Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 01 Ran by Samsung (administrator) on SAMSUNGWIN7 on 26-04-2014 12:29:55 Running from C:\Users\Samsung\Downloads Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\windows\system32\nvvsvc.exe (Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe (Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (TODO: ) C:\Users\Samsung\AppData\Local\ConvertAd\ConvertAd.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\dmhkcore.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\MovieColorEnhancer.exe (Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Settings\SmartSetting.exe () C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Samsung Electronics) C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe (Intel Corporation) C:\windows\system32\igfxext.exe (Intel Corporation) C:\windows\system32\igfxsrvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe (SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Easy Support Center\SSCKbdHk.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\windows\SysWOW64\cmd.exe (ClientConnect Ltd.) C:\Users\Samsung\AppData\Local\NativeMessaging\CT3289075\1_0_1_6\TBMessagingHost.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\Media+Player10\Media+Player10Serv.exe (Intel Corporation) C:\windows\system32\hkcmd.exe (Intel Corporation) C:\windows\system32\igfxtray.exe (Intel Corporation) C:\windows\system32\igfxpers.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\SeaPort.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12558440 2011-07-12] (Realtek Semiconductor) HKLM\...\Run: [BTMTrayAgent] => C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10357008 2011-10-18] (Intel Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2784552 2011-05-13] (Synaptics Incorporated) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-01-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-02] (Adobe Systems Incorporated) HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) HKLM-x32\...\Run: [ConvertAd] => C:\Users\Samsung\AppData\Local\ConvertAd\ConvertAd.exe [1784832 2013-08-10] (TODO: ) HKLM-x32\...\Run: [tuto4pc_pl_17] => [X] HKLM-x32\...\Run: [AnyProtect Tray] => C:\Program Files (x86)\AnyProtectEx\AnyProtectTray.exe /scanner HKLM-x32\...\Run: [AnyProtect] => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-392818877-1939927122-1532879338-1001\...\Run: [Google Update] => C:\Users\Samsung\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-09-06] (Google Inc.) HKU\S-1-5-21-392818877-1939927122-1532879338-1001\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [449760 2013-10-31] (Sony) HKU\S-1-5-21-392818877-1939927122-1532879338-1001\...\Run: [TBHostSupport] => "C:\windows\SysWOW64\Rundll32.exe" "C:\Users\Samsung\AppData\Local\TBHostSupport\TBHostSupport_0.dll",DLLRunTBHostSupportPlugin <===== ATTENTION HKU\S-1-5-21-392818877-1939927122-1532879338-1001\...\RunOnce: [Application Restart #2] - C:\Users\Samsung\AppData\Local\Google\Chrome\Application\chrome.exe [841032 2014-04-02] (Google Inc.) HKU\S-1-5-21-392818877-1939927122-1532879338-1001\...\MountPoints2: {5e3a9f01-4d4c-11e3-981f-b803058059e8} - F:\Startme.exe AppInit_DLLs: c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll => c:\progra~3\bitguard\271769~1.27\{c16c1~1\loader.dll File Not Found AppInit_DLLs: c:\windows\system32\nvinitx.dll => c:\windows\system32\nvinitx.dll [226920 2011-06-05] (NVIDIA Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106&type=default&q={searchTerms} HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://www.searchgol.com/?babsrc=HP_ss&mntrId=04C1B803058059E5&affID=120699&tsp=5016 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106&type=default&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1380092485 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} SearchScopes: HKLM - {02B2B8AA-A41A-5793-940F-24F8F5C81BC0} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1380092485&type=default&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1388689551&from=wpm0102&uid=ST9500325AS_S2WFH410XXXXS2WFH410&q={searchTerms} SearchScopes: HKLM-x32 - {7308AAA3-588F-7A74-F51F-2F6006B16BC7} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1380092485&type=default&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106&type=default&q={searchTerms} SearchScopes: HKCU - bProtectorDefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} SearchScopes: HKCU - {02B2B8AA-A41A-5793-940F-24F8F5C81BC0} URL = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1380092485&type=default&q={searchTerms} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=04C1B803058059E5&affID=120699&tsp=5016 SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106&type=default&q={searchTerms} BHO: Object Browser - {11111111-1111-1111-1111-110311281150} - C:\Program Files (x86)\Object