Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-01-2015 01
Ran by Kuba (administrator) on KUBA-KOMPUTER on 24-01-2015 19:50:56
Running from C:\Users\Kuba\Desktop\logi
Loaded Profiles: Kuba (Available profiles: Kuba & Gość)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Sony DADC Austria AG.) C:\Windows\SysWOW64\UAService7.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe
() C:\Program Files (x86)\Greenshot\Greenshot.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
() C:\Program Files\Rainmeter\Rainmeter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Wargaming.net) C:\Games\World_of_Tanks\WorldOfTanks.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10810912 2010-05-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2014752 2010-05-13] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2101032 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [SynBtnAsst] => C:\Program Files\Synaptics\SynTP\SynBtnAsst.exe [54568 2010-05-03] (Synaptics Incorporated)
HKLM\...\Run: [MRT] => C:\windows\system32\MRT.exe [113365784 2015-01-15] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [35184 2008-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [UCam_Menu] => c:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] => c:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [167008 2010-02-03] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2014-12-08] (Raptr, Inc)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [Greenshot] => C:\Program Files (x86)\Greenshot\Greenshot.exe [548864 2010-07-12] ()
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [Facebook Update] => C:\Users\Kuba\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [Google Update] => "C:\Users\Kuba\AppData\Local\Google\Update\GoogleUpdate.exe" /c
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [Vidalia] => C:\Program Files (x86)\Vidalia Bundle\Vidalia\vidalia.exe [5407850 2011-12-14] ()
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [ALLUpdate] => C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe [3510704 2014-04-17] (ALLPlayer Group Ltd.)
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\...\CurrentVersion\Windows: [Load] C:\Users\Kuba\LOCALS~1\Temp\ccceoh.exe <===== ATTENTION
HKU\S-1-5-18\...\RunOnce: [Del13882996] => cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" <===== ATTENTION
HKU\S-1-5-18\...\RunOnce: [Del19802392] => cmd.exe /Q /D /c del "C:\windows\TEMP\0.del" <===== ATTENTION
Startup: C:\Users\Kuba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk
ShortcutTarget: Rainmeter.lnk -> C:\Program Files\Rainmeter\Rainmeter.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3839221274-3043303846-3843884880-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocnik rejestracji usługi Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: IplexToALLPlayer -> {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} -> C:\Program Files (x86)\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 62.179.1.62 62.179.1.63
Tcpip\..\Interfaces\{3C6BEDAC-295D-4CCA-B7C0-D29B9025112B}: [NameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Kuba\AppData\Roaming\Mozilla\Firefox\Profiles\fetm9tq7.default
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandasecurity.com/activescan -> C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
FF Plugin-x32: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF Plugin HKU\S-1-5-21-3839221274-3043303846-3843884880-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\Kuba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKU\S-1-5-21-3839221274-3043303846-3843884880-1000: @tools.google.com/Google Update;version=3 -> C:\Users\Kuba\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Plugin HKU\S-1-5-21-3839221274-3043303846-3843884880-1000: @tools.google.com/Google Update;version=9 -> C:\Users\Kuba\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File
FF Extension: Web Counselor - C:\Users\Kuba\AppData\Roaming\Mozilla\Firefox\Profiles\fetm9tq7.default\Extensions\{25dd52dc-89a8-469d-9e8f-8d483095d1e8} [2014-10-01]
