Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-02-2015 01
Ran by Admin (administrator) on FERRARI on 12-02-2015 09:20:54
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin (Available profiles: Admin & Tadeusz)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKWCtlx64.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\TotalProtection\AVKBackup\AVKBackupService.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(G Data Software AG) C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFwSvcx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe
(Sony) C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Creative Technology Ltd.) C:\Windows\V0610Mon.exe
(G Data Software AG) C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe
() C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanionInfo.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [V0610Mon.exe] => C:\Windows\V0610Mon.exe [24576 2011-08-22] (Creative Technology Ltd.)
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [G Data ASM] => C:\Program Files (x86)\G Data\TotalProtection\DelayLoader\AutorunDelayLoader.exe [431224 2013-12-19] (G Data Software AG)
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\...\Run: [Sony PC Companion] => C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe [466144 2014-11-27] (Sony)
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30872168 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = 
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = 
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3550082035-2878343640-584771193-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 62.179.1.60 62.179.1.61

FireFox:
========
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM -> C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.pl/ig
CHR StartupUrls: Default -> "hxxp://www.google.com/ig/redirectdomain?brand=SVEA&bmod=SVEA", "hxxp://www.google.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-10-18]
CHR Extension: (Szukaj w Google) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-10-18]
CHR Extension: (Bubble Translate) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlhlebbhengjlhmcjebbkambaekglhkf [2013-10-18]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-10-18]
CHR Extension: (Hover Zoom) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nonjdcjchghhkdoolnlbekcfllmednbl [2013-10-18]
CHR Extension: (Gmail) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-10-18]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\TotalProtection\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG)
R2 GDBackupSvc; C:\Program Files (x86)\G Data\TotalProtection\AVKBackup\AVKBackupService.exe [3844216 2014-08-21] (G Data Software AG)
R3 GDFwSvc; C:\Program Files (x86)\G Data\TotalProtection\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
S3 GDTunerSvc; C:\Program Files (x86)\G Data\TotalProtection\AVKTuner\AVKTunerService.exe [1637496 2014-05-28] (G Data Software AG)
S3 TSNxGService; C:\Program Files (x86)\G Data\TotalProtection\TSNxG\TSNxGService.exe [255608 2014-07-01] (G DATA Software)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-08-03] (VIA Technologies, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 amdkmdap; C:\Windows\System32\DRIVERS\atikmpag.sys [359936 2013-04-30] (Advanced Micro Devices, Inc.) [File not signed]
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW76.sys [96256 2013-07-05] (Advanced Micro Devices) [File not signed]
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [13896 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-30] (G Data Software AG)
R3 gddcd; C:\Windows\system32\drivers\gddcd64.sys [79872 2014-10-14] (G Data Software AG)
R1 gddcv; C:\Windows\system32\drivers\gddcv64.sys [59904 2014-10-14] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2015-01-20] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-10-14] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-30] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2015-02-07] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-04-25] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-30] (G Data Software AG)
S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [115240 2008-05-16] (MCCI Corporation)
S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [19496 2008-05-16] (MCCI Corporation)
S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [158760 2008-05-16] (MCCI Corporation)
S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [137256 2008-05-16] (MCCI Corporation)
