Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 08-03-2015 03
Ran by Janusz (administrator) on GLOWNY on 08-03-2015 20:19:34
Running from C:\Users\Janusz\Downloads
Loaded Profiles: Janusz (Available profiles: Janusz)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\stacsv.exe
(Hewlett-Packard) C:\Windows\System32\hpservice.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\AEstSrv.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
() C:\ProgramData\DatacardService\DCService.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_BLACHOTRAPEZ\bin\fbguard.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_BUDMAT\bin\fbguard.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_STD\bin\fbguard.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Splashtop Inc.) C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Splashtop Inc.) C:\Program Files\Splashtop\Splashtop Remote\Server\SRServer.exe
(Splashtop Inc.) C:\Program Files\Splashtop\Splashtop Software Updater\SSUService.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
() C:\Users\Janusz\AppData\Roaming\WHService\wh.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Splashtop Inc.) C:\Program Files\Splashtop\Splashtop Remote\Server\SRFeature.exe
(Kaspersky Lab ZAO) C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_STD\bin\fbserver.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_BUDMAT\bin\fbserver.exe
(Firebird Project) C:\Program Files\ZasobyPL\Firebird2_1_BLACHOTRAPEZ\bin\fbserver.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray.exe [495708 2010-03-23] (IDT, Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-02] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [InterBaseGuardian] => C:\Program Files\Borland\Interbase\\bin\ibguard.exe [22016 2000-06-23] (Inprise Corporation)
HKLM\...\Run: [AVP] => C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [206448 2012-10-29] (Kaspersky Lab ZAO)
HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] => [X]
Winlogon\Notify\klogon: C:\Windows\system32\klogon.dll (Kaspersky Lab ZAO)
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20587168 2013-11-18] (Skype Technologies S.A.)
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: G - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: H - H:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {4e0825b9-46dc-11e3-b7cf-00247e57a647} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {6f04adea-0259-11e1-972a-00247e57a647} - H:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {6f04ae06-0259-11e1-972a-001e101f4da1} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {8d9c3b05-cd3f-11e2-b2cc-001e101f57d0} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {9eabfa29-03ee-11e1-9353-001e101f9843} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {bc4dc2c7-03b8-11e1-8016-00247e57a647} - H:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {be870d38-2a75-11e3-8819-00247e57a647} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {c5081f51-748f-11e0-9f63-00247e57a647} - G:\AutoRun.exe
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\MountPoints2: {c5081f6e-748f-11e0-9f63-00247e57a647} - G:\AutoRun.exe
Startup: C:\Users\Janusz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk
ShortcutTarget: Powiadomienia monitorowania tuszu - HP Deskjet 3520 series.lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2324351772-319779767-1903044260-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://msn.gazeta.pl/msn/0,0.html?pc=UP97&ocid=UP97DHP&dt=072213
HKU\S-1-5-21-2324351772-319779767-1903044260-1000\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = http://search.babylon.com/?babsrc=HP_ss_din2g&mntrId=606C002100D1DF44&affID=119828&tt=250613_gr2&tsp=4926
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\.DEFAULT -> {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKU\S-1-5-21-2324351772-319779767-1903044260-1000 -> bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKU\S-1-5-21-2324351772-319779767-1903044260-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=606C002100D1DF44&affID=119828&tt=250613_gr2&tsp=4926
BHO: No Name -> {0025320D-4D37-4C73-9A5C-0C28F04068A3} -> C:\Users\Janusz\AppData\LocalLow\IE-BHO\bho.dll [2014-10-01] ()
BHO: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO: IEVkbdBHO Class -> {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll [2011-04-24] (Kaspersky Lab ZAO)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Pomocnik rejestracji usługi Windows Live -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22] (Microsoft Corporation)
BHO: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
BHO: delta Helper Object -> {C1AF5FA5-852C-4C90-812E-A7F75E011D87} -> C:\Program Files\Delta\delta\1.8.21.5\bh\delta.dll [2013-05-20] (Delta-search.com)
BHO: Bing Bar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-09-15] (Microsoft Corporation.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2011-04-11] (Sun Microsystems, Inc.)
BHO: FilterBHO Class -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll [2011-04-24] (Kaspersky Lab ZAO)
BHO: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll [2011-09-15] (Microsoft Corporation.)