FF Extension: Torbutton - C:\Users\Kuba\AppData\Roaming\Mozilla\Firefox\Profiles\fetm9tq7.default\Extensions\{e0204bd5-9d31-402b-a99d-a6aa8ffebdca}.xpi [2014-06-01]
FF Extension: Skype extension - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-01-21]

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Plugin: (Shockwave Flash) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_0\McChPlg.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll No File
CHR Plugin: (Panda ActiveScan 2.0) - C:\Program Files (x86)\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security, S.L.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Windows Live® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Kuba\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Google Update) - C:\Users\Kuba\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No File
CHR Profile: C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-03-10]
CHR Extension: (Dysk Google) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-03-10]
CHR Extension: (YouTube) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-03-10]
CHR Extension: (Szukaj w Google) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-03-10]
CHR Extension: (Google Wallet) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (Gmail) - C:\Users\Kuba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-03-10]
StartMenuInternet: Google Chrome.3L66V3FMTC45VZTRPN5MKY4USQ - C:\Users\Kuba\AppData\Local\Google\Chrome\Application\chrome.exe
StartMenuInternet: Opera - C:\Program Files (x86)\Opera\Opera.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 MSSQL$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [40999448 2008-07-10] (Microsoft Corporation)
S4 SQLAgent$SQLEXPRESS; c:\Program Files (x86)\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [369688 2008-07-10] (Microsoft Corporation)
R2 UserAccess7; C:\windows\SysWOW64\UAService7.exe [221184 2011-04-24] (Sony DADC Austria AG.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\DRIVERS\amdkmpfd.sys [62152 2014-10-28] (Advanced Micro Devices, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-10-27] (Disc Soft Ltd)
R1 HWiNFO32; C:\windows\system32\drivers\HWiNFO64A.SYS [26528 2015-01-08] (REALiX(tm))
S1 ujtzlwkw; \??\C:\windows\system32\drivers\ujtzlwkw.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-21 15:42 - 2015-01-21 15:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-17 14:24 - 2015-01-17 14:24 - 00114350 _____ () C:\Users\Kuba\Downloads\FileKing-pl-zaglodzeni-starve-2014-480pweb-dlxvidac3-j25-lektor-pl-82304.torrent
2015-01-17 14:16 - 2015-01-17 14:16 - 00015038 _____ () C:\Users\Kuba\Downloads\FileKing-pl-igrzyska-smierci-kosoglos-czesc-1-the-hunger-games-mockingjay-part-1-2014blured-ts-xvid-mors-napisy-pl-81971.torrent
2015-01-17 12:04 - 2015-01-17 12:04 - 00057194 _____ () C:\Users\Kuba\Downloads\FileKing-pl-krypta-cryptic-2014-hdtvxvid-j25-lektor-pl-82302.torrent
2015-01-15 16:48 - 2015-01-15 16:48 - 00000218 _____ () C:\Users\Kuba\AppData\Local\recently-used.xbel
2015-01-14 15:24 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\profsvc.dll
2015-01-14 15:24 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxdav.sys
2015-01-14 15:24 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2015-01-14 15:24 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2015-01-14 15:24 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2015-01-14 15:24 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2015-01-14 15:24 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2015-01-14 15:24 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2015-01-14 15:24 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2015-01-14 15:24 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\TSWbPrxy.exe
2015-01-14 15:24 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2015-01-14 15:24 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2015-01-14 15:24 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2015-01-12 09:20 - 2015-01-12 09:20 - 00014604 _____ () C:\Users\Kuba\Downloads\FileKing-pl-slepy-traf-runner-runner-2013-brrip-xvid-cwnc-lektor-pl-64841.torrent
