Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2015 Ran by SYSTEM on MININT-IJ5DP1H on 13-04-2015 11:58:22 Running from G:\ Platform: Windows 7 Professional (X86) OS Language: Polski (Polska) Internet Explorer Version 11 Boot Mode: Recovery The current controlset is ControlSet001 [b]ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.[/b] Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2379504 2013-04-24] (Synaptics Incorporated) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [5088456 2014-10-01] (ESET) HKLM\...\Run: [] => [X] HKLM\...\Run: [sketchmanager] => C:\Program Files\Wacom\Inkling Sketch Manager\SketchManager.exe [3659776 2011-08-01] () HKU\Tekla\...\Run: [Expressivo] => C:\Program Files\ivo\Expressivo\expressivo.exe [2031616 2007-12-06] (IVO Software Sp. z o.o.) HKU\Tekla\...\Run: [MobiLink Lite] => C:\Program Files\Novatel Wireless\MobiLink\Lite.exe [446536 2008-08-18] (Novatel Wireless) HKU\Tekla\...\Run: [AdobeBridge] => [X] HKU\Tekla\...\Run: [GoogleDriveSync] => C:\Program Files\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google) HKU\Tekla\...\Run: [ChomikBox] => C:\Program Files\ChomikBox\chomikbox.exe [6033408 2014-07-26] ( ) HKU\Tekla\...\Run: [ABBYY Screenshot Reader Retail] => C:\Program Files\ABBYY Screenshot Reader\ScreenshotReader.exe [959752 2009-10-27] (ABBYY) HKU\Tekla\...\Run: [EPSON Stylus Photo R265 Series] => C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE [139264 2006-05-19] (SEIKO EPSON CORPORATION) HKU\Tekla\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [31344744 2015-02-26] (Skype Technologies S.A.) HKU\Tekla\...\Run: [GoogleChromeAutoLaunch_830B90EFA7A430646CA50AC92298ACDE] => C:\Program Files\Google\Chrome\Application\chrome.exe [809288 2015-03-07] (Google Inc.) HKU\Tekla\...\RunOnce: [!DefaultSetup] => C:\Users\Tekla\AppData\Local\Microsoft\DefaultSetup\DefaultSetup.exe [2645136 2015-03-21] (© 2013 Microsoft Corporation) HKU\Tekla\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\wm.scr [1937253 2013-10-09] (Jan Kolarik & Ondrej Vaverka) Startup: C:\Users\Tekla\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> (No File) BootExecute: PDBoot.exeautocheck autochk * ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 ABBYY.Licensing.FineReader.Professional.9.0; C:\Program Files\Common Files\ABBYY\FineReader\9.00\Licensing\PE\NetworkLicenseServer.exe [660768 2007-12-06] (ABBYY (BIT Software)) S2 ABBYY.Licensing.FineReader.ScreenshotReader.9.0; C:\Program Files\ABBYY Screenshot Reader\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY) S2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) S2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) S3 Creative ALchemy AL6 Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2013-07-24] (Creative Labs) S2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe [1349576 2014-10-01] (ESET) S2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [235696 2014-04-09] (McAfee, Inc.) S2 PDAgent; C:\Program Files\Raxco\PerfectDisk10\PDAgent.exe [939272 2010-01-26] (Raxco Software, Inc.) S3 PDEngine; C:\Program Files\Raxco\PerfectDisk10\PDEngine.exe [1033480 2010-01-26] (Raxco Software, Inc.) S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] () S1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [191928 