Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01 Ran by Sylwester Sobkowiak (administrator) on SOBKOWIAK on 28-01-2015 10:40:05 Running from Z:\T.Tomala Loaded Profiles: Sylwester Sobkowiak (Available profiles: Sylwester Sobkowiak & Iga) Platform: Microsoft® Windows Vista™ Business Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (American Power Conversion Corporation) C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe () C:\LAB-EL\LBX\bin\lbxdnt.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE (Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Fujitsu Siemens Computers) C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Windows\System32\msiexec.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (Farbar) \\serwer\Udostepniony\T.Tomala\FRST.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [2219184 2011-11-22] (ESET) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\MountPoints2: {93f8ba75-e0bd-11df-aa00-0019994c5304} - E:\urDrive.exe HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\MountPoints2: {9ba5e0d5-47b5-11df-847e-0019994c5304} - F:\LaunchU3.exe -a HKU\S-1-5-18\...\Run: [Google Update] => C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-02-10] (Google Inc.) Startup: C:\Users\Sylwester Sobkowiak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKU\S-1-5-21-4057883698-1414104491-491510895-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie SearchScopes: HKU\S-1-5-21-4057883698-1414104491-491510895-1000 -> {A10AD535-E267-425B-A265-F8DCA7C8D738} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll (Oracle Corporation) DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1216156.dll (Adobe Systems, Inc.) FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=3 -> C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=9 -> C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2015-01-28] Chrome: ======= CHR HomePage: Default -> CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Sylwester Sobkowiak\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Wallet) - C:\Users\Sylwester Sobkowiak\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-04] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 APC UPS Service; C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe [689408 2007-07-19] (American Power Conversion Corporation) S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed] S3 EhttpSrv; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [33584 2011-11-22] (ESET) R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [814264 2011-11-22] (ESET) R2 lbxd; C:\LAB-EL\LBX\bin\lbxdnt.exe [12288 2013-08-27] () [File not signed] R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed] S3 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed] R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.) R2 TestHandler; C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [303104 2008-04-25] (Fujitsu Siemens Computers) [File not signed] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 BrPar; C:\Windows\System32\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed] S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-10-12] (Samsung Electronics Co., Ltd.) [File not signed] R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k6032.sys [197800 2009-12-10] (Intel Corporation) R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [137144 2011-11-21] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [115008 2011-11-21] (ESET) R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [95384 2011-11-21] (ESET) S4 oxpar; C:\Windows\system32\drivers\oxpar.sys [80128 2007-01-24] (OEM) R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-10-12] (Samsung Electronics) [File not signed] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-28 10:38 - 2015-01-28 10:38 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2015-01-28 10:38 - 2015-01-28 10:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-01-28 10:37 - 2015-01-28 10:37 - 00639400 _____ (Oracle Corporation) C:\Users\Sylwester Sobkowiak\Downloads\chromeinstall-8u31.exe 2015-01-28 10:28 - 2015-01-28 10:28 - 00000000 ____D () C:\Windows\LastGood 2015-01-28 10:27 - 2015-01-28 10:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET 2015-01-28 10:27 - 2015-01-28 10:27 - 00000000 ____D () C:\ProgramData\ESET 2015-01-28 10:27 - 2015-01-28 10:27 - 00000000 ____D () C:\Program