Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-10-2013 Ran by Paulina (administrator) on PAULINKA on 02-11-2013 17:02:08 Running from C:\Users\Paulina\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Woodtale Technology Inc) C:\Program Files (x86)\iSafe\iSafeSvc.exe (Woodtale Technology Inc) C:\Program Files (x86)\iSafe\iSafeSvc2.exe () C:\Program Files (x86)\Przyspiesz Komputer\PCSUService.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\windows\system32\WLANExt.exe (Wsys Co., Ltd.) C:\ProgramData\eSafe\eGdpSvc.exe (Woodtale Technology Inc) C:\Program Files (x86)\iSafe\iSafeTray.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Samsung) C:\Program Files (x86)\Samsung\Easy Software Manager\SWMAgent.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (Novatel Wireless Inc.) C:\Program Files (x86)\Novatel Wireless\MobiLink3\MobiLink3.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe (Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe () C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe (Intel Corporation) C:\windows\SysWOW64\irstrtsv.exe () C:\windows\SysWOW64\srvany.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe () C:\windows\KMService.exe () C:\Program Files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON\MyEpson Portal\mep.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe (Microsoft Corporation) C:\windows\splwow64.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\windows\system32\igfxext.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\windows\splwow64.exe (TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesApp64.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\windows\System32\alg.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\windows\system32\hkcmd.exe (Intel Corporation) C:\windows\system32\igfxtray.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Intel Corporation) C:\windows\system32\igfxpers.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13374568 2011-11-24] (Realtek Semiconductor) HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2776872 2011-08-31] (ELAN Microelectronics Corp.) HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKCU\...\Run: [MobiLink3] - C:\Program Files (x86)\Novatel Wireless\MobiLink3\MobiLink3.exe [912896 2009-03-12] (Novatel Wireless Inc.) HKCU\...\Run: [NTRedirect] - C:\windows\SysWOW64\rundll32.exe "C:\Users\Paulina\AppData\Roaming\BabSolution\Shared\enhancedNT.dll",Run HKCU\...\RunOnce: [Application Restart #1] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --flag-switches-begin --flag-switches-end --restore-last-session http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=1373123208 [829392 2013-09-02] (Google Inc.) HKCU\...\Policies\Explorer: [] MountPoints2: {800e46fb-ad23-11e2-86e3-88532ed9c429} - D:\LaunchU3.exe -a MountPoints2: {df5c9a62-4f75-11e2-b43d-88532ed9c429} - D:\NokiaPCIA_Autorun.exe HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4297136 2012-10-30] (AVAST Software) AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll [1531256 2013-02-14] (Bandoo Media Inc) AppInit_DLLs-x32: C:\PROGRA~3\Wincert\WIN32C~1.DLL c:\progra~3\browse~3\261562~1.220\{c16c1~1\browse~1.dll [2699216 2013-08-13] () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www1.delta-search.com/?babsrc=HP_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=1370698918 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=1370698918 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&from=newgdp&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=1373123208 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=4390962 SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=4390962 SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=341&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2911434583154315&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=4390962 SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=prs&from=prs&uid=HitachiXHTS545050A7E380_TA9511GZK214XSK214XSX&ts=4390962 SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=341&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2911434583154315&q={searchTerms} SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?q={sear SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=341&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=2911434583154315&q={searchTerms} BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC) BHO-x32: DealPly Shopping - {4B6ACEA2-308A-4876-AD36-57CEC5B4FCC7} - C:\Program Files (x86)\DealPly\DealPlyIE.dll (DealPly) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.24.6\bh\delta.dll (Delta-search.com) BHO-x32: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: smartdownloader Class - {F1AF26F8-1828-4279-ABCE-074EF3235BD7} - C:\Program Files (x86)\PutLockerDownloader\smarterdownloader.dll (TODO: ) Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.24.6\deltaTlbr.dll (Delta-search.com) Toolbar: HKLM-x32 - Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC) Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) DPF: HKLM-x32 {8AD9C840-044E-11D1-B3E9-00805F499D93} http://javadl-esd.sun.com/update/1.4.1/jinstall-1_4_1-windows-i586.cab Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default FF user.js: detected! => C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\user.js FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 FF SearchEngineOrder.1: qvo6 FF SelectedSearchEngine: qvo6 FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=941C88532ED9C426&affID=119357&tsp=4982 FF Keyword.URL: hxxp://dts.search-results.com/sr?src=ffb&gct=ds&appid=341&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&apn_uid=2911434583154315&o=APN10645&q= FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\searchplugins\delta.xml FF SearchPlugin: C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\searchplugins\Search_Results.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\qvo6.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Search_Results.xml FF Extension: DealPly Shopping - C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\Extensions\addon@dealplyshopping.com FF Extension: Delta Toolbar - C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\Extensions\ffxtlbr@delta.com FF Extension: Search-Results Toolbar - C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\Extensions\{377e5d4d-77e5-476a-8716-7e70a9272da0} FF Extension: putlockerdownloader - C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\Extensions\putlockerdownloader@putlockerdownloader.com.xpi FF Extension: No Name - C:\Users\Paulina\AppData\Roaming\Mozilla\Firefox\Profiles\xp66n9r2.default\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433} FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! WebRep - C:\Program Files\AVAST Software\Avast\WebRep\FF Chrome: ======= CHR DefaultSearchURL: (Search the web (Babylon)) - http://isearch.babylon.com/?q={searchTerms}&babsrc=SP_ssbtis1&mntrId=941C88532ED9C426&affID=119357&tsp=4980 CHR DefaultSuggestURL: (Search the web (Babylon)) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.66\pdf.dll () CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.) CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll () CHR Plugin: (Java Deployment Toolkit 7.0.210.11) - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) CHR Extension: (PutLockerDownloader) - C:\Users\Paulina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apfdadfinodckpcehhdhjlgiphgnbfci\1.0_1 CHR Extension: (Delta Toolbar) - C:\Users\Paulina\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.4_1 CHR Extension: (Delta Toolbar) - C:\Users\Paulina\AppData\Local\Google\Chrome\User Data\Default\Extensions\gnnabbonolmdccgncgckdfikehphiknc\1.0_1 CHR Extension: (avast! WebRep) - C:\Users\Paulina\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1474_0 CHR Extension: (Google Wallet) - C:\Users\Paulina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0 CHR HKLM-x32\...\Chrome\Extension: [apfdadfinodckpcehhdhjlgiphgnbfci] - C:\Program Files (x86)\PutLockerDownloader\putlockerdownloader10.crx CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Paulina\AppData\Roaming\BabSolution\CR\Delta.crx CHR HKLM-x32\...\Chrome\Extension: [gnnabbonolmdccgncgckdfikehphiknc] - C:\Users\Paulina\AppData\Roaming\CRDeltaTB\DeltaYHS.crx CHR HKLM-x32\...\Chrome\Extension: [icmlaeflemplmjndnaapfdbbnpncnbda] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx ==================== Services (Whitelisted) ================= S4 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [44808 2012-10-30] (AVAST Software) R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2011-09-23] (Diskeeper Corporation) R2 InstallFilterService; C:\Program Files (x86)\STMicroelectronics\Accelerometer\InstallFilterService.exe [60928 2010-12-17] () R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [184320 2011-07-06] (Intel Corporation) R2 iSafeService; C:\Program Files (x86)\iSafe\iSafeSvc.exe [245576 2013-06-19] (Woodtale Technology Inc) R2 KMService; C:\windows\SysWow64\srvany.exe [8192 2012-12-30] () R2 MyEpson Portal Service; C:\Program Files (x86)\EPSON\MyEpson