Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 24-07-2016
Ran by Norbix (administrator) on NORBIX-PC (24-07-2016 16:43:46)
Running from C:\Users\Norbix\Downloads
Loaded Profiles: Norbix (Available Profiles: Norbix)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgfwsa.exe
(Tensons Corporation) N:\programy\Download Accelerator Manager\DownloadAcceleratorManager.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgidsagenta.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Framework\Common\avguix.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgui.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgwdsvca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgcsrva.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgemca.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\Av\avgrsa.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AvgUi] => C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe [186640 2016-06-21] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\Av\avgui.exe [6723856 2016-06-29] (AVG Technologies CZ, s.r.o.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8619224 2016-01-15] (Piriform Ltd)
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\Run: [Download Accelerator Manager] => N:\programy\Download Accelerator Manager\DownloadAcceleratorManager.exe [1184088 2016-03-11] (Tensons Corporation)
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\MountPoints2: {84090085-f43e-11e5-874b-d850e6b7c173} - F:\setup.exe
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\MountPoints2: {84090222-f43e-11e5-874b-d850e6b7c173} - F:\setup.exe
HKU\S-1-5-21-2906863885-3013527000-343546376-1000\...\MountPoints2: {a6c5f5de-f3fb-11e5-bf38-d850e6b7c173} - G:\setup.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.254
Tcpip\..\Interfaces\{F38EA8DB-6F10-4459-BF54-0F1C317C647C}: [DhcpNameServer] 192.168.2.254

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
SearchScopes: HKLM -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKLM-x32 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2906863885-3013527000-343546376-1000 -> DefaultScope {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-2906863885-3013527000-343546376-1000 -> {0191A6B0-1154-4C22-9182-23A95BBE92D9} URL = hxxp://www.google.com/search?q={searchTerms}
BHO: Tensons.Application.DownloadAcceleratorManager.BHO -> {00000003-1118-11da-8cd6-0800200c9888} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Norbix\AppData\Roaming\Mozilla\Firefox\Profiles\jdr9sr2v.norbert
FF Plugin: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File]
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-01-29] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-01-29] (NVIDIA Corporation)
FF HKLM\...\Firefox\Extensions: [dam@tensons.com] - n:\Programy\Download Accelerator Manager\DamFirefox\old\ex
FF Extension: Download Accelerator Manager (DAM) - n:\Programy\Download Accelerator Manager\DamFirefox\old\ex [2016-04-23]
FF HKLM-x32\...\Firefox\Extensions: [dam@tensons.com] - n:\Programy\Download Accelerator Manager\DamFirefox\old\ex

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR DefaultSearchURL: Default -> hxxp://www.google.com/search?q={searchTerms}
CHR DefaultSearchKeyword: Default -> google
CHR Profile: C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Prezentacje Google) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-17]
CHR Extension: (Dokumenty Google) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-17]
CHR Extension: (Dysk Google) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2016-03-17]
CHR Extension: (YouTube) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-03-17]
CHR Extension: (Fruumo Download Manager) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekmbkhodcdnafhomcpbfgimkglaohmil [2016-04-23]
CHR Extension: (Arkusze Google) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-03-17]
CHR Extension: (Dokumenty Google offline) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-07-16]
CHR Extension: (AdBlock) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2016-07-10]
CHR Extension: (Instant Translate: Select and Translate) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihmgiclibbndffejedjimfjmfoabpcke [2016-07-10]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Gmail) - C:\Users\Norbix\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-03-17]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AvgAMPS; C:\Program Files (x86)\AVG\Av\avgamps.exe [637944 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 avgfws; C:\Program Files (x86)\AVG\Av\avgfwsa.exe [2007608 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\Av\avgidsagenta.exe [5251808 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 avgsvc; C:\Program Files (x86)\AVG\Framework\Common\avgsvca.exe [1080080 2016-06-21] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\Av\avgwdsvca.exe [712792 2016-06-29] (AVG Technologies CZ, s.r.o.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2016-01-29] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-11-21] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706128 2016-01-29] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833360 2016-01-29] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2104840 2016-03-26] (Electronic Arts)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [163072 2016-05-13] (AVG Technologies CZ, s.r.o.)
