Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-10-2014 01 Ran by Pawel at 2014-10-19 15:00:45 Running from C:\Users\Pawel\Downloads Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Ochrona komputera (Enabled - Up to date) {15414183-282E-D62C-CA37-EF24860A2F17} AS: Ochrona komputera (Enabled - Up to date) {AE20A067-0E14-D9A2-F087-D456FD8D65AA} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adblock Plus dla IE (32-bitowego i 64-bitowego) (HKLM\...\{084BAFFE-E0C5-4418-9FE5-FC39B353018B}) (Version: 99.9 - Eyeo GmbH) Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.182 - Adobe Systems Incorporated) Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated) Adobe Reader XI (11.0.08) - Polish (HKLM-x32\...\{AC76BA86-7AD7-1045-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated) Aktualizacja produktu Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0415-0000-0000000FF1CE}_HOMESTUDENTR_{04E205D6-88B1-4652-B162-42DF2C3B1228}) (Version: - Microsoft) Aktualizacja produktu Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0415-0000-0000000FF1CE}_HOMESTUDENTR_{442ECBCF-94A7-48CC-8CD9-D31FFFD5FA86}) (Version: - Microsoft) Aktualizacja produktu Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0415-0000-0000000FF1CE}_HOMESTUDENTR_{128A36ED-21BE-4547-9FFE-5B85AEC735DD}) (Version: - Microsoft) Altitude (HKLM-x32\...\Steam App 41300) (Version: - Nimbly Games) AMD Accelerated Video Transcoding (Version: 12.5.100.30429 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.937.2 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Fuel (Version: 2013.0429.2313.39747 - Nazwa firmy) Hidden AMD Media Foundation Decoders (Version: 1.0.80430.0002 - Advanced Micro Devices, Inc.) Hidden AMD VISION Engine Control Center (x32 Version: 2013.0429.2313.39747 - Nazwa firmy) Hidden ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version: - ASRock Inc.) ASRock InstantBoot v1.24 (HKLM-x32\...\ASRock InstantBoot_is1) (Version: - ) Battle Islands (HKLM-x32\...\Steam App 305260) (Version: - DR Studios) Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.6.0.0 - Electronic Arts) Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB) Brother MFL-Pro Suite DCP-130C (HKLM-x32\...\{7E48AFD3-F28A-4E54-99A8-9F3A4A27DBC4}) (Version: 1.0.3.0 - Brother Industries, Ltd.) calibre 64bit (HKLM\...\{57ADE316-7B2D-4DD0-BA95-11AF9B58B3DA}) (Version: 2.2.0 - Kovid Goyal) Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (x32 Version: 2013.1206.1603.28764 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (x32 Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help English (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help French (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help German (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (x32 Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden ccc-utility64 (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden Company of Heroes 2 (HKLM-x32\...\Steam App 231430) (Version: - Relic Entertainment) Computer Security 12.83.104.0 (release) (x32 Version: 12.83.104.0 - F-Secure Corporation) Hidden Euro Truck Simulator 2 (HKLM-x32\...\{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1) (Version: 1.0.5 - SCS Software) F-Secure CCF Reputation (x32 Version: 1.0.25.1877 - F-Secure) Hidden F-Secure CCF Scanning 1.43.102.193 (release) (x32 Version: 1.43.102.193 - F-Secure Corporation) Hidden F-Secure Network CCF 1.02.128 (x32 Version: 1.02.128.1 - F-Secure Corporation) Hidden Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge) Glary Utilities PRO 5.10 (HKLM-x32\...