Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01 Ran by Michal (administrator) on JA on 05-04-2014 18:30:32 Running from C:\Users\Michal\Downloads Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Polish Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe (Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (ATI Technologies Inc.) C:\Windows\system32\Ati2evxx.exe (Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Odometer\hpsysdrv.exe (CyberLink Corp.) C:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgfws.exe (CyberLink) C:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe (CyberLink Corp.) C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe () C:\Program Files\Winamp\winampa.exe (Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe (Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe (Hewlett-Packard Company) c:\Program Files\Common Files\LightScribe\LSSrvc.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe (Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (Advanced Micro Devices Inc.) c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\KBD\kbd.exe (Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe (Farbar) C:\Users\Michal\Downloads\FRST(1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [hpsysdrv] - c:\program files\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM\...\Run: [KBD] - C:\Program Files\Hewlett-Packard\KBD\KbdStub.EXE [12288 2008-07-21] (Microsoft) HKLM\...\Run: [StartCCC] - c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2008-08-29] (Advanced Micro Devices, Inc.) HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75016 2008-12-04] (Hewlett-Packard) HKLM\...\Run: [UpdateP2GoShortCut] - c:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [210216 2008-10-30] (CyberLink Corp.) HKLM\...\Run: [UpdateLBPShortCut] - c:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.) HKLM\...\Run: [UpdatePDIRShortCut] - c:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [210216 2008-06-13] (CyberLink Corp.) HKLM\...\Run: [UpdatePSTShortCut] - c:\Program Files\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe [210216 2008-11-26] (CyberLink Corp.) HKLM\...\Run: [TSMAgent] - c:\Program Files\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe [1152296 2008-12-15] (CyberLink Corp.) HKLM\...\Run: [CLMLServer for HP TouchSmart] - c:\Program Files\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe [189736 2008-12-15] (CyberLink) HKLM\...\Run: [DVDAgent] - c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2008-11-28] (CyberLink Corp.) HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-11-03] (Intel Corporation) HKLM\...\Run: [WinampAgent] - C:\Program Files\Winamp\winampa.exe [37888 2009-07-01] () HKLM\...\Run: [SmartMenu] - C:\Program Files\Hewlett-Packard\HP MediaSmart\SmartMenu.exe [914224 2008-11-18] (Hewlett-Packard) HKLM\...\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-01-12] (Hewlett-Packard) HKLM\...\Run: [LWS] - C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-08-12] (Logitech Inc.) HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM\...\Run: [mobilegeni daemon] - C:\Program Files\Mobogenie\DaemonProcess.exe HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-2588287397-866835569-1081779446-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation) HKU\S-1-5-21-2588287397-866835569-1081779446-1000\...\Run: [WebcamMaxAutoRun] - C:\Program Files\WebcamMax\WebcamMax.exe [6038672 2010-10-03] (CoolwareMax) HKU\S-1-5-21-2588287397-866835569-1081779446-1000\...\Run: [uTorrent] - "C:\Users\Michal\AppData\Roaming\uTorrent\uTorrent.exe" /MINIMIZED HKU\S-1-5-21-2588287397-866835569-1081779446-1000\...