Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-02-2015 02
Ran by 1 (administrator) on 1-KOMPUTER on 12-02-2015 23:00:17
Running from C:\Users\1\Downloads
Loaded Profiles: 1 (Available profiles: 1)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(XTab system) C:\Program Files (x86)\XTab\HPNotify.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Spotify Ltd) C:\Users\1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files (x86)\Dynamo Combo\bin\utilDynamoCombo.exe
() C:\Users\1\Downloads\rlq6327p.exe
() C:\Program Files (x86)\Dynamo Combo\bin\DynamoCombo.PurBrowse64.exe
() C:\Program Files (x86)\Dynamo Combo\bin\DynamoCombo.BrowserAdapter64.exe
() C:\Program Files (x86)\Dynamo Combo\bin\DynamoCombo.BrowserAdapter.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\prevhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227112 2015-01-27] (AVAST Software)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\...\Run: [EA Core] => "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\ChomikBox.exe
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\...\Run: [Spotify] => C:\Users\1\AppData\Roaming\Spotify\Spotify.exe [6737976 2014-12-17] (Spotify Ltd)
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\...\Run: [Spotify Web Helper] => C:\Users\1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-17] (Spotify Ltd)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-12] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-09-12] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
BootExecute: autocheck autochk * aswBoot.exe /M:a31b574ee7 /wow /dir:"C:\Program Files\AVAST Software\Avast"
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420871780&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420871780&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420871780&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420871780&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
HKU\S-1-5-21-2654220689-2568901334-3418674353-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2654220689-2568901334-3418674353-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
SearchScopes: HKU\S-1-5-21-2654220689-2568901334-3418674353-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Dynamo Combo 1.0.0.7 -> {986c37a1-7b65-476f-80dc-54f80bd4b0d6} -> C:\Program Files (x86)\Dynamo Combo\DynamoComboBHO.dll (Dynamo Combo)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKU\S-1-5-21-2654220689-2568901334-3418674353-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.3

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2654220689-2568901334-3418674353-1000: pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-10-18]

Chrome: 
=======
CHR HomePage: Default -> hxxp://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6
CHR StartupUrls: Default -> "hxxp://isearch.omiga-plus.com/?type=hppp&ts=1420871792&from=cor&uid=ST320LT012-9WS14C_S0V8FKG6XXXXS0V8FKG6"
CHR DefaultSearchKeyword: Default -> omiga-plus
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\1\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-10-18]
CHR Extension: (Dysk Google) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-10-18]
CHR Extension: (YouTube) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-18]
CHR Extension: (Adblock dla serwisu Youtube™) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmedhionkhpnakcndndgjdbohmhepckk [2015-02-11]
CHR Extension: (Szukaj w Google) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-18]
CHR Extension: (AdBlock) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-02-11]
CHR Extension: (Avast Online Security) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-10-18]
CHR Extension: (Dynamo Combo) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpgkaimemdlpgfgohekgcjddinhmphfb [2015-01-20]