R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [73480 2016-06-06] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [310016 2016-06-09] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [261376 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [260352 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [360736 2016-02-16] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [249088 2016-06-02] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [52992 2016-06-01] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [280320 2016-06-01] (AVG Technologies CZ, s.r.o.)
R0 avguniva; C:\Windows\System32\DRIVERS\avguniva.sys [76544 2016-06-01] (AVG Technologies CZ, s.r.o.)
S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-03-18] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-03-18] (Disc Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-11-21] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2016-01-29] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-10-13] (NVIDIA Corporation)
S3 RTCore64; N:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13512 2015-12-09] ()
S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam620.sys [58512 2012-07-03] (Realtek Corporation)
S3 cleanhlp; \??\C:\Program Files (x86)\Ashampoo\Ashampoo Anti-Virus\cleanhlp64.sys [X]
S3 cpuz138; \??\C:\Users\Norbix\AppData\Local\Temp\cpuz138\cpuz138_x64.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-24 16:36 - 2016-07-24 16:36 - 00593952 _____ (Duplex Secure Ltd) C:\Users\Norbix\Downloads\SPTDinst-v189-x64.exe
2016-07-24 13:31 - 2016-07-24 16:44 - 00012871 _____ C:\Users\Norbix\Downloads\FRST.txt
2016-07-24 13:30 - 2016-07-24 16:43 - 00000000 ____D C:\FRST
2016-07-24 13:29 - 2016-03-11 14:53 - 00380928 _____ C:\Users\Norbix\Downloads\gmer.exe
2016-07-24 13:27 - 2016-07-24 13:27 - 02394112 _____ (Farbar) C:\Users\Norbix\Downloads\FRST64.exe
2016-07-24 12:36 - 2016-07-24 12:36 - 18119768 _____ (SoftActivity ) C:\Users\Norbix\Downloads\activmon.exe
2016-07-23 20:14 - 2016-07-24 12:25 - 00000000 ____D C:\Users\Norbix\Desktop\Old Firefox Data
2016-07-22 16:55 - 2016-07-22 16:55 - 00477600 _____ (Bleeping Computer, LLC) C:\Users\Norbix\Downloads\sc-cleaner
2016-07-22 16:45 - 2016-07-22 16:45 - 00317952 _____ C:\Users\Norbix\Desktop\SpyHunterCleaner-reboot.exe
2016-07-22 16:44 - 2016-07-22 16:44 - 00525312 _____ C:\Users\Norbix\Desktop\SpyHunterCleaner.exe
2016-07-22 16:40 - 2016-07-22 16:41 - 00587972 _____ C:\TDSSKiller.3.1.0.9_22.07.2016_16.40.39_log.txt
2016-07-22 16:35 - 2016-07-22 16:37 - 00198786 _____ C:\TDSSKiller.3.1.0.9_22.07.2016_16.35.47_log.txt
2016-07-21 20:10 - 2016-07-23 20:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2016-07-21 20:08 - 2016-07-21 20:09 - 00000000 ____D C:\Program Files (x86)\AVG
2016-07-21 20:08 - 2016-07-21 20:08 - 00000862 _____ C:\Users\Public\Desktop\AVG.lnk
2016-07-21 20:08 - 2016-07-21 20:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Zen
2016-07-19 17:30 - 2016-07-19 17:30 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2016-07-17 17:27 - 2016-07-19 17:22 - 00002544 _____ C:\Users\Norbix\Desktop\Rkill.txt
2016-07-17 17:24 - 2016-07-17 17:24 - 00001846 _____ C:\Windows\system32\.crusader
2016-07-17 17:18 - 2016-07-17 17:18 - 02030536 _____ (Bleeping Computer, LLC) C:\Users\Norbix\Downloads\rkill.com
2016-07-17 17:14 - 2016-07-17 17:24 - 00000000 ____D C:\ProgramData\HitmanPro
2016-07-17 17:14 - 2016-07-17 17:14 - 11438608 _____ (SurfRight B.V.) C:\Users\Norbix\Downloads\HitmanPro_x64.exe
2016-07-17 17:00 - 2016-07-17 17:00 - 01196752 _____ (Adobe Systems Incorporated) C:\Users\Norbix\Downloads\flashplayer22_ka_install.exe
2016-07-17 16:58 - 2016-07-17 16:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-07-17 16:57 - 2016-07-17 16:57 - 00242120 _____ C:\Users\Norbix\Downloads\Firefox Setup Stub 47.0.1.exe
