Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by sere (administrator) on SERE-KOMPUTER on 05-04-2015 17:17:32
Running from D:\NAPRAWA
Loaded Profiles: sere (Available profiles: sere & UpdatusUser)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 9 (Default browser path: "C:\Program Files (x86)\Opera\Opera.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(ASUSTeK COMPUTER INC.) C:\Windows\System32\ATKFUSService.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
() C:\Program Files\ASUS\GamerOSD\ATKFastUserSwitching.exe
() C:\Windows\SysWOW64\ASDR.exe
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe
() C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\BEWConfigSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Realtek) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Users\sere\AppData\Local\Google\Update\GoogleUpdate.exe
(Sony Ericsson Mobile Communications AB) C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
() C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\BusinessEverywhere.exe
() C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\UpdteApp.exe
() C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\SMSNotifier.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winamp.exe
(Last.fm) D:\Dyskietka Mega\Last.fm\LastFM.exe
(Monolith Productions Inc.) C:\Program Files (x86)\Pazur\CLAW.EXE
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\osk.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10081312 2010-02-25] (Realtek Semiconductor)
HKLM-x32\...\Run: [BCU] => C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [375000 2009-10-15] (DeviceVM, Inc.)
HKLM-x32\...\Run: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETcall.exe [20480 2007-07-26] ()
HKLM-x32\...\Run: [ASUSGamerOSD] => C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe [380928 2009-07-30] (ASUSTeK Computer Inc.)
HKLM-x32\...\Run: [WinampAgent] => C:\Program Files (x86)\Winamp\winampa.exe [74752 2011-03-22] (Nullsoft, Inc.)
HKLM-x32\...\Run: [NeroCheck] => C:\Windows\SysWOW64\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-04-03] (Nero AG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [0 2011-09-27] ()
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2011-10-24] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-29] ()
HKLM-x32\...\Run: [Start_BusinessEverywhere_{ad30a369-08e3-414c-9d2c-7f47dbe748da}] => C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\BusinessEverywhere.exe [3363808 2012-06-06] ()
HKLM-x32\...\Run: [Start_Update_{ad30a369-08e3-414c-9d2c-7f47dbe748da}] => C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\UpdteApp.exe [966600 2012-06-06] ()
HKLM-x32\...\Run: [Start_SMSNotifier_{ad30a369-08e3-414c-9d2c-7f47dbe748da}] => C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\SMSNotifier.exe [1359824 2012-06-06] ()
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [Google Update] => C:\Users\sere\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-08-20] (Google Inc.)
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [ALLUpdate] => D:\ALLPlayer\ALLUpdate.exe [1379840 2011-08-16] ()
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [Sony Ericsson PC Companion] => C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCompanion.exe [774144 2009-12-08] (Sony Ericsson Mobile Communications AB)
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [HEXelon MAX] => "C:\Program Files (x86)\HEXelon MAX 6\hexelon.exe" /auto
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [MediaGet2] => C:\Users\sere\AppData\Local\MediaGet2\mediaget.exe --minimized
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Run: [ABBYY Screenshot Reader Bonus] => "C:\Program Files (x86)\ABBYY PDF Transformer 3.0\Bonus.ScreenshotReader.exe" -autorun
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\Policies\Explorer: [NoDriveTypeAutoRun] 0x95000000
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\MountPoints2: {036e9690-bcf6-11df-a8d2-6cf049ad44bb} - F:\autorun.exe
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\MountPoints2: {78f43d04-d76c-11df-ae79-6cf049ad44bb} - G:\Startme.exe
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\MountPoints2: {861ed185-99f5-11e2-8d0f-b0474f000aa8} - G:\Setup.exe
HKU\S-1-5-21-448289024-605243297-948884167-1000\...\MountPoints2: {898ac51a-cb07-11e4-9dc1-806e6f6e6963} - E:\setup.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\sere\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-448289024-605243297-948884167-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-448289024-605243297-948884167-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=135
URLSearchHook: HKU\S-1-5-21-448289024-605243297-948884167-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch64.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-448289024-605243297-948884167-1000 - SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll (DeviceVM, Inc.)
URLSearchHook: HKU\S-1-5-21-448289024-605243297-948884167-1000 - (No Name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - No File
SearchScopes: HKU\S-1-5-21-448289024-605243297-948884167-1000 -> DefaultScope {0AD681F7-84E3-4df6-AADA-EABF3BEBA857} URL = http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
SearchScopes: HKU\S-1-5-21-448289024-605243297-948884167-1000 -> {0AD681F7-84E3-4df6-AADA-EABF3BEBA857} URL = http://uk.search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=IEBD
SearchScopes: HKU\S-1-5-21-448289024-605243297-948884167-1000 -> {98CEAFE1-FF0E-41fc-B688-9D68CB8630A5} URL = http://www.google.com/custom?client=pub-3794288947762788&forid=1&channel=1975384696&ie=UTF-8&oe=UTF-8&safe=active&cof=GALT%3A%23008000%3BGL%3A1%3BDIV%3A%23336699%3BVLC%3A663399%3BAH%3Acenter%3BBGC%3AFFFFFF%3BLBGC%3A336699%3BALC%3A0000FF%3BLC%3A0000FF%3BT%3A000000%3BGFNT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=pl&q={searchTerms}
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-07-27] (Adobe Systems Incorporated)
BHO-x32: Bcool Class -> {2416BAB2-A62C-8B48-420D-149190AB6F64} -> C:\ProgramData\Bcool\bhoclass.dll [2012-07-04] ()
BHO-x32: DivX Plus Web Player HTML5 <video> -> {326E768D-4182-46FD-9C16-1449A49795F4} -> C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll [2011-12-12] (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll [2012-03-25] (Sun Microsystems, Inc.)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper -> {9FDDE16B-836F-4806-AB1F-1455CBEFF289} -> C:\Program Files (x86)\Windows Live\Companion\companioncore.dll [2011-05-13] (Microsoft Corporation)
BHO-x32: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
BHO-x32: No Name -> {B164E929-A1B6-4A06-B104-2CD0E90A88FF} ->  No File
BHO-x32: Bcool Class -> {B3122BBE-C417-FDAF-57DC-BE99065DAC0B} -> C:\ProgramData\Bcool\bhoclass.dll [2012-07-04] ()
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2012-03-25] (Sun Microsystems, Inc.)
BHO-x32: IplexToALLPlayer -> {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} -> D:\ALLPlayer\Iplex\IplexToALLPlayer.dll [2011-02-09] (ALLCinema Ltd.)
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2010-02-08] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2011-11-03] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0

