Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:31-12-2015 Ran by Robert (administrator) on ROBERT-PC (06-01-2016 14:10:33) Running from D:\Użytki\Wir_2015 Loaded Profiles: Robert (Available Profiles: Robert) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) Language: English (United States) Internet Explorer Version 9 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Agere Systems) C:\Windows\System32\agrsmsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (SafeNet Inc.) C:\Windows\System32\hasplms.exe () C:\ProgramData\DatacardService\HWDeviceService.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () C:\Toshiba\IVP\ISM\pinger.exe (Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe () C:\Toshiba\IVP\swupdate\swupdtmr.exe (Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (TOSHIBA) C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\Launcher\Avira.Systray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe (Microsoft Corporation) C:\Windows\System32\conime.exe () C:\Users\Robert\Desktop\gmer.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [180224 2006-09-11] (Alps Electric Co., Ltd.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4444160 2007-04-25] (Realtek Semiconductor) HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [411192 2007-03-29] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [538744 2007-04-27] (TOSHIBA Corporation) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [803200 2015-12-01] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Avira SystrayStartTrigger] => C:\Program Files\Avira\Launcher\Avira.SystrayStartTrigger.exe [66320 2015-11-23] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [596528 2015-11-09] (Oracle Corporation) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [417792 2007-01-22] (TOSHIBA) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {4a9c0996-4914-11e3-ae2a-001b381e2405} - G:\Startme.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {5a0ef322-11d0-11e4-a313-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {5a0ef334-11d0-11e4-a313-001b381e2405} - H:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {a4d18fcf-e1c3-11e3-959e-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {c72db925-3680-11e2-a3cd-001b381e2405} - H:\LaunchU3.exe -a HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea06-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea09-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea14-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea15-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea17-0fc1-11e2-a763-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea1b-0fc1-11e2-a763-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [294912 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...A8F59079A8D5}\localserver32: <==== ATTENTION ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll [2013-01-17] (GG Network S.A.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 62.179.1.63 192.168.0.1 Tcpip\..\Interfaces\{0D0DF4D7-5714-43B6-8290-50DFD6B93FC2}: [DhcpNameServer] 173.168.200.189 Tcpip\..\Interfaces\{4DE4B3C3-3D2D-4CD8-A553-F7F337DA667F}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{6781E73D-4263-456B-9B4B-BED5243BAFED}: [DhcpNameServer] 193.41.112.18 193.41.112.14 Tcpip\..\Interfaces\{6B42F0C3-08DC-4D5B-920B-9FB7291E20E8}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{71ADEAF5-014C-4AB0-BB70-E1BC98096C16}: [DhcpNameServer] 62.179.1.63 192.168.0.1 Internet Explorer: ================== HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=56626&homepage=hxxp://fr.msn.com/ HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://www.google.pl/ HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome SearchScopes: HKLM -> DefaultScope {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKLM -> {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> DefaultScope {EE3BE3F5-9CDD-422C-A85C-AF79C0477D43} URL = hxxps://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {0E3F87BF-3B86-4614-B5E5-729F4C268F92} URL = hxxps://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = hxxp://mystart.incredimail.com/mb68/?search={searchTerms}&loc=search_box&u=92541684122227008 SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {EE3BE3F5-9CDD-422C-A85C-AF79C0477D43} URL = hxxps://www.google.com/search?q={searchTerms} BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_66\bin\ssv.dll [2015-11-19] (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-26] (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_66\bin\jp2ssv.dll [2015-11-19] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-26] (Google Inc.) Toolbar: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-12-26] (Google Inc.) DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation) FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_19_0_0_245.dll [2015-11-11] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2015-05-20] (Google) FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll [2015-07-11] (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\npDeployJava1.dll [2015-11-19] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.66.2 -> C:\Program Files\Java\jre1.8.0_66\bin\plugin2\npjp2.dll [2015-11-19] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.29.1\npGoogleUpdate3.dll [2015-12-04] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2015-09-24] (Adobe Systems Inc.) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-11-18] [not signed] FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon FF Extension: Bytemobile Optimization Client - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon [2014-07-22] [not signed] Chrome: ======= CHR HomePage: Default -> hxxp://startsear.ch/?aff=1 CHR StartupUrls: Default -> "hxxp://startsear.ch/?aff=1" CHR DefaultSearchURL: Default -> hxxps://safesearch.avira.com/#web/result?source=omnibar&q={searchTerms} CHR DefaultSearchKeyword: Default -> Avira CHR DefaultSuggestURL: Default -> hxxps://safesearch.avira.com/suggestions?q={searchTerms}&li=ff&hl=en CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\47.0.2526.106\gcswf32.dll => No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll => No File CHR Plugin: (Java Deployment Toolkit 6.0.270.7) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll => No File CHR Plugin: (Java(TM) Platform SE 6 U27) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll => No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll => No File CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\47.0.2526.106\ppGoogleNaClPluginChrome.dll => No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\47.0.2526.106\pdf.dll => No File CHR Plugin: (Babylon Chrome Plugin) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll => No File CHR Plugin: (vShare.tv plug-in) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll => No File CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll => No File CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Profile: C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avira SafeSearch) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffalmjohbhdhlkajphgkhloccibhmoog [2015-12-21] CHR Extension: (Avira Browser Safety) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-12-16] CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-21] CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - CHR HKLM\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files\vShare.tv plugin\vshareplg.crx ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [930944 2015-12-01] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [466408 2015-12-01] (Avira Operations GmbH & Co. KG) S2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1222952 2015-12-01] (Avira Operations GmbH & Co. KG) R2 Avira.ServiceHost; C:\Program Files\Avira\Launcher\Avira.ServiceHost.exe [249624 2015-11-23] (Avira Operations GmbH & Co. KG) R2 CFSvcs; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2006-11-15] (TOSHIBA CORPORATION) [File not signed] S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [1862144 2007-05-21] (Google) [File not signed] R2 hasplms; C:\Windows\system32\hasplms.exe [4883400 2011-10-18] (SafeNet Inc.) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] () S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed] S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2014-07-22] () R2 pinger; C:\Toshiba\IVP\ISM\pinger.exe [136816 2007-01-26] () R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [6324208 2015-08-19] (Reimage®) S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) [File not signed] R2 Swupdtmr; c:\Toshiba\IVP\swupdate\swupdtmr.exe [63096 2007-01-26] () R2 TNaviSrv; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [114688 2007-04-28] (TOSHIBA Corporation) [File not signed] R2 TODDSrv; C:\Windows\system32\TODDSrv.exe [114688 2006-05-26] (TOSHIBA Corporation) [File not signed] R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-24] (Ulead Systems, Inc.) [File not signed] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 aksfridge; C:\Windows\System32\DRIVERS\aksfridge.sys [367560 2011-10-04] (SafeNet Inc.) S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [238208 2010-09-27] (Aladdin Knowledge Systems Ltd.) S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [46720 2011-08-25] (SafeNet Inc.) S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [16512 2011-08-03] (SafeNet Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [106968 2015-12-01] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136272 2015-12-01] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37896 2015-05-20] (Avira Operations GmbH & Co. KG) R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [13184 2014-07-22] (Bytemobile, Inc.) [File not signed] S3 DrvAgent32; C:\Windows\system32\Drivers\DrvAgent32.sys [23456 2014-05-18] (Phoenix Technologies) [File not signed] R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-11] (DT