Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2015 Ran by Teresa (administrator) on RODZICE on 14-02-2015 11:46:30 Running from C:\Users\Teresa\Downloads Loaded Profiles: UpdatusUser & Teresa (Available profiles: UpdatusUser & Teresa) Platform: Windows 8 (X64) OS Language: Polski (Polska) Internet Explorer Version 10 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Broadcom Corp.) C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe (McAfee, Inc.) C:\Windows\System32\mfevtps.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe (Dritek System INC.) C:\Windows\RfBtnSvc64.exe (Atheros) C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.7\GoogleCrashHandler.exe (Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.7\GoogleCrashHandler64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\CSP\1.3.336.0\McCSPServiceHost.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (McAfee, Inc.) C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerTray.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Acer Incorporated) C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor) HKLM-x32\...\Run: [LManager] => [X] HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [533872 2014-10-06] (McAfee, Inc.) HKLM-x32\...\Run: [SweetIM] => C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [115032 2012-10-04] (SweetIM Technologies Ltd.) HKLM-x32\...\Run: [mcpltui_exe] => C:\Program Files\Common Files\mcafee\Platform\McUICnt.exe [643064 2014-09-17] (McAfee, Inc.) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2015-01-19] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-02-04] (Avira Operations GmbH & Co. KG) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\...\Run: [ALLUpdate] => C:\MAMA\Instalki\ALLPlayer\ALLUpdate.exe [3000680 2013-11-01] (ALLPlayer Group Ltd.) HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd) HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\...\MountPoints2: {068f66f6-e1b4-11e2-810f-b888e3c61bcb} - "E:\AutoRun.exe" HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\...\MountPoints2: {068f6728-e1b4-11e2-810f-b888e3c61bcb} - "E:\AutoRun.exe" HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid} AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [202600 2012-10-08] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer Backup Manager Tray.lnk ShortcutTarget: Acer Backup Manager Tray.lnk -> C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1410026014&from=tt4u&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1418841199&from=wpm12173&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1410026014&from=tt4u&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1418841199&from=wpm12173&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT&q={searchTerms} HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.delta-search.com/?babsrc=HP_ss&mntrId=5A2F12689D4CB918&affID=119357&tt=040713_ctrl&tsp=4934 HKU\S-1-5-21-1347931101-2817040922-1319910007-1002\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1418841199&from=wpm12173&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT&q={searchTerms} URLSearchHook: [S-1-5-21-1347931101-2817040922-1319910007-1001] ATTENTION ==> Default URLSearchHook is missing. URLSearchHook: HKU\S-1-5-21-1347931101-2817040922-1319910007-1002 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) URLSearchHook: HKU\S-1-5-21-1347931101-2817040922-1319910007-1002 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = SearchScopes: HKLM-x32 -> DefaultScope value is missing. SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = http://search.sweetim.com/search.asp?src=6&crg=3.27010003&st=12&q={searchTerms}&barid={DCF778A7-403F-4FAD-9B81-432F5A803092} SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKU\S-1-5-21-1347931101-2817040922-1319910007-1002 -> {32E41EB3-8AD3-44DD-8888-C1A0DE815239} URL = http://rts.dsrlte.com/?affID=&q={searchTerms}&r=686 BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) BHO: WordProser -> {F6F484C9-29B9-43EC-A924-DCBAAA86B31D} -> C:\Program Files\WordProser_1.10.0.1\IE\WordProserClientIE.dll (Word Proser) BHO-x32: No Name -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> No File BHO-x32: ALLYouTubeDownloader -> {61DB16C5-B733-43F4-872E-B20DC9E72740} -> C:\Program Files (x86)\ALLYouTubeDownloader\ALLYouTubeDownloader.dll (ALLCinema Ltd.