Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-03-2015
Ran by SYSTEM on MININT-KDPTK8N on 04-03-2015 10:39:49
Running from g:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet002
[b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b]

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11772520 2011-01-04] (Realtek Semiconductor)
HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-29] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM\...\RunOnce: [*Restore] => C:\Windows\system32\rstrui.exe [296960 2010-11-21] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
HKU\Art-Pol\...\Run: [GG] => C:\Users\Art-Pol\AppData\Local\GG\Application\gghub.exe [4023872 2015-02-19] (GG Network S.A.)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe [206448 2012-10-29] (Kaspersky Lab ZAO)
S2 MSSQL$INSERTGT; C:\Program Files\Microsoft SQL Server\MSSQL10_50.INSERTGT\MSSQL\Binn\sqlservr.exe [61913952 2010-04-03] (Microsoft Corporation)
S4 SQLAgent$INSERTGT; C:\Program Files\Microsoft SQL Server\MSSQL10_50.INSERTGT\MSSQL\Binn\SQLAGENT.EXE [428384 2010-04-03] (Microsoft Corporation)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 Winmgmt; C:\PROGRA~3\vqtvt8z.faa [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)
S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2012-10-29] (Kaspersky Lab)
S1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)
S3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)
S3 OxPCIeMf; C:\Windows\System32\DRIVERS\OxPCIeMf.sys [62000 2009-09-24] (OEM)
S3 OxPCIeSer; C:\Windows\System32\DRIVERS\OxPCIeSer.sys [102960 2009-09-24] (OEM)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 10:39 - 2015-03-04 10:39 - 00000000 ____D () C:\FRST
2015-03-04 10:27 - 2015-03-04 11:23 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2015-03-03 12:54 - 2015-03-03 12:54 - 00000134 _____ () C:\Users\Art-Pol\Desktop\Rozwiązywanie problemów z programem Internet Explorer.url
2015-03-03 12:46 - 2015-03-03 12:54 - 00011069 _____ () C:\Windows\IE11_main.log
2015-03-02 08:09 - 2015-03-02 08:09 - 00001151 _____ () C:\Users\Art-Pol\Desktop\GG.lnk
2015-02-24 09:10 - 2015-02-24 09:10 - 00000122 _____ () C:\Users\Art-Pol\Desktop\MASTER SPORT ART_POL artpol1.url
2015-02-20 08:32 - 2015-02-20 08:32 - 01055936 _____ (Adobe) C:\Users\Art-Pol\Downloads\install_flashplayer16x32_mssd_aaa_aih(2).exe
2015-02-03 10:01 - 2015-02-03 10:01 - 00016678 _____ () C:\Users\Art-Pol\Downloads\1606.bmp