Soft Ltd) R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [596424 2011-08-10] (SafeNet Inc.) R2 Haspnt; C:\Windows\system32\drivers\Haspnt.sys [47616 2003-12-18] (Aladdin Knowledge Systems) [File not signed] S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90368 2014-07-22] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [64384 2014-07-22] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2014-07-22] (Huawei Technologies Co., Ltd.) S4 KR10I; C:\Windows\system32\drivers\kr10i.sys [216320 2006-02-14] (TOSHIBA CORPORATION) [File not signed] S4 KR10N; C:\Windows\system32\drivers\kr10n.sys [207104 2005-09-28] (TOSHIBA CORPORATION) [File not signed] S4 KR3NPXP; C:\Windows\system32\drivers\kr3npxp.sys [479488 2006-09-28] (TOSHIBA CORPORATION) [File not signed] R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [19456 2006-07-29] (COMPAL ELECTRONIC INC.) R2 port_nt; c:\windows\system32\drivers\port_nt.sys [3608 2000-10-23] () [File not signed] S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [124016 2010-03-15] (MCCI Corporation) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [31848 2015-06-21] (Avira Operations GmbH & Co. KG) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [24192 2014-07-22] (Bytemobile, Inc.) [File not signed] S3 XXLHASP; c:\windows\system32\drivers\XXLHASP.sys [821248 2012-01-30] () [File not signed] S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 cpuz134; \??\C:\Users\Robert\AppData\Local\Temp\cpuz134\cpuz134_x32.sys [X] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [235392 2014-07-22] (Huawei Technologies Co., Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 MEMSWEEP2; \??\C:\Windows\system32\2302.tmp [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 Tosrfcom; no ImagePath S3 TpChoice; system32\DRIVERS\TpChoice.sys [X] U3 uwliqpow; \??\C:\Users\Robert\AppData\Local\Temp\uwliqpow.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-06 13:56 - 2016-01-06 13:56 - 01721856 _____ (Farbar) C:\Users\Robert\Downloads\FRST.exe 2016-01-06 13:18 - 2014-01-28 18:36 - 00380416 _____ C:\Users\Robert\Desktop\gmer.exe 2016-01-06 13:07 - 2016-01-06 13:07 - 00370943 _____ C:\Users\Robert\Downloads\gmer.zip 2016-01-06 11:13 - 2016-01-06 11:13 - 02031992 _____ (Microsoft Corporation) C:\Users\Robert\Desktop\MGADiag (4).exe 2016-01-05 19:59 - 2016-01-05 19:59 - 02031992 _____ (Microsoft Corporation) C:\Users\Robert\Downloads\MGADiag (3).exe 2016-01-05 19:48 - 2016-01-05 19:48 - 02031992 _____ (Microsoft Corporation) C:\Users\Robert\Downloads\MGADiag (2).exe 2016-01-05 18:27 - 2015-12-06 21:55 - 53217204 _____ C:\Users\Robert\Desktop\HKEY_CLASSES_ROOT.reg 2016-01-05 18:09 - 2016-01-06 13:08 - 00012622 _____ C:\Users\Robert\Desktop\report.txt 2016-01-05 18:09 - 2016-01-05 18:10 - 00000000 ____D C:\MGADiagToolOutput 2016-01-05 18:06 - 2016-01-05 18:06 - 00000000 ____D C:\ProgramData\Office Genuine Advantage 2016-01-05 18:05 - 2016-01-05 18:05 - 02031992 _____ (Microsoft Corporation) C:\Users\Robert\Downloads\MGADiag.exe 2016-01-05 18:05 - 2016-01-05 18:05 - 02031992 _____ (Microsoft Corporation) C:\Users\Robert\Downloads\MGADiag (1).exe 2016-01-05 18:00 - 2016-01-05 18:00 - 00000556 _____ C:\Users\Robert\Desktop\Windows Product Key.txt 2016-01-05 17:13 - 2016-01-05 17:14 - 00401100 _____ C:\Users\Robert\Downloads\winproductkey.zip 2016-01-04 22:17 - 2016-01-04 22:17 - 00000225 _____ C:\Users\Robert\Documents\ThisWorkbook2016.cls 2016-01-04 21:35 - 2016-01-04 21:35 - 00000000 ____D C:\ProgramData\Reimage Protector 2016-01-04 21:34 - 2016-01-04 21:56 - 00000000 ____D C:\Program Files\Reimage 2016-01-04 21:31 - 2016-01-04 21:36 - 00000139 _____ C:\Windows\Reimage.ini 2016-01-04 21:31 - 2016-01-04 21:31 - 00772016 _____ (Reimage®) C:\Users\Robert\Downloads\ReimageRepair.exe 2016-01-04 20:20 - 2016-01-04 20:20 - 00652800 _____ C:\Users\Robert\Downloads\MicrosoftFixit50362.msi 2016-01-04 19:44 - 2016-01-04 19:44 - 00347816 _____ (Microsoft Corporation) C:\Users\Robert\Downloads\MicrosoftFixit.wu.MATSKB.Run.exe 2015-12-12 20:08 - 2015-12-13 22:08 - 08879808 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-06 14:10 - 2015-04-18 14:42 - 00000000 ____D C:\FRST 2016-01-06 14:08 - 2012-04-22 13:37 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2016-01-06 13:19 - 2010-10-09 20:45 - 00001036 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2016-01-06 10:09 - 2014-11-24 19:06 - 00001032 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0081168b7e9b0.job 2016-01-06 10:09 - 2010-10-09 20:45 - 00001032 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2016-01-06 10:03 - 2006-11-02 14:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-01-06 10:02 - 2006-11-02 14:01 - 00032646 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2016-01-05 19:17 - 2010-11-14 01:56 - 02223718 _____ C:\Windows\ntbtlog.txt 2016-01-04 23:04 - 2011-12-19 19:39 - 00000000 ____D C:\Users\Robert\Desktop\Aaaaaaaa 2016-01-04 21:31 - 2006-11-02 12:18 - 