Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by Bartek (administrator) on BARTEK-PC on 23-10-2014 16:32:18
Running from C:\Users\Bartek\Desktop
Loaded Profile: Bartek (Available profiles: Bartek)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Foxit Corporation) C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ovislink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ovislink\Common\RaRegistry64.exe
() C:\Program Files (x86)\AdvanceElite\updateAdvanceElite.exe
() C:\Program Files (x86)\AdvanceElite\bin\tmp8AA4.tmp
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Ovislink Corp.) C:\Program Files (x86)\Ovislink\Common\AirLiveUI.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\Framed Display\bin\utilFramedDisplay.exe
() C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe
() C:\Program Files (x86)\AdvanceElite\bin\AdvanceElite.PurBrowse64.exe
() C:\Program Files (x86)\Framed Display\bin\FramedDisplay.PurBrowse64.exe
() C:\Program Files (x86)\AdvanceElite\bin\AdvanceElite.BrowserAdapter.exe
() C:\Program Files (x86)\AdvanceElite\bin\AdvanceElite.BrowserAdapter64.exe
() C:\Program Files (x86)\Framed Display\bin\FramedDisplay.BrowserAdapter.exe
() C:\Program Files (x86)\Framed Display\bin\FramedDisplay.BrowserAdapter64.exe
() C:\Program Files (x86)\AdvanceElite\bin\AdvanceElite.BOASHelper.exe
() C:\Program Files (x86)\Framed Display\bin\FramedDisplay.BOASHelper.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
() C:\Program Files (x86)\Opera\25.0.1614.50\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\25.0.1614.50\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11464296 2010-09-03] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-10-03] (AVAST Software)
HKU\S-1-5-21-892155775-1604218965-3713751438-1000\...\MountPoints2: F - F:\LGAutoRun.exe
HKU\S-1-5-21-892155775-1604218965-3713751438-1000\...\MountPoints2: {205b39b1-aea2-11e3-b6c2-001fd0520f16} - G:\LGAutoRun.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AirLive 802.11G Wireless Utility.lnk
ShortcutTarget: AirLive 802.11G Wireless Utility.lnk -> C:\Program Files (x86)\Ovislink\Common\AirLiveUI.exe (Ovislink Corp.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Bartek\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141013
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120141013
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=sc&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2&q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Framed Display -> {05b5ef3f-4c6a-426e-b77e-48ebb3e721f1} -> C:\Program Files (x86)\Framed Display\FramedDisplaybho.dll (Framed Display)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: BitComet Helper -> {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} -> C:\Program Files\BitComet\tools\BitCometBHO_1.5.4.11.dll (BitComet)
BHO-x32: AdvanceElite -> {3b2cb4c8-72ab-4b25-8fa1-219b36a60bed} -> C:\Program Files (x86)\AdvanceElite\AdvanceElitebho.dll (AdvanceElite)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Tcpip\Parameters: [DhcpNameServer] 79.139.112.1 91.123.160.5

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-12-29]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2
CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1413218903&from=cor&uid=ST3160815A_9RA8BQE2XXXX9RA8BQE2"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\38.0.2125.104\pdf.dll ()
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
CHR Profile: C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-29]
CHR Extension: (Dysk Google) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-29]
CHR Extension: (YouTube) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-29]
CHR Extension: (Szukaj w Google) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-29]
CHR Extension: (Framed Display) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gagcbogmgkaogoadfcoicjdojbmkegao [2014-10-21]
CHR Extension: (Avast Online Security) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-10-10]
CHR Extension: (Google Wallet) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-29]
CHR Extension: (Gmail) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-29]
CHR Extension: (AdvanceElite) - C:\Users\Bartek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkbbmldjcnhopjhpifcocnmkooiadpbb [2014-10-21]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-10-03]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.) [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-10-03] (AVAST Software)
S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2010-12-28] (www.BitComet.com)
R2 FoxitCloudUpdateService; C:\Program Files (x86)\Foxit Software\Foxit Reader\Foxit Cloud\FCUpdateService.exe [242728 2014-07-01] (Foxit Corporation)
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [705416 2014-09-24] (Cherished Technololgy LIMITED)
R2 RalinkRegistryWriter; C:\Program Files (x86)\Ovislink\Common\RaRegistry.exe [185632 2009-12-15] (Ralink Technology, Corp.)
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ovislink\Common\RaRegistry64.exe [212256 2009-12-15] (Ralink Technology, Corp.)
