Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015 Ran by Dorota (administrator) on DOROTA-PC on 07-01-2015 17:56:40 Running from C:\Users\Dorota\Desktop Loaded Profile: Dorota (Available profiles: Dorota) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files\WinZipper\winzipersvc.exe (AVG Secure Search) C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\loggingserver.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe () C:\Program Files\AVG SafeGuard toolbar\vprot.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Valve Corporation) C:\Program Files\Steam\Steam.exe (PriceMeter) C:\Users\Dorota\AppData\Local\PriceMeter\pricemeterw.exe (ALLPlayer Group Ltd.) C:\Program Files\ALLPlayer Remote\ALLPlayerRemoteControl.exe (GG Network S.A.) C:\Users\Dorota\AppData\Local\GG\Application\gghub.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe ( ) C:\Program Files\ChomikBox\chomikbox.exe () C:\Program Files\DigiHelp\bin\utilDigiHelp.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (GG Network S.A.) C:\Users\Dorota\AppData\Local\GG\Application\ggapp.exe () C:\Program Files\DigiHelp\bin\DigiHelp.BrowserAdapter.exe () C:\Program Files\DigiHelp\bin\DigiHelp.PurBrowse.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Valve Corporation) C:\Program Files\Steam\bin\steamwebhelper.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe () C:\Program Files\Opera\26.0.1656.60\opera_crashreporter.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe () C:\Program Files\DigiHelp\updateDigiHelp.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642304 2013-04-29] (Advanced Micro Devices, Inc.) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-07] (AVAST Software) HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AdobeCS5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated) HKLM\...\Run: [fst_pl_127] => [X] HKLM\...\Run: [vProt] => C:\Program Files\AVG SafeGuard toolbar\vprot.exe [2640408 2014-08-31] () HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [Steam] => C:\Program Files\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ALLUpdate] => C:\Program Files\ALLPlayer\ALLUpdate.exe [3510704 2014-04-17] (ALLPlayer Group Ltd.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [PriceMeterW] => C:\Users\Dorota\AppData\Local\PriceMeter\pricemeterw.exe [287232 2014-05-04] (PriceMeter) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ALLPlayer WiFi Remote] => C:\Program Files\ALLPlayer Remote\ALLPlayerRemoteControl.exe [5052800 2014-01-31] (ALLPlayer Group Ltd.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [GG] => C:\Users\Dorota\AppData\Local\GG\Application\gghub.exe [4023360 2014-12-02] (GG Network S.A.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ChomikBox] => C:\Program Files\ChomikBox\chomikbox.exe [6033408 2014-03-11] ( ) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\MountPoints2: {141b1043-ecc9-11e3-a7c5-002215f2ecb7} - E:\setup.exe AppInit_DLLs: C:\PROGRA~1\SupTab\SEARCH~1.DLL => C:\Program Files\SupTab\SearchProtect32.dll [91248 2014-05-08] (Skytech Co., Ltd.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.qone8.com/web/?type=ds&ts=1402162438&from=tt4u&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.qone8.com/web/?type=ds&ts=1402162438&from=tt4u&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.delta-homes.com/?type=hp&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?type=hp&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://start.qone8.com/?type=sc&ts=1402162438&from=tt4u&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.qone8.com/web/?type=ds&ts=1402162438&from=tt4u&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.qone8.com/web/?type=ds&ts=1402162438&from=tt4u&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} SearchScopes: HKU\S-1-5-21-1113750723-2783305751-3862205039-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} SearchScopes: HKU\S-1-5-21-1113750723-2783305751-3862205039-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84&q={searchTerms} SearchScopes: HKU\S-1-5-21-1113750723-2783305751-3862205039-1000 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={DE289BFE-EFC6-4173-8DB3-5012550C5C4C}&mid=b4acfa79299247d2bc4ed16b53160544-6d6a121b0d2c7c6e45c51db57f8bd774ff757963&lang=en&ds=px011&coid=avgtbdispx&cmpid=&pr=sa&d=2014-06-19 10:56:34&v=18.1.9.799&pid=safeguard&sg=&sap=dsp&q={searchTerms} BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: DigiHelp 1.0.0.6 -> {5bee7be9-df29-4c14-a18e-2bdd06205e29} -> C:\Program Files\DigiHelp\DigiHelpBHO.dll (DigiHelp) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) Toolbar: HKLM - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG SafeGuard toolbar\18.1.9.799\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search) Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.9\ViProtocol.dll (AVG Secure Search) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_206.dll () FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.9\\npsitesafety.dll No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-1113750723-2783305751-3862205039-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Dorota\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-05-01] Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.114\pdf.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Profile: C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-01] CHR Extension: (Google Drive) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-01] CHR Extension: (YouTube) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-01] CHR Extension: (Google Search) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-01] CHR Extension: (DigiHelp) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\memgfpjkclkffgjbbigbgilbjgjogghh [2014-12-16] CHR Extension: (Google Wallet) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-01] CHR Extension: (Security Protection) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh [2014-12-29] CHR Extension: (Quick start) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-06-07] CHR Extension: (Gmail) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-01] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-01] CHR HKLM\...\Chrome\Extension: [noajmlkipclmeolfcnflkjhijkigpfjh] - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\noajmlkipclmeolfcnflkjhijkigpfjh.crx [2014-12-29] CHR HKLM\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-06-07] CHR StartMenuInternet: Google Chrome - C:\Program Files\Google\Chrome\Application\chrome.exe http://www.delta-homes.com/?type=sc&ts=1419844097&from=wpm12262&uid=ST3500320AS_9QM2XW84XXXX9QM2XW84 ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-01] (AVAST Software) S3 Survarium Update Service; C:\Program Files\Survarium\game\binaries\x86\survarium_service.exe [76408 2014-12-19] () S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] R2 Update DigiHelp; C:\Program Files\DigiHelp\updateDigiHelp.exe [529128 2015-01-07] () R2 Util DigiHelp; C:\Program Files\DigiHelp\bin\utilDigiHelp.exe [529128 2015-01-07] () R2 vToolbarUpdater18.1.9; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.9\ToolbarUpdater.exe [1820184 2014-08-12] (AVG Secure Search) R2 winzipersvc; C:\Program Files\WinZipper\winzipersvc.exe [470704 2014-12-17] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-05-01] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-05-01] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [54832 2014-05-15] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-05-01] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software) R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2014-05-01] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-05-01] () R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-08-12] (AVG Technologies) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-06-05] (Disc Soft Ltd) R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [48640 2009-08-05] (Atheros Communications, Inc.) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () R1 {1fceab11-b7eb-4010-811f-3f56268f9366}t; C:\Windows\System32\drivers\{1fceab11-b7eb-4010-811f-3f56268f9366}t.sys [55816 2014-12-30] (StdLib) R1 {2b4f8230-394e-4951-9495-bafd44d837da}t; C:\Windows\System32\drivers\{2b4f8230-394e-4951-9495-bafd44d837da}t.sys [55816 2014-12-27] (StdLib) R1 {3211ae5b-d056-4176-9f6e-b51496f003f1}t; C:\Windows\System32\drivers\{3211ae5b-d056-4176-9f6e-b51496f003f1}t.sys [55816 2014-12-14] (StdLib) R1 {34cccceb-a541-48ac-a26b-92818f06439d}t; C:\Windows\System32\drivers\{34cccceb-a541-48ac-a26b-92818f06439d}t.sys [55816 2015-01-02] (StdLib) R1 {47a3b56f-80e6-4ea5-8093-7656ffd5c11a}t; C:\Windows\System32\drivers\{47a3b56f-80e6-4ea5-8093-7656ffd5c11a}t.sys [55816 2014-12-15] (StdLib) R1 {8aefbcaf-640f-4dca-9a92-ed05ee387238}t; C:\Windows\System32\drivers\{8aefbcaf-640f-4dca-9a92-ed05ee387238}t.sys [55816 2014-12-21] (StdLib) R1 {97daceee-c4d3-4ae1-975b-b77d85ce2d13}t; C:\Windows\System32\drivers\{97daceee-c4d3-4ae1-975b-b77d85ce2d13}t.sys [55816 2014-12-23] (StdLib) R1 {993baf86-643c-42e9-95e5-094f337533f0}t; C:\Windows\System32\drivers\{993baf86-643c-42e9-95e5-094f337533f0}t.sys [55816 2014-12-17] (StdLib) R1 {9eaa49e2-6918-49c4-9a04-be590dd80dc6}t; C:\Windows\System32\drivers\{9eaa49e2-6918-49c4-9a04-be590dd80dc6}t.sys [55816 2015-01-05] (StdLib) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-07 17:56 - 2015-01-07 17:58 - 00020722 _____ () C:\Users\Dorota\Desktop\FRST.txt 2015-01-07 17:56 - 2015-01-07 17:56 - 00380416 _____ () C:\Users\Dorota\Desktop\04ftki5b.exe 2015-01-07 17:55 - 2015-01-07 17:55 - 01115648 _____ (Farbar) C:\Users\Dorota\Desktop\FRST.exe 2015-01-07 17:55 - 2015-01-07 17:55 - 00602112 _____ (OldTimer Tools) C:\Users\Dorota\Desktop\OTL.exe 2015-01-06 19:44 - 2015-01-06 20:33 - 00003524 _____ () C:\Users\Dorota\Desktop\op.txt 2015-01-05 19:36 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\Dorota\Documents\Moje dzieła SPORE 2015-01-05 19:35 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\SPORE 2015-01-05 19:10 - 2015-01-05 23:18 - 00000000 ____D () C:\Users\Dorota\Desktop\spore 2015-01-05 19:06 - 2015-01-05 19:06 - 00000000 ____D () C:\Users\Dorota\Desktop\Crack 2015-01-05 19:06 - 2015-01-05 19:06 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\eCyber 2015-01-05 18:24 - 2015-01-05 06:25 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{9eaa49e2-6918-49c4-9a04-be590dd80dc6}t.sys 2015-01-04 22:19 - 2015-01-04 22:19 - 00000543 _____ () C:\Users\Public\Desktop\ChomikBox.lnk 2015-01-04 22:19 - 2015-01-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chomikuj.pl 2015-01-04 22:19 - 2015-01-04 22:19 - 00000000 ____D () C:\Program Files\ChomikBox 2015-01-04 22:15 - 2015-01-04 22:15 - 28266496 _____ () C:\Users\Dorota\Desktop\ChomikBox.msi 2015-01-02 19:21 - 2015-01-02 00:23 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{34cccceb-a541-48ac-a26b-92818f06439d}t.sys 2015-01-02 17:09 - 2015-01-02 17:29 - 154349936 _____ (Macrovision Corporation) C:\Users\Dorota\Desktop\PATCH DO SPORE v 5_1.exe 2015-01-02 17:09 - 2015-01-02 17:27 - 152634107 _____ () C:\Users\Dorota\Desktop\spore_dd_patch_all_v5_1.zip 2014-12-31 20:41 - 2014-12-31 22:14 - 00075502 _____ () C:\Users\Dorota\Desktop\Plan.odt 2014-12-31 20:41 - 2014-12-31 20:41 - 00071870 _____ () C:\Users\Dorota\Desktop\powieść.odt 2014-12-30 