FireFox:
========
FF ProfilePath: C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default
FF Homepage: hxxp://www.gazeta.pl/0,0.html?p=135
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_265.dll [2012-07-18] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll [2012-04-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll [2012-07-18] ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll [2011-12-13] (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2011-06-20] (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2012-04-14] (Google)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll [2012-03-25] (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll [2012-04-11] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 -> C:\Program Files (x86)\Sony\Media Go\npmediago.dll [2010-01-20] (Sony Media Software and Services Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll [2012-09-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll [2012-09-18] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-448289024-605243297-948884167-1000: @tools.google.com/Google Update;version=3 -> C:\Users\sere\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll [2012-09-21] (Google Inc.)
FF Plugin HKU\S-1-5-21-448289024-605243297-948884167-1000: @tools.google.com/Google Update;version=9 -> C:\Users\sere\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll [2012-09-21] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2012-03-25] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2012-07-27] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2011-10-31] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2011-10-31] (Apple Inc.)
FF Extension: Bcool - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\4fd8973cdcf0f@4fd8973cdcf49.info [2012-06-13]
FF Extension: Bcool - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\4ff37ee8e7e8b@4ff37ee8e7ec5.info [2012-07-13]
FF Extension: Iplex to ALLPlayer - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\IplextoALL@ALLPlayer.org [2012-05-01]
FF Extension: pdfit - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\service@touchpdf.com [2010-08-29]
FF Extension: Yahoo! Toolbar - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2014-11-16]
FF Extension: Iplex to ALLPlayer - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\IplextoALL@ALLPlayer.org.xpi [2011-09-29]
FF Extension: ReloadEvery - C:\Users\sere\AppData\Roaming\Mozilla\Firefox\Profiles\jnonpw8v.default\Extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi [2011-04-10]
FF Extension: Skype extension for Firefox - C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010-09-17]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-04-20]