2016-07-16 23:29 - 2016-07-16 23:29 - 00001391 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2016-07-16 23:29 - 2016-07-16 23:29 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2016-07-16 23:29 - 2016-07-16 23:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2016-07-16 23:29 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2016-07-16 23:25 - 2016-07-16 23:25 - 295956734 _____ (Resurrection team ) C:\Users\Norbix\Downloads\FoRes_EN_1_4_install.exe
2016-07-16 12:44 - 2016-07-24 16:33 - 00000000 ____D C:\AdwCleaner
2016-07-16 12:43 - 2016-07-16 12:43 - 03712064 _____ C:\Users\Norbix\Downloads\adwcleaner.pl 5.201.exe
2016-07-16 12:37 - 2016-07-16 12:37 - 00000000 ____D C:\Windows\system32\appmgmt
2016-07-15 23:49 - 2016-07-15 23:49 - 00000037 _____ C:\Users\Norbix\Desktop\New Text Document (2).txt
2016-07-15 23:48 - 2016-07-15 23:48 - 207317536 _____ (Ashampoo GmbH & Co. KG ) C:\Users\Norbix\Downloads\ashampoo_anti-virus_1.3.0_sm.exe
2016-07-13 19:03 - 2016-06-11 08:57 - 00394448 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-07-13 19:03 - 2016-06-11 06:48 - 00346320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-07-13 19:03 - 2016-06-10 23:38 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2016-07-13 19:03 - 2016-06-10 23:38 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2016-07-13 19:03 - 2016-06-10 23:20 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2016-07-13 19:03 - 2016-06-10 23:19 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2016-07-13 19:03 - 2016-06-10 23:19 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2016-07-13 19:03 - 2016-06-10 23:18 - 00572416 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2016-07-13 19:03 - 2016-06-10 23:18 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2016-07-13 19:03 - 2016-06-10 23:17 - 02895360 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-07-13 19:03 - 2016-06-10 23:10 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2016-07-13 19:03 - 2016-06-10 23:08 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2016-07-13 19:03 - 2016-06-10 23:05 - 25814016 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-07-13 19:03 - 2016-06-10 23:04 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2016-07-13 19:03 - 2016-06-10 23:03 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2016-07-13 19:03 - 2016-06-10 23:03 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2016-07-13 19:03 - 2016-06-10 23:02 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2016-07-13 19:03 - 2016-06-10 23:02 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2016-07-13 19:03 - 2016-06-10 22:53 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2016-07-13 19:03 - 2016-06-10 22:50 - 00489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2016-07-13 19:03 - 2016-06-10 22:49 - 06047744 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-07-13 19:03 - 2016-06-10 22:40 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2016-07-13 19:03 - 2016-06-10 22:38 - 00107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2016-07-13 19:03 - 2016-06-10 22:35 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2016-07-13 19:03 - 2016-06-10 22:34 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2016-07-13 19:03 - 2016-06-10 22:31 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2016-07-13 19:03 - 2016-06-10 22:28 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2016-07-13 19:03 - 2016-06-10 22:15 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2016-07-13 19:03 - 2016-06-10 22:13 - 00724992 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-07-13 19:03 - 2016-06-10 22:12 - 00806400 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-07-13 19:03 - 2016-06-10 22:11 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2016-07-13 19:03 - 2016-06-10 22:10 - 02131456 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-07-13 19:03 - 2016-06-10 21:45 - 15409664 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-07-13 19:03 - 2016-06-10 21:44 - 02869248 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-07-13 19:03 - 2016-06-10 21:30 - 01550848 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-07-13 19:03 - 2016-06-10 21:21 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-07-13 19:03 - 2016-06-10 21:09 