19:52 - 2014-12-30 07:24 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{1fceab11-b7eb-4010-811f-3f56268f9366}t.sys 2014-12-29 23:55 - 2014-12-29 23:55 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\Unity 2014-12-29 10:09 - 2015-01-07 17:45 - 00000000 ____D () C:\Program Files\WinZipper 2014-12-29 10:09 - 2015-01-05 19:06 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\WinZipper 2014-12-29 10:09 - 2014-12-29 10:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper 2014-12-29 10:08 - 2014-12-29 22:42 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2014-12-28 20:33 - 2014-12-28 20:33 - 96548610 _____ () C:\Users\Dorota\Desktop\Bez nazwy-2.psd 2014-12-28 18:44 - 2014-12-28 18:44 - 07350204 _____ () C:\Users\Dorota\Desktop\MODIS1000017.tif 2014-12-27 18:31 - 2014-12-27 01:22 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{2b4f8230-394e-4951-9495-bafd44d837da}t.sys 2014-12-26 15:38 - 2014-12-26 16:54 - 00000000 ____D () C:\Program Files\auto-clicker 2014-12-26 15:38 - 2014-12-26 15:38 - 00000792 _____ () C:\Users\Dorota\Desktop\auto-clicker.lnk 2014-12-26 15:38 - 2014-12-26 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\auto-clicker 2014-12-25 17:07 - 2014-11-01 18:00 - 04238336 _____ () C:\Users\Dorota\Desktop\Crusader Kings 2 V2.2 Steam Trainer +8 MrAntiFun.EXE 2014-12-25 16:26 - 2014-12-25 16:26 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AGOT 2014-12-25 15:17 - 2014-12-25 16:14 - 00000000 ____D () C:\Users\Dorota\Desktop\Crusader Kings II 2014-12-24 09:48 - 2014-12-23 19:25 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{97daceee-c4d3-4ae1-975b-b77d85ce2d13}t.sys 2014-12-23 21:03 - 2014-12-23 21:03 - 00741788 _____ () C:\Users\Dorota\Desktop\Wspomnienia (Wyznania) gejszy - Golden, Artur.mobi 2014-12-23 17:25 - 2014-12-23 17:26 - 00000000 ____D () C:\Users\Dorota\Desktop\Tor Browser 2014-12-23 17:19 - 2014-12-23 17:20 - 34630867 _____ () C:\Users\Dorota\Desktop\torbrowser-install-4.0.2_pl.exe 2014-12-21 22:51 - 2014-12-21 22:51 - 00002070 _____ () C:\Users\Dorota\Desktop\Skyrim (SKSE).lnk 2014-12-21 14:00 - 2014-12-21 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager 2014-12-21 10:43 - 2014-12-21 01:23 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{8aefbcaf-640f-4dca-9a92-ed05ee387238}t.sys 2014-12-20 09:11 - 2014-12-20 11:13 - 736583680 _____ () C:\Users\Dorota\Desktop\The.Hunger.Games.Catching.Fire.2013.PLSUBBED.LQ.BRRip.XviD-BiDA.avi 2014-12-19 13:10 - 2014-12-19 23:34 - 00000000 ____D () C:\Users\Dorota\Documents\Survarium 2014-12-19 13:10 - 2014-12-19 15:21 - 00000000 ____D () C:\Program Files\Survarium 2014-12-19 13:10 - 2014-12-19 13:10 - 00002081 _____ () C:\Users\Public\Desktop\Play Survarium.lnk 2014-12-19 13:10 - 2014-12-19 13:10 - 00000972 _____ () C:\Windows\certutil.log 2014-12-19 13:10 - 2014-12-19 13:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Survarium 2014-12-18 09:10 - 2014-12-17 18:25 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{993baf86-643c-42e9-95e5-094f337533f0}t.sys 2014-12-15 11:06 - 2014-12-15 00:30 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{47a3b56f-80e6-4ea5-8093-7656ffd5c11a}t.sys 2014-12-15 00:33 - 2014-12-14 11:34 - 00055816 _____ (StdLib) C:\Windows\system32\Drivers\{3211ae5b-d056-4176-9f6e-b51496f003f1}t.sys 2014-12-15 00:29 - 2014-12-15 00:29 - 00001714 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk 2014-12-15 00:29 - 2014-12-15 00:29 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\SumatraPDF 2014-12-15 00:29 - 2014-12-15 00:29 - 00000000 ____D () C:\Program Files\SumatraPDF 2014-12-15 00:27 - 2015-01-07 17:47 - 00000000 ____D () C:\Program Files\DigiHelp 2014-12-15 00:27 - 2014-12-15 00:27 - 04551776 _____ (Krzysztof Kowalczyk) C:\Users\Dorota\Downloads\SumatraPDF-3.0-install.exe 