R2 Update AdvanceElite; C:\Program Files (x86)\AdvanceElite\updateAdvanceElite.exe [524016 2014-10-22] ()
R2 Update Framed Display; C:\Program Files (x86)\Framed Display\updateFramedDisplay.exe [524024 2014-10-23] ()
R2 Util AdvanceElite; C:\Program Files (x86)\AdvanceElite\bin\utilAdvanceElite.exe [523504 2014-10-23] ()
R2 Util Framed Display; C:\Program Files (x86)\Framed Display\bin\utilFramedDisplay.exe [524024 2014-10-23] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2012-07-03] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2012-07-03] (LG Electronics Inc.)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-10-03] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-10-03] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-10-03] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-10-03] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-10-03] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-03] (AVAST Software)
S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-10-03] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-10-03] ()
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 {00aec75d-051f-41a9-9837-e94ac4f56303}Gw64; C:\Windows\System32\drivers\{00aec75d-051f-41a9-9837-e94ac4f56303}Gw64.sys [48784 2014-10-15] (StdLib)
R1 {02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64; C:\Windows\System32\drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys [48784 2014-10-17] (StdLib)
R1 {1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64; C:\Windows\System32\drivers\{1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64.sys [48784 2014-10-13] (StdLib)
R1 {3b808196-ff63-49ee-b33b-efdf51723eca}Gw64; C:\Windows\System32\drivers\{3b808196-ff63-49ee-b33b-efdf51723eca}Gw64.sys [48784 2014-10-13] (StdLib)
R1 {3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64; C:\Windows\System32\drivers\{3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64.sys [48784 2014-10-18] (StdLib)
R1 {4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64; C:\Windows\System32\drivers\{4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64.sys [48784 2014-10-14] (StdLib)
R1 {4530e639-76ab-4435-889d-a5e81ae090a4}Gw64; C:\Windows\System32\drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys [48784 2014-10-20] (StdLib)
R1 {46a147d8-5171-42d8-b8a8-6a187525781d}Gw64; C:\Windows\System32\drivers\{46a147d8-5171-42d8-b8a8-6a187525781d}Gw64.sys [48784 2014-10-15] (StdLib)
R1 {5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64; C:\Windows\System32\drivers\{5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64.sys [48784 2014-10-17] (StdLib)
R1 {67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64; C:\Windows\System32\drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys [48784 2014-10-20] (StdLib)
R1 {6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64; C:\Windows\System32\drivers\{6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64.sys [48784 2014-10-19] (StdLib)
R1 {7012eec1-4f37-42d4-a2cd-26727494d248}Gw64; C:\Windows\System32\drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys [48792 2014-10-13] (StdLib)
R1 {733fb217-c049-41ba-9504-3f2045e61977}Gw64; C:\Windows\System32\drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys [48784 2014-10-21] (StdLib)
R1 {949aba83-1d7f-4d0b-b0ba-203450825231}Gw64; C:\Windows\System32\drivers\{949aba83-1d7f-4d0b-b0ba-203450825231}Gw64.sys [48784 2014-10-16] (StdLib)
R1 {a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64; C:\Windows\System32\drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys [48792 2014-10-22] (StdLib)
R1 {dc592624-f532-4311-9fc7-6920126fc404}Gw64; C:\Windows\System32\drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys [48784 2014-10-22] (StdLib)
R1 {f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64; C:\Windows\System32\drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys [48784 2014-10-22] (StdLib)
R1 {fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64; C:\Windows\System32\drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys [48784 2014-10-18] (StdLib)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
U3 ufdiipow; \??\C:\Users\Bartek\AppData\Local\Temp\ufdiipow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 16:32 - 2014-10-23 16:32 - 00020827 _____ () C:\Users\Bartek\Desktop\FRST.txt
2014-10-23 16:30 - 2014-10-23 16:30 - 00306659 _____ () C:\Users\Bartek\Desktop\gmer.log
2014-10-23 15:58 - 2014-10-23 15:58 - 00037680 _____ () C:\Users\Bartek\Desktop\Extras.Txt