CHR Extension: (Google Wallet) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-18]
CHR Extension: (Gmail) - C:\Users\1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-01]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-01] (AVAST Software)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158864 2014-12-29] (XTab system)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 Util Dynamo Combo; C:\Program Files (x86)\Dynamo Combo\bin\utilDynamoCombo.exe [366832 2015-02-04] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [473088 2015-01-10] (Fuyu LIMITED) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-12-01] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [83280 2014-12-01] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-12-01] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-12-01] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1050432 2014-12-01] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [436624 2014-12-01] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [116728 2014-12-01] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [267632 2014-12-01] ()
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
R1 {16a92140-918d-4afb-9edb-46f22437bb10}w64; C:\Windows\System32\drivers\{16a92140-918d-4afb-9edb-46f22437bb10}w64.sys [48792 2015-01-25] (StdLib)
R1 {3bcf4f2c-0bbb-4d4c-bf1f-11bbe6d501ea}w64; C:\Windows\System32\drivers\{3bcf4f2c-0bbb-4d4c-bf1f-11bbe6d501ea}w64.sys [48792 2015-01-28] (StdLib)
R1 {641e52b1-3179-43ed-8bcb-f688871e52b0}w64; C:\Windows\System32\drivers\{641e52b1-3179-43ed-8bcb-f688871e52b0}w64.sys [48792 2015-01-20] (StdLib)
R1 {915cb94b-b4d8-4c0e-83b4-61409471b1c3}w64; C:\Windows\System32\drivers\{915cb94b-b4d8-4c0e-83b4-61409471b1c3}w64.sys [48792 2015-01-22] (StdLib)
R1 {bf5001a3-ae7a-4910-925a-5060ef2c0508}Gw64; C:\Windows\System32\drivers\{bf5001a3-ae7a-4910-925a-5060ef2c0508}Gw64.sys [48792 2015-01-09] (StdLib)
R1 {ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}w64; C:\Windows\System32\drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}w64.sys [48792 2015-01-13] (StdLib)
R1 {ecd6aae4-019c-44b2-a0e5-570904275d66}w64; C:\Windows\System32\drivers\{ecd6aae4-019c-44b2-a0e5-570904275d66}w64.sys [48792 2015-01-16] (StdLib)
R1 {f81878fa-25e9-442d-8ada-79658b6520f2}w64; C:\Windows\System32\drivers\{f81878fa-25e9-442d-8ada-79658b6520f2}w64.sys [48792 2015-01-10] (StdLib)
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]
U3 axloquog; \??\C:\Users\1\AppData\Local\Temp\axloquog.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 23:00 - 2015-02-12 23:00 - 00016402 _____ () C:\Users\1\Downloads\FRST.txt
2015-02-12 00:23 - 2015-02-12 00:23 - 00442996 _____ () C:\Users\1\Desktop\GMER scan.txt
2015-02-11 23:35 - 2015-02-11 23:36 - 00380416 _____ () C:\Users\1\Downloads\rlq6327p.exe
2015-02-11 23:27 - 2015-02-12 23:00 - 00000000 ____D () C:\FRST
2015-02-11 23:24 - 2015-02-11 23:24 - 02134016 _____ (Farbar) C:\Users\1\Downloads\FRST64.exe
2015-01-29 09:50 - 2015-01-28 22:26 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{3bcf4f2c-0bbb-4d4c-bf1f-11bbe6d501ea}w64.sys
2015-01-25 18:03 - 2015-01-25 18:04 - 00000000 ____D () C:\Users\1\Desktop\filmy
2015-01-25 14:54 - 2015-01-25 05:44 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{16a92140-918d-4afb-9edb-46f22437bb10}w64.sys
2015-01-23 00:53 - 2015-01-22 12:54 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{915cb94b-b4d8-4c0e-83b4-61409471b1c3}w64.sys
2015-01-21 15:42 - 2015-01-21 17:07 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-21 15:42 - 2015-01-21 15:42 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-20 18:48 - 2015-01-20 08:40 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{641e52b1-3179-43ed-8bcb-f688871e52b0}w64.sys
2015-01-16 11:43 - 2015-01-16 00:43 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{ecd6aae4-019c-44b2-a0e5-570904275d66}w64.sys