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-04 07:07 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-04 07:07 - 2009-07-14 05:45 - 00016976 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-04 07:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK
2015-03-04 07:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR
2015-03-04 07:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\zh-HK
2015-03-04 07:07 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\tr-TR
2015-03-04 07:06 - 2012-06-01 17:12 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-04 07:06 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-04 07:06 - 2009-07-14 05:51 - 00097915 _____ () C:\Windows\setupact.log
2015-03-04 07:06 - 2009-07-14 05:45 - 00301712 _____ () C:\Windows\System32\FNTCACHE.DAT
2015-03-03 17:01 - 2013-07-11 07:03 - 00000000 ____D () C:\Users\Art-Pol\AppData\Roaming\GG
2015-03-03 17:01 - 2012-06-01 16:09 - 01555065 _____ () C:\Windows\WindowsUpdate.log
2015-03-03 08:33 - 2012-06-01 16:19 - 00003990 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{6BA4EED6-869D-4E51-AB01-D6ED2BB70057}
2015-03-02 08:09 - 2013-07-11 07:09 - 00001634 _____ () C:\Users\Art-Pol\Desktop\GG dysk.lnk
2015-03-02 08:09 - 2013-07-11 07:03 - 00000000 ____D () C:\Users\Art-Pol\AppData\Local\GG
2015-02-20 11:48 - 2012-07-02 11:22 - 00000000 ____D () C:\Users\Art-Pol\AppData\Local\Adobe
2015-02-20 11:48 - 2012-06-01 16:19 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-20 11:48 - 2012-06-01 16:19 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-17 08:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\System32\NDF
2015-02-04 07:36 - 2009-07-14 06:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\Art-Pol\AppData\Local\Temp\05pczc4s.dll
C:\Users\Art-Pol\AppData\Local\Temp\12gdxbzh.dll
C:\Users\Art-Pol\AppData\Local\Temp\883085bh.dll
C:\Users\Art-Pol\AppData\Local\Temp\a5w07mz3.dll
C:\Users\Art-Pol\AppData\Local\Temp\arq-r4hq.dll
C:\Users\Art-Pol\AppData\Local\Temp\b9yb2rbb.dll
C:\Users\Art-Pol\AppData\Local\Temp\bhp6qo6p.dll
C:\Users\Art-Pol\AppData\Local\Temp\cjp8sfan.dll
C:\Users\Art-Pol\AppData\Local\Temp\dfpkd_ab.dll
C:\Users\Art-Pol\AppData\Local\Temp\dquz5_pv.dll
C:\Users\Art-Pol\AppData\Local\Temp\er8guxfn.dll
C:\Users\Art-Pol\AppData\Local\Temp\f5jgzva7.dll
C:\Users\Art-Pol\AppData\Local\Temp\facsa7tx.dll
C:\Users\Art-Pol\AppData\Local\Temp\falmpbp5.dll
C:\Users\Art-Pol\AppData\Local\Temp\flf16oju.dll
C:\Users\Art-Pol\AppData\Local\Temp\ft1d_l38.dll
C:\Users\Art-Pol\AppData\Local\Temp\gg10.upgr.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggdrive-menu.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggdrive-overlay.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggsetup12088712.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggsetup40123122.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggsetup44320037.exe
C:\Users\Art-Pol\AppData\Local\Temp\ggsetup49085450.exe
C:\Users\Art-Pol\AppData\Local\Temp\i2bpfuud.dll
C:\Users\Art-Pol\AppData\Local\Temp\ifexu3yk.dll
C:\Users\Art-Pol\AppData\Local\Temp\imtmmof7.dll
C:\Users\Art-Pol\AppData\Local\Temp\installstats.exe
C:\Users\Art-Pol\AppData\Local\Temp\iyzoa2i-.dll
C:\Users\Art-Pol\AppData\Local\Temp\jvgpgrj4.dll
C:\Users\Art-Pol\AppData\Local\Temp\kg2moxn-.dll
C:\Users\Art-Pol\AppData\Local\Temp\killproc.dll
C:\Users\Art-Pol\AppData\Local\Temp\kpbxahjp.dll
C:\Users\Art-Pol\AppData\Local\Temp\k_bsvvpe.dll
C:\Users\Art-Pol\AppData\Local\Temp\k_knsqii.dll
C:\Users\Art-Pol\AppData\Local\Temp\l-tovavw.dll
C:\Users\Art-Pol\AppData\Local\Temp\lnv1_aqo.dll
C:\Users\Art-Pol\AppData\Local\Temp\l_bt28xk.dll
C:\Users\Art-Pol\AppData\Local\Temp\nw4ldjer.dll
C:\Users\Art-Pol\AppData\Local\Temp\o2w74kgd.dll
C:\Users\Art-Pol\AppData\Local\Temp\ogccyjpq.dll
C:\Users\Art-Pol\AppData\Local\Temp\p6m6tjol.dll
C:\Users\Art-Pol\AppData\Local\Temp\qp5f3kl8.dll
C:\Users\Art-Pol\AppData\Local\Temp\run.exe
C:\Users\Art-Pol\AppData\Local\Temp\update.exe
C:\Users\Art-Pol\AppData\Local\Temp\ur2ub8fn.dll
C:\Users\Art-Pol\AppData\Local\Temp\uswzvpjo.dll
C:\Users\Art-Pol\AppData\Local\Temp\v71xziwr.dll
C:\Users\Art-Pol\AppData\Local\Temp\yy__djfb.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
C:\Windows\System32\winsrv.dll IS MISSING <==== ATTENTION!.

==================== Restore Points  =========================

Restore point made on: 2015-02-25 17:23:22
Restore point made on: 2015-03-03 12:48:32

==================== Memory info =========================== 

Percentage of memory in use: 26%
Total physical RAM: 1965.42 MB
Available physical RAM: 1437.05 MB
Total Pagefile: 1965.42 MB
Available Pagefile: 1425.31 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:68.26 GB) (Free:25.26 GB) NTFS
Drive e: () (Fixed) (Total:397.4 GB) (Free:302.95 GB) NTFS
Drive f: (KRD10) (CDROM) (Total:0.3 GB) (Free:0 GB) CDFS
Drive g: (GSP1RMCULFR) (Removable) (Total:3.72 GB) (Free:0.59 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (Zastrzeżone przez system) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 1D7AE87D)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=68.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=397.4 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 3.7 GB) (Disk ID: CAD4EBEA)
Partition 4: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2015-02-25 11:27

==================== End Of Log ============================