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2016-07-13 19:03 - 2016-06-10 20:54 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2016-07-13 19:03 - 2016-06-10 20:53 - 00497664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2016-07-13 19:03 - 2016-06-10 20:53 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2016-07-13 19:03 - 2016-06-10 20:53 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2016-07-13 19:03 - 2016-06-10 20:52 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2016-07-13 19:03 - 2016-06-10 20:47 - 02287104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-07-13 19:03 - 2016-06-10 20:46 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2016-07-13 19:03 - 2016-06-10 20:45 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2016-07-13 19:03 - 2016-06-10 20:42 - 20348928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-07-13 19:03 - 2016-06-10 20:42 - 00476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2016-07-13 19:03 - 2016-06-10 20:41 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2016-07-13 19:03 - 2016-06-10 20:41 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2016-07-13 19:03 - 2016-06-10 20:41 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2016-07-13 19:03 - 2016-06-10 20:32 - 00416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2016-07-13 19:03 - 2016-06-10 20:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-07-13 19:03 - 2016-06-10 20:26 - 00091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2016-07-13 19:03 - 2016-06-10 20:24 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2016-07-13 19:03 - 2016-06-10 20:23 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2016-07-13 19:03 - 2016-06-10 20:21 - 00279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2016-07-13 19:03 - 2016-06-10 20:19 - 00130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2016-07-13 19:03 - 2016-06-10 20:14 - 04608000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-07-13 19:03 - 2016-06-10 20:12 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2016-07-13 19:03 - 2016-06-10 20:10 - 00692736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-07-13 19:03 - 2016-06-10 20:09 - 02055680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-07-13 19:03 - 2016-06-10 20:09 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2016-07-13 19:03 - 2016-06-10 19:58 - 13806080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-07-13 19:03 - 2016-06-10 19:45 - 02392576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-07-13 19:03 - 2016-06-10 19:42 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-07-13 19:03 - 2016-06-10 19:41 - 01315840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-07-13 18:52 - 2016-06-26 02:27 - 00970240 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2016-07-13 18:52 - 2016-06-26 02:27 - 00756736 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2016-07-13 18:52 - 2016-06-26 02:27 - 00344576 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.dll
2016-07-13 18:52 - 2016-06-26 02:27 - 00166400 _____ (Microsoft Corporation) C:\Windows\system32\inetpp.dll
2016-07-13 18:52 - 2016-06-26 02:27 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\inetppui.dll
2016-07-13 18:52 - 2016-06-25 21:54 - 00497152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2016-07-13 18:52 - 2016-06-25 21:53 - 00297472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.dll
2016-07-13 18:52 - 2016-06-25 21:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\ntprint.exe
2016-07-13 18:52 - 2016-06-25 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wpnpinst.exe
2016-07-13 18:52 - 2016-06-25 21:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntprint.exe
2016-07-13 18:52 - 2016-06-14 17:03 - 03217408 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2016-07-12 20:28 - 2016-07-16 12:46 - 00000000 ____D C:\Windows\system32\log
2016-07-10 22:05 - 2016-07-10 22:05 - 00000085 _____ C:\Windows\wininit.ini
2016-07-10 21:48 - 2016-07-23 20:13 - 00000000 ____D C:\Program Files\Common Files\AV