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: McAfee SiteAdvisor BHO -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} -> c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) BHO-x32: IplexToALLPlayer -> {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} -> C:\MAMA\Instalki\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) BHO-x32: Shopping Suggestion. -> {e7e8ed77-2fba-4ec6-bc07-65de4de6709f} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation) BHO-x32: WordProser -> {F6F484C9-29B9-43EC-A924-DCBAAA86B31D} -> C:\Program Files (x86)\WordProser_1.10.0.1\IE\WordProserClientIE.dll (Word Proser) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Toolbar: HKLM-x32 - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll (McAfee, Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.istartsurf.com/?type=sc&ts=1410026014&from=tt4u&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT FireFox: ======== FF ProfilePath: C:\Users\Teresa\AppData\Roaming\Mozilla\Firefox\Profiles\WOXeaNSp.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll () FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\2\NP_wtapp.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: Avira Browser Safety - C:\Users\Teresa\AppData\Roaming\Mozilla\Firefox\Profiles\WOXeaNSp.default\Extensions\abs@avira.com [2015-02-13] FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2012-09-01] FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2013-01-20] Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION CHR HomePage: Default -> hxxp://www.delta-homes.com/?type=hp&ts=1418841199&from=wpm12173&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT CHR RestoreOnStartup: Default -> "hxxp://rts.dsrlte.com?affID=pr_c9f45ae2-bb8a-491f-98ca-e9aeb651b19a" CHR StartupUrls: Default -> "hxxp://rts.dsrlte.com?affID=pr_c9f45ae2-bb8a-491f-98ca-e9aeb651b19a" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\PepperFlash\pepflashplayer.dll () CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll () CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.60.126.1_0\McChPlg.dll No File CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) CHR Plugin: (Intel Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) CHR Plugin: (WildTangent Games App V2 Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll No File CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL () CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Profile: C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (YouTube) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-01] CHR Extension: (CommonShare) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\chmjbmkmgbfcjchbimamdpopjkmkbioi [2014-11-13] CHR Extension: (Szukaj w Google) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-01] CHR Extension: (Shopping Suggestion) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejbpjlaagejfakeobljhgplbgklgemll [2013-12-22] CHR Extension: (SiteAdvisor) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2013-05-01] CHR Extension: (Avira Browser Safety) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-13] CHR Extension: (AdBlock) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-09-20] CHR Extension: (PlantUML Viewer) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\legbfeljfbjgfifnkmpoajgpgejojooj [2015-02-07] CHR Extension: (ofufersooFt) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmgomjjhhiehlldmfbppeinndkcpdfin [2015-02-07] CHR Extension: (Google Wallet) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-30] CHR Extension: (Security Protection) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh [2014-12-17] CHR Extension: (Quick start) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-09-06] CHR Extension: (Gmail) - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-01] CHR HKLM\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-02-13] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh.crx [2014-12-17] CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Teresa\AppData\Roaming\BabSolution\CR\Delta.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx [2015-02-13] CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path CHR HKLM-x32\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - C:\Users\Teresa\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh.crx [2014-12-17] Opera: ======= StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe http://www.delta-homes.com/?type=sc&ts=1418841199&from=wpm12173&uid=TOSHIBAXMQ01ABD050_82RCP12ATXX82RCP12AT ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-02-04] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-02-04] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [182520 2015-01-19] (Avira Operations GmbH & Co. KG) R2 BrcmCardReader; C:\Program