2014-12-14 13:02 - 2014-12-14 13:39 - 202878300 _____ () C:\Users\Dorota\Desktop\09 - Czwarta Siła.cbr 2014-12-09 20:31 - 2014-12-09 20:31 - 00000000 ____D () C:\ProgramData\Avg_Update_1214tb ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-08 02:00 - 2014-05-01 19:56 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Adobe 2015-01-07 17:56 - 2013-08-20 21:01 - 00000000 ____D () C:\FRST 2015-01-07 17:54 - 2006-11-02 13:52 - 01849726 _____ () C:\Windows\WindowsUpdate.log 2015-01-07 17:47 - 2014-07-31 19:39 - 00000000 ____D () C:\Users\Dorota\.gstreamer-0.10 2015-01-07 17:47 - 2006-11-02 11:23 - 00000321 _____ () C:\Windows\win.ini 2015-01-07 17:46 - 2014-05-01 22:16 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\GG 2015-01-07 17:46 - 2014-05-01 21:43 - 00000000 ____D () C:\Program Files\Steam 2015-01-07 17:46 - 2014-05-01 19:59 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-07 17:42 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-07 17:42 - 2006-11-02 13:47 - 00004752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-07 17:42 - 2006-11-02 13:47 - 00004752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-06 23:26 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-06 22:39 - 2014-05-01 19:59 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-05 19:22 - 2014-08-01 19:47 - 00000000 ____D () C:\Program Files\Electronic Arts 2015-01-05 19:20 - 2014-05-01 14:59 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-01-05 19:07 - 2014-07-31 19:36 - 00000000 ____D () C:\Users\Dorota\AppData\Local\ChomikBox 2015-01-05 18:27 - 2014-05-01 15:03 - 00000000 ____D () C:\Program Files\Opera 2014-12-29 10:08 - 2014-06-07 18:34 - 00000000 ____D () C:\ProgramData\WindowsProtectManger 2014-12-26 22:56 - 2014-06-05 18:35 - 00000132 _____ () C:\Users\Dorota\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG 2014-12-26 19:46 - 2014-05-20 20:05 - 00000000 ____D () C:\Users\Dorota\Documents\Universe Sandbox 2014-12-26 17:04 - 2014-10-29 09:59 - 00000000 ____D () C:\Users\Dorota\Desktop\zsjęcia 2014-12-26 17:02 - 2014-05-01 10:54 - 00000000 ____D () C:\Users\Dorota 2014-12-25 10:38 - 2014-05-01 10:54 - 00001356 _____ () C:\Users\Dorota\AppData\Local\d3d9caps.dat 2014-12-23 21:04 - 2014-10-15 12:24 - 00000000 ____D () C:\Users\Dorota\Documents\My Digital Editions 2014-12-23 17:24 - 2014-08-15 11:26 - 00000000 ____D () C:\Users\Dorota\Desktop\Mods 2014-12-23 17:21 - 2014-05-01 22:05 - 00000000 ____D () C:\Users\Dorota\Desktop\skyrim mody 2014-12-22 22:37 - 2014-05-02 08:20 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Skyrim 2014-12-22 22:19 - 2006-11-02 13:52 - 00026252 _____ () C:\Windows\setupact.log 2014-12-21 14:31 - 2014-05-02 07:59 - 00000000 ____D () C:\Users\Dorota\Documents\Nexus Mod Manager 2014-12-21 14:01 - 2014-05-02 07:59 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Black_Tree_Gaming 2014-12-21 14:00 - 2014-05-03 15:42 - 00000882 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2014-12-21 14:00 - 2014-05-02 08:55 - 00000000 ____D () C:\Program Files\Nexus Mod Manager 2014-12-17 03:43 - 2014-04-23 19:57 - 00773808 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll 2014-12-17 03:43 - 2014-04-23 19:57 - 00421040 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll 2014-12-16 09:50 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\GroupPolicy 2014-12-12 21:40 - 2014-05-01 19:59 - 00002163 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-09 20:33 - 2014-06-19 09:55 - 00000000 ____D () C:\Program Files\AVG SafeGuard toolbar Some content of TEMP: ==================== C:\Users\Dorota\AppData\Local\Temp\ALLRemote.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-07 17:57 ==================== End Of Log ============================