Browser\Object Browser-bho64.dll (Object Browser) BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) BHO-x32: Object Browser - {11111111-1111-1111-1111-110311281150} - C:\Program Files (x86)\Object Browser\Object Browser-bho.dll (Object Browser) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: IETabPage Class - {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} - C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited) BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation) BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) BHO-x32: mysearchdial Helper Object - {EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD} - C:\Program Files (x86)\Mysearchdial\1.8.21.0\bh\mysearchdial.dll (Ironsource Israel (2011) LTD) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\amd64\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM-x32 - mysearchdial Toolbar - {3004627E-F8E9-4E8B-909D-316753CBA923} - C:\Program Files (x86)\Mysearchdial\1.8.21.0\mysearchdialTlbr.dll (Ironsource Israel (2011) LTD) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.132.0\BingExt.dll (Microsoft Corporation.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 173.234.241.50 8.8.8.8 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll () FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Samsung\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Samsung\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.) FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\IPSFFPlgn\ [] FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\coFFPlgn_2011_7_13_2 [2014-04-26] Chrome: ======= CHR HomePage: hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106 CHR StartupUrls: "hxxp://www.delta-homes.com/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=hp&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106" CHR DefaultSearchKeyword: delta-homes CHR DefaultSearchProvider: delta-homes CHR DefaultSearchURL: http://search.delta-homes.com/web/?utm_source=b&utm_medium=wpm0226&utm_campaign=installer&utm_content=ds&from=wpm0226&uid=ST9500325AS_S2WFH410XXXXS2WFH410&ts=1393451106&type=default&q={searchTerms} CHR DefaultNewTabURL: CHR Extension: (uTorrentControl_v6) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp [2013-10-26] CHR Extension: (AdBlock) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-11-02] CHR Extension: (Lightning Newtab) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo [2014-01-08] CHR Extension: (Object Browser) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\kfgaibfbmkjgmimhbbaikfnpkkjkpoan [2013-10-27] CHR Extension: (Google Wallet) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-06] CHR Extension: (Extended Protection) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogfjmhfnldnajmfaofeiaepghjenbgjo [2014-02-26] CHR Extension: (MySearchDial) - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\pflphaooapbgpeakohlggbpidpppgdff [2013-10-26] CHR HKLM\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Samsung\AppData\Local\mysearchdial-speeddial.crx [2013-10-26] CHR HKCU\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Samsung\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx [2013-10-21] CHR HKCU\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Samsung\AppData\Local\mysearchdial-speeddial.crx [2013-10-26] CHR HKLM-x32\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Samsung\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx [2013-10-21] CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx [2013-09-25] CHR HKLM-x32\...\Chrome\Extension: [ogfjmhfnldnajmfaofeiaepghjenbgjo] - C:\Users\Samsung\AppData\Local\Google\Chrome\User Data\Default\Extensions\ep.crx [2014-02-26] CHR HKLM-x32\...\Chrome\Extension: [pflphaooapbgpeakohlggbpidpppgdff] - C:\Users\Samsung\AppData\Local\mysearchdial-speeddial.crx [2013-10-26] ==================== Services (Whitelisted) ================= R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation) R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-01] (Symantec Corporation) R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] () R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [425104 2014-02-26] (Taiwan Shui Mu Chih Ching Technology Limited.) R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [501904 2014-02-26] (Cherished Technololgy LIMITED) ==================== Drivers (Whitelisted) ==================== R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-28] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-28] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-28] () R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\BASHDefs\20130412.001\BHDrvx64.sys [1390680 2013-04-13] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-02-28] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-02-28] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\IPSDefs\20130426.001\IDSvia64.sys [513184 2013-02-27] (Symantec Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-26] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130427.007\ENG64.SYS [126192 2013-02-28] (Symantec Corporation) S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.5.0.125\Definitions\VirusDefs\20130427.007\EX64.SYS [2087664 2013-02-28] (Symantec Corporation) S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2012-04-13] (Windows (R) 2003 DDK 3790 provider) R2 SGDrv; C:\Windows\System32\DRIVERS\SGdrv64.sys [7680 2011-04-11] (Phoenix Technologies Ltd.) S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation) R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2013-02-28] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation) R2 VBoxDrv; C:\Program Files (x86)\YouWave Android\vb\VBoxDrv.sys [202592 2011-11-20] (Oracle Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-26 12:29 - 2014-04-26 12:30 - 00026601 _____ () C:\Users\Samsung\Downloads\FRST.txt 2014-04-26 12:28 - 2014-04-26 12:29 - 00000000 ____D () C:\FRST 2014-04-26 12:27 - 2014-04-26 12:28 - 02061824 _____ (Farbar) C:\Users\Samsung\Downloads\FRST64.exe 2014-04-26 12:24 - 2014-04-26 12:25 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-26 12:24 - 2014-04-26 12:24 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-04-26 12:24 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-04-26 12:24 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-04-26 12:24 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-04-26 12:23 - 2014-04-26 12:23 - 00052865 _____ () C:\Users\Samsung\Downloads\Shortcut.txt 2014-04-26 12:22 - 2014-04-26 12:23 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Samsung\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-26 12:22 - 2014-04-26 12:22 - 00000000 ____D () C:\Users\Samsung\Desktop\WYNIKI SKANU 2014-04-26 12:21 - 2014-04-26 12:21 - 00047487 _____ () C:\Users\Samsung\Downloads\mbam.txt 2014-04-19 13:38 - 2014-04-25 22:48 - 00003108 _____ () C:\windows\System32\Tasks\RegClean Pro 2014-04-12 17:04 - 2014-04-12 17:05 - 00000000 ____D () C:\Users\Samsung\Desktop\muza 1 2014-04-11 21:57 - 2014-04-11 21:57 - 00000000 __SHD () C:\Users\Samsung\AppData\Local\EmieUserList 2014-04-11 21:57 - 2014-04-11 21:57 - 00000000 __SHD () C:\Users\Samsung\AppData\Local\EmieSiteList 2014-04-11 10:09 - 2014-03-06 12:21 - 23549440 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-04-11 10:09 - 2014-03-06 11:32 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-04-11 10:09 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-04-11 10:09 - 2014-03-06 11:19 - 17387008 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-04-11 10:09 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-04-11 10:09 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-04-11 10:09 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-04-11 10:09 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-04-11 10:09 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-04-11 10:09 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-04-11 10:09 - 2014-03-06 10:32 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-04-11 10:09 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-04-11 10:09 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-04-11 10:09 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-04-11 10:09 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-04-11 10:09 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-04-11 10:09 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-04-11 10:09 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-04-11 10:09 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-04-11 10:09 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-04-11 10:09 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-04-11 10:09 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-04-11 10:09 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-04-11 10:09 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-04-11 10:09 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-04-11 10:09 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-04-11 10:09 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-04-11 10:09 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-04-11 10:09 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-04-11 10:09 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-04-11 10:09 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-04-11 10:09 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-04-11 10:09 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-04-11 10:09 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-04-11 10:09 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-04-11 10:09 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-04-11 10:09 