S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [34344 2008-05-16] (MCCI Corporation)
S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [136744 2008-05-16] (MCCI Corporation)
S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [151592 2008-05-16] (MCCI Corporation)
R0 TS4NT; C:\Windows\System32\Drivers\TS4nt.sys [98760 2015-02-07] (G Data Software)
R1 UimBus; C:\Windows\System32\DRIVERS\UimBus.sys [102664 2014-11-24] ()
R1 Uim_DEVIM; C:\Windows\System32\DRIVERS\uim_devim.sys [25992 2014-11-24] ()
R1 Uim_IM; C:\Windows\System32\DRIVERS\uim_im.sys [700680 2014-11-24] ()
R3 V0610Vid; C:\Windows\System32\DRIVERS\V0610Vid.sys [323136 2011-09-01] (Creative Technology Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 09:20 - 2015-02-12 09:21 - 00012463 _____ () C:\Users\Admin\Desktop\FRST.txt
2015-02-12 08:58 - 2015-02-11 16:49 - 02134016 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2015-02-11 19:42 - 2015-02-11 19:42 - 02134016 _____ (Farbar) C:\Users\Tadeusz\Desktop\FRST64 (1).exe
2015-02-11 17:37 - 2015-02-11 16:54 - 00022458 _____ () C:\Users\Tadeusz\Desktop\Addition.txt
2015-02-11 17:37 - 2015-02-11 16:52 - 00036898 _____ () C:\Users\Tadeusz\Desktop\FRST.txt
2015-02-11 16:51 - 2015-02-12 09:20 - 00000000 ____D () C:\FRST
2015-02-11 13:10 - 2015-02-11 13:10 - 00001213 _____ () C:\Users\Public\Desktop\EasyBCD 2.2.lnk
2015-02-11 13:10 - 2015-02-11 13:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NeoSmart Technologies
2015-02-11 06:11 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 06:11 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 06:11 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 06:11 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 06:11 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 06:11 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 06:11 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 06:11 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 06:11 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 06:11 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 06:11 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 06:11 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 06:11 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 06:11 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 06:11 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 06:11 - 2015-01-12 03:33 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-11 06:11 - 2015-01-12 03:32 - 06041088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-11 06:11 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 06:11 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 06:11 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 06:11 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 06:11 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 06:11 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 06:11 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 06:11 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 06:11 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 06:11 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 06:11 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 06:11 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 06:11 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 06:11 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 06:11 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 06:11 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 06:11 - 2015-01-12 02:55 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-11 06:11 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 06:11 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 06:11 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 06:11 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 06:11 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 06:11 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 06:11 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 06:11 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 06:11 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 06:11 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 06:11 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 06:11 - 2015-01-12 02:29 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 06:11 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 06:11 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 06:11 