Chrome: 
=======
CHR Profile: C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (AT_JamesWhite) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkeidgmehkdjmpjodpjkepolokanalkm [2010-09-12]
CHR Extension: (YouTube) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-16]
CHR Extension: (Google Search) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-16]
CHR Extension: (Bcool) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\gboceangmmlhhnjfgkfakfpkceekcfjn [2012-07-04]
CHR Extension: (Page Refresh) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\hmooaemjmediafeacjplpbpenjnpcneg [2011-03-24]
CHR Extension: (Bcool) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\hpkjpdimfelibdmpkccdkphbikcipjjj [2012-06-13]
CHR Extension: (DivX Plus Web Player HTML5 <video>) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm [2012-04-20]
CHR Extension: (uTorrentControl2) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc [2012-07-04]
CHR Extension: (Gmail) - C:\Users\sere\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-16]
CHR HKU\S-1-5-21-448289024-605243297-948884167-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\sere\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2012-06-30]
CHR HKLM-x32\...\Chrome\Extension: [gboceangmmlhhnjfgkfakfpkceekcfjn] - C:\ProgramData\Bcool\gboceangmmlhhnjfgkfakfpkceekcfjn.crx [2012-07-04]
CHR HKLM-x32\...\Chrome\Extension: [hpkjpdimfelibdmpkccdkphbikcipjjj] - C:\ProgramData\Bcool\hpkjpdimfelibdmpkccdkphbikcipjjj.crx [2012-06-13]
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12]
CHR HKLM-x32\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\sere\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2012-06-30]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ASDR; C:\Windows\SysWOW64\ASDR.exe [61440 2009-07-27] () [File not signed]
R2 ATKFUSService; C:\Windows\system32\ATKFUSService.exe [62464 2009-05-06] (ASUSTeK COMPUTER INC.) [File not signed]
R2 BEWConfigSrv; C:\Program Files (x86)\OrangeBusinessServices\Manager polaczen\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\BEWConfigSrv.exe [173008 2012-06-06] () [File not signed]
S2 ES lite Service; C:\Program Files (x86)\Gigabyte\EasySaver\ESSVR.EXE [68136 2009-08-24] ()
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed]
S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed]
R2 Realtek11nSU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
S2 nvUpdatusService; C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [X]
S2 Stereo Service; C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AODDriver; C:\Program Files (x86)\Gigabyte\ET6\amd64\AODDriver.sys [14904 2009-02-23] ()
R3 asusgsb; C:\Windows\System32\drivers\asusgsb.sys [17792 2009-02-17] (ASUSTeK Computer Inc.)
R3 atkdisplf; C:\Windows\System32\drivers\ATKDispLowFilter.sys [39424 2009-02-17] (ASUSTeK Computer Inc.)
R1 EIO64; C:\Windows\System32\DRIVERS\EIO64.sys [16384 2010-08-17] (ASUSTeK Computer Inc.)
S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-01-06] ()
U3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2009-11-19] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2009-11-19] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2009-11-19] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2009-11-19] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2009-11-19] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2009-11-19] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2009-11-19] (MCCI Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2012-12-23] () [File not signed]
U3 a403b24n; C:\Windows\System32\Drivers\a403b24n.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero size file/folder)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-05 17:16 - 2015-04-05 17:17 - 00000000 ____D () C:\FRST
2015-04-05 13:33 - 2015-04-05 13:33 - 00000000 ____D () C:\Users\sere\AppData\Local\Nero_AG

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-05 17:09 - 2012-02-10 15:49 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-05 17:09 - 2012-02-10 15:49 - 00001040 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-05 17:09 - 2010-08-20 22:08 - 00001054 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448289024-605243297-948884167-1000UA.job
2015-04-05 17:03 - 2009-07-14 06:51 - 00124733 _____ () C:\Windows\setupact.log
2015-04-05 16:48 - 2010-08-17 17:36 - 01602155 _____ () C:\Windows\WindowsUpdate.log
2015-04-05 16:09 - 2010-08-20 22:08 - 00001002 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-448289024-605243297-948884167-1000Core.job
2015-04-04 23:30 - 2009-07-14 06:45 - 00015008 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-04 23:30 - 2009-07-14 06:45 - 00015008 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-04 19:32 - 2010-09-18 21:44 - 00000000 ____D () C:\Users\sere\AppData\Roaming\Winamp
2015-03-15 13:41 - 2009-07-14 19:55 - 02892794 _____ () C:\Windows\system32\perfh015.dat
2015-03-15 13:41 - 2009-07-14 19:55 - 00878954 _____ () C:\Windows\system32\perfc015.dat
2015-03-15 13:41 - 2009-07-14 07:13 - 00005438 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-15 13:36 - 2010-08-17 17:44 - 00000062 _____ () C:\service.log
2015-03-15 13:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

