Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-01-2015
Ran by Sylwester Sobkowiak (administrator) on SOBKOWIAK on 22-01-2015 10:16:28
Running from Z:\T.Tomala
Loaded Profiles: Sylwester Sobkowiak (Available profiles: Sylwester Sobkowiak & Iga)
Platform: Microsoft® Windows Vista™ Business  Service Pack 2 (X86) OS Language: Polski (Polska)
Internet Explorer Version 9 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(American Power Conversion Corporation) C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
() C:\LAB-EL\LBX\bin\lbxdnt.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Fujitsu Siemens Computers) C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Windows Mail\WinMail.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Farbar) \\serwer\Udostepniony\T.Tomala\FRST.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\MountPoints2: {93f8ba75-e0bd-11df-aa00-0019994c5304} - E:\urDrive.exe
HKU\S-1-5-21-4057883698-1414104491-491510895-1000\...\MountPoints2: {9ba5e0d5-47b5-11df-847e-0019994c5304} - F:\LaunchU3.exe -a
HKU\S-1-5-18\...\Run: [Google Update] => C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2014-02-10] (Google Inc.)
Startup: C:\Users\Sylwester Sobkowiak\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk
ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk -> C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKU\S-1-5-21-4057883698-1414104491-491510895-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
SearchScopes: HKU\S-1-5-21-4057883698-1414104491-491510895-1000 -> {A10AD535-E267-425B-A265-F8DCA7C8D738} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=3 -> C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKU\.DEFAULT: @tools.google.com/Google Update;version=9 -> C:\Windows\system32\config\systemprofile\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

Chrome: 
=======
CHR HomePage: Default -> 
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Sylwester Sobkowiak\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Wallet) - C:\Users\Sylwester Sobkowiak\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-04]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 APC UPS Service; C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe [689408 2007-07-19] (American Power Conversion Corporation)
S3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 lbxd; C:\LAB-EL\LBX\bin\lbxdnt.exe [12288 2013-08-27] () [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
S3 PLFlash DeviceIoControl Service; C:\Windows\system32\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 TestHandler; C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe [303104 2008-04-25] (Fujitsu Siemens Computers) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 BrPar; C:\Windows\System32\drivers\BrPar.sys [19537 2000-07-24] (Brother Industries Ltd.) [File not signed]
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [38400 2009-10-12] (Samsung Electronics Co., Ltd.) [File not signed]
R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k6032.sys [197800 2009-12-10] (Intel Corporation)
S4 oxpar; C:\Windows\system32\drivers\oxpar.sys [80128 2007-01-24] (OEM)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2009-10-12] (Samsung Electronics) [File not signed]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-22 10:10 - 2015-01-22 10:11 - 00000884 _____ () C:\zoek-results.log
2015-01-22 10:09 - 2015-01-22 10:11 - 00000000 ____D () C:\zoek_backup
2015-01-22 10:09 - 2015-01-22 10:09 - 01295360 _____ () C:\Users\Sylwester Sobkowiak\Downloads\zoek.exe
2015-01-22 10:02 - 2015-01-22 10:02 - 00000000 ____D () C:\Program Files\Windows Defender
2015-01-07 09:24 - 2015-01-07 09:24 - 04187592 _____ (Kaspersky Lab ZAO) C:\Users\Sylwester Sobkowiak\Downloads\tdsskiller.exe
2014-12-23 10:30 - 2014-12-23 10:30 - 00147264 _____ () C:\Windows\Minidump\Mini122314-01.dmp
2014-12-23 10:07 - 2014-12-23 10:07 - 01114112 _____ (Farbar) C:\Users\Sylwester Sobkowiak\Downloads\FRST.exe
2014-12-23 10:07 - 2014-12-23 10:07 - 00602112 _____ (OldTimer Tools) C:\Users\Sylwester Sobkowiak\Downloads\OTL.exe
2014-12-23 10:07 - 2014-12-23 10:07 - 00380416 _____ () C:\Users\Sylwester Sobkowiak\Downloads\3cc8bxcp.exe
2014-12-23 09:37 - 2014-12-23 09:31 - 00000471 _____ () C:\Users\Sylwester Sobkowiak\Desktop\lbx.LB486.100.key
2014-12-23 08:08 - 2014-12-23 08:08 - 00000000 _____ () C:\Users\Sylwester Sobkowiak\Desktop\Nowy dokument tekstowy.txt
2014-12-23 07:47 - 2014-12-23 07:47 - 00001561 _____ () C:\Users\Public\Desktop\LBX.lnk
2014-12-23 07:47 - 2014-12-23 07:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LAB-EL LBX
2014-12-23 07:46 - 2014-12-23 07:46 - 00000000 ____D () C:\Users\Sylwester Sobkowiak\Desktop\Nowy folde3r
2014-12-23 07:39 - 2015-01-15 11:01 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-23 07:39 - 2014-12-23 07:39 - 00000905 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-12-23 07:39 - 2014-12-23 07:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-23 07:39 - 2014-12-23 07:39 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-12-23 07:39 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-23 07:39 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-23 07:39 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-23 07:32 - 2014-12-23 07:32 - 00000000 ____D () C:\Users\Sylwester Sobkowiak\Desktop\backup