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 06:11 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 06:11 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 06:11 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 06:11 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 06:11 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 06:11 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 06:11 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 06:10 - 2015-01-12 04:13 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 06:10 - 2015-01-12 04:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 06:10 - 2015-01-12 03:47 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 06:10 - 2015-01-12 03:47 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 06:10 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 06:10 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 06:10 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 06:10 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 06:10 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 06:10 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 06:10 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 06:09 - 2015-01-12 04:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 06:09 - 2015-01-12 04:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 06:09 - 2015-01-12 03:45 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-10 16:05 - 2015-02-10 16:05 - 00000000 ____D () C:\Users\Admin\Downloads\Dowcipy
2015-02-10 08:43 - 2015-02-10 08:43 - 00000000 _____ () C:\Users\Admin\defogger_reenable
2015-02-10 08:39 - 2015-02-10 08:39 - 00246544 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTD2inst-v202-x86.exe
2015-02-10 08:39 - 2015-02-10 08:39 - 00003142 _____ () C:\Windows\System32\Tasks\{E30DBFBA-537F-4288-A3F7-3FD4DF584E68}
2015-02-10 08:38 - 2015-02-10 08:38 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTDinst-v187-x64 (4).exe
2015-02-10 08:35 - 2015-02-10 08:35 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTDinst-v187-x64 (3).exe
2015-02-10 08:35 - 2015-02-10 08:35 - 00294160 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTD2inst-v202-x64 (2).exe
2015-02-10 08:33 - 2015-02-10 08:33 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTDinst-v187-x64 (2).exe
2015-02-10 08:33 - 2015-02-10 08:33 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTDinst-v187-x64 (1).exe
2015-02-10 08:33 - 2015-02-10 08:33 - 00294160 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTD2inst-v202-x64 (1).exe
2015-02-10 08:30 - 2015-02-11 13:17 - 00003870 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423553433
2015-02-10 08:30 - 2015-02-11 13:17 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-02-10 08:30 - 2015-02-10 08:30 - 00001135 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-02-10 08:30 - 2015-02-10 08:30 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Opera Software
2015-02-10 08:30 - 2015-02-10 08:30 - 00000000 ____D () C:\Users\Admin\AppData\Local\Opera Software
2015-02-10 07:55 - 2015-02-10 07:55 - 00294160 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTD2inst-v202-x64.exe
2015-02-10 07:54 - 2015-02-10 07:54 - 00619688 _____ (Duplex Secure Ltd) C:\Users\Admin\Downloads\SPTDinst-v187-x64.exe
2015-02-09 15:03 - 2015-02-09 15:03 - 00024153 _____ () C:\ComboFix.txt
2015-02-09 14:48 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-02-09 14:48 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-02-09 14:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-02-09 14:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-02-09 14:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-02-09 14:48 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-02-09 14:48 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-02-09 14:48 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-02-09 14:46 - 2015-02-09 15:03 - 00000000 ____D () C:\Qoobox
2015-02-09 14:43 - 2015-02-09 14:59 - 00000000 ____D () C:\Windows\erdnt
2015-02-09 13:22 - 2015-02-09 13:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-09 10:43 - 2015-02-09 10:43 - 00000000 ____D () C:\Users\Tadeusz\AppData\Roaming\Mozilla
2015-02-07 18:40 - 2015-02-07 18:40 - 00000000 ____D () C:\ProgramData\launcher
2015-02-07 18:40 - 2015-02-07 18:40 - 00000000 ____D () C:\ProgramData\explauncher
2015-02-07 18:39 - 2015-02-07 18:39 - 00002350 _____ () C:\Users\Public\Desktop\Paragon Hard Disk Manager™ 15 Suite.lnk