00000000 ____D C:\Windows 2016-01-04 20:23 - 2010-11-12 19:15 - 00000000 ____D C:\Users\Robert\AppData\Local\ElevatedDiagnostics 2016-01-03 11:55 - 2010-11-13 23:27 - 00045056 _____ C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2016-01-03 11:39 - 2015-12-06 22:52 - 00786894 _____ C:\Windows\system32\PerfStringBackup.TMP 2015-12-20 09:18 - 2014-08-12 14:53 - 00000000 ____D C:\ProgramData\Package Cache 2015-12-19 19:35 - 2015-09-14 18:53 - 00000970 _____ C:\Users\Public\Desktop\Avira Launcher.lnk 2015-12-19 19:35 - 2014-05-21 18:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira ==================== Files in the root of some directories ======= 2012-07-14 00:54 - 2012-07-14 00:54 - 0002528 _____ () C:\Users\Robert\AppData\Roaming\$_hpcst$.hpc 2010-11-14 00:20 - 2010-11-14 00:20 - 0000691 _____ () C:\Users\Robert\AppData\Roaming\GetValue.vbs 2010-11-14 00:20 - 2010-11-14 00:20 - 0000035 _____ () C:\Users\Robert\AppData\Roaming\SetValue.bat 2010-11-09 21:19 - 2013-01-09 21:00 - 0001356 _____ () C:\Users\Robert\AppData\Local\d3d9caps.dat 2010-11-13 23:27 - 2016-01-03 11:55 - 0045056 _____ () C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-06 00:24 - 2013-01-06 00:27 - 0004096 ____H () C:\Users\Robert\AppData\Local\keyfile3.drm 2012-10-02 18:57 - 2012-10-02 18:58 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempaC5260.html 2012-04-06 12:24 - 2012-04-06 21:37 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempal3340.html 2011-12-01 19:56 - 2011-12-01 22:36 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempAl5144.html 2012-03-26 18:16 - 2012-03-26 19:21 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempbJ1944.html 2012-09-05 17:03 - 2012-09-05 17:03 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempcc4256.html 2012-07-04 17:01 - 2012-07-04 22:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempck4616.html 2013-01-11 21:50 - 2013-01-11 22:51 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempCo2856.html 2011-12-19 19:27 - 2011-12-20 01:28 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempcW6044.html 2013-07-10 11:02 - 2013-07-10 11:14 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempcx5968.html 2011-12-29 11:05 - 2011-12-29 23:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempdC3284.html 2012-11-04 12:58 - 2012-11-04 23:29 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempdQ5880.html 2012-06-03 13:04 - 2012-06-03 16:19 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempDx5852.html 2011-12-01 19:56 - 2011-12-01 22:36 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempec5144.html 2012-11-08 19:07 - 2012-11-08 23:26 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempEF4720.html 2012-09-28 19:45 - 2012-09-29 00:38 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempEY4224.html 2012-09-17 20:51 - 2012-09-17 22:10 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempfe6040.html 2012-09-04 18:44 - 2012-09-04 21:41 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempfLU976.html 2012-04-28 12:26 - 2012-04-28 14:43 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempFr1324.html 2012-03-26 18:16 - 2012-03-26 19:21 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempgB1944.html 2012-09-18 17:18 - 2012-09-18 22:29 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempGi1216.html 2012-10-20 18:54 - 2012-10-20 19:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempgk5824.html 2012-04-06 12:25 - 2012-04-06 21:37 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempGq3340.html 2011-12-01 19:56 - 2011-12-01 19:57 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempho5144.html 2012-06-29 13:16 - 2012-06-29 20:07 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempiJ5220.html 2012-01-05 17:43 - 2012-01-06 00:14 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempiO1748.html 2012-09-17 20:51 - 2012-09-17 22:10 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempIs6040.html 2012-10-02 18:58 - 2012-10-02 19:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempji5872.html 2012-09-30 16:39 - 2012-09-30 16:39 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempjJ5748.html 2012-09-04 18:44 - 2012-09-04 21:41 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempjNX976.html 2012-02-16 20:12 - 2012-02-16 23:27 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempJt4724.html 2012-04-06 12:24 - 2012-04-06 21:37 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempjw3340.html 2012-11-14 18:51 - 2012-11-14 20:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempKb2560.html 2011-12-29 11:05 - 2011-12-29 23:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempKc3284.html 2012-10-02 18:57 - 2012-10-02 18:58 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempKc5260.html 2012-04-24 21:26 - 2012-04-24 21:52 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempkRx848.html 2012-10-20 18:54 - 2012-10-20 19:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempLA5824.html 