2014-10-10] (ESET) S1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [135296 2014-10-10] (ESET) S2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [123424 2014-10-10] (ESET) S1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2009-02-10] (EZB Systems, Inc.) S3 skfiltv; C:\Windows\System32\drivers\skfiltv.sys [17408 2008-08-14] (Creative Technology Ltd.) S3 AcpiPmi; \SystemRoot\system32\drivers\acpipmi.sys [X] S3 ADIHdAudAddService; system32\drivers\ADIHdAud.sys [X] S3 adp94xx; \SystemRoot\system32\DRIVERS\adp94xx.sys [X] S3 adpahci; \SystemRoot\system32\DRIVERS\adpahci.sys [X] S3 adpu320; \SystemRoot\system32\DRIVERS\adpu320.sys [X] S3 aic78xx; \SystemRoot\system32\DRIVERS\djsvs.sys [X] S3 aliide; \SystemRoot\system32\drivers\aliide.sys [X] S3 amdagp; \SystemRoot\system32\drivers\amdagp.sys [X] S3 amdide; \SystemRoot\system32\drivers\amdide.sys [X] S3 AmdK8; \SystemRoot\system32\DRIVERS\amdk8.sys [X] S3 AmdPPM; \SystemRoot\system32\DRIVERS\amdppm.sys [X] S3 amdsata; \SystemRoot\system32\drivers\amdsata.sys [X] S3 amdsbs; \SystemRoot\system32\DRIVERS\amdsbs.sys [X] S0 amdxata; system32\drivers\amdxata.sys [X] S3 arc; \SystemRoot\system32\DRIVERS\arc.sys [X] S3 arcsas; \SystemRoot\system32\DRIVERS\arcsas.sys [X] S3 atikmdag; system32\DRIVERS\atikmdag.sys [X] S3 b06bdrv; \SystemRoot\system32\DRIVERS\bxvbdx.sys [X] S3 b57nd60x; system32\DRIVERS\b57nd60x.sys [X] S1 blbdrive; system32\DRIVERS\blbdrive.sys [X] S0 BMLoad; system32\drivers\BMLoad.sys [X] S3 BrFiltLo; \SystemRoot\system32\DRIVERS\BrFiltLo.sys [X] S3 BrFiltUp; \SystemRoot\system32\DRIVERS\BrFiltUp.sys [X] S3 Brserid; \SystemRoot\System32\Drivers\Brserid.sys [X] S3 BrSerWdm; \SystemRoot\System32\Drivers\BrSerWdm.sys [X] S3 BrUsbMdm; \SystemRoot\System32\Drivers\BrUsbMdm.sys [X] S3 BrUsbSer; \SystemRoot\System32\Drivers\BrUsbSer.sys [X] S3 BTHMODEM; \SystemRoot\system32\DRIVERS\bthmodem.sys [X] S3 BthPan; system32\DRIVERS\bthpan.sys [X] S3 circlass; \SystemRoot\system32\DRIVERS\circlass.sys [X] S3 cmdide; \SystemRoot\system32\drivers\cmdide.sys [X] S4 crcdisk; \SystemRoot\system32\DRIVERS\crcdisk.sys [X] S2 DefragFS; No ImagePath S3 e1express; system32\DRIVERS\e1e6032.sys [X] S3 ebdrv; \SystemRoot\system32\DRIVERS\evbdx.sys [X] S3 elxstor; \SystemRoot\system32\DRIVERS\elxstor.sys [X] S3 fdc; \SystemRoot\system32\DRIVERS\fdc.sys [X] S3 flpydisk; \SystemRoot\system32\DRIVERS\flpydisk.sys [X] S3 gagp30kx; \SystemRoot\system32\DRIVERS\gagp30kx.sys [X] S3 GEARAspiWDM; system32\DRIVERS\GEARAspiWDM.sys [X] S3 hcw85cir; \SystemRoot\system32\drivers\hcw85cir.sys [X] S3 HidBatt; \SystemRoot\system32\DRIVERS\HidBatt.sys [X] S3 HidBth; \SystemRoot\system32\DRIVERS\hidbth.sys [X] S3 HidIr; \SystemRoot\system32\DRIVERS\hidir.sys [X] S2 HOSTNT; No ImagePath S3 HpSAMD; \SystemRoot\system32\drivers\HpSAMD.sys [X] S3 HSF_DPV; system32\DRIVERS\HSX_DPV.sys [X] S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X] S0 iaStor; system32\DRIVERS\iaStor.sys [X] S3 iaStorV; \SystemRoot\system32\drivers\iaStorV.sys [X] S3 IBMPMDRV; system32\DRIVERS\ibmpmdrv.sys [X] S3 iirsp; \SystemRoot\system32\DRIVERS\iirsp.sys [X] S0 intelide; system32\drivers\intelide.sys [X] S3 IPMIDRV; \SystemRoot\system32\drivers\IPMIDrv.sys [X] S3 