\Glary Utilities 5) (Version: 5.10.0.17 - Glarysoft Ltd) Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle) Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.236 - LogMeIn, Inc.) LogMeIn Hamachi (x32 Version: 2.2.0.236 - LogMeIn, Inc.) Hidden Malwarebytes Anti-Malware wersja 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (PLK) (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (Polski) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1045) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Excel MUI (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (Polish) 2007 (x32 Version: 12.0.4518.1020 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Shared 64-bit MUI (Polish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Word MUI (Polish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation) Mozilla Firefox 28.0 (x86 pl) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 pl)) (Version: 28.0 - Mozilla) Mozilla Firefox 33.0 (x86 pl) (HKCU\...\Mozilla Firefox 33.0 (x86 pl)) (Version: 33.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla) Need For Speed™ World (HKLM-x32\...\{3AF1B16A-7DC9-4C80-BAEC-70B088A7C5B8}) (Version: 1.0.0.0 - Electronic Arts) NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation) NVIDIA ForceWare Network Access Manager (HKLM-x32\...\InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}) (Version: - ) NVIDIA ForceWare Network Access Manager (Version: 1.00.7305 - NVIDIA Corporation) Hidden Online Safety 2.83.1346.10 (x32 Version: 2.83.1346.10 - F-Secure Corporation) Hidden Opera Stable 25.0.1614.50 (HKLM-x32\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA) Origin (HKLM-x32\...\Origin) (Version: 9.4.7.2799 - Electronic Arts, Inc.) Pakiet Bezpieczeństwa UPC (HKLM-x32\...\F-Secure ServiceEnabler 46267) (Version: 1.83.311.0 - F-Secure Corporation) Pakiet Bezpieczeństwa UPC (x32 Version: 1.83.311.0 - F-Secure Corporation) Hidden Platform (x32 Version: 1.34 - VIA Technologies, Inc.) Hidden PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.) RaceRoom Racing Experience (HKLM-x32\...\Steam App 211500) (Version: - SimBin Studios AB) RaceRoom Racing Experience Launcher (HKLM-x32\...\{1FD9F07F-7BBF-4C91-B3F0-A23714A3A913}_is1) (Version: 1.0 - SimBin) Robocraft version 0.3.290 (HKCU\...\{9F101691-69D3-422E-BB5C-8CAD7110781B}_is1) (Version: 0.3.290 - Freejam) S.K.I.L.L. - Special Force 2 (HKLM-x32\...\Special Force 2 Beta_is1) (Version: - ) Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation) Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.) Space Engineers (HKLM-x32\...\Steam App 244850) (Version: - ) Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation) TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH) Terraria (HKLM-x32\...\Steam App 105600) (Version: - Re-Logic) Tom Clancy's Ghost Recon Phantoms - EU (HKLM-x32\...\Steam App 272350) (Version: - Ubisoft Singapore) TP-LINK USB Printer Controller (HKLM-x32\...\{3EC900B5-28EE-4472-A9FF-B11A879EC838}) (Version: 1.12.0927 - TP-LINK) Traffic Giant (HKLM-x32\...\{A3011BA0-752B-11D5-8CC5-00C0CA129740}) (Version: - ) Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Unturned (HKLM-x32\...\Steam App 304930) (Version: - Nelson Sexton) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) VIA Platforma Menedżera urządzeń (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.) War Thunder Launcher 1.0.1.396 (HKLM-x32\...\{ed8deea4-29fa-3932-9612-e2122d8a62d9}}_is1) (Version: - Gaijin Entertainment) WinRAR 5.10 (64-bitowy) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH) XFast LAN v6.61 (HKLM\...\XFast LAN) (Version: 6.61 - cFos Software GmbH, Bonn) XFastUSB (HKLM-x32\...\XFastUSB) (Version: 3.02.28 - ASRock Inc.) