\...\Run: [HP LaserJet M2727 MFP Series Fax] => C:\Program Files\HP\hp LaserJet M2727\hppfaxprintersrv.exe [2453504 2009-09-22] (Hewlett-Packard Company) HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2005-02-16] (Hewlett-Packard Co.) HKLM\...\Run: [] => [X] HKLM\...\Run: [HPUsageTracking] => C:\Program Files\HP\HP UT\bin\hppusg.exe [36864 2007-08-31] () HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Endpoint Security\egui.exe [3141320 2014-09-24] (ESET) HKU\S-1-5-21-2328316672-3808866255-1709578514-1001\...\MountPoints2: {4a7a3589-a130-11e0-be87-806e6f6e6963} - D:\autorun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\TP-LINK Wireless Utility.lnk ShortcutTarget: TP-LINK Wireless Utility.lnk -> C:\Program Files\TP-LINK\COMMON\TWCU.exe (TP-LINK TECHNOLOGIES CO., LTD. ) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Tcpip\..\Interfaces\{CA6FFA2D-04C4-44A4-B280-057F8214BB73}: [NameServer] 8.8.8.8 FireFox: ======== FF ProfilePath: C:\Users\GRAD\AppData\Roaming\Mozilla\Firefox\Profiles\8ixzn9vx.default FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Adblock Plus Pop-up Addon - C:\Users\GRAD\AppData\Roaming\Mozilla\Firefox\Profiles\8ixzn9vx.default\Extensions\adblockpopups@jessehakanen.net.xpi [2015-01-02] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Endpoint Security\Mozilla Thunderbird FF Extension: ESET Endpoint Security Extension - C:\Program Files\ESET\ESET Endpoint Security\Mozilla Thunderbird [2015-01-02] Chrome: ======= ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 C2PublicFolders; C:\Program Files\CodeTwo\C2PublicFoldersServer\C2PublicFoldersServer.exe [1035472 2011-08-30] (CodeTwo(R)) [File not signed] S2 C2PublicFoldersBackupService; C:\Program Files\CodeTwo\C2PublicFoldersServer\C2PublicFoldersBackupService.exe [341504 2011-08-30] (CodeTwo(R)) [File not signed] S3 EhttpSrv; C:\Program Files\ESET\ESET Endpoint Security\EHttpSrv.exe [33992 2014-09-24] (ESET) S2 ekrn; C:\Program Files\ESET\ESET Endpoint Security\ekrn.exe [1029704 2014-09-24] (ESET) S3 ERA_HTTP_SERVER; C:\Program Files\ESET\ESET Remote Administrator\Server\EHttpSrv.exe [98584 2014-05-15] (ESET) S2 ERA_SERVER; C:\Program Files\ESET\ESET Remote Administrator\Server\era.exe [4840752 2014-05-15] (ESET) S3 ESHASRV; C:\Program Files\ESET\ESET Endpoint Security\EShaSrv.exe [188104 2014-09-24] (ESET) S2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [310272 2012-06-01] (Microsoft Corporation) S2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [136192 2009-11-12] (HP) [File not signed] S3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [217088 2007-03-11] (Hewlett-Packard Co.) [File not signed] S2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-03-11] (Hewlett-Packard Co.) [File not signed] S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed] S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed] S2 RalinkRegistryWriter; C:\Program Files\TP-LINK\COMMON\RaRegistry.exe [185632 2010-06-25] (Ralink Technology, Corp.) S2 sysdown; C:\Windows\system32\sysdown.exe [19344 2013-11-22] (Hewlett-Packard Company) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) S2 MaintainerSvc1.11.3209076; "C:\ProgramData\a68d9eea-b970-45e3-ba05-b4a5e2e396bc\maintainer.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [177472 2014-08-19] (ESET) S1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [128056 2014-08-19] (ESET) S2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [157408 2014-08-19] (ESET) R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [35368 2014-08-19] (ESET) S0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [48728 2014-09-10] (ESET) S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R0 HpAHCIsr; C:\Windows\System32\DRIVERS\HpAHCIsr.sys [182376 2010-05-28] (Hewlett-Packard Company) R3 hpqmgmt; C:\Windows\System32\DRIVERS\hpqmgmt.sys [70544 2013-11-22] (Hewlett-Packard Company) S3 netr28u; C:\Windows\System32\DRIVERS\netr28u.sys [854368 2010-06-25] (Ralink Technology Corp.) S2 LMIInfo; \??