2015-02-07 18:39 - 2015-02-07 18:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_blockmounter_01_09_00.Wdf
2015-02-07 18:39 - 2015-02-07 18:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paragon Hard Disk Manager™ 15 Suite
2015-02-07 18:38 - 2015-02-07 18:38 - 00000000 ____D () C:\Program Files\Paragon Software
2015-02-07 18:29 - 2015-02-07 18:29 - 00000000 __SHD () C:\Users\Admin\AppData\Local\EmieUserList
2015-02-07 18:29 - 2015-02-07 18:29 - 00000000 __SHD () C:\Users\Admin\AppData\Local\EmieSiteList
2015-02-07 18:29 - 2015-02-07 18:29 - 00000000 __SHD () C:\Users\Admin\AppData\Local\EmieBrowserModeList
2015-02-07 16:06 - 2015-02-07 16:06 - 00000000 ____D () C:\Users\Admin\AppData\Local\NeoSmart_Technologies
2015-02-07 14:21 - 2015-02-07 14:22 - 222249050 _____ () C:\Users\Admin\Documents\Kopia rejestru 07-02-2015.reg
2015-02-07 13:39 - 2015-02-07 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\G DATA TOTAL PROTECTION
2015-02-01 08:33 - 2015-02-01 08:33 - 00000000 ____D () C:\$SysReset
2015-01-31 07:31 - 2015-02-11 13:13 - 00024576 _____ () C:\Users\Admin\Documents\EasyBCD Backup (2015-01-31).bcd
2015-01-31 07:31 - 2015-02-11 13:10 - 00000000 ____D () C:\Program Files (x86)\NeoSmart Technologies
2015-01-27 15:35 - 2015-01-27 15:35 - 00000000 ____D () C:\Users\Admin\AppData\Local\Skype
2015-01-27 14:26 - 2015-01-27 14:44 - 4155508736 _____ () C:\Users\Tadeusz\Downloads\Windows10_TechnicalPreview_x64_PL-PL_9926.iso
2015-01-24 07:15 - 2015-01-24 07:15 - 00000000 __SHD () C:\Users\Tadeusz\AppData\Local\EmieBrowserModeList
2015-01-20 07:07 - 2015-02-11 16:28 - 00004090 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1421734039
2015-01-20 07:07 - 2015-01-20 07:07 - 00001239 _____ () C:\Users\Tadeusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2015-01-20 07:07 - 2015-01-20 07:07 - 00000000 ____D () C:\Users\Tadeusz\AppData\Roaming\Opera Software
2015-01-20 07:07 - 2015-01-20 07:07 - 00000000 ____D () C:\Users\Tadeusz\AppData\Local\Opera Software
2015-01-20 07:05 - 2015-01-20 07:05 - 00683472 _____ (Opera Software) C:\Users\Tadeusz\Downloads\Opera_NI_stable.exe
2015-01-14 09:35 - 2015-01-14 09:35 - 00000000 ____D () C:\Users\Tadeusz\AppData\Local\HP
2015-01-14 08:37 - 2015-01-14 08:37 - 00003486 _____ () C:\Windows\System32\Tasks\HP Deskjet 2050 J510 series.exe_{833C6AE2-B7D3-4281-9C6A-FF73F0C59724}
2015-01-14 08:37 - 2015-01-14 08:37 - 00002984 _____ () C:\Windows\System32\Tasks\HPCustPartic.exe_{CF06C799-5451-41A4-BD66-798A21A5AC13}
2015-01-14 08:35 - 2015-01-14 08:35 - 00002912 _____ () C:\Windows\System32\Tasks\Toolbox.exe_{7C24517E-973D-4D3D-A1E5-50A77BA559AF}
2015-01-14 08:34 - 2015-01-14 08:34 - 00000057 _____ () C:\ProgramData\Ament.ini
2015-01-14 08:32 - 2015-01-14 08:32 - 00000000 ____D () C:\Users\Admin\AppData\Local\HP
2015-01-14 08:30 - 2015-01-14 08:34 - 00000000 ____D () C:\ProgramData\HP
2015-01-14 08:28 - 2015-01-14 08:28 - 07169624 _____ () C:\Users\Tadeusz\Desktop\HPPSdr.exe
2015-01-14 07:05 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 07:05 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 07:05 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 07:05 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 07:05 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 07:05 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-12 09:18 - 2013-10-18 10:57 - 01856750 _____ () C:\Windows\WindowsUpdate.log
2015-02-12 09:15 - 2013-11-24 11:12 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Skype
2015-02-12 09:15 - 2013-10-18 11:32 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-12 09:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-12 09:15 - 2009-07-14 05:51 - 00367403 _____ () C:\Windows\setupact.log
2015-02-12 09:09 - 2009-07-14 05:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-12 09:09 - 2009-07-14 05:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-12 09:08 - 2013-10-18 11:32 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-12 08:54 - 2013-11-20 17:30 - 00000000 ____D () C:\Users\Tadeusz\AppData\Roaming\Skype
2015-02-12 08:42 - 2014-03-03 08:19 - 00001066 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3550082035-2878343640-584771193-1001UA.job
2015-02-12 08:01 - 2013-10-18 14:53 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-12 04:53 - 2014-05-11 07:20 - 00017333 _____ () C:\Users\Tadeusz\Documents\Waga ciała.ods
2015-02-11 13:55 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-11 06:52 - 2013-10-18 12:05 - 00000000 ___RD () C:\Users\Tadeusz
