Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-04-2015 02 Ran by Patryk (administrator) on MARIAN-KOMPUTER on 15-04-2015 16:16:41 Running from C:\Users\Patryk\Desktop Loaded Profiles: Patryk (Available profiles: Marian & Patryk & Adrian & EWA) Platform: Windows 7 Ultimate (X64) OS Language: Polski (Polska) Internet Explorer Version 9 (Default browser path: "D:\Maxthon\Bin\Maxthon.exe" "%1") Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCUService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe () C:\ProgramData\Realtek\PnkBstrA.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe () C:\Users\Patryk\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe (Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe () C:\Program Files\IB Updater\ExtensionUpdaterService.exe (XTab system) C:\Program Files (x86)\XTab\ProtectService.exe (SearchProtect) C:\Program Files (x86)\XTab\CmdShell.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (XTab system) C:\Program Files (x86)\XTab\HPNotify.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (DEVGURU Co., LTD.) E:\Kic\USB Drivers\25_escape\conn\ss_conn_service.exe (TeamViewer GmbH) E:\teamviever3\TeamViewer_Service.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe (GBM Software) D:\GRemote Pro\GRemoteServer.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (DeviceVM, Inc.) C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe (Samsung Electronics Co., Ltd.) E:\Kic\Kies\KiesTrayAgent.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe () C:\Program Files (x86)\Solution Real\bin\SolutionReal.BOASHelper.exe () C:\Program Files (x86)\Solution Real\bin\SolutionReal.expext.exe (Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\IPC\AdobeIPCBroker.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\Program Files (x86)\Solution Real\updateSolutionReal.exe () C:\Program Files (x86)\Solution Real\bin\SolutionReal.PurBrowse64.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe () C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter.exe () C:\Program Files (x86)\Solution Real\bin\SolutionReal.BrowserAdapter64.exe () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Adobe Creative Cloud\HEX\Adobe CEF Helper.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2460488 2014-09-17] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5512912 2015-04-13] (Avast Software s.r.o.) HKLM-x32\...\Run: [BCU] => C:\Program Files (x86)\DeviceVM\Browser Configuration Utility\BCU.exe [346320 2009-08-04] (DeviceVM, Inc.) HKLM-x32\...\Run: [KiesTrayAgent] => E:\Kic\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2691480 2014-03-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1065024 2014-05-02] (SEIKO EPSON CORPORATION) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [QuickTime Task] => E:\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM\...\Policies\Explorer\Run: [PnkBstrA] => C:\ProgramData\Realtek\PnkBstrA.exe [248320 2013-11-07] ( ()) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Run: [GRemoteServer Pro] => D:\GRemote Pro\GRemoteServer.exe [2818528 2011-08-16] (GBM Software) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Run: [Steam] => D:\Steam\steam.exe [2889408 2015-04-09] (Valve Corporation) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [26232152 2015-02-19] (Google) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7416088 2015-02-19] (Piriform Ltd) HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\MountPoints2: {9daebe75-f6e7-11e0-8b85-806e6f6e6963} - F:\Setup.exe HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\MountPoints2: {caa6efdd-ffa6-11df-a54f-806e6f6e6963} - F:\launcher.exe HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Bubbles.scr [899584 2009-07-14] (Microsoft Corporation) AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.150\SSScheduler.exe (McAfee, Inc.) ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION GroupPolicyUsers\S-1-5-21-1693294449-2853722536-560343305-1006\User: Group Policy restriction detected <======= ATTENTION GroupPolicyUsers\S-1-5-21-1693294449-2853722536-560343305-1004\User: Group Policy restriction detected <======= ATTENTION GroupPolicyUsers\S-1-5-21-1693294449-2853722536-560343305-1003\User: Group Policy restriction detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1421258256&from=wpm01141&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?babsrc=HP_ss_gin2g&mntrId=E60D6CF04912EFE9&affID=119357&tt=070713_9124&tsp=4936 HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://isearch.omiga-plus.com/?type=hppp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3 HKU\S-1-5-21-1693294449-2853722536-560343305-1003\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1421258256&from=wpm01141&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} URLSearchHook: HKLM-x32 - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File URLSearchHook: HKLM-x32 - (No Name) - {8f3c1d75-d467-43c2-9a36-655366b76f5f} - No File URLSearchHook: HKLM-x32 - (No Name) - {40f5f417-32bb-4296-9446-c1e0094e7d82} - No File URLSearchHook: HKLM-x32 - (No Name) - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File URLSearchHook: HKLM-x32 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File URLSearchHook: HKLM-x32 - (No Name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {5c5b9468-d672-4eb7-b52f-b5afabf28c5b} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {51a86bb3-6602-4c85-92a5-130ee4864f13} - No File URLSearchHook: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 - (No Name) - {8040829d-1177-46e2-9157-8282438b79c7} - No File SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1420881240&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKLM-x32 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM-x32 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031817 SearchScopes: HKLM-x32 -> {d3f22a84-2a84-49eb-91e6-5dadaaf0165d} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm518YYpl&ptnrS=GRxdm518YYpl&ptb=DEDE97AE-18CC-436D-ACC8-39572D52CB1E&ind=2012112715&n=77ee674b&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {0BA9EFF0-F360-4AE1-9ACB-7A571FDA610D} URL = http://rts.dsrlte.com/?affID=na&q={searchTerms}&r=643 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searchTerms}&affID=119370&tt=190313_wo3&babsrc=SP_ss_gin2g&mntrId=E60D6CF04912EFE9 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} URL = http://www.crawler.com/search/dispatcher.aspx?tp=bs&qkw={searchTerms}&tbid=66019 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1420881270&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&q={searchTerms} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {3E1018A3-49B2-4653-AD4E-6E62A05A61DB} URL = http://www.bing.com/search?q={searchTerms}&form=SPLBR2&pc=SPLH SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {5BB4F252-A3F7-4C72-8E8E-F66BFA0C7DE1} URL = http://search.softonic.com/MON00005/tb_v1?q={searchTerms}&SearchSource=4&cc=&r=674 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {87FE74A0-F9A3-4593-90E6-72C2C875DB9F} URL = http://search.yahoo.com/search?p={searchTerms}&fr=chr-devicevm&type=STDVM SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://isearch.avg.com/search?cid={91CA612C-D769-414A-8EC6-BAD79F2B0E91}&mid=61a2c1c9da3a44cbbb9d226a974d67c1-3a8240382015bed401ff45a03efe52fe9603e643&lang=pl&ds=ax011&pr=&d=2012-09-21 15:31:42&v=12.2.5.34&sap=dsp&q={searchTerms} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050 SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {CEBC9A4E-5C2C-4DEA-B24E-3709952C969E} URL = http://www.mysearchresults.com/search?&c=3507&t=07&q={searchTerms} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {d3f22a84-2a84-49eb-91e6-5dadaaf0165d} URL = http://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm518YYpl&ptnrS=GRxdm518YYpl&ptb=DEDE97AE-18CC-436D-ACC8-39572D52CB1E&ind=2012112715&n=77ee674b&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> {F457602F-1819-4047-9C19-1286DA13B886} URL = http://www.google.com/cse?cx=partner-pub-3794288947762788%3A4067623346&ie=UTF-8&q={searchTerms}&sa=Search&siteurl=www.google.com%2Fcse%2Fhome%3Fcx%3Dpartner-pub-3794288947762788%3A4067623346 BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-04-13] (Avast Software s.r.o.