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 01-10-2014 16:03:48 Windows Update 02-10-2014 20:11:08 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 02-10-2014 20:12:04 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 02-10-2014 20:12:18 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 02-10-2014 20:13:15 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 05-10-2014 17:00:20 Windows Backup 11-10-2014 14:24:32 ComboFix created restore point 11-10-2014 15:22:06 Windows Update 16-10-2014 11:24:27 Windows Update 16-10-2014 18:33:17 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2014-10-11 16:40 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0D97C9EF-BE14-4C56-97D7-B59019F17777} - System32\Tasks\GlaryUpdate 5 => D:\Program Files (x86)\Glary Utilities 5\CheckUpdate.exe [2014-10-13] (Glarysoft Ltd) Task: {0F29527A-2788-4E56-9282-D0779F392AC5} - System32\Tasks\Opera scheduled Autoupdate 1397400410 => D:\Program Files (x86)\Opera\launcher.exe [2014-10-15] (Opera Software) Task: {19843C92-A79E-45D4-BE43-7310C4ECAB93} - System32\Tasks\{5F899801-6ACB-4F88-B7AF-9FD6EE80C55F} => C:\Users\Pawel\Desktop\GhostReconPhantoms_Setup(EU)(3).exe Task: {256F32B1-8371-46E9-A6A4-F6225A824485} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {56976C87-18FF-4E43-9E72-B3F59F59A906} - System32\Tasks\{CFAEAC2A-3FC6-4605-BCFB-B8875A5EE6B5} => D:\Program Files (x86)\Glary Utilities 4\Integrator.exe Task: {926C07E0-6E0B-4DC2-939F-D0FAE9DE0F61} - System32\Tasks\{73448661-0E78-4A87-9E34-7554CAB549B6} => C:\Users\Pawel\Desktop\GhostReconPhantoms_Setup(EU) (1).exe Task: {E3AE1E60-35EA-40FB-96A8-C13DD6F81323} - System32\Tasks\{A607F0F1-9200-434D-9866-0DCEAA2AB7C7} => D:\Program Files (x86)\Glary Utilities 4\Integrator.exe Task: {E60292B3-1A30-46F8-B141-467ABF44F129} - System32\Tasks\{AF898CA8-0B56-4525-8B07-44102FA41655} => C:\Users\Pawel\Desktop\GhostReconPhantoms_Setup(EU).exe Task: {E90B12A2-8020-4130-87D5-AAED4A085FC3} - System32\Tasks\zASRockInstantBoot => C:\Program Files (x86)\ASRock Utility\InstantBoot\InstantBoot.exe [2009-11-16] (ASRock) Task: {EF6FEDDC-FE77-4474-AC99-83BE2321B1A3} - System32\Tasks\{7FE5FB9B-0812-435B-ABCD-2C482A3B3F6D} => D:\Program Files\Origin\Origin.exe [2014-05-29] (Electronic Arts) Task: {EF83F773-B5C5-4B1F-BFE7-E35D76E4A4C1} - System32\Tasks\GlaryInitialize 5 => D:\Program Files (x86)\Glary Utilities 5\Initialize.exe [2014-10-13] (Glarysoft Ltd) Task: {FB49BDD0-F561-49F8-978F-45D83E75F097} - System32\Tasks\GU5SkipUAC => D:\Program Files (x86)\Glary Utilities 5\Integrator.exe [2014-10-13] (Glarysoft Ltd) Task: C:\Windows\Tasks\GlaryInitialize 5.job => D:\Program Files (x86)\Glary Utilities 5\Initialize.exe Task: C:\Windows\Tasks\GlaryUpdate 5.job => D:\Program Files (x86)\Glary Utilities 5\CheckUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-10-07 17:14 - 2014-09-25 09:06 - 00628736 _____ () C:\Users\Pawel\AppData\Roaming\HTThread\hb.exe 2014-04-14 08:32 - 2009-05-07 16:51 - 00071680 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll 2014-04-14 08:32 - 2009-05-07 16:53 - 00379392 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll 2014-04-14 08:32 - 2008-01-18 14:50 - 00098816 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\VMicApi.dll 2014-04-14 08:32 - 2009-09-02 09:26 - 47601664 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Skin.dll 2013-04-29 23:25 - 2013-04-29 23:25 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll 2013-06-18 15:49 - 2013-06-18 15:49 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2013-04-29 23:08 - 2013-04-29 23:08 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2014-04-14 22:43 - 2014-06-28 19:33 - 00076152 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2009-04-19 08:34 - 2009-04-19 08:34 - 00625184 