Portal\mepService.exe [703616 2012-07-26] (SEIKO EPSON CORPORATION) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-15] () R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation) R2 NvtlService; C:\Program Files (x86)\Novatel Wireless\Novacore\Server\NvtlSrvr.exe [40448 2009-03-06] () R2 PCSUService; C:\Program Files (x86)\Przyspiesz Komputer\PCSUService.exe [388912 2013-05-03] () R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesService64.exe [2365792 2012-10-15] (TuneUp Software) R2 WsysSvc; C:\ProgramData\eSafe\eGdpSvc.exe [301120 2013-08-16] (Wsys Co., Ltd.) ==================== Drivers (Whitelisted) ==================== R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [25232 2012-10-30] (AVAST Software) R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [71600 2012-10-30] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [54072 2012-10-15] (AVAST Software) R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [984144 2012-10-30] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [370288 2012-10-30] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [59728 2012-10-30] (AVAST Software) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2011-09-23] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [80688 2011-09-23] (Diskeeper Corporation) R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2011-06-15] (Intel Corporation) S3 iSafeFsFlt; C:\Program Files (x86)\iSafe\iSafeFsFlt.sys [15216 2013-06-19] (Woodtale Technology Inc) R3 iSafeKrnl; C:\Windows\System32\DRIVERS\iSafeKrnl.sys [122736 2013-06-19] (Woodtale Technology Inc) S3 NWUSBModem; C:\Windows\System32\DRIVERS\nwusbmdm.sys [213248 2008-12-04] (Novatel Wireless Inc.) S3 NWUSBPort; C:\Windows\System32\DRIVERS\nwusbser.sys [213248 2008-12-04] (Novatel Wireless Inc.) R2 SGDrv; C:\Windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.) R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2013\TuneUpUtilitiesDriver64.sys [11880 2012-09-19] (TuneUp Software) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-02 17:00 - 2013-11-02 17:00 - 00000000 ____D C:\FRST 2013-11-02 16:57 - 2013-11-02 16:57 - 00133076 _____ C:\Users\Paulina\Downloads\Extras.Txt 2013-11-02 16:53 - 2013-11-02 16:53 - 00115074 _____ C:\Users\Paulina\Downloads\OTL.Txt 2013-11-02 16:49 - 2013-11-02 16:50 - 01957098 _____ (Farbar) C:\Users\Paulina\Downloads\FRST64.exe 2013-11-02 16:33 - 2013-11-02 16:33 - 00602112 _____ (OldTimer Tools) C:\Users\Paulina\Downloads\OTL.exe 2013-11-02 15:47 - 2013-11-02 16:28 - 00000168 _____ C:\windows\setupact.log 2013-11-02 15:47 - 2013-11-02 15:47 - 00491510 _____ C:\windows\PFRO.log 2013-11-02 15:47 - 2013-11-02 15:47 - 00000000 _____ C:\windows\setuperr.log 2013-11-02 15:45 - 2013-11-02 15:45 - 00000000 ____D C:\Users\Paulina\Desktop\PDF 2013-11-02 15:40 - 2013-11-02 15:40 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update 2013-11-02 15:40 - 2013-11-02 15:40 - 00001958 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2013-11-02 15:40 - 2013-11-02 15:40 - 00000000 _____ C:\windows\SysWOW64\config.nt 2013-11-02 15:40 - 2012-10-30 23:51 - 00984144 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys 2013-11-02 15:40 - 2012-10-30 23:51 - 00370288 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys 2013-11-02 15:40 - 2012-10-30 23:51 - 00071600 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys 2013-11-02 15:40 - 2012-10-30 23:51 - 00059728 _____ (AVAST Software) C:\windows\system32\Drivers\aswTdi.sys 2013-11-02 15:40 - 2012-10-30 23:51 - 00041224 _____ (AVAST Software) C:\windows\avastSS.scr 2013-11-02 15:40 - 2012-10-30 23:51 - 00025232 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys 2013-11-02 15:40 - 2012-10-30 23:50 - 00285328 _____ (AVAST Software) C:\windows\system32\aswBoot.exe 2013-11-02 15:40 - 2012-10-30 23:50 - 00227648 _____ (AVAST Software) C:\windows\SysWOW64\aswBoot.exe 2013-11-02 15:40 - 2012-10-15 17:59 - 00054072 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys 2013-11-02 15:39 - 2013-11-02 15:39 - 00000000 ____D C:\ProgramData\AVAST Software 2013-11-02 15:39 - 2013-11-02 15:39 - 00000000 ____D C:\Program Files\AVAST Software 2013-11-02 15:30 - 2013-11-02 15:30 - 00007186 _____ C:\Users\Paulina\Documents\cc_20131102_153023.reg 2013-11-02 15:28 - 2013-11-02 15:28 - 00002776 _____ C:\windows\System32\Tasks\CCleanerSkipUAC 2013-11-02 15:28 - 2013-11-02 15:28 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-11-02 15:28 - 2013-11-02 15:28 - 00000000 ____D C:\Program Files\CCleaner 2013-11-02 15:19 - 2013-11-02 15:19 - 00000000 ____D