Files\ESET 2015-01-28 10:20 - 2015-01-28 10:20 - 00000000 ____D () C:\Windows\system32\Adobe 2015-01-22 14:04 - 2015-01-22 14:06 - 00006793 _____ () C:\Users\Sylwester Sobkowiak\Desktop\~ESETUninstaller.log 2015-01-22 14:01 - 2015-01-22 13:50 - 00671432 _____ (ESET) C:\Users\Sylwester Sobkowiak\Desktop\ESETUninstaller.exe 2015-01-22 10:10 - 2015-01-22 10:11 - 00000884 _____ () C:\zoek-results.log 2015-01-22 10:09 - 2015-01-22 10:11 - 00000000 ____D () C:\zoek_backup 2015-01-22 10:09 - 2015-01-22 10:09 - 01295360 _____ () C:\Users\Sylwester Sobkowiak\Downloads\zoek.exe 2015-01-22 10:02 - 2015-01-22 10:02 - 00000000 ____D () C:\Program Files\Windows Defender 2015-01-07 09:24 - 2015-01-07 09:24 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\Sylwester Sobkowiak\Downloads\tdsskiller.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-28 10:40 - 2014-12-02 07:22 - 00000000 ____D () C:\FRST 2015-01-28 10:38 - 2014-12-02 10:25 - 00000000 ____D () C:\Program Files\Java 2015-01-28 10:38 - 2011-07-29 06:02 - 00000454 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{5C715285-0C41-4E61-BC0D-C03F3902D05C}.job 2015-01-28 10:32 - 2014-11-13 11:14 - 00747816 _____ () C:\Windows\WindowsUpdate.log 2015-01-28 10:29 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-28 10:29 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-28 10:28 - 2008-11-05 12:34 - 00000000 ____D () C:\Users\Sylwester Sobkowiak 2015-01-28 10:22 - 2008-11-05 12:51 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-01-28 10:20 - 2008-11-12 11:44 - 00000000 ____D () C:\Windows\system32\Macromed 2015-01-28 10:18 - 2008-11-05 12:27 - 00000000 ____D () C:\ProgramData\Adobe 2015-01-28 10:15 - 2010-06-02 12:21 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-28 09:48 - 2014-02-10 11:43 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-18UA.job 2015-01-28 07:15 - 2014-10-21 05:55 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfeceb423b1e10.job 2015-01-28 07:00 - 2013-04-08 06:46 - 01627632 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-28 07:00 - 2008-04-14 22:18 - 00707140 _____ () C:\Windows\system32\perfh015.dat 2015-01-28 07:00 - 2008-04-14 22:18 - 00149392 _____ () C:\Windows\system32\perfc015.dat 2015-01-28 06:56 - 2010-06-02 12:21 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-28 06:55 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-27 15:01 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-27 11:48 - 2014-02-10 11:43 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-18Core.job 2015-01-27 07:17 - 2014-05-26 13:35 - 00001983 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-01-26 08:03 - 2013-09-18 10:46 - 00000678 _____ () C:\Windows\BRCALIB.INI 2015-01-22 14:07 - 2006-11-02 13:47 - 00387504 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-01-22 14:03 - 2014-11-13 11:46 - 00079426 _____ () C:\Windows\PFRO.log 2015-01-22 10:02 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\pl-PL 2015-01-16 12:57 - 2008-11-05 13:53 - 00000069 _____ () C:\Windows\NeroDigital.ini 2015-01-15 11:01 - 2014-12-23 07:39 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-08 09:55 - 2009-10-05 06:06 - 00249488 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe ==================== Files in the root of some directories ======= 2012-01-04 08:54 - 2012-01-04 08:54 - 0030941 _____ () C:\Users\Sylwester Sobkowiak\AppData\Roaming\UserTile.png 2013-09-13 10:17 - 2014-11-13 07:27 - 0000308 _____ () C:\Users\Sylwester Sobkowiak\AppData\Roaming\WB.CFG 2008-11-05 15:59 - 2014-11-25 13:54 - 0017920 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2009-11-19 09:46 - 2009-11-19 09:46 - 0000600 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\PUTTY.RND 2011-03-02 10:59 - 2011-03-02 10:59 - 0002170 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\unins000.dat 2012-05-18 06:20 - 2012-05-18 06:25 - 0000358 _____ () C:\ProgramData\hpzinstall.log Some content of TEMP: ==================== C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\GLB1A2B.EXE C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\jre-8u31-windows-au.exe C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\lbxkeycheck.exe C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\vcredist_x86.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-28 07:01 ==================== End Of Log ============================