LSI_FC; \SystemRoot\system32\DRIVERS\lsi_fc.sys [X] S3 LSI_SAS; \SystemRoot\system32\DRIVERS\lsi_sas.sys [X] S3 LSI_SAS2; \SystemRoot\system32\DRIVERS\lsi_sas2.sys [X] S3 LSI_SCSI; \SystemRoot\system32\DRIVERS\lsi_scsi.sys [X] S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X] S3 megasas; \SystemRoot\system32\DRIVERS\megasas.sys [X] S3 MegaSR; \SystemRoot\system32\DRIVERS\MegaSR.sys [X] S0 msahci; system32\drivers\msahci.sys [X] S3 MTConfig; \SystemRoot\system32\DRIVERS\MTConfig.sys [X] S3 Netaapl; system32\DRIVERS\netaapl.sys [X] S3 netw5v32; system32\DRIVERS\netw5v32.sys [X] S3 NETwLv32; system32\DRIVERS\NETwLv32.sys [X] S3 nfrd960; \SystemRoot\system32\DRIVERS\nfrd960.sys [X] S3 NSCIRDA; system32\DRIVERS\nscirda.sys [X] S3 nvraid; \SystemRoot\system32\drivers\nvraid.sys [X] S3 nvstor; \SystemRoot\system32\drivers\nvstor.sys [X] S3 nv_agp; \SystemRoot\system32\drivers\nv_agp.sys [X] S3 Parport; \SystemRoot\system32\DRIVERS\parport.sys [X] S2 Parvdm; \SystemRoot\system32\DRIVERS\parvdm.sys [X] S3 Processor; \SystemRoot\system32\DRIVERS\processr.sys [X] S3 ql2300; \SystemRoot\system32\DRIVERS\ql2300.sys [X] S3 ql40xx; \SystemRoot\system32\DRIVERS\ql40xx.sys [X] S3 s3cap; \SystemRoot\system32\drivers\vms3cap.sys [X] S3 sbp2port; \SystemRoot\system32\drivers\sbp2port.sys [X] S2 secdrv; No ImagePath S3 Serenum; \SystemRoot\system32\DRIVERS\serenum.sys [X] S3 Serial; \SystemRoot\system32\DRIVERS\serial.sys [X] S3 sfloppy; \SystemRoot\system32\DRIVERS\sfloppy.sys [X] S3 sisagp; \SystemRoot\system32\drivers\sisagp.sys [X] S3 SiSRaid2; \SystemRoot\system32\DRIVERS\SiSRaid2.sys [X] S3 SiSRaid4; \SystemRoot\system32\DRIVERS\sisraid4.sys [X] S3 slabbus; system32\DRIVERS\slabbus.sys [X] S3 slabser; system32\DRIVERS\slabser.sys [X] S3 SrvHsfHDA; system32\DRIVERS\VSTAZL3.SYS [X] S3 SrvHsfV92; system32\DRIVERS\VSTDPV3.SYS [X] S3 SrvHsfWinac; system32\DRIVERS\VSTCNXT3.SYS [X] S3 stexstor; \SystemRoot\system32\DRIVERS\stexstor.sys [X] S0 storflt; system32\drivers\vmstorfl.sys [X] S3 storvsc; \SystemRoot\system32\drivers\storvsc.sys [X] S3 swenum; \SystemRoot\system32\drivers\swenum.sys [X] S3 SynTP; system32\DRIVERS\SynTP.sys [X] S1 tcpipBM; \??\C:\Windows\system32\drivers\tcpipBM.sys [X] S3 TPM; system32\drivers\tpm.sys [X] S3 uagp35; \SystemRoot\system32\DRIVERS\uagp35.sys [X] S3 UDA; System32\Drivers\rcudawdm.sys [X] S3 uliagpkx; \SystemRoot\system32\drivers\uliagpkx.sys [X] S3 UmPass; \SystemRoot\system32\DRIVERS\umpass.sys [X] S3 USBAAPL; System32\Drivers\usbaapl.sys [X] S3 usbcir; \SystemRoot\system32\drivers\usbcir.sys [X] S3 usbscan; system32\DRIVERS\usbscan.sys [X] S3 viaagp; \SystemRoot\system32\drivers\viaagp.sys [X] S3 ViaC7; \SystemRoot\system32\DRIVERS\viac7.sys [X] S3 viaide; \SystemRoot\system32\drivers\viaide.sys [X] S0 vmbus; system32\drivers\vmbus.sys [X] S3 VMBusHID; \SystemRoot\system32\drivers\VMBusHID.sys [X] S3 vsmraid; \SystemRoot\system32\DRIVERS\vsmraid.sys [X] S5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) S3 WacomPen; \SystemRoot\system32\DRIVERS\wacompen.sys [X] S3 Wd; \SystemRoot\system32\DRIVERS\wd.sys [X] S3 winachsf; system32\DRIVERS\HSX_CNXT.sys [X] S2 XAudio; system32\DRIVERS\xaudio.sys [X] S3 zte_cdc_acm; system32\DRIVERS\zte_cdc_acm.sys [X] S3 zte_cpo; system32\DRIVERS\zte_cpo.sys [X] ========================== Drivers MD5 ======================= C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit C:\Windows\system32\drivers\afd.sys D0B388DA1D111A34366E04EB4A5DD156 C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit C:\Windows\system32\drivers\appid.sys 81F97D8F8B3FB94A451CC6F7CF8B2965 C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit C:\Windows\system32\drivers\BthEnum.sys ==> MD5 is legit C:\Windows\System32\Drivers\BTHport.sys 1153DE2E4F5941E10C399CB5592F78A1 C:\Windows\System32\Drivers\BTHUSB.sys C81E9413A25A439F436B1D4B6A0CF9E9 C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit C:\Windows\System32\CLFS.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit C:\Windows\System32\Drivers\cng.sys 3051724F223EA48968B19567DE2A81F4 C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit C:\Program Files\SystemRequirementsLab\cpudrv.sys D01F685F8B4598D144B0CCE9FF95D8D5 C:\Windows\System32\drivers\csc.sys ==> MD5 is legit C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit C:\Windows\System32\drivers\discache.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit C:\Windows\system32\drivers\drmkaud.sys ==> MD5 is legit C:\Windows\System32\drivers\dxgkrnl.sys 3583A5A8CC2E682BFFBD4630D0FEC08B C:\Windows\System32\DRIVERS\eamonm.sys 687CCC438AA414AE22EEA081F98DC645 C:\Windows\System32\DRIVERS\ehdrv.sys 340870877DBE2A6D848537FC6AC2BA2F C:\Windows\System32\DRIVERS\epfwwfpr.sys AF28B861BCF67F4A533C95F8FFB671CE C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05 C:\Windows\System32\DRIVERS\fvevol.sys E306A24D9694C724FA2491278BF50FDB C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972 C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\i8042prt.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\irda.sys 9F7E491FB0BA0F9E370163834FC1FE31 C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit C:\Windows\system32\drivers\msiscsi.sys EB34CE31FABD4DC4343FD2AD16D2CAF9 C:\Program Files\UltraISO\drivers\ISODrive.sys 0AE61463ADDA697A6291155CE6B08AAF C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit C:\Windows\System32\Drivers\ksecdd.sys 4DAC97CF81FAE4B2988AEF0DF40D04AE C:\Windows\System32\Drivers\ksecpkg.sys 9EED5E0B7BF784C491C2289A09920BDA C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit C:\Windows\System32\drivers\modem.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit C:\Windows\System32\drivers\mountmgr.sys 644905A19D0F37F2233DFCE53BC4BC19 C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit C:\Windows\system32\drivers\mrxdav.sys 03F899F521D2AAED1C55008F734DF252 C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25 C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit C:\Windows\System32\drivers\ndis.sys 8C9C922D71F1CD4DEF73F186416B7896 C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit C:\Windows\System32\Drivers\Ntfs.sys C8DFF8D07755A66C7A4A738930F0FEAC C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B C:\Windows\System32\drivers\pci.sys ==> MD5 is legit C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\pcmcia.sys ==> MD5 is legit C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit C:\Windows\System32\drivers\peauth.sys AEBC369F7DC72AB3F5B9BDF34FA0D43F C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit C:\Windows\System32\drivers\rdpvideominiport.sys 65375DF758CA1872AB7EBBBA457FD5E6 C:\Windows\System32\Drivers\RDPWD.sys CD9214A6AE17D188D17C3CF8CB9CC693 C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\rfcomm.sys CB928D9E6DAF51879DD6BA8D02F01321 C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit C:\Windows\System32\drivers\skfiltv.sys A48B5AF8E18E4765ACDEC5BBB8343F84 C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46 C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC C:\Windows\System32\drivers\tcpip.sys 5579DD18546999F5D0EC39D018726C6B C:\Windows\System32\DRIVERS\tcpip.sys 5579DD18546999F5D0EC39D018726C6B C:\Windows\System32\drivers\tcpipreg.sys 3EEBD3BD93DA46A26E89893C7AB2FF3B C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8 C:\Windows\System32\DRIVERS\tdx.sys 7FE680A3DFA421C4A8E4879AE4C5AAB0 C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\tssecsrv.sys 6C5139E4283249518F7743D7043775B3 C:\Windows\System32\drivers\tsusbflt.sys 9CE253214ACAA5A7D323327D2055EFAA C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit C:\Windows\System32\drivers\usbaudio.sys A1977C315BF5691DA99235AA4A6907AF C:\Windows\System32\DRIVERS\usbccgp.sys 0803FBA9FE829D61AE26EC0BCC910C46 C:\Windows\system32\drivers\usbehci.sys D40855F89B69305140BBD7E9A3BA2DA6 C:\Windows\System32\DRIVERS\usbhub.sys EDF2DF71C4F1E13A6AC75F5224DE655A C:\Windows\system32\drivers\usbohci.sys 9828C8D14CC2676421778F0DE638CF97 C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A C:\Windows\system32\drivers\usbuhci.sys 800AABFD625EEFF899F7E5496BDE37AB C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit C:\Windows\System32\drivers\vga.sys ==> MD5 is legit C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit C:\Windows\System32\drivers\vwifibus.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit C:\Windows\System32\drivers\Wdf01000.sys 25944D2CC49E0A6C581D02A74B7D6645 C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708 C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit C:\Windows\System32\drivers\WudfPf.sys 06E6F32C8D0A3F66D956F57B43A2E070 C:\Windows\System32\DRIVERS\WUDFRd.sys 867C301E8B790040AE9CF6486E8041DF ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-13 11:53 - 2015-04-13 11:58 - 00000000 ____D () C:\FRST 2015-03-24 07:58 - 2015-03-24 08:11 - 00000000 ____D () C:\Windows\System32\Drivers\pl-PL 2015-03-24 07:55 - 2009-07-14 02:26 - 00019024 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\compbatt.sys 2015-03-23 22:42 - 2015-03-23 22:42 - 00428672 _____ () C:\Users\Tekla\Desktop\re.zip 2015-03-23 15:26 - 2015-03-23 15:37 - 11215239 _____ () C:\Users\Tekla\Desktop\logo profilwiert.psd 2015-03-23 10:35 - 2015-03-23 10:37 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2015-03-23 06:45 - 2015-03-23 07:02 - 06309888 _____ () C:\Users\Tekla\Desktop\Metale.ppt 2015-03-22 17:15 - 2015-03-22 17:15 - 00091844 _____ () C:\Users\Tekla\Desktop\to.tif 2015-03-22 17:12 - 2015-03-22 17:12 - 00160072 _____ () C:\Users\Tekla\Desktop\Untitled-1.tif 2015-03-22 16:39 - 2015-03-22 16:39 - 01047140 _____ () C:\Users\Tekla\Desktop\PWn.psd 2015-03-22 16:11 - 2015-03-22 16:40 - 13113346 _____ () C:\Users\Tekla\Desktop\PWGRAF.psd 2015-03-22 16:08 - 2015-03-22 16:10 - 13438270 _____ () C:\Users\Tekla\Desktop\PW.psd 2015-03-21 19:12 - 2015-03-21 19:12 - 00000000 ____D () C:\Users\Tekla\Tracing ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2020-11-28 10:39 - 2014-02-27 23:16 - 00000000 _____ () C:\Users\Tekla\Downloads\wardas.marta@gmail.com 2015-03-24 07:14 - 2009-12-14 10:08 - 00000000 ____D () C:\Users\Tekla\AppData\Roaming\Skype 2015-03-24 02:13 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\tracing 2015-03-23 23:43 - 2013-08-11 14:18 - 00000000 ___RD () C:\Users\Tekla\Dropbox 2015-03-23 22:20 - 2012-06-11 10:19 - 00000000 ___RD () C:\Users\Tekla\Google Drive 2015-03-23 17:25 - 2009-12-12 02:30 - 01103830 _____ () C:\Windows\WindowsUpdate.log 2015-03-23 16:12 - 2012-05-23 12:15 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2015-03-21 19:13 - 2010-02-06 01:30 - 00000000 ___RD () C:\Program Files\Skype 2015-03-21 19:12 - 2009-12-12 02:34 - 00000000 ____D () C:\users\Tekla 2015-03-21 19:11 - 2009-12-14 10:07 - 00000000 ____D () C:\ProgramData\Skype 2015-03-21 18:43 - 2015-02-18 16:44 - 00003067 _____ () C:\Windows\setupact.log 2015-03-21 10:21 - 2010-05-21 20:16 - 00002135 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-03-17 06:35 - 2009-12-12 02:40 - 01670590 _____ () C:\Windows\System32\PerfStringBackup.INI 2015-03-17 06:35 - 2009-07-14 09:07 - 00740688 _____ () C:\Windows\System32\perfh015.dat 2015-03-17 06:35 - 2009-07-14 09:07 - 00156230 _____ () C:\Windows\System32\perfc015.dat 2015-03-16 21:03 - 2014-10-05 22:34 - 00001823 _____ () C:\Users\Public\Desktop\Prezi.lnk 2015-03-16 21:03 - 2014-10-05 22:32 - 00000000 ____D () C:\Program Files\Prezi Files to move or delete: ==================== C:\Users\Tekla\pswG31.dll Some content of TEMP: ==================== C:\Users\Tekla\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbfos_s.dll C:\Users\Tekla\AppData\Local\Temp\SkypeSetup.exe ==================== Known DLLs (Whitelisted) ============ ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== Restore Points ========================= ==================== BCD ================================ Menedľer rozruchu systemu Windows --------------------------------- Identyfikator {bootmgr} device partition=Y: description Windows Boot Manager locale pl-PL inherit {globalsettings} default {default} resumeobject {34df0439-e691-11de-8f99-cba0f9445f35} displayorder {default} toolsdisplayorder {memdiag} timeout 30 Moduˆ ˆadujĄcy rozruchu systemu Windows --------------------------------------- Identyfikator {34df0437-e691-11de-8f99-cba0f9445f35} device ramdisk=[C:]\Recovery\34df0437-e691-11de-8f99-cba0f9445f35\Winre.wim,{34df0438-e691-11de-8f99-cba0f9445f35} path \windows\system32\winload.exe description Windows Recovery Environment inherit {bootloadersettings} osdevice ramdisk=[C:]\Recovery\34df0437-e691-11de-8f99-cba0f9445f35\Winre.wim,{34df0438-e691-11de-8f99-cba0f9445f35} systemroot \windows nx OptIn winpe Yes Moduˆ ˆadujĄcy rozruchu systemu Windows --------------------------------------- Identyfikator {default} device partition=C: path \Windows\system32\winload.exe description Windows 7 locale pl-PL inherit {bootloadersettings} recoverysequence {current} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {34df0439-e691-11de-8f99-cba0f9445f35} nx OptIn Moduˆ ˆadujĄcy rozruchu