2014-10-23 15:56 - 2014-10-23 15:56 - 00089894 _____ () C:\Users\Bartek\Desktop\OTL.Txt
2014-10-23 15:45 - 2014-10-23 16:32 - 00000000 ____D () C:\FRST
2014-10-23 15:22 - 2014-10-23 15:22 - 00380416 _____ () C:\Users\Bartek\Desktop\0o8gtfvh.exe
2014-10-23 15:13 - 2014-10-23 15:13 - 00602112 _____ (OldTimer Tools) C:\Users\Bartek\Desktop\OTL.exe
2014-10-23 15:12 - 2014-10-23 15:13 - 02112000 _____ (Farbar) C:\Users\Bartek\Desktop\FRST64.exe
2014-10-23 10:14 - 2014-10-22 22:33 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{a6762132-8e80-4305-b1ba-2bec91757ac2}Gw64.sys
2014-10-23 10:14 - 2014-10-22 22:33 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{f5d136d7-adc2-4c84-85b2-e564334ab0bc}Gw64.sys
2014-10-22 12:02 - 2014-10-22 01:31 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{dc592624-f532-4311-9fc7-6920126fc404}Gw64.sys
2014-10-21 21:50 - 2014-10-21 22:44 - 328898848 _____ () C:\Users\Bartek\Desktop\Prawo Cywilne.rar
2014-10-21 21:43 - 2014-10-21 12:00 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{733fb217-c049-41ba-9504-3f2045e61977}Gw64.sys
2014-10-21 21:37 - 2014-10-21 21:37 - 00000000 ____D () C:\ProgramData\374311380
2014-10-21 08:12 - 2014-10-20 22:09 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{4530e639-76ab-4435-889d-a5e81ae090a4}Gw64.sys
2014-10-20 17:02 - 2014-10-20 01:04 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{67f29abb-07b3-41f5-94cd-f819d7c1fc76}Gw64.sys
2014-10-19 22:01 - 2014-10-19 11:09 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{6c84eb28-66c4-4e3d-8a5a-46ab94f0575a}Gw64.sys
2014-10-19 10:57 - 2014-10-19 11:45 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-10-19 10:57 - 2014-10-19 10:57 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-10-19 10:57 - 2014-10-19 10:57 - 00000000 _____ () C:\autoexec.bat
2014-10-19 10:56 - 2014-10-19 11:45 - 00000000 ____D () C:\Windows\1F7E4FF9D2E542589AE1E16E6CB3252A.TMP
2014-10-19 10:47 - 2014-10-18 21:17 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{fce396ae-d8d1-4789-946e-2106fbe4292b}Gw64.sys
2014-10-18 10:58 - 2014-10-18 19:36 - 00000000 ____D () C:\Users\Bartek\Desktop\New folder (2)
2014-10-18 10:23 - 2014-10-18 00:12 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{3fa44d1f-c300-4673-a8c1-5ba05468b4bd}Gw64.sys
2014-10-17 19:34 - 2014-10-17 10:07 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{02bbe9df-d3b0-43f4-8dcb-e24500d3308f}Gw64.sys
2014-10-17 13:26 - 2014-10-17 03:02 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{5d78e0ee-ca60-46a4-9492-4f24429cc925}Gw64.sys
2014-10-16 15:43 - 2014-10-16 06:24 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{949aba83-1d7f-4d0b-b0ba-203450825231}Gw64.sys
2014-10-16 06:52 - 2014-10-15 15:29 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{46a147d8-5171-42d8-b8a8-6a187525781d}Gw64.sys
2014-10-15 19:56 - 2014-10-15 20:03 - 00000000 ____D () C:\Users\Bartek\Desktop\New folder
2014-10-15 14:30 - 2014-10-15 04:46 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{00aec75d-051f-41a9-9837-e94ac4f56303}Gw64.sys
2014-10-15 08:10 - 2014-10-14 22:09 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{4096aedf-3f28-4c8e-aebe-00255138fa8a}Gw64.sys
2014-10-15 08:08 - 2014-10-15 08:08 - 00000258 __RSH () C:\ProgramData\ntuser.pol
2014-10-14 12:14 - 2014-10-13 12:52 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{1de2a23f-1c23-4ea1-8ef4-79bc5c5cea78}Gw64.sys
2014-10-13 20:54 - 2014-10-13 21:10 - 00049666 _____ () C:\Users\Bartek\Documents\1.odt
2014-10-13 19:57 - 2014-10-13 03:05 - 00048792 _____ (StdLib) C:\Windows\system32\Drivers\{7012eec1-4f37-42d4-a2cd-26727494d248}Gw64.sys
2014-10-13 19:57 - 2014-10-13 03:05 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{3b808196-ff63-49ee-b33b-efdf51723eca}Gw64.sys
2014-10-13 19:28 - 2014-10-13 19:28 - 00000000 ____D () C:\Users\Public\Documents\sun
2014-10-13 19:23 - 2014-10-13 19:23 - 131579802 _____ () C:\Users\Bartek\Downloads\Apache_OpenOffice_4.1.1_Win_x86_install_pl.exe
2014-10-13 18:52 - 2014-10-21 08:13 - 00000000 ____D () C:\Program Files (x86)\SupTab
2014-10-13 18:52 - 2014-10-13 18:53 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-10-13 18:52 - 2014-10-13 18:52 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\SupTab
2014-10-13 18:49 - 2014-10-13 18:49 - 00000000 ____D () C:\Users\Bartek\Documents\Optimizer Pro
2014-10-13 18:48 - 2014-10-23 15:49 - 00000000 ____D () C:\Program Files (x86)\AdvanceElite
2014-10-13 18:48 - 2014-10-13 18:48 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\sweet-page