Files\Broadcom\MemoryCard\BrcmCardReader.exe [176640 2012-08-21] (Broadcom Corp.) [File not signed] R2 CCDMonitorService; C:\Program Files (x86)\Acer\Acer Cloud\CCDMonitorService.exe [2435728 2012-08-24] (Acer Incorporated) S3 DeviceFastLaneService; C:\Program Files\Acer\Acer Device Fast-lane\DeviceFastLaneSvc.exe [468624 2012-08-23] (Acer Incorporated) R3 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [658576 2012-08-23] (Acer Incorporated) R2 ETDService; C:\Program Files\Elantech\ETDService.exe [28560 2012-08-30] (ELAN Microelectronics Corp.) R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165760 2012-07-18] (Intel Corporation) R2 McAfee SiteAdvisor Service; c:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [155368 2015-02-12] (McAfee, Inc.) R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [562200 2014-10-06] (McAfee, Inc.) R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.3.336.0\McCSPServiceHost.exe [422632 2014-11-21] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [601864 2014-12-03] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1050952 2014-11-06] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [221832 2014-10-01] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [189920 2014-10-01] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [335064 2014-10-31] (McAfee, Inc.) R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [259136 2012-08-23] (NTI Corporation) R2 RfButtonDriverService; C:\Windows\RfBtnSvc64.exe [93296 2012-09-18] (Dritek System INC.) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16032 2014-09-22] (Microsoft Corporation) R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros\Ath_WlanAgent.exe [81536 2012-08-01] (Atheros) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-02-04] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-02-04] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-02-04] (Avira Operations GmbH & Co. KG) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [72136 2014-10-01] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197704 2013-09-23] (McAfee, Inc.) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [181584 2014-10-01] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [313680 2014-10-01] (McAfee, Inc.) S0 mfeelamk; C:\Windows\System32\drivers\mfeelamk.sys [70608 2014-10-01] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [526360 2014-10-01] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [786304 2014-10-01] (McAfee, Inc.) R3 mfencbdc; C:\Windows\system32\DRIVERS\mfencbdc.sys [447440 2014-09-19] (McAfee, Inc.) S3 mfencrk; C:\Windows\system32\DRIVERS\mfencrk.sys [96600 2014-09-19] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [348560 2014-10-01] (McAfee, Inc.) R3 Ps2Kb2Hid; C:\Windows\System32\drivers\aPs2Kb2Hid.sys [26736 2012-09-18] (Dritek System Inc.) R1 wpnfd_1_10_0_1; C:\Windows\System32\drivers\wpnfd_1_10_0_1.sys [58240 2014-10-14] (Word Proser) R1 {6a0e715f-5cd3-4402-8a39-80497da09315}Gw64; C:\Windows\System32\drivers\{6a0e715f-5cd3-4402-8a39-80497da09315}Gw64.sys [48776 2015-01-23] (StdLib) R1 {dc19896d-a3e2-417d-be46-d18ebc99e240}Gw64; C:\Windows\System32\drivers\{dc19896d-a3e2-417d-be46-d18ebc99e240}Gw64.sys [48776 2014-11-26] (StdLib) R1 {e4a6645a-3f85-4e1f-aa41-8367978844db}Gw64; C:\Windows\System32\drivers\{e4a6645a-3f85-4e1f-aa41-8367978844db}Gw64.sys [48832 2014-10-16] (StdLib) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-14 11:46 - 2015-02-14 11:47 - 00027859 _____ () C:\Users\Teresa\Downloads\FRST.txt 2015-02-14 11:46 - 2015-02-14 11:46 - 00000000 ____D () C:\FRST 2015-02-14 11:45 - 2015-02-14 11:45 - 02134016 _____ (Farbar) C:\Users\Teresa\Downloads\FRST64.exe 2015-02-14 09:00 - 2015-02-03 20:29 - 00714184 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-02-14 09:00 - 2015-02-03 20:29 - 00106440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-02-13 19:07 - 2015-01-12 07:48 - 19291136 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-13 19:07 - 2015-01-12 07:47 - 15403008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-13 19:07 - 2015-01-12 06:06 - 14373376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-13 19:07 - 2015-01-12 06:06 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-13 19:06 - 2015-01-15 12:44 - 01043968 _____ (Microsoft Corporation) C:\Windows\system32\usercpl.dll 2015-02-13 19:06 - 2015-01-15 12:44 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll 2015-02-13 19:06 - 2015-01-15 12:43 - 01282560 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-13 19:06 - 2015-01-15 11:00 - 