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO: Easy Photo Print -> {9421DD08-935F-4701-A9CA-22DF90AC4EA6} -> C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2012-01-25] (SEIKO EPSON CORPORATION) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-09-20] (Hewlett-Packard Co.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll [2014-04-09] (McAfee, Inc.) BHO-x32: No Name -> {14d02517-c8be-4735-a344-3c8366c77aa0} -> No File BHO-x32: E-Web Print -> {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} -> C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-03-15] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-04-13] (Avast Software s.r.o.) BHO-x32: Pomocnik logowania za pomocą konta Microsoft -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation) BHO-x32: No Name -> {b1df253a-9e7a-480d-b6a5-7a435b520dbb} -> No File BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-03-15] (Oracle Corporation) BHO-x32: IplexToALLPlayer -> {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} -> E:\ALLPlayer\Iplex\IplexToALLPlayer.dll [2011-02-09] (ALLCinema Ltd.) BHO-x32: SMTTB2009 Class -> {FCBCCB87-9224-4B8D-B117-F56D924BEB18} -> C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll [2011-06-22] () BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-09-20] (Hewlett-Packard Co.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll [2012-01-25] (SEIKO EPSON CORPORATION) Toolbar: HKLM-x32 - Hyperionics DB Toolbar - {338B4DFE-2E2C-4338-9E41-E176D497299E} - C:\Program Files (x86)\Hyperionics DB Toolbar\tbcore3.dll [2011-06-22] () Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} - No File Toolbar: HKLM-x32 - No Name - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - No File Toolbar: HKLM-x32 - E-Web Print - {201CF130-E29C-4E5C-A73F-CD197DEFA6AE} - C:\Program Files (x86)\Epson Software\E-Web Print\ewps_tb.dll [2014-11-27] (SEIKO EPSON CORPORATION) Toolbar: HKU\.DEFAULT -> No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No File Toolbar: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> No Name - {338B4DFE-2E2C-4338-9E41-E176D497299E} - No File Toolbar: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> No Name - {A0B1221C-A3FF-4F7C-A393-DC63AF5301E9} - No File Toolbar: HKU\S-1-5-21-1693294449-2853722536-560343305-1003 -> No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} - No File DPF: HKLM-x32 {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab DPF: HKLM-x32 {6E718D87-6909-4FCE-92D4-EDCB2F725727} http://navigram.com/engine/v1140/Navigram.cab Handler-x32: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files (x86)\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll [2011-12-12] (Logitech Inc.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2014-07-14] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2014-07-14] (Microsoft Corporation) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=ST31000528AS_5VP5HED3XXXX5VP5HED3&ts=1380138517 FireFox: ======== FF ProfilePath: C:\Users\Patryk\AppData\Roaming\Mozilla\Firefox\Profiles\hugow75b.default FF NewTab: hxxp://search.yahoo.com/?fr=hp-ddc-bd-tab&type=616_pr__alt__ddc_dsssyctab_bd_com FF SelectedSearchEngine: Yahoo! Search FF Homepage: hxxp://search.yahoo.com/?fr=hp-ddc-bd&type=616_pr__alt__ddc_dsssyc_bd_com FF Keyword.URL: hxxp://search.yahoo.com/yhs/search?hspart=ddc&hsimp=yhs-ddc_bd&type=616_pr__alt__ddc_dss_bd_com&p= FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-06] () FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelogx64.dll [2014-09-01] (EA Digital Illusions CE AB) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2014-03-21] (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-06] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [2013-11-21] (EA Digital Illusions CE AB) FF Plugin-x32: @esn/npbattlelog,version=2.5.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-01] (EA Digital Illusions CE AB) FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> E:\Dane\Marian\Picasa3\npPicasa3.dll [2014-01-06] (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-03-15] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-03-15] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation) FF Plugin-x32: @nullsoft.com/winampDetector;version=1 -> E:\Winamp Detect\npwachk.dll [2013-07-24] (Nullsoft, Inc.