\C:\Program Files\LogMeIn\x86\RaInfo.sys [X] S4 LMIRfsClientNP; No ImagePath U3 ufldypob; \??\C:\Users\GRAD\AppData\Local\Temp\ufldypob.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-15 20:48 - 2015-01-15 20:48 - 00008598 _____ () C:\Users\GRAD\Downloads\FRST.txt 2015-01-15 20:48 - 2015-01-15 20:48 - 00000000 ____D () C:\FRST 2015-01-15 20:47 - 2015-01-15 20:47 - 01116672 _____ (Farbar) C:\Users\GRAD\Downloads\FRST.exe 2015-01-15 20:45 - 2015-01-15 20:45 - 02125312 _____ (Farbar) C:\Users\GRAD\Downloads\FRST64.exe 2015-01-15 20:45 - 2015-01-15 20:45 - 00380416 _____ () C:\Users\GRAD\Downloads\gu37uevg.exe 2015-01-15 20:43 - 2015-01-15 20:43 - 05338272 _____ (TeamViewer) C:\Users\GRAD\Downloads\TeamViewerQS_pl-ckq(1).exe 2015-01-14 10:25 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-01-14 10:25 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 10:25 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 10:23 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 10:22 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 10:22 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-07 14:52 - 2015-01-07 14:52 - 05338272 _____ (TeamViewer) C:\Users\GRAD\Downloads\TeamViewerQS_pl-ckq.exe 2015-01-07 14:12 - 2015-01-07 14:13 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2015-01-07 10:12 - 2015-01-07 14:46 - 00000000 ____D () C:\AdwCleaner 2015-01-07 10:11 - 2015-01-07 10:11 - 02173952 _____ () C:\Users\GRAD\Downloads\AdwCleaner.exe 2015-01-02 14:00 - 2015-01-02 14:00 - 00000000 ____D () C:\Users\GRAD\AppData\Roaming\ESET 2015-01-02 14:00 - 2015-01-02 14:00 - 00000000 ____D () C:\Users\GRAD\AppData\Local\ESET 2015-01-02 13:43 - 2015-01-02 13:44 - 68134912 _____ () C:\Users\GRAD\Downloads\ees_nt32_plk.msi 2015-01-02 13:30 - 2015-01-02 13:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET 2015-01-02 13:30 - 2015-01-02 13:54 - 00000000 ____D () C:\ProgramData\ESET 2015-01-02 13:30 - 2015-01-02 13:54 - 00000000 ____D () C:\Program Files\ESET 2015-01-02 13:24 - 2015-01-02 13:25 - 59686912 _____ () C:\Users\GRAD\Downloads\era_server_nt32_plk.msi 2014-12-17 20:25 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-15 20:48 - 2011-06-28 04:04 - 01750856 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-15 20:48 - 2009-07-14 09:07 - 00772978 _____ () C:\Windows\system32\perfh015.dat 2015-01-15 20:48 - 2009-07-14 09:07 - 00166594 _____ () C:\Windows\system32\perfc015.dat 2015-01-15 19:46 - 2011-07-13 17:54 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-15 13:02 - 2009-07-14 05:34 - 00029152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-15 13:02 - 2009-07-14 05:34 - 00029152 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-15 12:18 - 2011-07-13 17:54 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-15 12:16 - 2011-06-28 03:45 - 01926380 _____ () C:\Windows\WindowsUpdate.log 2015-01-15 12:11 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-15 12:08 - 2009-07-14 05:39 - 00042962 _____ () C:\Windows\setupact.log 2015-01-15 03:06 - 2013-08-08 02:01 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-15 03:03 - 2011-06-27 22:28 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-14 12:37 - 2011-06-28 07:22 - 00087660 _____ () C:\Windows\PFRO.log 2015-01-07 21:45 - 2013-09-16 15:10 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-01-07 14:52 - 2014-06-07 10:57 - 00000000 ____D () C:\Users\GRAD\AppData\Roaming\TeamViewer 2015-01-07 10:16 - 2009-07-14 03:04 - 00000592 _____ () C:\Windows\win.ini 2015-01-06 04:36 - 2011-06-27 22:27 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-01-02 14:54 - 2011-06-28 07:28 - 00000000 ___RD () C:\PENTAGON 2015-01-02 14:51 - 2014-10-29 23:52 - 00000000 ____D () C:\ProgramData\a68d9eea-b970-45e3-ba05-b4a5e2e396bc 2015-01-02 13:49 - 2012-05-09 02:02 - 00001912 _____ () C:\Windows\epplauncher.mif 2015-01-02 09:42 - 2011-06-28 08:59 - 00000000 ____D () C:\BOSS Some content of TEMP: ==================== C:\Users\GRAD\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 00:22 ==================== End Of Log ============================