2015-01-14 11:36 - 2015-02-11 22:51 - 17295024 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-01-14 08:38 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 08:38 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 08:37 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 08:37 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 08:37 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 08:37 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 08:37 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 08:37 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 08:37 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 08:37 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 08:37 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 08:37 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 08:37 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-13 16:56 - 2015-01-13 07:41 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{ebd8d0c0-e022-4b76-a1f2-bc2963e3a147}w64.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 22:56 - 2013-11-27 17:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 2.4
2015-02-12 22:56 - 2013-11-27 17:57 - 00000000 ____D () C:\Program Files (x86)\OpenOffice.org 2.4
2015-02-12 22:54 - 2013-11-27 18:03 - 00000000 ____D () C:\Users\1\AppData\Roaming\OpenOffice.org2
2015-02-12 22:52 - 2013-10-18 19:03 - 00000000 ____D () C:\Users\1\AppData\Local\Google
2015-02-12 22:52 - 2013-10-18 19:03 - 00000000 ____D () C:\Program Files (x86)\Google
2015-02-12 22:47 - 2013-10-18 12:06 - 00001437 _____ () C:\Users\1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-02-12 22:46 - 2015-01-10 07:36 - 00000000 ____D () C:\Program Files (x86)\Dynamo Combo
2015-02-12 22:41 - 2014-11-20 20:36 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-12 22:41 - 2013-10-18 12:03 - 01478469 _____ () C:\Windows\WindowsUpdate.log
2015-02-12 22:41 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini
2015-02-12 06:25 - 2013-10-18 19:03 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-12 00:12 - 2014-07-05 20:08 - 00003876 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1382777078
2015-02-12 00:12 - 2013-10-26 09:44 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-11 23:24 - 2009-07-14 05:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-11 23:24 - 2009-07-14 05:45 - 00029120 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-11 22:51 - 2014-11-20 20:36 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-11 22:51 - 2014-11-20 11:00 - 00767152 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-11 22:51 - 2014-11-20 11:00 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-11 16:48 - 2014-06-29 10:56 - 00000000 ____D () C:\Users\1\Desktop\Originals
2015-02-07 04:36 - 2013-10-18 19:03 - 00004044 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 04:36 - 2013-10-18 19:03 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-07 04:35 - 2013-10-18 19:03 - 00003792 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 19:07 - 2013-11-13 16:48 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-02-02 18:43 - 2011-04-12 14:21 - 00740672 _____ () C:\Windows\system32\perfh015.dat
2015-02-02 18:43 - 2011-04-12 14:21 - 00156214 _____ () C:\Windows\system32\perfc015.dat
2015-02-02 18:43 - 2009-07-14 06:13 - 01670518 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-02 18:42 - 2014-04-27 14:30 - 00020480 ____H () C:\Users\1\Desktop\photothumb.db
2015-02-02 14:44 - 2014-04-06 20:34 - 00000000 ____D () C:\Users\1\AppData\Roaming\Spotify
2015-02-02 14:40 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-02 14:40 - 2009-07-14 05:51 - 00137524 _____ () C:\Windows\setupact.log
2015-02-01 15:31 - 2013-10-20 15:19 - 00000000 ____D () C:\Users\1\AppData\Roaming\Skype