00961536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usercpl.dll 2015-02-13 19:06 - 2015-01-15 11:00 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll 2015-02-13 19:06 - 2015-01-15 10:38 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-13 19:06 - 2015-01-15 10:09 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-13 19:06 - 2015-01-15 05:08 - 00568656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-13 19:06 - 2015-01-12 07:49 - 02237952 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-13 19:06 - 2015-01-12 07:49 - 01627648 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-13 19:06 - 2015-01-12 07:49 - 01409536 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-13 19:06 - 2015-01-12 07:49 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll 2015-02-13 19:06 - 2015-01-12 07:49 - 00600576 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-13 19:06 - 2015-01-12 07:48 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-13 19:06 - 2015-01-12 07:47 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 19:06 - 2015-01-12 07:47 - 02655744 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-13 19:06 - 2015-01-12 07:47 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-02-13 19:06 - 2015-01-12 07:47 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-13 19:06 - 2015-01-12 07:46 - 01509376 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-13 19:06 - 2015-01-12 06:07 - 01762816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-13 19:06 - 2015-01-12 06:07 - 01338880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-13 19:06 - 2015-01-12 06:07 - 01181696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-13 19:06 - 2015-01-12 06:07 - 00523264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-13 19:06 - 2015-01-12 06:06 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-13 19:06 - 2015-01-12 06:06 - 02055168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-13 19:06 - 2015-01-12 06:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-02-13 19:06 - 2015-01-12 06:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-13 19:06 - 2015-01-12 06:06 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-13 19:06 - 2015-01-12 05:16 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-02-13 19:06 - 2015-01-12 04:46 - 00361984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2015-02-13 19:06 - 2015-01-09 05:33 - 04061696 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-13 19:06 - 2014-12-08 07:48 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-13 19:06 - 2014-12-08 06:04 - 00318464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-13 19:05 - 2015-01-29 09:30 - 00593408 _____ (Microsoft Corporation) C:\Windows\system32\AutoUpdate.exe 2015-02-13 19:05 - 2015-01-29 09:30 - 00467952 _____ (Microsoft Corporation) C:\Windows\system32\NotificationUI.exe 2015-02-13 19:05 - 2015-01-29 09:30 - 00011056 _____ () C:\Windows\system32\AutoconfigV2.cab 2015-02-13 19:05 - 2015-01-29 09:05 - 00695808 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll 2015-02-13 19:05 - 2015-01-29 09:05 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2015-02-13 19:05 - 2015-01-29 07:19 - 00568832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll 2015-02-13 19:05 - 2015-01-29 07:19 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2015-02-13 19:03 - 2015-02-04 10:54 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-13 19:03 - 2015-02-04 10:52 - 00894464 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-13 19:03 - 2015-02-04 10:52 - 00761856 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-13 19:03 - 2015-02-04 10:52 - 00414208 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-13 19:03 - 2015-02-04 10:52 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-13 19:03 - 2015-02-03 00:18 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-13 19:03 - 2014-12-18 09:51 - 00096576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wfplwfs.sys 2015-02-13 19:03 - 2014-12-18 07:52 - 00889344 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2015-02-13 19:03 - 2014-12-18 07:51 - 01160192 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2015-02-13 19:03 - 2014-12-18 07:50 - 00723968 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL 2015-02-13 19:03 - 2014-12-18 07:20 - 00702464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2015-02-13 19:03 - 2014-12-09 00:14 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml 2015-02-13 19:03 - 2014-11-26 07:43 - 00778240 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-13 19:03 - 