==================== Files in the root of some directories =======

2010-08-17 17:36 - 2012-01-26 16:32 - 0000000 _____ () C:\Users\sere\AppData\Local\Microsofၴ
2012-04-06 14:07 - 2012-04-06 14:08 - 0002432 _____ () C:\Users\sere\AppData\Local\Tempcc4020.html
2012-04-29 22:26 - 2012-04-29 22:27 - 0002432 _____ () C:\Users\sere\AppData\Local\TempCV4052.html
2012-06-15 17:19 - 2012-06-15 17:20 - 0002432 _____ () C:\Users\sere\AppData\Local\TempcW5076.html
2012-06-29 16:20 - 2012-06-29 16:22 - 0002432 _____ () C:\Users\sere\AppData\Local\TempFJ3660.html
2012-06-18 14:04 - 2012-06-18 14:04 - 0002432 _____ () C:\Users\sere\AppData\Local\TempFm2056.html
2012-04-27 18:26 - 2012-04-27 18:27 - 0002432 _____ () C:\Users\sere\AppData\Local\Tempgt3208.html
2012-04-06 22:27 - 2012-04-06 22:28 - 0002432 _____ () C:\Users\sere\AppData\Local\TemphBD944.html
2012-04-21 17:18 - 2012-04-21 17:19 - 0002432 _____ () C:\Users\sere\AppData\Local\TempiC3424.html
2012-08-16 22:12 - 2012-08-16 22:32 - 0002432 _____ () C:\Users\sere\AppData\Local\Tempic4224.html
2012-03-12 15:40 - 2012-03-12 15:47 - 0002432 _____ () C:\Users\sere\AppData\Local\Tempjk3852.html
2012-04-08 12:02 - 2012-04-08 12:02 - 0002432 _____ () C:\Users\sere\AppData\Local\TempjKp240.html
2012-04-05 22:55 - 2012-04-06 01:20 - 0002432 _____ () C:\Users\sere\AppData\Local\TempJm4908.html
2012-04-22 23:03 - 2012-04-22 23:03 - 0002432 _____ () C:\Users\sere\AppData\Local\TempKx2128.html
2012-05-06 23:09 - 2012-05-06 23:10 - 0002432 _____ () C:\Users\sere\AppData\Local\Templum888.html
2012-07-18 00:03 - 2012-07-18 00:05 - 0002432 _____ () C:\Users\sere\AppData\Local\TempMS5664.html
2012-07-10 23:54 - 2012-07-11 00:58 - 0002432 _____ () C:\Users\sere\AppData\Local\TempMx3724.html
2012-04-07 14:47 - 2012-04-07 14:47 - 0002432 _____ () C:\Users\sere\AppData\Local\TempNF3360.html
2012-08-11 19:44 - 2012-08-11 19:50 - 0002432 _____ () C:\Users\sere\AppData\Local\TempSH1720.html
2012-02-25 15:11 - 2012-02-25 15:12 - 0002432 _____ () C:\Users\sere\AppData\Local\TempVG4788.html
2012-08-11 19:43 - 2012-08-11 19:43 - 0002089 _____ () C:\Users\sere\AppData\Local\TempVh2208.html
2012-06-10 00:00 - 2012-06-10 00:02 - 0002432 _____ () C:\Users\sere\AppData\Local\TempYD2696.html
2012-06-26 18:48 - 2012-06-26 19:46 - 0002432 _____ () C:\Users\sere\AppData\Local\TempZJ3248.html
2012-08-11 19:43 - 2012-08-11 19:43 - 0002432 _____ () C:\Users\sere\AppData\Local\TempZQ2208.html
2012-04-28 14:48 - 2012-04-28 14:48 - 0002181 _____ () C:\Users\sere\AppData\Local\unins000.dat
2012-04-28 14:48 - 2012-04-28 14:48 - 0707504 _____ () C:\Users\sere\AppData\Local\unins000.exe
2012-04-28 14:48 - 2012-04-28 14:48 - 0011761 _____ () C:\Users\sere\AppData\Local\unins000.msg
2010-09-17 19:51 - 2010-09-17 19:51 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2010-09-21 21:41 - 2013-09-21 19:12 - 0003664 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\sere\AppData\Local\Temp\ccittfax3.exe
C:\Users\sere\AppData\Local\Temp\nvStInst.exe
C:\Users\sere\AppData\Local\Temp\t.dll
C:\Users\sere\AppData\Local\Temp\tbuTor.dll
C:\Users\sere\AppData\Local\Temp\uttCD6D.tmp.exe
C:\Users\sere\AppData\Local\Temp\zlib1.exe


Some zero byte size files/folders:
==========================
C:\Windows\SysWOW64\spwizimg.dll
C:\Windows\System32\mssitlb.dll
C:\Windows\System32\၏penCL.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-04 19:30

==================== End Of Log ============================