2014-10-13 18:47 - 2014-10-23 15:49 - 00000000 ____D () C:\Program Files (x86)\Framed Display
2014-10-13 18:46 - 2014-10-21 21:39 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\Systweak
2014-10-13 18:46 - 2014-08-29 17:02 - 00020296 _____ () C:\Windows\system32\roboot64.exe
2014-10-13 18:44 - 2014-10-21 21:37 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro
2014-10-03 20:15 - 2014-10-03 20:15 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-10-03 20:15 - 2014-10-03 20:15 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\DropboxMaster
2014-10-03 20:14 - 2014-10-03 20:15 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\Dropbox
2014-10-03 20:08 - 2014-10-03 20:08 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\AVAST Software
2014-10-03 20:07 - 2014-10-14 12:03 - 00170956 _____ () C:\Windows\PFRO.log
2014-10-03 15:07 - 2014-10-03 15:07 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-10-03 15:07 - 2014-10-03 15:07 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-10-03 15:07 - 2014-10-03 15:07 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 16:00 - 2013-12-29 14:09 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-23 13:58 - 2009-07-14 04:34 - 00000505 _____ () C:\Windows\win.ini
2014-10-23 12:00 - 2013-12-29 14:09 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-23 10:10 - 2013-12-29 13:04 - 01527419 _____ () C:\Windows\WindowsUpdate.log
2014-10-23 10:06 - 2014-05-26 06:30 - 00023082 _____ () C:\Windows\setupact.log
2014-10-23 10:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-22 19:35 - 2013-12-29 13:44 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\AIMP3
2014-10-22 19:14 - 2013-12-29 13:35 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-10-22 18:23 - 2013-12-30 00:01 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\GG
2014-10-20 15:09 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-16 06:58 - 2014-06-03 13:29 - 00003874 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1388317007
2014-10-16 06:58 - 2013-12-29 13:36 - 00000000 ____D () C:\Program Files (x86)\Opera
2014-10-14 20:16 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2014-10-14 12:03 - 2009-07-14 06:45 - 00292904 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-13 21:34 - 2013-12-29 13:32 - 00063568 _____ () C:\Users\Bartek\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-13 18:48 - 2013-12-29 13:10 - 00001631 _____ () C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-13 18:48 - 2013-12-29 13:10 - 00001609 _____ () C:\Users\Bartek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-10-09 21:42 - 2013-12-30 00:01 - 00000000 ____D () C:\Users\Bartek\AppData\Local\GG
2014-10-04 07:42 - 2013-12-29 13:43 - 00000000 ____D () C:\Users\Bartek\AppData\Roaming\BitComet
2014-10-03 20:18 - 2013-12-29 13:35 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-10-03 15:07 - 2013-12-29 13:35 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-10-03 15:07 - 2013-12-29 13:35 - 00307344 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-10-03 15:07 - 2013-12-29 13:35 - 00224896 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-10-03 15:07 - 2013-12-29 13:35 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-10-03 15:07 - 2013-12-29 13:35 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-10-03 15:07 - 2013-12-29 13:35 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-10-03 14:58 - 2013-12-29 13:34 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-10-03 14:56 - 2013-12-29 13:35 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-10-02 16:47 - 2009-07-14 07:08 - 00032608 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Some content of TEMP:
====================
C:\Users\Bartek\AppData\Local\Temp\Checkupdate.exe
C:\Users\Bartek\AppData\Local\Temp\drm_dialogs.dll
C:\Users\Bartek\AppData\Local\Temp\drm_dyndata_7390006.dll
C:\Users\Bartek\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpeazu5h.dll
C:\Users\Bartek\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Bartek\AppData\Local\Temp\gcapi_dll.dll
C:\Users\Bartek\AppData\Local\Temp\ggdrive-menu.exe
C:\Users\Bartek\AppData\Local\Temp\ggdrive-overlay.exe
C:\Users\Bartek\AppData\Local\Temp\gtapi_signed.dll
C:\Users\Bartek\AppData\Local\Temp\ICReinstall_Malavida_Download_Manager.exe
C:\Users\Bartek\AppData\Local\Temp\installstats.exe
C:\Users\Bartek\AppData\Local\Temp\optprosetup.exe
C:\Users\Bartek\AppData\Local\Temp\SHSetup.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-16 16:18

==================== End Of Log ============================