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-07-02] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-07-02] (NVIDIA Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll [2014-01-01] (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-07] (Google Inc.) FF Plugin-x32: Adobe Reader -> E:\Adobe Reader XI\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2014-03-21] (Adobe Systems) FF Plugin HKU\S-1-5-21-1693294449-2853722536-560343305-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Patryk\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2013-10-03] (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-1693294449-2853722536-560343305-1003: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2014-12-05] () FF user.js: detected! => C:\Users\Patryk\AppData\Roaming\Mozilla\Firefox\Profiles\hugow75b.default\user.js [2015-03-05] FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdnu.dll [2012-04-02] (AOL LLC) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdnupdater2.dll [2012-04-02] (AOL LLC) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-05-08] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-02-28] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-02-28] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-02-28] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-02-28] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-02-28] (Apple Inc.) FF SearchPlugin: C:\Users\Patryk\AppData\Roaming\Mozilla\Firefox\Profiles\hugow75b.default\searchplugins\dsrlte.xml [2015-02-12] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\delta-homes.xml [2014-01-02] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\omiga-plus.xml [2015-02-13] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-07-14] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-12-24] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: No Name - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-06-10] FF HKLM-x32\...\Firefox\Extensions: [e-webprint@epson.com] - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on FF Extension: E-Web Print - C:\Program Files (x86)\Epson Software\E-Web Print\Firefox Add-on [2014-12-12] FF HKU\S-1-5-21-1693294449-2853722536-560343305-1003\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [Not Found] Chrome: ======= CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\IB Updater\source.crx [2012-10-22] CHR HKLM\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - No Path Or update_url value CHR HKU\S-1-5-21-1693294449-2853722536-560343305-1003\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [bopakagnckmlgajfccecajhnimjiiedh] - http://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [dkinklhnkmkhkhofcnapakaoehijaoih] - C:\Program Files (x86)\OnlineHD.TV\onhd11.crx [2012-10-22] CHR HKLM-x32\...\Chrome\Extension: [dpaeeflekdffkcflihellcgkhgbjgibl] - C:\ProgramData\SendSpaceExtention\chrome\sendspace_extension.crx [2011-10-03] CHR HKLM-x32\...\Chrome\Extension: [edcikfknpchdehdlmjpbofgkoaonaijg] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-17] CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14] CHR HKLM-x32\...\Chrome\Extension: [mbcjjdjanpccmehilicphhmeobiljcpk] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [naipdapbimiiikbbgjcpbgmfhnlbagpj] - No Path Or update_url value CHR HKLM-x32\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - No Path Or update_url value ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-06] (Advanced Micro Devices, Inc.) [File not signed] R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-20] (Apple Inc.) R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-04-13] (Avast Software s.r.o.) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation) R2 DefaultTabUpdate; C:\Users\Patryk\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe [107520 2012-10-27] () [File not signed] R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2014-09-17] (NVIDIA Corporation) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed] R2 IB Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [188760 2013-01-29] () [File not signed] R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158864 2014-12-29] (XTab system) S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2010-12-04] () [File not signed] R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-06-17] (Hewlett-Packard Company) [File not signed] S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed] R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1795912 2014-09-17] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19439944 2014-09-17] (NVIDIA Corporation) S3 Origin Client Service; D:\Origin\OriginClientService.exe [1910640 2015-03-01] (Electronic Arts) R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed] R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-11-13] () R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2015-04-03] () S3 ReviverSoft Smart Alerts Service; C:\Program Files\ReviverSoft\PC Reviver\ReviverSoft Smart Alerts Service.exe [2135136 2014-12-18] () S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [575488 2008-09-08] (Nokia.) [File not signed] R2 ss_conn_service; E:\Kic\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.) R2 TeamViewer9; E:\teamviever3\TeamViewer_Service.exe [4915040 2014-02-17] (TeamViewer GmbH) R2 Update Solution Real; C:\Program Files (x86)\Solution Real\updateSolutionReal.exe [411376 2015-04-15] () R2 Util Solution Real; C:\Program Files (x86)\Solution Real\bin\utilSolutionReal.exe [411376 2015-04-15] () R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424624 2015-01-12] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [53888 2012-03-05] (Advanced Micro Devices) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-04-13] () R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-04-13] (Avast Software s.r.o.) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-04-13] (Avast Software s.r.o.) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-04-13] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-04-13] (Avast Software s.r.o.) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-04-13] (Avast Software s.r.o.) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-04-13] (Avast Software s.r.o.) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [271200 2015-04-13] () R0 BtHidBus; C:\Windows\System32\Drivers\BtHidBus.sys [23944 2010-04-06] (IVT Corporation.) S3 btnetBUs; C:\Windows\System32\Drivers\btnetBus.sys [30088 2010-04-06] () R3 GRemoteBus; C:\Windows\System32\DRIVERS\GRemoteBus64.sys [27336 2009-08-05] (GBM Software) R3 GRemoteJoy; C:\Windows\System32\DRIVERS\GRemoteJoy64.sys [46792 2009-08-05] (GBM Software) S3 IvtBtBUs; C:\Windows\System32\Drivers\IvtBtBus.sys [27016 2010-04-06] (IVT Corporation.) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19272 2014-09-17] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation) R3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation ) S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation) S3 s1018bus; C:\Windows\System32\DRIVERS\s1018bus.sys [113704 2009-03-25] (MCCI Corporation) S3 s1018mdfl; C:\Windows\System32\DRIVERS\s1018mdfl.sys [19496 2009-03-25] (MCCI Corporation) S3 s1018mdm; C:\Windows\System32\DRIVERS\s1018mdm.sys [153128 2009-03-25] (MCCI Corporation) S3 s1018mgmt; C:\Windows\System32\DRIVERS\s1018mgmt.sys [133160 2009-03-25] (MCCI Corporation) S3 s1018nd5; C:\Windows\System32\DRIVERS\s1018nd5.sys [34856 2009-03-25] (MCCI Corporation) S3 s1018obex; C:\Windows\System32\DRIVERS\s1018obex.sys [128552 2009-03-25] (MCCI Corporation) S3 s1018unic; C:\Windows\System32\DRIVERS\s1018unic.sys [146472 2009-03-25] (MCCI Corporation) S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-15] (MCCI Corporation) S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-15] (MCCI Corporation) S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-15] (MCCI Corporation) S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-15] (MCCI Corporation) S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-15] (MCCI Corporation) S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-15] (MCCI