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe 2009-04-19 08:34 - 2009-04-19 08:34 - 00070176 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nv_common.dll 2009-04-19 08:34 - 2009-04-19 08:34 - 00578080 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\SpecialCase.dll 2009-04-19 08:34 - 2009-04-19 08:34 - 00207904 _____ () C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe 2014-04-14 09:15 - 2013-08-14 14:22 - 00045504 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\apps\ComputerSecurity\Anti-Virus\FSAVHRES.eng 2013-05-15 16:05 - 2013-05-15 16:05 - 00220096 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\daas2.dll 2014-10-07 17:14 - 2014-10-07 17:14 - 00374272 _____ () C:\Users\Pawel\AppData\Roaming\HTThread\sub\default.dll 2014-04-13 17:17 - 2014-04-13 17:17 - 00593464 _____ () C:\Windows\WinSxS\x86_f-secure.qt_4_6_2_2e112a926211c0a3_4.6.482.65_none_b59e1e0911fd55ab\QtMultimediaKit1.dll 2014-04-14 09:15 - 2013-08-14 14:22 - 00056256 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\apps\ComputerSecurity\FSGUI\fsavures.eng 2014-08-05 19:32 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll 2014-04-14 09:19 - 2014-04-14 09:19 - 00030888 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\apps\ComputerSecurity\Anti-Virus\minifilter\hashlib_x86.dll 2014-04-14 09:15 - 2014-04-14 09:19 - 00212008 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\apps\ComputerSecurity\Spam Control\fsas.dll 2014-04-14 09:15 - 2014-05-21 12:05 - 00949288 _____ () C:\Program Files (x86)\Pakiet Bezpieczenstwa UPC\apps\ComputerSecurity\Anti-Virus\fm4av.dll 2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL 2014-10-19 13:58 - 2014-10-19 13:58 - 03649648 _____ () D:\Program Files\Mozilla Firefox\mozjs.dll 2014-09-11 22:45 - 2014-09-11 22:45 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" MSCONFIG\startupreg: TP-LINK USB Printer Controller => D:\Program Files (x86)\TP-LINK\USB Printer Controller\USB Printer Controller.exe -mini MSCONFIG\startupreg: XFastUSB => "C:\Program Files (x86)\XFastUSB\XFastUsb.exe" ========================= Accounts: ========================== Administrator (S-1-5-21-4003311287-3242459109-815560048-500 - Administrator - Disabled) Guest (S-1-5-21-4003311287-3242459109-815560048-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-4003311287-3242459109-815560048-1002 - Limited - Enabled) Pawel (S-1-5-21-4003311287-3242459109-815560048-1001 - Administrator - Enabled) => C:\Users\Pawel ==================== Faulty Device Manager Devices ============= Name: AODDriver4.2.0 Description: AODDriver4.2.0 Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: AODDriver4.2.0 Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Teredo Tunneling Pseudo-Interface Description: Karta tunelowania Teredo firmy Microsoft Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Microsoft Service: tunnel Problem: : This device cannot start. (Code10) Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device. On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (10/19/2014 01:44:39 PM) (Source: FSecure-FSecure-F-Secure Anti-Virus) (EventID: 103) (User: ) Description: 1 2014-10-19 13:44:39+02:00 PAWEL-PC Pawel-PC\Pawel F-Secure Anti-Virus Spyware detected: Type: adware Family: Name: Adware.SwiftBrowse.BF Object: C:\Windows\System32\drivers\wStLibG64.sys Error: (10/16/2014 08:34:48 PM) (Source: FSecure-FSecure-F-Secure Anti-Virus) (EventID: 103) (User: ) Description: 1 2014-10-16 20:34:48+02:00 PAWEL-PC SYSTEM F-Secure Anti-Virus Spyware detected: Type: adware Family: Name: Adware.SwiftBrowse.BF Object: C:\Windows\System32\drivers\wStLibG64.sys Error: (10/15/2014 04:39:08 PM) (Source: FSecure-FSecure-F-Secure Anti-Virus) (EventID: 