2012-03-03 21:12 - 2012-03-03 21:12 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempmH4568.html 2012-09-29 08:57 - 2012-09-29 23:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempmR4476.html 2012-02-15 12:40 - 2012-02-15 23:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempNW5116.html 2012-02-15 12:40 - 2012-02-15 23:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempOR5116.html 2011-10-19 21:35 - 2011-10-19 22:00 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempOU5248.html 2011-12-29 11:05 - 2011-12-29 23:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemppA3284.html 2011-12-19 19:27 - 2011-12-20 01:28 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemppF6044.html 2011-10-19 21:35 - 2011-10-19 22:00 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempPL5248.html 2013-07-10 11:02 - 2013-07-10 11:14 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempQB5968.html 2012-03-10 21:06 - 2012-03-10 21:06 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempqk5476.html 2012-08-05 10:48 - 2012-08-05 16:44 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempQM3648.html 2012-09-18 17:18 - 2012-09-18 22:29 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempQR1216.html 2012-06-29 13:16 - 2012-06-29 20:07 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempqs5220.html 2012-04-28 12:26 - 2012-04-28 14:43 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempRC1324.html 2012-03-10 21:06 - 2012-03-10 21:06 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempRw5476.html 2012-08-29 21:39 - 2012-08-29 21:51 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempTq3396.html 2012-01-09 18:59 - 2012-01-09 23:16 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemptV2788.html 2012-10-02 18:58 - 2012-10-02 19:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Temptv5872.html 2012-07-04 17:01 - 2012-07-04 22:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempUD4616.html 2011-12-29 11:05 - 2011-12-29 23:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempUI3284.html 2012-06-03 13:04 - 2012-06-03 16:19 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempuM5852.html 2012-09-28 19:45 - 2012-09-29 00:38 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempUO4224.html 2012-08-29 21:39 - 2012-08-29 21:51 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempUQ3396.html 2012-03-03 21:12 - 2012-03-03 21:12 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempus4568.html 2012-04-24 21:26 - 2012-04-24 21:52 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempuTf848.html 2013-01-11 21:50 - 2013-01-11 22:51 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempuU2856.html 2012-09-29 08:57 - 2012-09-29 23:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempvr4476.html 2013-01-06 20:06 - 2013-01-06 22:44 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempvu5412.html 2012-03-12 22:26 - 2012-03-12 22:36 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempVv5304.html 2013-01-06 20:06 - 2013-01-06 22:44 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempwr5412.html 2012-09-05 17:03 - 2012-09-05 17:03 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempxb4256.html 2012-04-06 12:25 - 2012-04-06 21:37 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempxL3340.html 2012-03-12 22:26 - 2012-03-12 22:36 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempXR5304.html 2012-01-02 20:18 - 2012-01-02 21:33 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempyb5456.html 2012-11-14 18:51 - 2012-11-14 20:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempyl2560.html 2012-01-02 23:04 - 2012-01-02 23:04 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempYt4480.html 2012-08-05 10:48 - 2012-08-05 16:44 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempzH3648.html 2012-09-30 16:39 - 2012-09-30 16:39 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempZK5748.html 2012-02-16 20:12 - 2012-02-16 23:27 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempzS4724.html 2012-11-08 19:07 - 2012-11-08 23:26 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempZZ4720.html 2011-04-19 20:14 - 2013-04-11 18:15 - 0004103 _____ () C:\Users\Robert\AppData\Local\unins000.dat 2013-04-11 18:15 - 2013-04-11 18:15 - 0707504 _____ () C:\Users\Robert\AppData\Local\unins000.exe 2013-04-11 18:15 - 2013-04-11 18:15 - 0011761 _____ () C:\Users\Robert\AppData\Local\unins000.msg 2013-01-08 19:42 - 2013-01-09 20:52 - 95023320 ____T () C:\ProgramData\dsgsdgdsgdsgw.pad Files to move or delete: ==================== C:\ProgramData\dsgsdgdsgdsgw.pad C:\Users\Robert\HKEY_LOCAL_MACHINE.reg Some files in TEMP: ==================== C:\Users\Robert\AppData\Local\Temp\avgnt.exe C:\Users\Robert\AppData\Local\Temp\jre-8u66-windows-au.exe C:\Users\Robert\AppData\Local\Temp\ReimagePackage.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-01-06 10:14 ==================== End of FRST.txt ============================