2014-11-26 05:50 - 00567808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-13 19:01 - 2015-01-15 22:45 - 06973248 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-13 17:37 - 2015-02-13 17:35 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys 2015-02-13 17:35 - 2015-02-13 17:35 - 00000000 ____D () C:\Users\Teresa\AppData\Roaming\Mozilla 2015-02-13 17:35 - 2015-02-13 17:35 - 00000000 ____D () C:\Users\Teresa\AppData\Roaming\Avira 2015-02-13 17:29 - 2015-02-04 17:51 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys 2015-02-13 17:29 - 2015-02-04 17:51 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys 2015-02-13 17:29 - 2015-02-04 17:51 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys 2015-02-13 17:28 - 2015-02-13 17:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-02-13 17:28 - 2015-02-13 17:29 - 00000000 ____D () C:\ProgramData\Avira 2015-02-13 17:28 - 2015-02-13 17:29 - 00000000 ____D () C:\Program Files (x86)\Avira 2015-02-13 17:28 - 2015-02-13 17:28 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk 2015-02-13 17:27 - 2015-02-13 17:27 - 00000000 ____D () C:\ProgramData\Package Cache 2015-02-13 17:02 - 2015-02-13 17:03 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-13 17:01 - 2015-02-13 17:01 - 00001110 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2015-02-13 17:01 - 2015-02-13 17:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2015-02-13 17:01 - 2015-02-13 17:01 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-13 17:01 - 2015-02-13 17:01 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2015-02-13 17:01 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-13 17:01 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-13 17:01 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-13 17:00 - 2015-02-13 17:01 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Teresa\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-13 16:54 - 2015-02-13 16:54 - 02112512 _____ () C:\Users\Teresa\Downloads\Niepotwierdzony 867925.crdownload 2015-02-13 16:54 - 2015-02-13 16:54 - 02112512 _____ () C:\Users\Teresa\Downloads\Niepotwierdzony 414897.crdownload 2015-02-13 14:41 - 2015-02-13 17:48 - 00162382 _____ () C:\Windows\PFRO.log 2015-02-13 13:25 - 2015-02-14 11:35 - 00857981 _____ () C:\Windows\WindowsUpdate.log 2015-02-13 13:25 - 2015-02-13 13:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-13 13:25 - 2015-02-13 13:25 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-13 13:25 - 2015-02-13 13:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-13 13:23 - 2015-02-13 13:23 - 13087456 _____ (Microsoft Corporation) C:\Users\Teresa\Downloads\Silverlight_x64.exe 2015-02-13 13:04 - 2015-02-13 13:07 - 00006162 _____ () C:\Users\Teresa\Downloads\software_removal_tool.log 2015-02-13 12:45 - 2015-02-13 12:45 - 00000000 ____D () C:\Program Files (x86)\brrOwseandsshaoP 2015-02-13 12:33 - 2015-02-13 12:33 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2015-02-13 12:33 - 2015-02-13 12:33 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2015-02-13 12:33 - 2015-02-13 12:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-02-13 12:33 - 2015-02-13 12:33 - 00000000 ____D () C:\Program Files\CCleaner 2015-02-13 12:31 - 2015-02-13 12:31 - 05325208 _____ (Piriform Ltd) C:\Users\Teresa\Downloads\ccsetup502.exe 2015-02-07 12:15 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\oFFFersale 2015-02-07 12:14 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\PlantUML Viewer 2015-02-07 12:11 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\Priozzeccoupon 2015-02-07 12:11 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\buyfAst 2015-02-07 12:10 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\ofufersooFt 2015-02-07 12:07 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\sAleeOfffEr 2015-02-06 20:40 - 2015-02-07 12:15 - 00000000 ____D () C:\ProgramData\1473215379271396166 2015-02-05 20:24 - 2015-02-05 20:24 - 00000000 ____D () C:\ProgramData\salesale 2015-02-03 20:35 - 2015-02-05 19:48 - 00000000 ____D () C:\Users\Teresa\AppData\Roaming\MsDtc 2015-02-03 19:55 - 2015-02-03 19:55 - 00613880 _____ (RealNetworks, Inc.) C:\Users\Teresa\Downloads\Installer_thetreasuresofmontezuma3deluxe (3).exe 2015-01-29 20:40 - 2015-02-13 16:43 - 00000020 _____ () C:\Users\Teresa\AppData\Roaming\appdataFr3.bin 2015-01-29 20:40 - 2015-01-29 20:40 - 00000000 ____D () C:\ProgramData\couponcheapchea 2015-01-28 20:08 - 2015-01-28 20:08 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (9).exe 2015-01-28 20:03 - 2015-01-28 20:03 