2015-01-12 09:00 - 2015-01-12 09:00 - 00015012 _____ () C:\Users\Kuba\Downloads\FileKing-pl-sasiedzi-neighbors-2014-bdrip-xvid-kit-lektor-pl-agusiq-75198.torrent
2015-01-12 08:54 - 2015-01-12 08:54 - 00015882 _____ () C:\Users\Kuba\Downloads\FileKing-pl-igrzyska-smierci-w-pierscieniu-ognia-the-hunger-games-catching-fire-2013-brrip-ac3-xvid-kit-lektor-pl-agusiq-63776.torrent
2015-01-12 08:48 - 2015-01-12 08:48 - 00014663 _____ () C:\Users\Kuba\Downloads\FileKing-pl-klik-i-robisz-co-chcesz-click-2006-brrip-xvid-lektor-pl-50602.torrent
2015-01-10 15:04 - 2015-01-10 15:04 - 00113457 _____ () C:\Users\Kuba\Downloads\[kickass.so]deliverance.creek.2014.hdrip.xvid.ac3.evo.torrent
2015-01-10 15:03 - 2015-01-10 15:03 - 00006526 _____ () C:\Users\Kuba\Downloads\[kickass.so]the.anatomy.of.violence.the.biological.roots.of.crime.2013.torrent
2015-01-10 15:01 - 2015-01-10 15:01 - 00029420 _____ () C:\Users\Kuba\Downloads\[kickass.so]for.sale.by.owner.2009.dvdrip.xvid.ifn.torrent
2015-01-10 14:59 - 2015-01-10 14:59 - 00014943 _____ () C:\Users\Kuba\Downloads\[kickass.so]opancerzony.armored.2009.dvdrip.xvid.er.lektor.pl.agusiq.torrent
2015-01-08 19:47 - 2015-01-08 19:47 - 00026528 _____ (REALiX(tm)) C:\windows\system32\Drivers\HWiNFO64A.SYS
2015-01-08 19:44 - 2015-01-08 19:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64
2015-01-08 19:44 - 2015-01-08 19:44 - 00000000 ____D () C:\Program Files\HWiNFO64
2015-01-08 19:43 - 2015-01-08 19:43 - 02699320 _____ (Martin Malík - REALiX ) C:\Users\Kuba\Downloads\hw64_448.exe
2015-01-07 14:36 - 2015-01-07 14:36 - 00015080 _____ () C:\Users\Kuba\Downloads\[kickass.so]the.magic.of.ordinary.days.torrent
2015-01-07 14:28 - 2015-01-07 14:28 - 00012555 _____ () C:\Users\Kuba\Downloads\[kickass.so]obława.takedown.2000.dvdrip.xvid.lektor.pl.depesz11.torrent
2015-01-07 14:26 - 2015-01-07 14:26 - 00017793 _____ () C:\Users\Kuba\Downloads\[kickass.so]chill.factor.1999.720p.brrip.850mb.mkvcage.torrent
2015-01-05 19:54 - 2015-01-05 19:54 - 00016540 _____ () C:\Users\Kuba\Downloads\[kickass.so]tove.lo.truth.serum.2014.ep.torrent
2015-01-04 22:33 - 2015-01-04 22:33 - 00015046 _____ () C:\Users\Kuba\Downloads\FileKing-pl-krzyk-scream-1996-tvrip-xvid-lektor-pl-40748.torrent
2015-01-04 22:26 - 2015-01-04 22:26 - 00015117 _____ () C:\Users\Kuba\Downloads\FileKing-pl-teksanska-masakra-pila-mechaniczna-poczatek-the-texas-chainsaw-massacre-the-beginning-2006-dvdrip-xvid-lektor-pl-39363.torrent
2015-01-04 21:55 - 2015-01-04 21:55 - 00025582 _____ () C:\Users\Kuba\Downloads\FileKing-pl-eagle-eye-2008-720-brrip-xvid-ac3-lts-lektor-pl-68063.torrent
2015-01-04 21:48 - 2015-01-04 21:48 - 00028620 _____ () C:\Users\Kuba\Downloads\[kickass.so]frontière.s.torrent
2015-01-04 21:47 - 2015-01-04 21:47 - 00013052 _____ () C:\Users\Kuba\Downloads\FileKing-pl-frontieres-frontiegraveres-2007-dvdrip-xvid-miguel-lektor-pl-fk-43188.torrent
2015-01-03 22:53 - 2015-01-03 22:53 - 00014818 _____ () C:\Users\Kuba\Downloads\FileKing-pl-droga-bez-powrotu-6-hotel-na-uboczu-wrong-turn-6-last-resort-2014-dvdrip-xvid-gr4pe-lektor-pl-81655.torrent
2015-01-02 20:35 - 2015-01-02 20:36 - 54843014 _____ () C:\Users\Kuba\Downloads\download (1).zip
2015-01-02 20:26 - 2015-01-02 20:26 - 53961839 _____ () C:\Users\Kuba\Downloads\download.zip
2015-01-02 13:58 - 2015-01-02 13:58 - 00788296 _____ ( ) C:\Users\Kuba\Downloads\installer_adobe_flash_player_English.exe
2014-12-30 21:29 - 2014-12-30 21:29 - 02381736 _____ (Lenovo Group ) C:\Users\Kuba\Downloads\IN1CHP22WW1.exe
2014-12-28 22:38 - 2014-12-28 22:41 - 302470552 _____ (AMD Inc.) C:\Users\Kuba\Downloads\amd-catalyst-omega-14.12-with-dotnet45-win7-64bit (1).exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 19:51 - 2013-09-13 12:45 - 00000000 ____D () C:\FRST
2015-01-24 19:50 - 2014-09-12 18:56 - 00000000 ____D () C:\Users\Kuba\Desktop\logi
2015-01-24 19:25 - 2013-03-10 17:24 - 00001054 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000UA.job
2015-01-24 19:07 - 2012-03-27 17:57 - 00001074 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000UA.job