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-04-11 10:09 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-04-11 10:09 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-04-11 10:09 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-04-11 10:09 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-04-11 10:09 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-04-11 10:09 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-04-11 10:09 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-04-11 10:09 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-04-11 10:09 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll 2014-04-11 10:09 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-04-11 10:09 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{2A10C5ED-C7E1-4825-B9C1-5432D8968AC1} 2014-04-09 18:22 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll 2014-04-09 18:22 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll 2014-04-09 18:22 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll 2014-04-09 18:22 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll 2014-04-09 18:22 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll 2014-04-09 18:22 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll 2014-04-09 18:22 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll 2014-04-09 18:22 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe 2014-04-09 18:22 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll 2014-04-09 18:22 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe 2014-04-09 18:22 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe 2014-04-09 18:22 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\windows\system32\Drivers\msiscsi.sys 2014-04-09 18:22 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\windows\system32\Drivers\storport.sys 2014-04-09 18:22 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Diskdump.sys 2014-04-09 18:22 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\iologmsg.dll 2014-04-09 18:22 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\iologmsg.dll 2014-04-09 18:22 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys 2014-04-08 10:48 - 2014-04-09 22:09 - 00024576 ___SH () C:\Users\Samsung\Desktop\Thumbs.db 2014-04-08 10:46 - 2014-04-09 21:44 - 00000000 ____D () C:\Users\Samsung\Documents\Moje odebrane pliki 2014-04-08 10:21 - 2014-04-09 21:45 - 00000000 ____D () C:\Users\Samsung\AppData\Local\Windows Live 2014-04-08 10:20 - 2014-04-08 10:22 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{98EA16BC-6924-47C2-9CCE-7E008D3BBB68} 2014-04-08 10:20 - 2014-04-08 10:21 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{963EAAE2-F2EB-44FD-805A-285983549737} 2014-03-31 17:29 - 2014-03-31 17:29 - 00000000 ____D () C:\Users\Samsung\Desktop\poznan zdj ==================== One Month Modified Files and Folders ======= 2014-04-26 12:30 - 2014-04-26 12:29 - 00026601 _____ () C:\Users\Samsung\Downloads\FRST.txt 2014-04-26 12:29 - 2014-04-26 12:28 - 00000000 ____D () C:\FRST 2014-04-26 12:28 - 2014-04-26 12:27 - 02061824 _____ (Farbar) C:\Users\Samsung\Downloads\FRST64.exe 2014-04-26 12:25 - 2014-04-26 12:24 - 00119512 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-26 12:24 - 2014-04-26 12:24 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-26 12:24 - 2014-04-26 12:24 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-04-26 12:23 - 2014-04-26 12:23 - 00052865 _____ () C:\Users\Samsung\Downloads\Shortcut.txt 2014-04-26 12:23 - 2014-04-26 12:22 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\Samsung\Downloads\mbam-setup-2.0.1.1004.exe 2014-04-26 12:22 - 2014-04-26 12:22 - 00000000 ____D () C:\Users\Samsung\Desktop\WYNIKI SKANU 2014-04-26 12:21 - 2014-04-26 12:21 - 00047487 _____ () C:\Users\Samsung\Downloads\mbam.txt 2014-04-26 12:20 - 2009-07-14 06:45 - 00021200 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-26 12:20 - 2009-07-14 06:45 - 00021200 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-26 12:17 - 2012-01-10 06:35 - 01832090 _____ () C:\windows\WindowsUpdate.log 2014-04-26 12:11 - 2013-02-28 15:10 - 00000000 ____D () C:\Users\Samsung\AppData\Local\CrashDumps 2014-04-26 12:10 - 2014-02-26 23:46 - 00000000 ____D () C:\Program Files (x86)\WinZipper 2014-04-26 12:08 - 2013-10-26 18:51 - 00001934 _____ () C:\windows\Tasks\Object Browser-chromeinstaller.job 2014-04-26 12:08 - 2013-10-26 18:51 - 00001318 _____ () C:\windows\Tasks\Object Browser-updater.job 2014-04-26 12:08 - 2013-10-26 18:51 - 00001220 _____ () C:\windows\Tasks\Object Browser-codedownloader.job 2014-04-26 12:08 - 2013-10-26 18:51 - 00001120 _____ () C:\windows\Tasks\Object Browser-enabler.job 2014-04-26 12:08 - 2013-06-21 14:45 - 00001046 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-04-26 12:07 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-04-26 