\Run: [AVG-Secure-Search-Update_0913b] - C:\Users\Michal\AppData\Roaming\AVG 0913b Campaign\AVG-Secure-Search-Update-0913b.exe /PROMPT --mid 65d574c1fe5347d0bcdcd14b0268f55d-6368786cfca9ce1e1c8fe2d56b500d51a46baa5b --CMPID 0913b ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=92&bd=Pavilion&pf=cndt HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=92&bd=Pavilion&pf=cndt SearchScopes: HKCU - DefaultScope {DDBC3248-7BD9-4800-8BCE-206D1E27B806} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} SearchScopes: HKCU - {DDBC3248-7BD9-4800-8BCE-206D1E27B806} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - No Name - {95B7759C-8C7F-4BF1-B163-73684A933233} - No File DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} http://cached.gamedesire.com/g_bin/pl/poker_2_0_0_50.cab Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll (AVG Secure Search) Tcpip\Parameters: [DhcpNameServer] 80.238.112.12 80.238.112.13 FireFox: ======== FF ProfilePath: C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default FF Homepage: google.pl FF Keyword.URL: user_pref("keyword.URL", ""); FF NetworkProxy: "backup.ftp", "" FF NetworkProxy: "backup.ftp_port", "" FF NetworkProxy: "backup.gopher", "91,121,91,61" FF NetworkProxy: "backup.gopher_port", "" FF NetworkProxy: "backup.socks", "" FF NetworkProxy: "backup.socks_port", "" FF NetworkProxy: "backup.ssl", "" FF NetworkProxy: "backup.ssl_port", "" FF NetworkProxy: "gopher", "" FF NetworkProxy: "gopher_port", "" FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.) FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\\npsitesafety.dll (AVG Technologies) FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF Plugin: @ganymede/GanymedeNetPlugin,version=1.0 - C:\Program Files\Ganymede\Plugins\npganymedenet.dll ( ) FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPBOARDS.dll (Ganymede Technologies) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npganymedenet.dll ( ) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF SearchPlugin: C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\searchplugins\nation-secure-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\nation-secure-search.xml FF Extension: Microsoft .NET Framework Assistant - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-25] FF Extension: DownloadHelper - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-04-19] FF Extension: Bitdefender QuickScan - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2012-07-06] FF Extension: Stylish - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\Extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi [2011-05-09] FF Extension: Adblock Plus - C:\Users\Michal\AppData\Roaming\Mozilla\Firefox\Profiles\xsdh76le.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-16] FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-03-29] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-03-29] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-03-29] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-03-29] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Nation toolbar\FireFoxExt\17.3.0.49 FF Extension: AVG Nation toolbar - C:\ProgramData\AVG Nation toolbar\FireFoxExt\17.3.0.49 [2014-01-07] ========================== Services (Whitelisted) ================= R2 avgfws; C:\Program Files\AVG\AVG2014\avgfws.exe [1358944 2013-09-24] (AVG Technologies CZ, s.r.o.) R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.) R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-12-04] (Hewlett-Packard) R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2011-08-19] (Logitech Inc.) R2 vToolbarUpdater17.3.0; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [1770312 2014-01-07] (AVG Secure Search) ==================== Drivers (Whitelisted) ==================== R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [120600 2013-11-25] (AVG Technologies CZ, s.r.o.) R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6x.sys [47928 2013-09-26] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [210712 2013-11-25] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [149272 2013-11-25] (AVG Technologies CZ, s.r.o.) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22808 2014-01-19] (AVG Technologies CZ, s.r.o.) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [176952 2013-11-01] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [222520 2013-10-31] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [102712 2013-10-01] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27448 2013-09-10] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [193848 2013-08-01] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-10-03] (AVG Technologies) R3 CompFilter; C:\Windows\System32\DRIVERS\lvbusflt.sys [22176 2011-08-19] (Logitech Inc.) R2 cpuz133; C:\Windows\system32\drivers\cpuz133_x32.sys [20072 2010-05-11] (Windows (R) Win 7 DDK provider) R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-03] () R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82320 2010-01-29] (EZB Systems, Inc.) S3 lvselsus; C:\Windows\System32\DRIVERS\lvselsus.sys [66528 2010-05-15] (Logitech Inc.) S3 PID_08A0; C:\Windows\System32\DRIVERS\LV302AV.SYS [271360 2004-01-21] (Labtec Inc.) R0 speedfan; C:\Windows\System32\speedfan.sys [5248 2006-09-24] (Windows (R) 2000 DDK provider) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [721904 2009-09-15] () S3 usbbus; C:\Windows\System32\DRIVERS\lgusbbus.sys [13056 2009-08-11] (LG Electronics Inc.) S3 UsbDiag; C:\Windows\System32\DRIVERS\lgusbdiag.sys [20736 2009-08-11] (LG Electronics Inc.) S3 USBModem; C:\Windows\System32\DRIVERS\lgusbmodem.sys [24832 2009-08-11] (LG Electronics Inc.) R2 {55662437-DA8C-40c0-AADA-2C816A897A49}; c:\Program Files\Hewlett-Packard\Media\DVD\000.fcl [87536 2008-11-28] (CyberLink Corp.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-05 18:31 - 2014-04-05 18:31 - 00000000 ____D () C:\Users\Michal\AppData\Local\Apple 2014-04-05 18:28 - 2014-04-05 18:28 - 01145856 _____ (Farbar) C:\Users\Michal\Downloads\FRST(1).exe 2014-04-05 18:26 - 2014-04-05 18:26 - 00000000 ____D () C:\Users\Michal\AppData\Local\Mozilla 2014-04-05 18:26 - 2014-04-05 18:26 - 00000000 ____D () C:\Users\Michal\AppData\Local\Macromedia 2014-04-05 18:23 - 2014-04-05 18:23 - 00000000 ____D () C:\Users\Michal\AppData\Local\Logitech® Webcam Software 2014-04-05 18:22 - 2014-04-05 18:22 - 00000000 ____D () C:\Users\Michal\AppData\Local\ATI 2014-04-05 18:20 - 2014-04-05 18:20 - 00082536 _____ () C:\Users\Michal\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-05 18:16 - 2014-04-05 18:16 - 01873344 _____ ( ) C:\Users\Michal\Downloads\AVG_Browser_configuration_tool(1).exe 2014-04-05 18:12 - 2014-04-05 18:12 - 01873344 _____ ( ) C:\Users\Michal\Downloads\AVG_Browser_configuration_tool.exe 2014-03-31 22:59 - 2014-03-23 21:50 - 18575360 _____ () C:\Users\Michal\vertex.mpg 2014-03-29 20:48 - 2014-03-29 20:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-03-24 15:01 - 2014-03-24 15:01 - 00000000 ____D () C:\Users\Michal\AppData\Roaming\AVG2014 2014-03-24 15:00 - 2014-03-31 13:47 - 00000834 _____ () C:\Users\Public\Desktop\AVG 2014.lnk 2014-03-24 14:59 - 2014-03-24 15:01 - 00000000 ____D () C:\ProgramData\AVG2014 2014-03-24 14:59 - 2014-03-24 14:59 - 00000000 ___HD () C:\$AVG 2014-03-24 14:58 - 2014-03-24 14:58 - 00000000 ____D () C:\Program Files\AVG 2014-03-24 14:54 - 2014-04-05 18:12 - 00000000 ____D () C:\Users\Michal\AppData\Local\Avg2014 2014-03-24 14:54 - 2014-04-05 17:58 - 00000000 ____D () C:\ProgramData\MFAData 2014-03-24 14:53 - 2014-03-24 14:53 - 04471880 _____ (AVG Technologies) C:\Users\Michal\Downloads\avg_avct_stb_all_2014_4354.exe 2014-03-24 14:44 - 2014-03-24 14:47 - 00550278 _____ () C:\Users\Michal\Downloads\avgremover.log 2014-03-24 14:39 - 2014-03-24 14:39 - 03386520 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Michal\Downloads\avg_remover_stf_x86_2014_4116.exe 2014-03-23 23:57 - 2014-03-23 23:57 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-21 19:26 - 2014-03-21 19:26 - 00111292 _____ () C:\Users\Michal\Downloads\Extras.Txt 2014-03-21 19:25 - 2014-03-21 19:25 - 00123200 _____ () C:\Users\Michal\Downloads\OTL.Txt 2014-03-21 19:16 - 2014-04-05 18:31 - 00018823 _____ () C:\Users\Michal\Downloads\FRST.txt 2014-03-21 19:16 - 2014-03-21 19:18 - 00041969 _____ () C:\Users\Michal\Downloads\Addition.txt 2014-03-21 19:15 - 2014-04-05 18:30 - 00000000 ____D () C:\FRST 2014-03-21 19:06 - 2014-03-21 19:06 - 01145856 _____ (Farbar) C:\Users\Michal\Downloads\FRST.exe 2014-03-21 19:06 - 2014-03-21 19:06 - 00602112 _____ (OldTimer Tools) C:\Users\Michal\Downloads\OTL.exe 2014-03-21 18:51 - 2014-03-21 18:51 - 00000838 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk 2014-03-21 18:51 - 2014-03-21 18:51 - 00000000 ____D () C:\ProgramData\Licenses 2014-03-21 18:50 - 2014-03-21 18:51 - 04095448 _____ (BrightFort LLC ) C:\Users\Michal\Downloads\spywareblastersetup50.exe 2014-03-15 21:01 - 2014-02-23 07:50 - 12347904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-15 21:01 - 2014-02-23 07:47 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-15 