Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015 Ran by Jacek (administrator) on ACER on 16-01-2015 12:01:35 Running from C:\Users\Jacek\Desktop\raport Loaded Profile: Jacek (Available profiles: Jacek) Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: Polski (Polska) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Egis Technology Inc.) C:\Program Files\Acer Bio Protection\CompPtcVUI.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (ClickCaption) C:\Program Files\ClickCaption_1.10.0.6\Service\ccsvc.exe (Egis Technology Inc.) C:\Program Files\Acer Bio Protection\BASVC.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Avast Software) C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (AlcorMicro Co., Ltd.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (ZTE) C:\Program Files\T-Mobile\InternetManager_Z\Bin\mcserver.exe (Microsoft Corporation) C:\Windows\System32\cmd.exe () C:\Program Files\T-Mobile\InternetManager_Z\Bin\dbus-daemon.exe () C:\Program Files\T-Mobile\InternetManager_Z\Bin\db_daemon.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Farbar) C:\Users\Jacek\Desktop\raport\Farbar Recovery Scan Tool (FRST) 7.1.2015.0 ( 32bit).exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-11-30] (Realtek Semiconductor) HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2009-04-02] (AlcorMicro Co., Ltd.) HKLM\...\Run: [VitaKeyPdtWzd] => C:\Program Files\Acer Bio Protection\PdtWzd.exe [3567616 2009-09-05] (Egis Technology Inc.) HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1537320 2009-06-18] (Synaptics Incorporated) HKLM\...\Run: [Sage Komunikator] => C:\Program Files\Sage\Komunikator\SageUpdt.exe [247008 2010-11-15] () HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [ControlCenter3] => C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.) HKLM\...\Run: [BrStsMon00] => C:\Program Files\Browny02\Brother\BrStMonW.exe [2621440 2010-02-09] (Brother Industries, Ltd.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-14] (AVAST Software) HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [3872080 2010-04-16] (Microsoft Corporation) HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3514176 2011-11-10] (DT Soft Ltd) HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\...\MountPoints2: {95dd1aa3-60c2-11e3-bba5-001f16c49629} - F:\setup.exe HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-04-04] (Microsoft Corporation) Lsa: [Notification Packages] C:\Program Files\Acer Bio Protection\PwdFilter Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\mcserver.lnk ShortcutTarget: mcserver.lnk -> C:\Program Files\T-Mobile\InternetManager_Z\Bin\mcserver.exe (ZTE) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ShellIconOverlayIdentifiers: [GDriveBlacklistedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: [GDriveSharedEditOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: [GDriveSharedViewOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: [GDriveSyncedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) ShellIconOverlayIdentifiers: [GDriveSyncingOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files\Google\Drive\googledrivesync32.dll (Google) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mystartsearch.com/?type=hppp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1421096046&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1421096046&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=dspp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.mystartsearch.com/?type=hppp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX HKU\S-1-5-21-2949696853-1657588460-2157650677-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=dspp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1421096046&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX SearchScopes: HKLM -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=2921&r=2015/01/12&hid=7335698499489535646&lg=EN&cc=PL&unqvl=74 SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=ds&ts=1421096046&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} SearchScopes: HKLM -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=2921&r=2015/01/12&hid=7335698499489535646&lg=EN&cc=PL&unqvl=74 SearchScopes: HKU\S-1-5-21-2949696853-1657588460-2157650677-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} SearchScopes: HKU\S-1-5-21-2949696853-1657588460-2157650677-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.mystartsearch.com/web/?type=dspp&ts=1421096091&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX&q={searchTerms} SearchScopes: HKU\S-1-5-21-2949696853-1657588460-2157650677-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.thesearchpage.info/?l=1&q={searchTerms}&pid=2921&r=2015/01/12&hid=7335698499489535646&lg=EN&cc=PL&unqvl=74 BHO: uaniSaales -> {29f954b1-bf1a-4310-b36d-23d46383d2cd} -> C:\Program Files\uaniSaales\sAiId2fMAkJRei.dll () BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: unisaoles -> {80d325f8-a215-4f3a-bede-33b8b3706129} -> C:\Program Files\unisaoles\zs6UoeBcFTfVCw.dll () BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Pomocnik rejestracji usługi Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: youtubeadblocker -> {a5970951-edbd-494a-9016-c603330698e6} -> C:\Program Files\youtubeadblocker\wYU0jcyjVALCLF.dll () BHO: Adblock Plus for IE Browser Helper Object -> {FFCB3198-32F3-4E8B-9539-4324694ED664} -> C:\Program Files\Adblock Plus for IE\AdblockPlus32.dll (Adblock Plus) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.55.1 FireFox: ======== FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2015-01-14] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR DefaultSearchKeyword: Default -> D7F746F4BE0BB4725686EC0385F86ADE47904E2EF920DBCDAF621E7E59E3DF60 CHR DefaultSearchURL: Default -> F92F7B982FC04D9310A52AA67FA87432D51ECD8B1E59978C538BB182C1FD7168 CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\internal-nacl-plugin No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\pdf.dll () CHR Profile: C:\Users\Jacek\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avast Online Security) - C:\Users\Jacek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2015-01-16] CHR Extension: (Browse Save Win) - C:\Users\Jacek\AppData\Local\Google\Chrome\User Data\Default\Extensions\lghjfnfolmcikomdjmoiemllfnlmmoko [2015-01-12] CHR Extension: (Google Wallet) - C:\Users\Jacek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-31] CHR Extension: (unisaoles) - C:\ProgramData\nnemiiegoljppknkjanlnjehlokgldjp\ [2014-08-31] CHR Extension: (unisalEs) - C:\ProgramData\plhjhkdnechhnhnnkjbmilfbmaflobma\ [2014-08-31] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-01-14] CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.mystartsearch.com/?type=sc&ts=1421096046&from=wpc&uid=HitachiXHTS545050B9A300_090823PB4406Q7C415EAX ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 24c54e38; c:\Program Files\DeltaFix\DeltaFix.dll [4182016 2015-01-12] () [File not signed] <==== ATTENTION R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2015-01-14] (AVAST Software) R3 AvastVBoxSvc; C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe [3192344 2015-01-14] (Avast Software) R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed] R2 ccsvc_1.10.0.6; C:\Program Files\ClickCaption_1.10.0.6\Service\ccsvc.exe [277584 2015-01-07] (ClickCaption) R2 IGBASVC; C:\Program Files\Acer Bio Protection\BASVC.exe [3450368 2009-09-05] (Egis Technology Inc.) [File not signed] S3 ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [620544 2008-11-11] (Nokia.) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [25728 2011-02-11] (Google Inc) [File not signed] R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2015-01-14] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2015-01-14] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2015-01-14] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2015-01-14] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2015-01-14] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2015-01-14] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2015-01-14] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2015-01-14] () R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [13184 2009-12-15] (Bytemobile, Inc.) [File not signed] S3 BMserDiag; C:\Windows\System32\DRIVERS\BMserDiag.sys [87424 2009-11-26] (Global Wireless Incorporated) [File not signed] S3 BMserNmea; C:\Windows\System32\DRIVERS\BMserNmea.sys [87424 2009-11-26] (Global Wireless Incorporated) [File not signed] S3 BMusbmdm; C:\Windows\System32\DRIVERS\BMusbmdm.sys [87424 2009-11-26] (Global Wireless Incorporated) [File not signed] R1 ccnfd_1_10_0_6; C:\Windows\System32\drivers\ccnfd_1_10_0_6.sys [52728 2015-01-07] (ClickCaption) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [239168 2011-12-09] (DT Soft Ltd) S2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [29744 2010-07-07] (EgisTec) S3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [36640 2009-12-22] () [File not signed] R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2009-07-21] (Windows (R) Win 7 DDK provider) R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2009-07-21] (Nuvoton Technology Corporation) S3 qcusbnet; C:\Windows\System32\DRIVERS\qcusbnet.sys [136192 2012-10-26] (QUALCOMM Incorporated) S3 qcusbser; C:\Windows\System32\DRIVERS\qcusbser.sys [110080 2012-10-26] (QUALCOMM Incorporated) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2011-12-09] (Duplex Secure Ltd.) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [24192 2009-12-15] (Bytemobile, Inc.) [File not signed] R2 VBoxAswDrv; C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [218192 2015-01-14] (Avast Software) S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [67968 2011-08-10] (ZTE) S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [9984 2011-08-10] (ZTE) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) U3 pxldrpob; \??\C:\Users\Jacek\AppData\Local\Temp\pxldrpob.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 11:34 - 2015-01-16 11:34 - 00000000 _____ () C:\Users\Jacek\Downloads\FRST.exe.xsak89w.partial 2015-01-16 11:07 - 2015-01-16 12:01 - 00000000 ____D () C:\FRST 2015-01-16 11:04 - 2015-01-16 11:04 - 00000000 ____D () C:\Program Files\ClickCaption_1.10.0.6 2015-01-16 10:54 - 2015-01-16 10:54 - 00380416 _____ () C:\Users\Jacek\Downloads\5u29e0wc.exe 2015-01-16 10:50 - 2015-01-16 12:01 - 00000000 ____D () C:\Users\Jacek\Desktop\raport 2015-01-15 20:24 - 2015-01-15 20:24 - 00000197 _____ () C:\Windows\system32\2015-01-15-19-24-45.075-AvastVBoxSVC.exe-2736.log 2015-01-15 16:32 - 2015-01-15 16:33 - 00000197 _____ () C:\Windows\system32\2015-01-15-15-32-56.092-AvastVBoxSVC.exe-2556.log 2015-01-15 11:38 - 2015-01-15 11:38 - 00000197 _____ () C:\Windows\system32\2015-01-15-10-38-19.081-AvastVBoxSVC.exe-2544.log 2015-01-15 06:23 - 2015-01-15 06:23 - 00000197 _____ () C:\Windows\system32\2015-01-15-05-23-05.071-AvastVBoxSVC.exe-2512.log 2015-01-14 20:26 - 2015-01-14 20:33 - 00000247 _____ () C:\Windows\system32\2015-01-14-19-26-21.079-aswFe.exe-6096.log 2015-01-14 20:26 - 2015-01-14 20:26 - 00000197 _____ () C:\Windows\system32\2015-01-14-19-26-14.084-AvastVBoxSVC.exe-3252.log 2015-01-14 20:12 - 2015-01-14 20:12 - 00000000 ____D () C:\Windows\system32\vbox 2015-01-14 20:10 - 2015-01-14 20:10 - 00000000 ____D () C:\Users\Jacek\AppData\Roaming\AVAST Software 2015-01-14 20:06 - 2015-01-14 20:06 - 00091496 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys 2015-01-14 20:06 - 2015-01-14 20:06 - 00024184 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-01-14 20:06 - 2015-01-14 20:06 - 00002045 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2015-01-14 20:06 - 2015-01-14 20:05 - 00291352 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2015-01-14 20:05 - 2015-01-14 20:05 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr 2015-01-14 20:03 - 2015-01-14 20:06 - 00206248 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-01-14 20:03 - 2015-01-14 20:06 - 00049944 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-01-14 19:59 - 2015-01-14 19:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2015-01-14 19:58 - 2015-01-14 20:36 - 00787800 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys 2015-01-14 19:58 - 2015-01-14 20:36 - 00423784 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys 2015-01-14 19:58 - 2015-01-14 20:06 - 00070384 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-01-14 19:58 - 2015-01-14 20:05 - 00081768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys 2015-01-14 19:52 - 2015-01-14 19:53 - 00002152 _____ () C:\Users\Jacek\Desktop\Google Chrome.lnk 2015-01-14 16:22 - 2015-01-14 20:14 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2015-01-14 05:09 - 2014-12-19 03:43 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 05:09 - 2014-12-19 02:34 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 05:09 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-01-14 05:09 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 05:09 - 2014-12-11 18:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 05:09 - 2014-12-06 04:50 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-12 22:04 - 2015-01-12 22:04 - 00000000 ____D () C:\ProgramData\nnemiiegoljppknkjanlnjehlokgldjp 2015-01-12 22:04 - 2015-01-12 22:04 - 00000000 ____D () C:\Program Files\unisaoles 2015-01-12 21:55 - 2015-01-13 11:07 - 00000000 ____D () C:\Program Files\XTab 2015-01-12 21:55 - 2015-01-12 21:55 - 00000000 ____D () C:\ProgramData\IHProtectUpDate 2015-01-12 21:52 - 2015-01-12 22:05 - 00000000 ____D () C:\Program Files\DeltaFix 2015-01-12 21:52 - 2015-01-12 21:52 - 00000000 ____D () C:\Program Files\youtubeadblocker 2015-01-12 21:52 - 2015-01-12 21:52 - 00000000 ____D () C:\Program Files\Browse Save Win 2015-01-12 21:51 - 2015-01-12 21:51 - 00000000 ____D () C:\ProgramData\plhjhkdnechhnhnnkjbmilfbmaflobma 2015-01-12 21:51 - 2015-01-12 21:51 - 00000000 ____D () C:\ProgramData\5744965725342391347 2015-01-12 21:51 - 2015-01-12 21:51 - 00000000 ____D () C:\Program Files\unisalEs 2015-01-12 21:51 - 2015-01-12 21:51 - 00000000 ____D () C:\Program Files\uaniSaales 2015-01-12 21:45 - 2015-01-12 21:50 - 00000000 ____D () C:\Users\Jacek\Desktop\Nowy folder (2) 2015-01-12 21:00 - 2015-01-12 20:50 - 167115973 _____ () C:\Users\Jacek\Desktop\People Are Awesome 2014 (INSANE Edition).mp4 2015-01-11 18:42 - 2015-01-11 18:48 - 00000000 ____D () C:\Users\Jacek\Desktop\anka 2015-01-07 20:04 - 2015-01-07 20:04 - 00052728 _____ (ClickCaption) C:\Windows\system32\Drivers\ccnfd_1_10_0_6.sys 2015-01-01 19:00 - 2015-01-01 19:07 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-01-01 19:00 - 2015-01-01 19:00 - 00001989 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk 2014-12-31 20:08 - 2014-12-31 20:08 - 01442364 _____ () C:\Users\Jacek\Downloads\Anim8orTutorial02a.zip 2014-12-31 20:08 - 2007-01-04 23:24 - 00030508 _____ () C:\Users\Jacek\Downloads\TutorialAnim8orRocket.htm 2014-12-31 20:08 - 2007-01-04 23:10 - 00000000 ____D () C:\Users\Jacek\Downloads\Data 2014-12-31 20:08 - 2006-11-26 17:54 - 00000000 ____D () C:\Users\Jacek\Downloads\Textures 2014-12-29 18:33 - 2014-12-29 18:34 - 00000000 ____D () C:\Users\Jacek\Desktop\skoda 2014-12-24 14:34 - 2014-12-24 14:35 - 00000000 ____D () C:\Users\Jacek\Desktop\serwatko 2014-12-18 06:50 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-16 11:59 - 2011-07-14 22:42 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-16 11:37 - 2014-12-09 17:11 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-16 11:34 - 2009-07-14 05:34 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-16 11:34 - 2009-07-14 05:34 - 00026032 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-16 11:32 - 2010-07-07 10:41 - 01670590 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-16 11:32 - 2009-07-14 09:07 - 00740688 _____ () C:\Windows\system32\perfh015.dat 2015-01-16 11:32 - 2009-07-14 09:07 - 00156230 _____ () C:\Windows\system32\perfc015.dat 2015-01-16 11:31 - 2010-07-07 10:33 - 01271462 _____ () C:\Windows\WindowsUpdate.log 2015-01-16 11:25 - 2010-07-21 19:32 - 00000000 ____D () C:\Users\Jacek\Tracing 2015-01-16 11:24 - 2011-07-14 22:42 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-16 11:24 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-16 11:24 - 2009-07-14 05:39 - 00458936 _____ () C:\Windows\setupact.log 2015-01-15 06:19 - 2012-10-17 13:22 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-01-14 20:07 - 2010-07-07 13:26 - 03098604 _____ () C:\Windows\PFRO.log 2015-01-14 20:03 - 2011-07-14 06:33 - 00000000 ____D () C:\ProgramData\AVAST Software 2015-01-14 20:03 - 2009-07-14 03:04 - 00002577 _____ () C:\Windows\system32\config.nt 2015-01-14 19:59 - 2011-07-14 22:42 - 00000000 ____D () C:\Users\Jacek\AppData\Local\Google 2015-01-14 19:59 - 2011-07-14 22:42 - 00000000 ____D () C:\Program Files\Google 2015-01-14 19:57 - 2011-07-14 22:41 - 00000000 ____D () C:\Program Files\AVAST Software 2015-01-14 16:37 - 2014-12-09 17:11 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-01-14 16:37 - 2011-09-18 03:26 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-01-13 20:05 - 2010-07-07 10:40 - 00001395 _____ () C:\Users\Jacek\Desktop\Internet Explorer.lnk 2015-01-12 21:54 - 2012-02-21 06:31 - 00001647 _____ () C:\Users\Jacek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-01-06 04:36 - 2014-10-16 13:21 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-01-01 19:00 - 2010-07-26 12:11 - 00000000 ____D () C:\Users\Jacek\AppData\Local\Adobe 2015-01-01 19:00 - 2010-07-21 17:29 - 00000000 ____D () C:\Users\Jacek\AppData\Roaming\Adobe 2015-01-01 19:00 - 2010-07-07 14:13 - 00000000 ____D () C:\ProgramData\Adobe 2015-01-01 19:00 - 2010-07-07 14:13 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-01-01 19:00 - 2010-07-07 14:13 - 00000000 ____D () C:\Program Files\Adobe 2014-12-23 11:31 - 2010-09-20 14:29 - 00000000 ____D () C:\Users\Jacek\AppData\Local\Thunderbird Some content of TEMP: ==================== C:\Users\Jacek\AppData\Local\Temp\ICReinstall_Farbar Recovery Scan Tool.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-14 18:24 ==================== End Of Log ============================