12:06 - 2009-07-14 06:51 - 00094278 _____ () C:\windows\setupact.log 2014-04-25 22:58 - 2013-09-06 07:57 - 00001066 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-392818877-1939927122-1532879338-1001UA.job 2014-04-25 22:57 - 2013-09-06 07:57 - 00001014 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-392818877-1939927122-1532879338-1001Core.job 2014-04-25 22:56 - 2013-06-21 14:45 - 00001050 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-04-25 22:48 - 2014-04-19 13:38 - 00003108 _____ () C:\windows\System32\Tasks\RegClean Pro 2014-04-25 22:46 - 2013-10-02 15:09 - 00001368 _____ () C:\Users\Samsung\Desktop\Wyczyść rejestr za darmo!.lnk 2014-04-25 22:45 - 2013-06-21 14:45 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update 2014-04-25 12:39 - 2013-09-13 14:31 - 00000930 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-04-23 09:31 - 2013-09-25 09:31 - 00000288 _____ () C:\windows\Tasks\RegClean Pro_UPDATES.job 2014-04-21 16:27 - 2013-09-25 09:31 - 00000280 _____ () C:\windows\Tasks\RegClean Pro_DEFAULT.job 2014-04-21 12:28 - 2009-07-14 07:08 - 00032608 _____ () C:\windows\Tasks\SCHEDLGU.TXT 2014-04-21 09:57 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF 2014-04-12 17:09 - 2012-01-10 06:18 - 00744192 _____ () C:\windows\system32\perfh015.dat 2014-04-12 17:09 - 2012-01-10 06:18 - 00158076 _____ () C:\windows\system32\perfc015.dat 2014-04-12 17:09 - 2009-07-14 07:13 - 01680660 _____ () C:\windows\system32\PerfStringBackup.INI 2014-04-12 17:05 - 2014-04-12 17:04 - 00000000 ____D () C:\Users\Samsung\Desktop\muza 1 2014-04-11 21:57 - 2014-04-11 21:57 - 00000000 __SHD () C:\Users\Samsung\AppData\Local\EmieUserList 2014-04-11 21:57 - 2014-04-11 21:57 - 00000000 __SHD () C:\Users\Samsung\AppData\Local\EmieSiteList 2014-04-11 14:48 - 2014-02-26 23:46 - 00000000 ____D () C:\Program Files (x86)\SupTab 2014-04-11 14:47 - 2014-02-26 23:46 - 00000000 ____D () C:\ProgramData\IePluginService 2014-04-11 14:44 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions 2014-04-11 09:00 - 2013-02-28 15:14 - 00002665 _____ () C:\Users\Samsung\Desktop\Google Chrome.lnk 2014-04-10 10:42 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache 2014-04-10 09:07 - 2012-01-09 13:44 - 00252778 _____ () C:\windows\DPINST.LOG 2014-04-10 08:58 - 2013-07-31 04:37 - 00000000 ____D () C:\windows\system32\MRT 2014-04-09 23:52 - 2013-04-01 13:47 - 90655440 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-04-09 22:09 - 2014-04-08 10:48 - 00024576 ___SH () C:\Users\Samsung\Desktop\Thumbs.db 2014-04-09 21:45 - 2014-04-09 21:45 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{2A10C5ED-C7E1-4825-B9C1-5432D8968AC1} 2014-04-09 21:45 - 2014-04-08 10:21 - 00000000 ____D () C:\Users\Samsung\AppData\Local\Windows Live 2014-04-09 21:44 - 2014-04-08 10:46 - 00000000 ____D () C:\Users\Samsung\Documents\Moje odebrane pliki 2014-04-08 10:48 - 2014-01-20 20:18 - 00000000 ____D () C:\Users\Samsung\Desktop\audi 2014-04-08 10:22 - 2014-04-08 10:20 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{98EA16BC-6924-47C2-9CCE-7E008D3BBB68} 2014-04-08 10:21 - 2014-04-08 10:20 - 00000000 ____D () C:\Users\Samsung\AppData\Local\{963EAAE2-F2EB-44FD-805A-285983549737} 2014-04-08 10:20 - 2013-07-25 16:04 - 00000000 ____D () C:\Users\Samsung\Desktop\zdjęcia 2014-04-08 10:06 - 2013-07-25 16:04 - 00000000 ____D () C:\Users\Samsung\Desktop\m, 2014-04-03 09:51 - 2014-04-26 12:24 - 00088280 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-26 12:24 - 00063192 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-26 12:24 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2014-03-31 17:29 - 2014-03-31 17:29 - 00000000 ____D () C:\Users\Samsung\Desktop\poznan zdj 2014-03-31 09:35 - 2010-11-21 05:27 - 00270496 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe 2014-03-28 23:51 - 2013-06-21 14:45 - 00004046 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-28 23:51 - 2013-06-21 14:45 - 00003794 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore Some content of TEMP: ==================== C:\Users\Samsung\AppData\Local\Temp\cabex.dll C:\Users\Samsung\AppData\Local\Temp\ggdrive-menu.exe C:\Users\Samsung\AppData\Local\Temp\ggdrive-overlay.exe C:\Users\Samsung\AppData\Local\Temp\ggsetup1362919965.exe C:\Users\Samsung\AppData\Local\Temp\installstats.exe C:\Users\Samsung\AppData\Local\Temp\ipl5B87.tmp.exe C:\Users\Samsung\AppData\Local\Temp\iplC6D7.tmp.exe C:\Users\Samsung\AppData\Local\Temp\kjfytdrp.exe C:\Users\Samsung\AppData\Local\Temp\unelevate.exe C:\Users\Samsung\AppData\Local\Temp\uninst1.exe C:\Users\Samsung\AppData\Local\Temp\uttFBB0.tmp.exe C:\Users\Samsung\AppData\Local\Temp\VARemove.exe C:\Users\Samsung\AppData\Local\Temp\yta_bu12_setup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-10 10:34 ==================== End Of Log ============================