21:01 - 2014-02-23 07:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-15 21:01 - 2014-02-23 07:41 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-15 21:01 - 2014-02-23 07:40 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-15 21:01 - 2014-02-23 07:39 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-15 21:01 - 2014-02-23 07:38 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-03-15 21:01 - 2014-02-23 07:38 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-15 21:01 - 2014-02-23 07:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-15 21:01 - 2014-02-23 07:37 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-15 21:01 - 2014-02-23 07:37 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-03-15 21:01 - 2014-02-23 07:37 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-15 21:01 - 2014-02-23 07:37 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-03-15 21:01 - 2014-02-23 07:36 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-15 21:01 - 2014-02-23 07:36 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-03-15 21:01 - 2014-02-23 07:35 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-15 08:49 - 2014-02-07 12:38 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-15 08:49 - 2014-02-03 12:37 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-15 08:48 - 2014-01-30 09:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll 2014-03-15 08:48 - 2013-11-13 02:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-03-08 19:26 - 2014-03-09 19:22 - 00000000 ____D () C:\Program Files\AVG Nation toolbar ==================== One Month Modified Files and Folders ======= 2014-04-05 18:31 - 2014-04-05 18:31 - 00000000 ____D () C:\Users\Michal\AppData\Local\Apple 2014-04-05 18:31 - 2014-03-21 19:16 - 00018823 _____ () C:\Users\Michal\Downloads\FRST.txt 2014-04-05 18:30 - 2014-03-21 19:15 - 00000000 ____D () C:\FRST 2014-04-05 18:28 - 2014-04-05 18:28 - 01145856 _____ (Farbar) C:\Users\Michal\Downloads\FRST(1).exe 2014-04-05 18:26 - 2014-04-05 18:26 - 00000000 ____D () C:\Users\Michal\AppData\Local\Mozilla 2014-04-05 18:26 - 2014-04-05 18:26 - 00000000 ____D () C:\Users\Michal\AppData\Local\Macromedia 2014-04-05 18:25 - 2009-04-15 21:26 - 00714682 _____ () C:\Windows\system32\perfh015.dat 2014-04-05 18:25 - 2009-04-15 21:26 - 00151554 _____ () C:\Windows\system32\perfc015.dat 2014-04-05 18:25 - 2006-11-02 12:33 - 01616158 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-05 18:24 - 2013-08-14 14:28 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-05 18:24 - 2009-05-26 12:25 - 02034880 _____ () C:\Windows\WindowsUpdate.log 2014-04-05 18:23 - 2014-04-05 18:23 - 00000000 ____D () C:\Users\Michal\AppData\Local\Logitech® Webcam Software 2014-04-05 18:22 - 2014-04-05 18:22 - 00000000 ____D () C:\Users\Michal\AppData\Local\ATI 2014-04-05 18:22 - 2009-08-23 14:43 - 00000000 ____D () C:\Users\Michal\AppData\Local\Hewlett-Packard 2014-04-05 18:21 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-05 18:21 - 2006-11-02 14:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-05 18:20 - 2014-04-05 18:20 - 00082536 _____ () C:\Users\Michal\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-05 18:20 - 2013-08-14 14:28 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-05 18:20 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-05 18:19 - 2006-11-02 15:01 - 00032546 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-05 18:16 - 2014-04-05 18:16 - 01873344 _____ ( ) C:\Users\Michal\Downloads\AVG_Browser_configuration_tool(1).exe 2014-04-05 18:13 - 2009-08-24 22:08 - 00000000 ____D () C:\Users\Michal\AppData\Local\Thunderbird 2014-04-05 18:13 - 2009-08-23 14:35 - 00000000 ____D () C:\Users\Michal\AppData\Local\VirtualStore 2014-04-05 18:12 - 2014-04-05 18:12 - 01873344 _____ ( ) C:\Users\Michal\Downloads\AVG_Browser_configuration_tool.exe 2014-04-05 18:12 - 2014-03-24 14:54 - 00000000 ____D () C:\Users\Michal\AppData\Local\Avg2014 2014-04-05 18:01 - 2012-04-02 19:00 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-05 17:58 - 2014-03-24 14:54 - 00000000 ____D () C:\ProgramData\MFAData 2014-04-04 21:07 - 2009-08-26 01:26 - 00000000 ____D () C:\Users\Michal\AppData\Roaming\Skype 2014-04-04 20:17 - 2009-08-25 18:51 - 00000000 ____D () C:\Users\Michal\AppData\Roaming\Winamp 2014-03-31 23:11 - 2009-08-23 14:22 - 00000000 ____D () C:\Users\Michal 2014-03-31 13:47 - 2014-03-24 15:00 - 00000834 _____ () C:\Users\Public\Desktop\AVG 2014.lnk 2014-03-30 18:39 - 2012-04-27 19:27 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-03-29 20:48 - 2014-03-29 20:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2014-03-26 22:57 - 2009-08-23 14:43 - 00000326 _____ () C:\Windows\Tasks\HPCeeScheduleForMichal.job 2014-03-26 07:55 - 2011-12-06 17:24 - 00000000 ____D () C:\Program Files\SpywareBlaster 2014-03-24 15:01 - 2014-03-24 15:01 - 00000000 ____D () C:\Users\Michal\AppData\Roaming\AVG2014 2014-03-24 15:01 - 2014-03-24 14:59 - 00000000 ____D () C:\ProgramData\AVG2014 2014-03-24 14:59 - 2014-03-24 14:59 - 00000000 ___HD () C:\$AVG 2014-03-24 14:58 - 2014-03-24 14:58 - 00000000 ____D () C:\Program Files\AVG 2014-03-24 14:53 - 2014-03-24 14:53 - 04471880 _____ (AVG Technologies) C:\Users\Michal\Downloads\avg_avct_stb_all_2014_4354.exe 2014-03-24 14:47 - 2014-03-24 14:44 - 00550278 _____ () C:\Users\Michal\Downloads\avgremover.log 2014-03-24 14:46 - 2008-01-21 04:47 - 00531452 _____ () C:\Windows\PFRO.log 2014-03-24 14:39 - 2014-03-24 14:39 - 03386520 _____ (AVG Technologies CZ, s.r.o.) C:\Users\Michal\Downloads\avg_remover_stf_x86_2014_4116.exe 2014-03-23 23:57 - 2014-03-23 23:57 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird 2014-03-23 21:50 - 2014-03-31 22:59 - 18575360 _____ () C:\Users\Michal\vertex.mpg 2014-03-21 19:26 - 2014-03-21 19:26 - 00111292 _____ () C:\Users\Michal\Downloads\Extras.Txt 2014-03-21 19:25 - 2014-03-21 19:25 - 00123200 _____ () C:\Users\Michal\Downloads\OTL.Txt 2014-03-21 19:18 - 2014-03-21 19:16 - 00041969 _____ () C:\Users\Michal\Downloads\Addition.txt 2014-03-21 19:06 - 2014-03-21 19:06 - 01145856 _____ (Farbar) C:\Users\Michal\Downloads\FRST.exe 2014-03-21 19:06 - 2014-03-21 19:06 - 00602112 _____ (OldTimer Tools) C:\Users\Michal\Downloads\OTL.exe 2014-03-21 18:53 - 2012-03-14 13:23 - 00000000 ____D () C:\Users\Michal\Desktop\Nowy folder 2014-03-21 18:51 - 2014-03-21 18:51 - 00000838 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk 2014-03-21 18:51 - 2014-03-21 18:51 - 00000000 ____D () C:\ProgramData\Licenses 2014-03-21 18:51 - 2014-03-21 18:50 - 04095448 _____ (BrightFort LLC ) C:\Users\Michal\Downloads\spywareblastersetup50.exe 2014-03-20 21:49 - 2006-11-02 14:42 - 00000000 ____D () C:\Windows\WindowsMobile 2014-03-19 21:33 - 2012-03-17 22:38 - 00000868 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-03-19 21:33 - 2010-08-09 23:54 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware 2014-03-18 21:05 - 2013-08-14 00:02 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-18 21:01 - 2006-11-02 12:24 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-03-16 14:58 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\rescache 2014-03-16 14:42 - 2006-11-02 14:47 - 00328304 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-15 21:01 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\pl-PL 2014-03-15 19:11 - 2011-01-13 23:07 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-12 18:01 - 2012-04-02 19:00 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-03-12 18:01 - 2011-05-21 15:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-03-09 19:22 - 2014-03-08 19:26 - 00000000 ____D () C:\Program Files\AVG Nation toolbar 2014-03-09 19:22 - 2013-09-28 09:55 - 00001704 _____ () C:\Program Files\Mozilla Firefoxnation-secure-search.xml 2014-03-08 22:24 - 2013-12-20 23:10 - 00000000 ____D () C:\Program Files\Mobogenie Files to move or delete: ==================== C:\ProgramData\Setting.dat Some content of TEMP: ==================== C:\Users\Michal\AppData\Local\Temp\UNINSTALL.EXE ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\system32\winlogon.exe => MD5 is legit C:\Windows\system32\wininit.exe => MD5 is legit C:\Windows\system32\svchost.exe => MD5 is legit C:\Windows\system32\services.exe => MD5 is legit C:\Windows\system32\User32.dll => MD5 is legit C:\Windows\system32\userinit.exe => MD5 is legit C:\Windows\system32\rpcss.dll => MD5 is legit C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-05 18:26 ==================== End Of Log ============================