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-22 10:16 - 2014-12-02 07:22 - 00000000 ____D () C:\FRST
2015-01-22 10:15 - 2010-06-02 12:21 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-22 10:13 - 2011-07-29 06:02 - 00000454 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{5C715285-0C41-4E61-BC0D-C03F3902D05C}.job
2015-01-22 10:02 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\pl-PL
2015-01-22 09:48 - 2014-02-10 11:43 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-18UA.job
2015-01-22 08:52 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-22 08:52 - 2006-11-02 13:47 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-22 07:15 - 2014-10-21 05:55 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cfeceb423b1e10.job
2015-01-22 06:59 - 2014-11-13 11:14 - 00666629 _____ () C:\Windows\WindowsUpdate.log
2015-01-22 06:57 - 2013-04-08 06:46 - 01627632 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-22 06:57 - 2008-04-14 22:18 - 00707140 _____ () C:\Windows\system32\perfh015.dat
2015-01-22 06:57 - 2008-04-14 22:18 - 00149392 _____ () C:\Windows\system32\perfc015.dat
2015-01-22 06:53 - 2010-06-02 12:21 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-22 06:52 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-21 15:22 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-01-21 11:48 - 2014-02-10 11:43 - 00001060 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-18Core.job
2015-01-21 08:29 - 2013-09-18 10:46 - 00000678 _____ () C:\Windows\BRCALIB.INI
2015-01-16 12:57 - 2008-11-05 13:53 - 00000069 _____ () C:\Windows\NeroDigital.ini
2015-01-16 12:16 - 2014-05-26 13:35 - 00001983 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-01-16 06:55 - 2014-11-13 11:46 - 00079092 _____ () C:\Windows\PFRO.log
2014-12-23 10:30 - 2014-12-01 08:44 - 381178489 _____ () C:\Windows\MEMORY.DMP
2014-12-23 10:30 - 2013-04-19 08:30 - 00000000 ____D () C:\Windows\Minidump
2014-12-23 10:01 - 2008-11-05 12:34 - 00000000 ____D () C:\Users\Sylwester Sobkowiak
2014-12-23 07:58 - 2014-11-13 11:47 - 00011878 _____ () C:\Windows\setupact.log

==================== Files in the root of some directories =======
2012-01-04 08:54 - 2012-01-04 08:54 - 0030941 _____ () C:\Users\Sylwester Sobkowiak\AppData\Roaming\UserTile.png
2013-09-13 10:17 - 2014-11-13 07:27 - 0000308 _____ () C:\Users\Sylwester Sobkowiak\AppData\Roaming\WB.CFG
2008-11-05 15:59 - 2014-11-25 13:54 - 0017920 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2009-11-19 09:46 - 2009-11-19 09:46 - 0000600 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\PUTTY.RND
2011-03-02 10:59 - 2011-03-02 10:59 - 0002170 _____ () C:\Users\Sylwester Sobkowiak\AppData\Local\unins000.dat
2012-05-18 06:20 - 2012-05-18 06:25 - 0000358 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\lbxkeycheck.exe
C:\Users\Sylwester Sobkowiak\AppData\Local\Temp\vcredist_x86.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-22 06:58

==================== End Of Log ============================