2015-02-11 06:52 - 2013-10-18 11:05 - 00000000 ____D () C:\Users\Admin
2015-02-11 06:30 - 2013-11-24 11:46 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-10 14:15 - 2011-04-12 14:21 - 00740098 _____ () C:\Windows\system32\perfh015.dat
2015-02-10 14:15 - 2011-04-12 14:21 - 00155672 _____ () C:\Windows\system32\perfc015.dat
2015-02-10 14:15 - 2009-07-14 06:13 - 01669190 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-10 11:42 - 2013-10-23 07:31 - 00025720 _____ () C:\Users\Tadeusz\Documents\Wydatki miesięczne.ods
2015-02-09 21:05 - 2013-11-25 18:46 - 00000000 ____D () C:\#GDATA.Trash.Store#
2015-02-09 15:12 - 2010-11-21 04:47 - 00171724 _____ () C:\Windows\PFRO.log
2015-02-09 15:03 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-02-09 14:58 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-09 13:03 - 2013-10-18 11:32 - 00004044 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-09 13:03 - 2013-10-18 11:32 - 00003792 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-09 11:09 - 2013-10-18 11:21 - 00000000 ____D () C:\Program Files (x86)\Gigabyte
2015-02-09 11:07 - 2013-10-18 11:21 - 00002607 _____ () C:\service.log
2015-02-09 10:42 - 2014-03-03 08:19 - 00001014 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3550082035-2878343640-584771193-1001Core.job
2015-02-09 10:37 - 2014-03-03 08:19 - 00004040 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3550082035-2878343640-584771193-1001UA
2015-02-09 10:37 - 2014-03-03 08:19 - 00003644 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3550082035-2878343640-584771193-1001Core
2015-02-09 10:15 - 2013-11-26 08:42 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-02-07 18:35 - 2013-10-18 14:53 - 00000000 ____D () C:\Users\Admin\AppData\Local\Downloaded Installations
2015-02-07 13:57 - 2013-10-18 13:40 - 00000000 ____D () C:\Program Files (x86)\Sony
2015-02-07 13:56 - 2014-03-16 06:56 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-02-07 13:50 - 2013-11-24 12:02 - 01640860 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-02-07 13:39 - 2014-10-14 05:42 - 00001971 _____ () C:\Users\Public\Desktop\G DATA TOTAL PROTECTION.lnk
2015-02-07 13:39 - 2013-10-18 11:37 - 00098760 _____ (G Data Software) C:\Windows\system32\Drivers\TS4nt.sys
2015-02-07 13:39 - 2013-10-18 11:37 - 00064512 _____ (G Data Software AG) C:\Windows\system32\Drivers\gdwfpcd64.sys
2015-02-01 09:59 - 2014-05-28 10:19 - 00002026 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2015-02-01 09:59 - 2013-10-18 13:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2015-02-01 09:59 - 2013-10-18 11:10 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-02-01 09:26 - 2014-05-06 19:13 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-01 09:26 - 2013-11-03 18:31 - 00000000 ____D () C:\Users\Tadeusz\AppData\Local\Nero
2015-02-01 09:26 - 2011-04-12 14:32 - 00000000 ____D () C:\Windows\ShellNew
2015-02-01 09:26 - 2011-04-12 14:32 - 00000000 ____D () C:\Program Files\Windows Journal
2015-02-01 09:26 - 2009-07-14 04:20 - 00000000 __RSD () C:\Windows\Media
2015-02-01 09:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\L2Schemas
2015-02-01 09:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\Cursors
2015-02-01 09:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2015-02-01 09:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2015-02-01 09:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-01 08:33 - 2013-10-18 11:05 - 00000000 ____D () C:\Recovery
2015-01-24 07:26 - 2014-10-24 08:37 - 00000000 ____D () C:\Users\Tadeusz\Documents\AntyPO
2015-01-20 06:54 - 2014-04-25 10:28 - 00020992 _____ (G Data Software AG) C:\Windows\system32\Drivers\GDKBFlt64.sys
2015-01-14 15:17 - 2013-11-24 11:14 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-14 15:09 - 2013-11-24 11:14 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-14 09:32 - 2013-10-18 12:06 - 00000000 ____D () C:\Users\Tadeusz\AppData\Local\VirtualStore
2015-01-14 08:32 - 2013-10-18 12:13 - 00064024 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT

==================== Files in the root of some directories =======

2014-07-07 08:58 - 2014-07-07 08:58 - 0003178 _____ () C:\Users\Admin\AppData\Local\unins000.dat
2014-07-07 08:58 - 2014-07-07 08:58 - 0011761 _____ () C:\Users\Admin\AppData\Local\unins000.msg
2015-01-14 08:34 - 2015-01-14 08:34 - 0000057 _____ () C:\ProgramData\Ament.ini

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-09 16:06

==================== End Of Log ============================