Corporation) S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-15] (MCCI Corporation) S3 seehcri; C:\Windows\System32\DRIVERS\seehcri.sys [34032 2011-01-12] (Sony Ericsson Mobile Communications) [File not signed] R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2015-01-10] (Duplex Secure Ltd.) S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [File not signed] R1 {31c21995-b861-4864-ab50-4a53fbca73d4}Gw64; C:\Windows\System32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys [48784 2015-03-10] (StdLib) R1 {df8eec40-f909-439c-9ffe-3fee212f71b9}w64; C:\Windows\System32\drivers\{df8eec40-f909-439c-9ffe-3fee212f71b9}w64.sys [48784 2015-01-31] (StdLib) S3 BT; system32\DRIVERS\btnetdrv.sys [X] S3 BTCOM; system32\DRIVERS\btcomport.sys [X] S3 BTCOMBUS; System32\Drivers\btcombus.sys [X] S3 Btcsrusb; System32\Drivers\btcusb.sys [X] S3 VHidMinidrv; system32\drivers\VHIDMini.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-15 16:16 - 2015-04-15 16:17 - 00042170 _____ () C:\Users\Patryk\Desktop\FRST.txt 2015-04-15 16:16 - 2015-04-15 16:16 - 00000000 ____D () C:\Users\Patryk\Desktop\FRST-OlderVersion 2015-04-15 08:18 - 2015-04-15 08:18 - 00602112 _____ (OldTimer Tools) C:\Users\Patryk\Downloads\OTL 3.2.69.0 [1].exe 2015-04-15 08:16 - 2015-04-15 08:16 - 00716488 _____ (Software ) C:\Users\Patryk\Desktop\OTL 3.2.69.0.exe 2015-04-15 08:11 - 2015-04-15 16:16 - 00000000 ____D () C:\FRST 2015-04-15 08:09 - 2015-04-15 16:16 - 02097152 _____ (Farbar) C:\Users\Patryk\Desktop\FRST64.exe 2015-04-15 07:09 - 2015-04-15 16:15 - 00000080 _____ () C:\Users\Patryk\AppData\Local剜捯獫慴⁲慇敭屳呇⁁屖湥楴汴浥湥⹴湩潦 2015-04-15 06:11 - 2015-04-15 06:19 - 170533144 _____ (Microsoft Corporation) C:\Users\Patryk\Desktop\msert.exe 2015-04-14 23:44 - 2015-04-15 07:18 - 00000000 ____D () C:\Program Files\Rockstar Games 2015-04-14 23:44 - 2015-04-15 07:18 - 00000000 ____D () C:\Program Files (x86)\Rockstar Games 2015-04-14 22:47 - 2015-04-14 22:47 - 00000668 _____ () C:\Users\Public\Desktop\Grand Theft Auto V.lnk 2015-04-13 20:16 - 2015-04-13 20:15 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe 2015-04-13 20:15 - 2015-04-13 20:15 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr 2015-04-11 20:43 - 2015-04-11 20:43 - 00001928 _____ () C:\Users\Patryk\Desktop\Drakensang Online.lnk 2015-04-11 20:43 - 2015-04-11 20:43 - 00000000 ____D () C:\Users\Patryk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Drakensang Online 2015-04-11 20:43 - 2015-04-11 20:43 - 00000000 ____D () C:\Program Files (x86)\Drakensang Online 2015-04-06 16:29 - 2015-04-13 22:03 - 00002358 _____ () C:\Windows\PFRO.log 2015-04-03 12:29 - 2015-04-03 12:37 - 00184557 _____ () C:\Windows\DirectX.log 2015-04-03 12:28 - 2015-04-03 12:28 - 00000273 _____ () C:\Windows\game.ini 2015-04-03 12:28 - 2015-04-03 12:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Activision 2015-04-03 00:16 - 2015-04-15 16:05 - 00014336 _____ () C:\Windows\setupact.log 2015-04-03 00:16 - 2015-04-03 00:16 - 00000000 _____ () C:\Windows\setuperr.log 2015-04-02 20:51 - 2015-04-02 20:51 - 00000577 _____ () C:\Users\Patryk\Desktop\Maxthon Cloud Browser.lnk 2015-03-27 15:15 - 2015-03-27 15:15 - 00000000 ____D () C:\Users\Marian\Desktop\Nowy folder 2015-03-26 17:24 - 2015-03-26 17:24 - 00000000 ____D () C:\Users\Marian\AppData\Local\Steam 2015-03-25 14:55 - 2015-03-11 04:39 - 00943616 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-03-25 14:55 - 2015-03-11 04:39 - 00760832 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-03-25 14:55 - 2015-03-11 04:39 - 00677888 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-03-25 14:55 - 2015-03-11 04:39 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-03-25 14:55 - 2015-03-11 04:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-03-25 14:55 - 2015-03-11 04:39 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll 2015-03-25 14:55 - 2015-03-11 04:34 - 01107456 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-03-24 10:08 - 2015-03-24 10:26 - 00000000 ____D () C:\Users\Marian\AppData\Roaming\WiseUpdate ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-15 16:11 - 2009-07-14 06:45 - 00025200 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-15 