systemu Windows --------------------------------------- Identyfikator {current} device ramdisk=[C:]\Recovery\34df043b-e691-11de-8f99-cba0f9445f35\Winre.wim,{34df043c-e691-11de-8f99-cba0f9445f35} path \windows\system32\winload.exe description Windows Recovery Environment inherit {bootloadersettings} osdevice ramdisk=[C:]\Recovery\34df043b-e691-11de-8f99-cba0f9445f35\Winre.wim,{34df043c-e691-11de-8f99-cba0f9445f35} systemroot \windows nx OptIn winpe Yes Wznawianie ze stanu hibernacji ------------------------------ Identyfikator {34df0439-e691-11de-8f99-cba0f9445f35} device partition=C: path \Windows\system32\winresume.exe description Windows Resume Application locale pl-PL inherit {resumeloadersettings} filedevice partition=C: filepath \hiberfil.sys pae Yes debugoptionenabled No Moduˆ testujĄcy pami©† systemu Windows -------------------------------------- Identyfikator {memdiag} device partition=Y: path \boot\memtest.exe description Diagnostyka pami©ci systemu Windows locale pl-PL inherit {globalsettings} badmemoryaccess Yes Ustawienia usˆug EMS -------------------- Identyfikator {emssettings} bootems Yes Ustawienia debugera ------------------- Identyfikator {dbgsettings} debugtype Serial debugport 1 baudrate 115200 Uszkodzenia pami©ci RAM ----------------------- Identyfikator {badmemory} Ustawienia globalne ------------------- Identyfikator {globalsettings} inherit {dbgsettings} {emssettings} {badmemory} Ustawienia moduˆu ˆadujĄcego rozruchu ------------------------------------- Identyfikator {bootloadersettings} inherit {globalsettings} {hypervisorsettings} Ustawienia funkcji hypervisor ----------------------------- Identyfikator {hypervisorsettings} hypervisordebugtype Serial hypervisordebugport 1 hypervisorbaudrate 115200 Ustawienia moduˆu ˆadujĄcego wznawiania --------------------------------------- Identyfikator {resumeloadersettings} inherit {globalsettings} Opcje urzĄdzenia ---------------- Identyfikator {34df0438-e691-11de-8f99-cba0f9445f35} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\34df0437-e691-11de-8f99-cba0f9445f35\boot.sdi Opcje urzĄdzenia ---------------- Identyfikator {34df043c-e691-11de-8f99-cba0f9445f35} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\34df043b-e691-11de-8f99-cba0f9445f35\boot.sdi ==================== Memory info =========================== Percentage of memory in use: 15% Total physical RAM: 3070.43 MB Available physical RAM: 2588.14 MB Total Pagefile: 3068.71 MB Available Pagefile: 2600.45 MB Total Virtual: 2047.88 MB Available Virtual: 1950.42 MB ==================== Drives ================================ Drive c: (32Win7 ) (Fixed) (Total:100 GB) (Free:23.06 GB) NTFS Drive e: (Nowy) (Fixed) (Total:365.66 GB) (Free:219.67 GB) NTFS Drive g: (MULTIBOOT) (Removable) (Total:0.94 GB) (Free:0.08 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Drive y: (Zastrzeżone przez system) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: ABC3EFB1) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=100 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=365.7 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 968 MB) (Disk ID: 20AC7DDA) No partition Table on disk 1. LastRegBack: 2015-03-14 22:28 ==================== End Of Log ============================