2016-07-10 21:48 - 2015-07-28 17:52 - 00821920 _____ (Safer-Networking Ltd. ) C:\Users\Public\Desktop\Post Win10 Spybot-install.exe
2016-07-10 21:23 - 2016-07-10 21:23 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2016-07-10 21:22 - 2016-07-17 00:09 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2016-07-10 21:22 - 2016-07-16 23:30 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2016-07-10 21:21 - 2016-07-10 21:22 - 46525608 _____ (Safer-Networking Ltd. ) C:\Users\Norbix\Downloads\spybot-2-4.exe
2016-07-10 13:06 - 2016-07-15 23:51 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2016-07-10 12:57 - 2016-07-10 12:58 - 167272920 _____ (Kaspersky Lab) C:\Users\Norbix\Documents\kts16.0.1.445pl-pl_full.exe
2016-07-09 23:35 - 2016-07-09 23:44 - 733829120 _____ C:\Users\Norbix\Downloads\Władca życzeń 2 - Wishmaster 2 PL.DVDRip.avi
2016-07-09 23:35 - 2016-07-09 23:43 - 712267926 _____ C:\Users\Norbix\Downloads\Wladca zyczen 1997 PL.DVDRIP.XVID-LaNK.avi
2016-07-03 17:58 - 2016-07-03 17:58 - 00000000 ____D C:\Users\Norbix\Downloads\Game.Of.Thrones.S01E01.720p.BluRay.nHD.x264-NhaNc3
2016-06-30 20:06 - 2016-06-30 20:06 - 00276384 _____ C:\Users\Norbix\Documents\U63H7S_Hepfler.pdf
2016-06-30 20:06 - 2016-06-30 20:06 - 00276138 _____ C:\Users\Norbix\Documents\U63H7S_Nazimek.pdf
2016-06-30 18:29 - 2016-06-30 18:29 - 00000000 ____D C:\Windows\System32\Tasks\Games

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-07-24 16:40 - 2016-03-17 20:48 - 00000000 ____D C:\ProgramData\MFAData
2016-07-24 16:39 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-07-24 12:25 - 2009-07-14 06:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-07-24 12:25 - 2009-07-14 06:45 - 00026768 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-07-24 00:37 - 2016-05-28 20:41 - 00000000 ____D C:\Users\Norbix\AppData\Roaming\vlc
2016-07-23 20:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-07-23 20:09 - 2016-03-17 20:46 - 00000000 ____D C:\Users\Norbix\AppData\Local\AvgSetupLog
2016-07-22 16:49 - 2016-05-05 19:10 - 00000000 ____D C:\Program Files (x86)\Tensons
2016-07-21 20:27 - 2016-03-18 07:49 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-07-21 20:10 - 2016-03-17 20:51 - 00000000 ___HD C:\$AVG
2016-07-21 20:10 - 2016-03-17 20:46 - 00000000 ____D C:\Users\Norbix\AppData\Local\Avg
2016-07-21 20:08 - 2016-03-17 20:47 - 00000000 ____D C:\ProgramData\Avg
2016-07-19 17:30 - 2016-03-29 21:04 - 00000000 ____D C:\Users\Norbix\Desktop\Programy
2016-07-17 17:25 - 2016-03-18 08:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-07-17 16:58 - 2016-03-18 07:55 - 00001159 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-07-17 16:58 - 2016-03-18 07:55 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-07-16 23:55 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-07-16 13:35 - 2016-03-17 21:21 - 00000000 ____D C:\Program Files (x86)\Google
2016-07-14 17:25 - 2009-07-14 06:45 - 00266656 _____ C:\Windows\system32\FNTCACHE.DAT
2016-07-13 22:08 - 2016-03-26 18:57 - 00000000 ____D C:\Windows\system32\MRT
2016-07-13 22:06 - 2016-03-26 18:56 - 144749672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-07-12 20:38 - 2016-03-19 20:38 - 00000000 ____D C:\ProgramData\NVIDIA
2016-07-12 20:22 - 2016-03-18 19:21 - 00000000 ____D C:\Users\Norbix\AppData\Roaming\DAEMON Tools Lite
2016-07-10 20:07 - 2016-06-07 19:37 - 00000000 ____D C:\Program Files (x86)\Opera
2016-07-10 20:07 - 2016-03-17 20:27 - 00001413 _____ C:\Users\Norbix\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-07-07 21:18 - 2009-07-14 06:45 - 00000000 ____D C:\Windows\Setup
2016-06-30 17:55 - 2016-04-07 06:45 - 00000169 _____ C:\Users\Norbix\Desktop\New Text Document.txt

==================== Files in the root of some directories =======

2016-04-30 21:15 - 2016-04-30 21:15 - 0000040 _____ () C:\ProgramData\ra3.ini

Some files in TEMP:
====================
C:\Users\Norbix\AppData\Local\Temp\HitmanPro.exe


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-07-17 21:06

==================== End of FRST.txt ============================