2015-01-24 18:45 - 2010-11-03 11:09 - 02083628 _____ () C:\windows\WindowsUpdate.log
2015-01-24 17:27 - 2014-06-01 14:50 - 00000000 ____D () C:\Users\Kuba\AppData\Roaming\Vidalia
2015-01-24 17:27 - 2014-06-01 14:50 - 00000000 ____D () C:\Users\Kuba\AppData\Roaming\Tor
2015-01-24 17:25 - 2013-03-10 17:24 - 00001002 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000Core.job
2015-01-24 16:12 - 2009-07-14 05:45 - 00022464 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-24 16:12 - 2009-07-14 05:45 - 00022464 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-24 16:06 - 2014-12-16 21:39 - 00000000 ____D () C:\Users\Kuba\AppData\Roaming\Raptr
2015-01-24 16:04 - 2014-05-07 17:00 - 00043387 _____ () C:\windows\setupact.log
2015-01-24 16:04 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2015-01-24 01:07 - 2012-03-27 17:57 - 00001052 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3839221274-3043303846-3843884880-1000Core.job
2015-01-22 09:21 - 2012-05-12 21:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-21 00:33 - 2011-04-07 22:32 - 00000000 ____D () C:\Users\Kuba\AppData\Roaming\SoftGrid Client
2015-01-19 22:31 - 2014-10-06 22:26 - 00000000 ____D () C:\Users\Kuba\Desktop\Filmy
2015-01-17 21:23 - 2014-10-01 10:43 - 00000000 ____D () C:\Users\Kuba\AppData\Roaming\uTorrent
2015-01-17 11:55 - 2010-11-03 18:55 - 00807312 _____ () C:\windows\system32\perfh015.dat
2015-01-17 11:55 - 2010-11-03 18:55 - 00181686 _____ () C:\windows\system32\perfc015.dat
2015-01-17 11:55 - 2009-07-14 06:13 - 01858932 _____ () C:\windows\system32\PerfStringBackup.INI
2015-01-15 07:22 - 2013-08-02 00:51 - 00000000 ____D () C:\windows\system32\MRT
2015-01-15 07:22 - 2011-08-15 20:58 - 113365784 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2015-01-09 18:04 - 2011-04-06 16:53 - 00000000 ____D () C:\Users\Kuba
2015-01-09 18:04 - 2009-07-14 06:08 - 00032604 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2015-01-08 20:48 - 2014-12-16 21:31 - 00000000 ____D () C:\Program Files\AMD
2015-01-07 20:05 - 2013-09-01 19:39 - 00000000 ___RD () C:\Users\Kuba\Desktop\notatki
2015-01-06 04:36 - 2012-08-05 08:09 - 00298120 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2015-01-03 14:44 - 2013-11-26 14:22 - 00000000 ____D () C:\Program Files (x86)\WarThunder
2014-12-28 22:32 - 2014-05-27 21:22 - 00012000 _____ () C:\windows\PFRO.log
2014-12-27 09:55 - 2012-12-01 23:04 - 00000000 ___RD () C:\Users\Kuba\Desktop\wot
2014-12-26 09:15 - 2011-07-09 07:39 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-12-25 09:34 - 2014-12-24 20:59 - 00003882 _____ () C:\windows\System32\Tasks\Opera scheduled Autoupdate 1419451148

==================== Files in the root of some directories =======

2015-01-15 16:48 - 2015-01-15 16:48 - 0000218 _____ () C:\Users\Kuba\AppData\Local\recently-used.xbel
2011-11-15 00:42 - 2014-10-10 06:39 - 0007632 _____ () C:\Users\Kuba\AppData\Local\Resmon.ResmonCfg
2013-06-09 18:25 - 2013-06-09 18:27 - 0000000 _____ () C:\ProgramData\kjhy64.txt
2014-02-11 21:53 - 2014-02-11 21:53 - 0000017 _____ () C:\ProgramData\systemskey.ini

Some content of TEMP:
====================
C:\Users\Kuba\AppData\Local\Temp\4234-torbutton-1.2.0-fx_sciagnij.exe
C:\Users\Kuba\AppData\Local\Temp\APNSetup.exe
C:\Users\Kuba\AppData\Local\Temp\babcabebbfj.exe
C:\Users\Kuba\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Kuba\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Kuba\AppData\Local\Temp\IrsoDLL.dll
C:\Users\Kuba\AppData\Local\Temp\NSISCodec.dll
C:\Users\Kuba\AppData\Local\Temp\Quarantine.exe
C:\Users\Kuba\AppData\Local\Temp\raptrpatch.exe
C:\Users\Kuba\AppData\Local\Temp\raptr_stub.exe
C:\Users\Kuba\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Kuba\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Kuba\AppData\Local\Temp\sqlite3.dll
C:\Users\Kuba\AppData\Local\Temp\ubiF147.tmp.exe
C:\Users\Kuba\AppData\Local\Temp\war3_install.exe
C:\Users\Kuba\AppData\Local\Temp\_isB7DE.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-14 01:23

==================== End Of Log ============================