16:11 - 2009-07-14 06:45 - 00025200 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-15 16:10 - 2010-12-04 15:09 - 01558435 _____ () C:\Windows\WindowsUpdate.log 2015-04-15 16:08 - 2015-01-14 20:00 - 00000000 ____D () C:\Program Files (x86)\WinZipper 2015-04-15 16:08 - 2009-07-14 04:34 - 00000645 _____ () C:\Windows\win.ini 2015-04-15 16:07 - 2015-01-19 22:23 - 00000000 ___RD () C:\Users\Patryk\Dysk Google 2015-04-15 16:07 - 2015-01-10 11:14 - 00000000 ____D () C:\Program Files (x86)\Solution Real 2015-04-15 16:07 - 2013-12-24 14:39 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-04-15 16:06 - 2015-01-11 17:06 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2015-04-15 16:06 - 2010-12-25 01:25 - 00000000 ____D () C:\Users\Patryk 2015-04-15 16:05 - 2014-11-09 01:04 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-15 16:05 - 2010-12-04 15:05 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-04-15 16:05 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-15 07:55 - 2014-11-09 01:04 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-15 07:44 - 2015-02-25 20:19 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2015-04-15 07:41 - 2014-04-30 07:10 - 00000318 _____ () C:\Windows\Tasks\WpsNotifyTask_Patryk.job 2015-04-15 07:41 - 2011-12-30 21:30 - 00000000 ____D () C:\Users\Marian\Documents\Rockstar Games 2015-04-15 07:41 - 2010-12-05 13:35 - 00000000 ____D () C:\Users\Marian\AppData\Roaming\Skype 2015-04-15 07:40 - 2014-08-25 18:40 - 00000911 _____ () C:\Windows\Tasks\EPSON XP-610 Series Update {42E2D2EF-88C9-4353-9FAB-EC7CADCEB83D}.job 2015-04-15 07:40 - 2014-08-25 18:40 - 00000725 _____ () C:\Windows\Tasks\EPSON XP-610 Series Invitation {42E2D2EF-88C9-4353-9FAB-EC7CADCEB83D}.job 2015-04-15 07:40 - 2011-12-30 21:26 - 00000000 ____D () C:\Users\Marian\AppData\Local\Rockstar Games 2015-04-15 07:39 - 2014-04-30 07:10 - 00000318 _____ () C:\Windows\Tasks\WpsUpdateTask_Patryk.job 2015-04-15 07:39 - 2010-12-04 15:09 - 00000000 ____D () C:\Users\Marian 2015-04-15 07:31 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-04-15 07:21 - 2012-03-30 19:51 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-15 07:18 - 2011-12-31 17:04 - 00000000 ____D () C:\Users\Patryk\Documents\Rockstar Games 2015-04-15 06:42 - 2011-03-31 19:33 - 00000000 ____D () C:\Users\Patryk\AppData\Local\Adobe 2015-04-15 00:02 - 2013-07-19 21:47 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-14 23:48 - 2010-12-25 00:57 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-04-14 23:48 - 2010-12-04 18:07 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-04-14 23:46 - 2011-12-31 17:00 - 00000000 ____D () C:\Users\Patryk\AppData\Local\Rockstar Games 2015-04-14 22:47 - 2011-10-22 09:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games 2015-04-14 21:20 - 2010-12-04 14:55 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-04-13 20:15 - 2014-04-22 08:50 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-04-13 20:15 - 2013-12-24 14:40 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys 2015-04-13 20:15 - 2013-03-05 10:41 - 00271200 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-04-13 20:15 - 2013-03-05 10:41 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-04-13 20:15 - 2012-02-24 17:02 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys 2015-04-13 20:15 - 2011-06-10 15:27 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys 2015-04-13 20:15 - 2011-06-10 14:33 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys 2015-04-13 20:15 - 2011-06-10 14:33 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-04-11 20:46 - 2014-11-04 20:55 - 00000000 ____D () C:\Users\Patryk\AppData\Roaming\mxnitro 2015-04-10 21:18 - 2011-01-09 22:12 - 00000000 ____D () C:\Users\Patryk\AppData\Roaming\Skype 2015-04-10 20:09 - 2014-03-12 14:04 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-04-10 20:09 - 2010-12-05 13:35 - 00000000 ____D () C:\ProgramData\Skype 2015-04-03 15:54 - 2009-07-14 07:08 - 00032514 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-03 13:09 - 2011-04-25 16:44 - 00066872 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2015-04-03 