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (8).exe 2015-01-28 19:58 - 2015-01-28 19:59 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (7).exe 2015-01-28 19:58 - 2015-01-28 19:58 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (6).exe 2015-01-28 19:56 - 2015-01-28 19:56 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (5).exe 2015-01-28 19:43 - 2015-01-28 19:43 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (4).exe 2015-01-28 19:42 - 2015-01-28 19:42 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (3).exe 2015-01-28 19:40 - 2015-01-28 19:40 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (2).exe 2015-01-28 19:39 - 2015-01-28 19:39 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup (1).exe 2015-01-28 19:38 - 2015-01-28 19:38 - 00880784 _____ (Google Inc.) C:\Users\Teresa\Downloads\GoogleEarthSetup.exe 2015-01-26 19:43 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\rec_pl_8 2015-01-26 19:43 - 2015-02-13 20:41 - 00000000 ____D () C:\Program Files (x86)\FreeSoftToday 2015-01-26 19:43 - 2015-01-26 19:43 - 00000000 ____D () C:\Users\Teresa\AppData\Local\rec_pl_8 2015-01-24 19:28 - 2015-01-24 19:28 - 00003492 _____ () C:\Windows\System32\Tasks\Yahoo! Search 2015-01-24 19:27 - 2015-01-23 13:28 - 00048776 _____ (StdLib) C:\Windows\system32\Drivers\{6a0e715f-5cd3-4402-8a39-80497da09315}Gw64.sys 2015-01-21 20:14 - 2015-01-21 20:14 - 00000000 ____D () C:\ProgramData\hdoefmllnllcdklhnbmfgancponedmdm 2015-01-21 20:13 - 2015-02-13 20:41 - 00000000 ____D () C:\ProgramData\bUyfuast 2015-01-21 20:12 - 2015-02-13 14:41 - 00000000 ____D () C:\ProgramData\brrOwseandsshaoP 2015-01-21 20:12 - 2015-02-13 12:50 - 00000000 ____D () C:\ProgramData\1471e994ff1d2b46 2015-01-21 19:41 - 2013-09-23 13:49 - 00197704 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys 2015-01-16 19:47 - 2014-11-15 07:06 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe 2015-01-16 19:47 - 2014-11-15 06:13 - 03286016 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 01623552 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll 2015-01-16 19:47 - 2014-11-15 06:13 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe 2015-01-16 19:47 - 2014-11-15 06:12 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll 2015-01-16 19:47 - 2014-11-15 04:54 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe 2015-01-16 19:47 - 2014-11-15 04:53 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll 2015-01-16 19:47 - 2014-11-15 04:53 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll 2015-01-16 19:47 - 2014-11-15 04:53 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll 2015-01-16 19:47 - 2014-11-05 07:40 - 00733184 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2015-01-16 19:47 - 2014-11-05 07:39 - 01024512 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2015-01-16 19:47 - 2014-11-01 07:28 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\services.exe 2015-01-16 19:47 - 2014-10-29 15:21 - 00499008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\vhdmp.sys 2015-01-16 19:46 - 2014-12-19 07:48 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-16 19:46 - 2014-12-19 05:35 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-16 19:46 - 2014-12-11 07:51 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-16 19:46 - 2014-12-06 08:53 - 00458240 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2015-01-16 19:46 - 2014-12-06 08:53 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\WerFaultSecure.exe 2015-01-16 19:46 - 2014-12-06 08:52 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2015-01-16 19:46 - 2014-12-06 08:52 - 00357376 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-16 19:46 - 2014-12-06 08:52 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2015-01-16 19:46 - 2014-12-06 08:51 - 00370688 _____ (Microsoft Corporation) C:\Windows\system32\Faultrep.dll 2015-01-16 19:46 - 2014-12-06 08:51 - 00267264 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-01-16 19:46 - 2014-12-06 08:50 - 00783872 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-01-16 19:46 - 2014-12-06 07:10 - 00355840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll 2015-01-16 19:46 - 2014-12-06 07:10 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WerFaultSecure.exe 2015-01-16 19:46 - 2014-12-06 07:09 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Faultrep.dll 2015-01-16 19:46 - 2014-12-06 07:09 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-14 11:17 - 2013-05-01 14:54 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00004486 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-11.