C:\Users\Paulina\AppData\Roaming\iSafe 2013-11-02 14:53 - 2013-11-02 14:53 - 00000000 ____D C:\Users\Paulina\Desktop\Muza ==================== One Month Modified Files and Folders ======= 2013-11-02 17:00 - 2013-11-02 17:00 - 00000000 ____D C:\FRST 2013-11-02 16:57 - 2013-11-02 16:57 - 00133076 _____ C:\Users\Paulina\Downloads\Extras.Txt 2013-11-02 16:54 - 2012-05-28 12:45 - 00000930 _____ C:\windows\Tasks\Adobe Flash Player Updater.job 2013-11-02 16:54 - 2011-12-28 22:02 - 01460504 _____ C:\windows\WindowsUpdate.log 2013-11-02 16:53 - 2013-11-02 16:53 - 00115074 _____ C:\Users\Paulina\Downloads\OTL.Txt 2013-11-02 16:50 - 2013-11-02 16:49 - 01957098 _____ (Farbar) C:\Users\Paulina\Downloads\FRST64.exe 2013-11-02 16:50 - 2012-12-16 21:08 - 00001050 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-02 16:40 - 2013-05-07 21:43 - 00000000 ____D C:\Program Files (x86)\Przyspiesz Komputer 2013-11-02 16:38 - 2009-07-14 05:45 - 00029168 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-11-02 16:38 - 2009-07-14 05:45 - 00029168 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-11-02 16:35 - 2011-11-21 04:24 - 00751308 _____ C:\windows\system32\perfh015.dat 2013-11-02 16:35 - 2011-11-21 04:24 - 00159478 _____ C:\windows\system32\perfc015.dat 2013-11-02 16:35 - 2009-07-14 06:13 - 01691620 _____ C:\windows\system32\PerfStringBackup.INI 2013-11-02 16:34 - 2013-06-08 14:40 - 00000000 ____D C:\ProgramData\eSafe 2013-11-02 16:33 - 2013-11-02 16:33 - 00602112 _____ (OldTimer Tools) C:\Users\Paulina\Downloads\OTL.exe 2013-11-02 16:33 - 2013-06-08 14:41 - 00000000 ____D C:\Program Files (x86)\iSafe 2013-11-02 16:30 - 2012-05-26 22:34 - 00000435 _____ C:\windows\system32\Drivers\etc\hosts.ics 2013-11-02 16:29 - 2012-12-16 21:08 - 00001046 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-02 16:28 - 2013-11-02 15:47 - 00000168 _____ C:\windows\setupact.log 2013-11-02 16:28 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-11-02 16:15 - 2013-06-08 14:40 - 00000000 ____D C:\Users\Paulina\AppData\Roaming\eDownload 2013-11-02 15:55 - 2012-05-30 19:52 - 00000000 ____D C:\Users\Paulina\AppData\Local\CrashDumps 2013-11-02 15:47 - 2013-11-02 15:47 - 00491510 _____ C:\windows\PFRO.log 2013-11-02 15:47 - 2013-11-02 15:47 - 00000000 _____ C:\windows\setuperr.log 2013-11-02 15:47 - 2011-12-28 06:28 - 00000000 ____D C:\ProgramData\Norton 2013-11-02 15:45 - 2013-11-02 15:45 - 00000000 ____D C:\Users\Paulina\Desktop\PDF 2013-11-02 15:45 - 2012-12-16 21:08 - 00004046 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-11-02 15:45 - 2012-12-16 21:08 - 00003794 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-11-02 15:44 - 2012-12-16 21:08 - 00000000 ____D C:\Program Files (x86)\Google 2013-11-02 15:44 - 2012-12-16 21:07 - 00000000 ____D C:\Users\Paulina\AppData\Local\Google 2013-11-02 15:40 - 2013-11-02 15:40 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update 2013-11-02 15:40 - 2013-11-02 15:40 - 00001958 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2013-11-02 15:40 - 2013-11-02 15:40 - 00000000 _____ C:\windows\SysWOW64\config.nt 2013-11-02 15:39 - 2013-11-02 15:39 - 00000000 ____D C:\ProgramData\AVAST Software 2013-11-02 15:39 - 2013-11-02 15:39 - 00000000 ____D C:\Program Files\AVAST Software 2013-11-02 15:30 - 2013-11-02 15:30 - 00007186 _____ C:\Users\Paulina\Documents\cc_20131102_153023.reg 2013-11-02 15:29 - 2012-05-28 19:43 - 00000000 ____D C:\windows\Minidump 2013-11-02 15:29 - 2011-02-11 20:57 - 00000000 ____D C:\windows\Panther 2013-11-02 15:28 - 2013-11-02 15:28 - 00002776 _____ C:\windows\System32\Tasks\CCleanerSkipUAC 2013-11-02 15:28 - 2013-11-02 15:28 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-11-02 15:28 - 2013-11-02 15:28 - 00000000 ____D C:\Program Files\CCleaner 2013-11-02 15:19 - 2013-11-02 15:19 - 00000000 ____D C:\Users\Paulina\AppData\Roaming\iSafe 2013-11-02 15:18 - 2012-05-25 12:59 - 00000000 ____D C:\Users\Paulina 2013-11-02 15:17 - 2013-06-08 14:41 - 00000000 ____D C:\Users\Paulina\AppData\Local\Lollipop 2013-11-02 15:15 - 2013-06-08 14:42 - 00000000 ____D C:\Program Files (x86)\Desk 365 2013-11-02 14:53 - 2013-11-02 14:53 - 00000000 ____D C:\Users\Paulina\Desktop\Muza Some content of TEMP: ==================== C:\Users\Paulina\AppData\Local\Temp\AcDeltree.exe C:\Users\Paulina\AppData\Local\Temp\UNINSTALL.exe C:\Users\Paulina\AppData\Local\Temp\{BF984205-2510-42E7-9A7A-C7126BD9A147}-30.0.1599.101_29.0.1547.66_chrome_updater.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-09-17 19:34 ==================== End Of Log ============================