13:08 - 2014-11-04 18:56 - 00103736 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2015-04-03 12:14 - 2014-08-08 10:49 - 00000000 ____D () C:\Users\Patryk\AppData\Roaming\.minecraft 2015-04-03 11:23 - 2009-07-20 10:15 - 26112704 _____ () C:\Windows\system32\perfh015.dat 2015-04-03 11:23 - 2009-07-20 10:15 - 08923164 _____ () C:\Windows\system32\perfc015.dat 2015-04-03 11:23 - 2009-07-14 07:13 - 00006830 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-03 08:47 - 2015-02-14 16:14 - 00000000 ____D () C:\Users\Patryk\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-04-02 23:46 - 2013-04-09 09:46 - 00000000 ____D () C:\Windows\SysWOW64\jmdp 2015-04-02 21:59 - 2012-04-05 09:31 - 00000000 ____D () C:\ProgramData\Origin 2015-03-26 17:22 - 2012-07-27 14:02 - 00000000 ____D () C:\Users\Marian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2015-03-25 15:37 - 2014-12-11 10:34 - 00000000 ____D () C:\Windows\system32\appraiser 2015-03-25 15:37 - 2014-07-09 19:37 - 00000000 ___SD () C:\Windows\system32\CompatTel ==================== Files in the root of some directories ======= 2007-03-12 19:59 - 2007-03-12 19:59 - 0299008 _____ () C:\Program Files (x86)\navigram_register.exe 2013-03-19 19:32 - 2013-02-09 23:55 - 0114176 _____ () C:\Users\Patryk\AppData\Roaming\BabMaint.exe 2013-02-13 23:42 - 2013-02-13 23:44 - 0000117 _____ () C:\Users\Patryk\AppData\Roaming\Movies2iPhone.ini 2013-07-27 22:55 - 2015-02-21 01:34 - 0000063 _____ () C:\Users\Patryk\AppData\Roaming\WB.CFG 2013-12-31 00:03 - 2013-12-31 00:03 - 0000006 _____ () C:\Users\Patryk\AppData\Roaming\WBPU-Q5-TTL.DAT 2013-06-14 22:55 - 2014-01-28 13:50 - 0000005 _____ () C:\Users\Patryk\AppData\Roaming\WBPU-TTL.DAT 2011-10-01 09:25 - 2013-12-03 22:52 - 0011264 _____ () C:\Users\Patryk\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2011-11-06 17:13 - 2011-11-06 17:13 - 0000094 _____ () C:\Users\Patryk\AppData\Local\fusioncache.dat 2014-05-12 02:47 - 2014-05-12 02:47 - 0001772 _____ () C:\Users\Patryk\AppData\Local\recently-used.xbel 2011-12-11 22:41 - 2011-12-11 22:43 - 2161160 _____ (DownVision ) C:\Users\Patryk\AppData\Local\setup.exe 2012-09-16 21:18 - 2012-09-17 16:36 - 0000080 _____ () C:\Users\Patryk\AppData\Local\X-Plane Installer.prf 2012-09-17 03:42 - 2012-09-17 16:41 - 0000015 _____ () C:\Users\Patryk\AppData\Local\X-Plane_drm.prf 2012-09-16 21:20 - 2012-09-16 21:20 - 0000021 _____ () C:\Users\Patryk\AppData\Local\x-plane_install_10.txt 2010-12-25 00:17 - 2010-12-25 00:17 - 0000056 ____H () C:\ProgramData\ezsidmv.dat 2010-12-24 21:59 - 2011-09-24 14:08 - 0011274 _____ () C:\ProgramData\hpzinstall.log 2014-01-23 18:57 - 2014-01-23 19:46 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt 2010-11-05 11:11 - 2010-11-05 11:11 - 0002045 ____H () C:\ProgramData\whlb32g.dll Files to move or delete: ==================== C:\ProgramData\whlb32g.dll C:\Users\Marian\ALLPlayerEN.exe Some content of TEMP: ==================== C:\Users\Adrian\AppData\Local\Temp\drm_dialogs.dll C:\Users\Adrian\AppData\Local\Temp\drm_dyndata_7320012.dll C:\Users\Adrian\AppData\Local\Temp\drm_dyndata_7380011.dll C:\Users\Adrian\AppData\Local\Temp\i4jdel0.exe C:\Users\Adrian\AppData\Local\Temp\i4jdel1.exe C:\Users\Adrian\AppData\Local\Temp\SkypeSetup.exe C:\Users\Adrian\AppData\Local\Temp\ubiB3D2.tmp.exe C:\Users\Adrian\AppData\Local\Temp\ubiE19A.tmp.exe C:\Users\Adrian\AppData\Local\Temp\_is15E0.exe C:\Users\Adrian\AppData\Local\Temp\_is36E7.exe C:\Users\Adrian\AppData\Local\Temp\_is3ACE.exe C:\Users\Adrian\AppData\Local\Temp\_is86DC.exe C:\Users\Adrian\AppData\Local\Temp\_is930B.exe C:\Users\Adrian\AppData\Local\Temp\_isA4F8.exe C:\Users\Adrian\AppData\Local\Temp\_isF343.exe C:\Users\EWA.Marian-Komputer\AppData\Local\Temp\SIntf16.dll C:\Users\EWA.Marian-Komputer\AppData\Local\Temp\SIntf32.dll C:\Users\EWA.Marian-Komputer\AppData\Local\Temp\SIntfNT.dll C:\Users\Patryk\AppData\Local\Temp\drm_dialogs.dll C:\Users\Patryk\AppData\Local\Temp\dsrsetup.exe C:\Users\Patryk\AppData\Local\Temp\res.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-04 15:39 ==================== End Of Log ============================