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00003804 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-3.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00002544 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-4.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00002398 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-6.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00002270 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-7.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00001826 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-1.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00001756 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-5_user.job 2015-02-14 11:15 - 2014-09-06 18:54 - 00001736 _____ () C:\Windows\Tasks\84c549b1-3b85-4bc5-9c93-240c48ad7371-5.job 2015-02-14 11:14 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru 2015-02-14 09:12 - 2013-05-01 14:54 - 00001064 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-14 09:00 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM 2015-02-14 08:58 - 2014-10-30 20:26 - 00308232 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-14 08:58 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-14 08:55 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI 2015-02-14 08:53 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore 2015-02-14 08:52 - 2015-01-11 20:55 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-14 08:52 - 2014-09-28 20:50 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 20:50 - 2013-04-06 13:21 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-13 20:41 - 2014-11-12 18:05 - 00000000 ____D () C:\ProgramData\ee70f246-63a3-464e-a2ed-28bc4d8db631 2015-02-13 20:39 - 2013-05-01 14:55 - 00002409 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-13 20:37 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache 2015-02-13 19:30 - 2012-07-26 08:59 - 00000000 ____D () C:\Windows\CbsTemp 2015-02-13 19:25 - 2013-02-15 16:54 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-02-13 19:25 - 2013-02-15 16:54 - 00000000 ____D () C:\ProgramData\Skype 2015-02-13 19:22 - 2013-09-21 13:40 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 19:15 - 2013-02-02 11:52 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-13 19:11 - 2012-12-08 08:05 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1347931101-2817040922-1319910007-1002 2015-02-13 17:28 - 2014-11-12 14:56 - 00000000 ____D () C:\Users\Teresa\AppData\Roaming\Systweak 2015-02-13 17:27 - 2013-12-22 15:16 - 00000000 ____D () C:\Users\Teresa\AppData\Local\fst_pl_14 2015-02-13 17:27 - 2012-09-18 08:46 - 00794946 _____ () C:\Windows\system32\perfh015.dat 2015-02-13 17:27 - 2012-09-18 08:46 - 00159530 _____ () C:\Windows\system32\perfc015.dat 2015-02-13 17:27 - 2012-07-26 08:28 - 01793398 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-13 17:24 - 2012-07-26 06:26 - 00000226 _____ () C:\Windows\win.ini 2015-02-13 14:41 - 2012-09-01 19:11 - 00000000 ____D () C:\Program Files (x86)\McAfee 2015-02-13 13:35 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\AUInstallAgent 2015-02-13 13:07 - 2013-05-01 14:54 - 00004036 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-13 13:07 - 2013-05-01 14:54 - 00003800 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-13 12:36 - 2013-01-20 15:59 - 00000000 ____D () C:\Users\Teresa\AppData\Local\CrashDumps 2015-02-13 12:36 - 2012-09-01 19:48 - 00000000 ____D () C:\Windows\Panther 2015-02-05 19:50 - 2013-04-06 13:21 - 00003818 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-24 19:28 - 2014-12-19 21:10 - 00003496 _____ () C:\Windows\System32\Tasks\Yahoo! Search Updater 2015-01-21 19:40 - 2012-09-01 19:11 - 00000000 ____D () C:\Program Files\Common Files\mcafee 2015-01-21 19:40 - 2012-07-26 09:12 - 00000000 ___HD () C:\Windows\ELAMBKUP ==================== Files in the root of some directories ======= 2015-01-29 20:40 - 2015-02-13 16:43 - 0000020 _____ () C:\Users\Teresa\AppData\Roaming\appdataFr3.bin 2013-07-27 14:42 - 2015-01-11 16:42 - 0000246 _____ () C:\Users\Teresa\AppData\Roaming\WB.CFG 2013-07-08 20:19 - 2013-07-08 20:19 - 0000005 _____ () C:\Users\Teresa\AppData\Roaming\WBPU-Q4-TTL.DAT 2013-07-05 14:42 - 2014-01-28 20:42 - 0000005 _____ () C:\Users\Teresa\AppData\Roaming\WBPU-TTL.DAT Some content of TEMP: ==================== C:\Users\Teresa\AppData\Local\Temp\avgnt.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-05 19:56 ==================== End Of Log ============================