2015-01-27 09:57 - 2013-10-18 12:53 - 01643124 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-21 15:52 - 2013-11-09 19:01 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-21 15:44 - 2014-08-18 10:13 - 00000000 ____D () C:\Users\1\AppData\Local\Adobe
2015-01-21 15:44 - 2013-10-18 18:51 - 00000000 ____D () C:\Users\1\AppData\Roaming\Adobe
2015-01-21 15:42 - 2013-11-09 19:13 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-20 22:38 - 2014-09-07 19:36 - 00000000 ____D () C:\Users\1\Desktop\GRY
2015-01-19 20:48 - 2014-04-06 20:36 - 00000000 ____D () C:\Users\1\AppData\Local\Spotify

Some content of TEMP:
====================
C:\Users\1\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\1\AppData\Local\Temp\EAD13AE.exe
C:\Users\1\AppData\Local\Temp\EAD166C.exe
C:\Users\1\AppData\Local\Temp\EAD1737.exe
C:\Users\1\AppData\Local\Temp\EAD186F.exe
C:\Users\1\AppData\Local\Temp\EAD18AE.exe
C:\Users\1\AppData\Local\Temp\EAD1D9D.exe
C:\Users\1\AppData\Local\Temp\EAD1DDC.exe
C:\Users\1\AppData\Local\Temp\EAD1E2A.exe
C:\Users\1\AppData\Local\Temp\EAD231.exe
C:\Users\1\AppData\Local\Temp\EAD2DC3.exe
C:\Users\1\AppData\Local\Temp\EAD2F0B.exe
C:\Users\1\AppData\Local\Temp\EAD2F78.exe
C:\Users\1\AppData\Local\Temp\EAD31B.exe
C:\Users\1\AppData\Local\Temp\EAD39E4.exe
C:\Users\1\AppData\Local\Temp\EAD3A70.exe
C:\Users\1\AppData\Local\Temp\EAD41EF.exe
C:\Users\1\AppData\Local\Temp\EAD427B.exe
C:\Users\1\AppData\Local\Temp\EAD4AE4.exe
C:\Users\1\AppData\Local\Temp\EAD4CD7.exe
C:\Users\1\AppData\Local\Temp\EAD4F09.exe
C:\Users\1\AppData\Local\Temp\EAD51B7.exe
C:\Users\1\AppData\Local\Temp\EAD5955.exe
C:\Users\1\AppData\Local\Temp\EAD6096.exe
C:\Users\1\AppData\Local\Temp\EAD6528.exe
C:\Users\1\AppData\Local\Temp\EAD707D.exe
C:\Users\1\AppData\Local\Temp\EAD72DE.exe
C:\Users\1\AppData\Local\Temp\EAD7666.exe
C:\Users\1\AppData\Local\Temp\EAD78E.exe
C:\Users\1\AppData\Local\Temp\EAD7BD.exe
C:\Users\1\AppData\Local\Temp\EAD7BE.exe
C:\Users\1\AppData\Local\Temp\EAD7C02.exe
C:\Users\1\AppData\Local\Temp\EAD7D78.exe
C:\Users\1\AppData\Local\Temp\EAD7E14.exe
C:\Users\1\AppData\Local\Temp\EAD80F1.exe
C:\Users\1\AppData\Local\Temp\EAD8313.exe
C:\Users\1\AppData\Local\Temp\EAD8738.exe
C:\Users\1\AppData\Local\Temp\EAD8767.exe
C:\Users\1\AppData\Local\Temp\EAD8786.exe
C:\Users\1\AppData\Local\Temp\EAD88AF.exe
C:\Users\1\AppData\Local\Temp\EAD895A.exe
C:\Users\1\AppData\Local\Temp\EAD8A92.exe
C:\Users\1\AppData\Local\Temp\EAD8BDA.exe
C:\Users\1\AppData\Local\Temp\EAD8BF9.exe
C:\Users\1\AppData\Local\Temp\EAD8C47.exe
C:\Users\1\AppData\Local\Temp\EAD8C76.exe
C:\Users\1\AppData\Local\Temp\EAD8D60.exe
C:\Users\1\AppData\Local\Temp\EAD8EC7.exe
C:\Users\1\AppData\Local\Temp\EAD904.exe
C:\Users\1\AppData\Local\Temp\EAD90C9.exe
C:\Users\1\AppData\Local\Temp\EAD91C3.exe
C:\Users\1\AppData\Local\Temp\EAD931A.exe
C:\Users\1\AppData\Local\Temp\EAD9368.exe
C:\Users\1\AppData\Local\Temp\EAD9387.exe
C:\Users\1\AppData\Local\Temp\EAD9388.exe
C:\Users\1\AppData\Local\Temp\EAD9452.exe
C:\Users\1\AppData\Local\Temp\EAD9471.exe
C:\Users\1\AppData\Local\Temp\EAD94A0.exe
C:\Users\1\AppData\Local\Temp\EAD94B0.exe
C:\Users\1\AppData\Local\Temp\EAD94BF.exe
C:\Users\1\AppData\Local\Temp\EAD94EE.exe
C:\Users\1\AppData\Local\Temp\EAD96F1.exe
C:\Users\1\AppData\Local\Temp\EAD99CE.exe
C:\Users\1\AppData\Local\Temp\EAD9BF0.exe
C:\Users\1\AppData\Local\Temp\EAD9DA5.exe
C:\Users\1\AppData\Local\Temp\EAD9F98.exe
C:\Users\1\AppData\Local\Temp\EADA034.exe
C:\Users\1\AppData\Local\Temp\EADA082.exe
C:\Users\1\AppData\Local\Temp\EADA0C1.exe
C:\Users\1\AppData\Local\Temp\EADA0FF.exe
C:\Users\1\AppData\Local\Temp\EADA13D.exe
C:\Users\1\AppData\Local\Temp\EADA18B.exe
C:\Users\1\AppData\Local\Temp\EADA19B.exe
C:\Users\1\AppData\Local\Temp\EADA247.exe
C:\Users\1\AppData\Local\Temp\EADA248.exe
C:\Users\1\AppData\Local\Temp\EADA249.exe
C:\Users\1\AppData\Local\Temp\EADA295.exe