103) (User: ) Description: 1 2014-10-15 16:39:08+02:00 PAWEL-PC Pawel-PC\Pawel F-Secure Anti-Virus Malicious code found in file D:\Program Files (x86)\WarThunder\aces.exe. Infection: Worm.Generic.522044 Action: The file was renamed. Error: (10/15/2014 04:19:20 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: Program firefox.exe w wersji 32.0.3.5379 zatrzymał interakcję z systemem Windows i został zamknięty. Aby zobaczyć, czy jest dostępnych więcej informacji dotyczących tego problemu, sprawdź historię problemu w panelu sterowania Centrum akcji. Identyfikator procesu: 1254 Godzina rozpoczęcia: 01cfe87dd71ae285 Godzina zakończenia: 15 Ścieżka aplikacji: D:\Program Files\Mozilla Firefox\firefox.exe Identyfikator raportu: 3642b0a4-5476-11e4-92d8-0015831861ee Error: (10/12/2014 10:27:02 AM) (Source: Application Error) (EventID: 1000) (User: ) Description: Nazwa aplikacji powodującej błąd: plugin-container.exe, wersja: 32.0.3.5379, sygnatura czasowa: 0x54224e6b Nazwa modułu powodującego błąd: mozalloc.dll, wersja: 32.0.3.5379, sygnatura czasowa: 0x54221b67 Kod wyjątku: 0x80000003 Przesunięcie błędu: 0x0000141b Identyfikator procesu powodującego błąd: 0xaa4 Godzina uruchomienia aplikacji powodującej błąd: 0xplugin-container.exe0 Ścieżka aplikacji powodującej błąd: plugin-container.exe1 Ścieżka modułu powodującego błąd: plugin-container.exe2 Identyfikator raportu: plugin-container.exe3 System errors: ============= Error: (10/19/2014 01:47:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/18/2014 10:19:34 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/17/2014 09:39:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/16/2014 09:40:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/16/2014 08:55:07 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Instalacja nie powiodła się: system Windows nie mógł zainstalować następującej aktualizacji, ponieważ wystąpił błąd 0x80242016: Update for Windows 7 for x64-based Systems (KB2952664). Error: (10/16/2014 08:52:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/16/2014 08:49:10 PM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1000) (User: NT AUTHORITY) Description: Inicjacja klienta CBS nie powiodła się. Ostatni błąd: 0x8007045b Error: (10/16/2014 08:48:33 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Error: (10/16/2014 08:43:42 PM) (Source: Service Control Manager) (EventID: 7043) (User: ) Description: Usługa Group Policy Client nie została poprawnie zamknięta po odebraniu kodu sterującego przed zamknięciem. Error: (10/15/2014 09:02:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: Nie można uruchomić usługi AODDriver4.2.0 z powodu następującego błędu: %%2 Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2014-10-11 16:33:57.149 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-10-11 16:33:56.790 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume1\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Processor: AMD Athlon(tm) II X3 445 Processor Percentage of memory in use: 51% Total physical RAM: 4095.3 MB Available physical RAM: 1984.38 MB Total Pagefile: 8188.79 MB Available Pagefile: 5449.25 MB Total Virtual: 8192 MB Available Virtual: 8191.79 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:488.28 GB) (Free:436.13 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive d: (Nowy) (Fixed) (Total:976.56 GB) (Free:829.49 GB) NTFS Drive e: (Nowy) (Fixed) (Total:398.16 GB) (Free:89.22 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 05EA05E9) Partition 1: (Active) - (Size=488.3 GB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=1374.7 GB) - (Type=OF Extended) ==================== End Of Log ============================