C:\Users\1\AppData\Local\Temp\EADA591.exe
C:\Users\1\AppData\Local\Temp\EADA62D.exe
C:\Users\1\AppData\Local\Temp\EADA6C9.exe
C:\Users\1\AppData\Local\Temp\EADA6E8.exe
C:\Users\1\AppData\Local\Temp\EADA6F8.exe
C:\Users\1\AppData\Local\Temp\EADA6F9.exe
C:\Users\1\AppData\Local\Temp\EADA717.exe
C:\Users\1\AppData\Local\Temp\EADA87E.exe
C:\Users\1\AppData\Local\Temp\EADA949.exe
C:\Users\1\AppData\Local\Temp\EADA9D5.exe
C:\Users\1\AppData\Local\Temp\EADAAA.exe
C:\Users\1\AppData\Local\Temp\EADAB3C.exe
C:\Users\1\AppData\Local\Temp\EADAC93.exe
C:\Users\1\AppData\Local\Temp\EADADBB.exe
C:\Users\1\AppData\Local\Temp\EADADCB.exe
C:\Users\1\AppData\Local\Temp\EADADEA.exe
C:\Users\1\AppData\Local\Temp\EADAEA5.exe
C:\Users\1\AppData\Local\Temp\EADAF8F.exe
C:\Users\1\AppData\Local\Temp\EADAFDD.exe
C:\Users\1\AppData\Local\Temp\EADB02B.exe
C:\Users\1\AppData\Local\Temp\EADB05A.exe
C:\Users\1\AppData\Local\Temp\EADB06A.exe
C:\Users\1\AppData\Local\Temp\EADB0A8.exe
C:\Users\1\AppData\Local\Temp\EADB0C7.exe
C:\Users\1\AppData\Local\Temp\EADB20F.exe
C:\Users\1\AppData\Local\Temp\EADB25D.exe
C:\Users\1\AppData\Local\Temp\EADB27C.exe
C:\Users\1\AppData\Local\Temp\EADB385.exe
C:\Users\1\AppData\Local\Temp\EADB386.exe
C:\Users\1\AppData\Local\Temp\EADB3C4.exe
C:\Users\1\AppData\Local\Temp\EADB48F.exe
C:\Users\1\AppData\Local\Temp\EADB4EC.exe
C:\Users\1\AppData\Local\Temp\EADB50B.exe
C:\Users\1\AppData\Local\Temp\EADB5A7.exe
C:\Users\1\AppData\Local\Temp\EADB5B7.exe
C:\Users\1\AppData\Local\Temp\EADBAF5.exe
C:\Users\1\AppData\Local\Temp\EADBB71.exe
C:\Users\1\AppData\Local\Temp\EADBCA9.exe
C:\Users\1\AppData\Local\Temp\EADBD07.exe
C:\Users\1\AppData\Local\Temp\EADBD17.exe
C:\Users\1\AppData\Local\Temp\EADBDB3.exe
C:\Users\1\AppData\Local\Temp\EADBE8D.exe
C:\Users\1\AppData\Local\Temp\EADBEEB.exe
C:\Users\1\AppData\Local\Temp\EADBF0A.exe
C:\Users\1\AppData\Local\Temp\EADBF58.exe
C:\Users\1\AppData\Local\Temp\EADBFE4.exe
C:\Users\1\AppData\Local\Temp\EADC10D.exe
C:\Users\1\AppData\Local\Temp\EADC189.exe
C:\Users\1\AppData\Local\Temp\EADC225.exe
C:\Users\1\AppData\Local\Temp\EADC2B2.exe
C:\Users\1\AppData\Local\Temp\EADC2F0.exe
C:\Users\1\AppData\Local\Temp\EADC3F.exe
C:\Users\1\AppData\Local\Temp\EADC560.exe
C:\Users\1\AppData\Local\Temp\EADC57F.exe
C:\Users\1\AppData\Local\Temp\EADC725.exe
C:\Users\1\AppData\Local\Temp\EADC86C.exe
C:\Users\1\AppData\Local\Temp\EADC8E9.exe
C:\Users\1\AppData\Local\Temp\EADCCC.exe
C:\Users\1\AppData\Local\Temp\EADCD0E.exe
C:\Users\1\AppData\Local\Temp\EADCD7B.exe
C:\Users\1\AppData\Local\Temp\EADCF6E.exe
C:\Users\1\AppData\Local\Temp\EADD039.exe
C:\Users\1\AppData\Local\Temp\EADD0D5.exe
C:\Users\1\AppData\Local\Temp\EADD400.exe
C:\Users\1\AppData\Local\Temp\EADD41F.exe
C:\Users\1\AppData\Local\Temp\EADD538.exe
C:\Users\1\AppData\Local\Temp\EADD8B1.exe
C:\Users\1\AppData\Local\Temp\EADD95D.exe
C:\Users\1\AppData\Local\Temp\EADDB7F.exe
C:\Users\1\AppData\Local\Temp\EADDBDD.exe
C:\Users\1\AppData\Local\Temp\EADDD24.exe
C:\Users\1\AppData\Local\Temp\EADDDFF.exe
C:\Users\1\AppData\Local\Temp\EADE001.exe
C:\Users\1\AppData\Local\Temp\EADE38A.exe
C:\Users\1\AppData\Local\Temp\EADE696.exe
C:\Users\1\AppData\Local\Temp\EADEC12.exe
C:\Users\1\AppData\Local\Temp\EADEF4D.exe
C:\Users\1\AppData\Local\Temp\EADF0A4.exe
C:\Users\1\AppData\Local\Temp\EADF102.exe
C:\Users\1\AppData\Local\Temp\EADF111.exe
C:\Users\1\AppData\Local\Temp\EADF67E.exe
C:\Users\1\AppData\Local\Temp\EADFD61.exe
C:\Users\1\AppData\Local\Temp\EADFF54.exe
C:\Users\1\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\1\AppData\Local\Temp\UninstallEADM.dll
C:\Users\1\AppData\Local\Temp\{BEB2F162-202A-4A9E-BED1-D9F6F577652B}-39.0.2171.71_39.0.2171.65_chrome_updater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-01 18:44

==================== End Of Log ============================