Toolbar: HKLM - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files\Delta\delta\1.8.21.5\deltaTlbr.dll [2013-05-20] (Delta-search.com)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-10-02] (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{21FBC60C-D7C1-4A36-8B8E-B0F7E5232C50}: [NameServer] 193.41.112.14 193.41.112.18
Tcpip\..\Interfaces\{35F72109-F747-4F7F-864D-9933CC5D9F58}: [NameServer] 212.2.96.51 212.2.96.52
Tcpip\..\Interfaces\{47570A26-4ADF-4010-9F5A-90F37D8A4F88}: [NameServer] 212.2.96.51 212.2.96.52
Tcpip\..\Interfaces\{9B67A551-EB88-4DF2-B66F-2F9302D67E69}: [NameServer] 212.2.96.51 212.2.96.52
Tcpip\..\Interfaces\{9F24EE9D-5B04-4EB5-B687-72F0081999B3}: [NameServer] 212.2.96.51 212.2.96.52

FireFox:
========
FF ProfilePath: C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210
FF NewTab: hxxp://www.delta-search.com/?babsrc=NT_ss&mntrId=606C002100D1DF44&affID=119828&tt=250613_gr2&tsp=4926
FF SearchEngineOrder.1: Delta Search
FF SearchEngineOrder.3: Bing 
FF Homepage: hxxp://www.google.pl/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&dt=072213&q=
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll [2011-04-11] (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll [2014-12-11] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-04-16] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\user.js [2014-11-03]
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-04-11] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\searchplugins\babylon.xml [2013-06-27]
FF SearchPlugin: C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\searchplugins\bingp.xml [2013-07-22]
FF SearchPlugin: C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\searchplugins\BrowserDefender.xml [2013-07-22]
FF SearchPlugin: C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\searchplugins\delta.xml [2013-06-27]
FF Extension: No Name - C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\Extensions\chrome [2014-11-03]
FF Extension: MEGA - C:\Users\Janusz\AppData\Roaming\Mozilla\Firefox\Profiles\u9sah8uo.default-1358853271210\Extensions\firefox@mega.co.nz.xpi [2015-03-06]
FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2014-10-15]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-10-15]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-11-02]
FF HKLM\...\Firefox\Extensions: [linkfilter@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru
FF Extension: Kaspersky URL Advisor - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru [2011-09-30]
FF HKLM\...\Firefox\Extensions: [virtualKeyboard@kaspersky.ru] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru
FF Extension: Kaspersky Virtual Keyboard - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru [2011-09-30]
FF HKU\S-1-5-21-2324351772-319779767-1903044260-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\urladvisor.crx [2011-07-28]
CHR HKLM\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Janusz\AppData\Roaming\BabSolution\CR\Delta.crx [2013-06-27]
CHR HKLM\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\virtkbd.crx [2011-07-28]
CHR HKLM\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\ab.crx [2011-07-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AVP; C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [206448 2012-10-29] (Kaspersky Lab ZAO)
R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [249856 2010-09-29] () [File not signed]
R2 FirebirdGuardianBlachotrapez; C:\Program Files\ZasobyPL\Firebird2_1_BLACHOTRAPEZ\bin\fbguard.exe [81920 2008-02-29] (Firebird Project) [File not signed]
R2 FirebirdGuardianBUDMAT; C:\Program Files\ZasobyPL\Firebird2_1_BUDMAT\bin\fbguard.exe [81920 2008-02-29] (Firebird Project) [File not signed]
R2 FirebirdGuardianZasobyPL; C:\Program Files\ZasobyPL\Firebird2_1_STD\bin\fbguard.exe [81920 2008-02-29] (Firebird Project) [File not signed]
R3 FirebirdServerBlachotrapez; C:\Program Files\ZasobyPL\Firebird2_1_BLACHOTRAPEZ\bin\fbserver.exe [2719744 2008-02-29] (Firebird Project) [File not signed]
R3 FirebirdServerBUDMAT; C:\Program Files\ZasobyPL\Firebird2_1_BUDMAT\bin\fbserver.exe [2719744 2008-02-29] (Firebird Project) [File not signed]
R3 FirebirdServerZasobyPL; C:\Program Files\ZasobyPL\Firebird2_1_STD\bin\fbserver.exe [2719744 2008-02-29] (Firebird Project) [File not signed]
R2 HP Health Check Service; C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [126520 2010-11-15] (Hewlett-Packard Company)
S2 MSSQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2009-05-14] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2009-05-14] (Hewlett-Packard) [File not signed]
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
R2 SplashtopRemoteService; C:\Program Files\Splashtop\Splashtop Remote\Server\SRService.exe [790880 2013-10-24] (Splashtop Inc.)
R2 SSUService; C:\Program Files\Splashtop\Splashtop Software Updater\SSUService.exe [609056 2013-10-09] (Splashtop Inc.)
R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_x86_neutral_9691412ff1876250\STacSV.exe [229458 2010-03-23] (IDT, Inc.)
R2 WHService; C:\Users\Janusz\AppData\Roaming\WHService\wh.exe [628736 2014-10-15] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [65896 2013-07-25] (FTDI Ltd.)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [133208 2011-03-04] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11352 2011-03-04] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [586072 2012-10-29] (Kaspersky Lab)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [23856 2011-03-10] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [19984 2009-11-02] (Kaspersky Lab)
S3 EagleNT; \??\C:\Windows\system32\drivers\EagleNT.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 20:19 - 2015-03-08 20:20 - 00019075 _____ () C:\Users\Janusz\Downloads\FRST.txt
2015-03-08 20:19 - 2015-03-08 20:19 - 00000000 ____D () C:\FRST
2015-03-08 20:18 - 2015-03-08 20:18 - 01134592 _____ (Farbar) C:\Users\Janusz\Downloads\FRST.exe
2015-03-08 14:24 - 2015-01-29 18:58 - 00000000 ____D () C:\Users\Janusz\Desktop\Metin2-Balmora s.2
2015-03-08 13:54 - 2015-03-08 14:10 - 1066983755 _____ () C:\Users\Janusz\Desktop\BalmoraS2_29012015.rar
2015-03-08 13:23 - 2015-03-08 13:23 - 00061899 _____ () C:\Users\Janusz\Desktop\OTL.perl
2015-03-08 12:56 - 2015-03-08 12:56 - 05705064 _____ (PGWARE LLC ) C:\Users\Janusz\Downloads\superram.exe
2015-03-08 12:53 - 2015-03-08 12:56 - 09656008 _____ (Bandisoft) C:\Users\Janusz\Downloads\bdcamsetup.exe
2015-03-08 12:52 - 2015-03-08 12:52 - 00123790 _____ () C:\Users\Janusz\Desktop\OTL.Txt
2015-03-08 12:52 - 2015-03-08 12:52 - 00078978 _____ () C:\Users\Janusz\Desktop\Extras.Txt
2015-03-08 12:51 - 2015-03-08 12:51 - 01607600 _____ (WiseCleaner.com ) C:\Users\Janusz\Downloads\WFHSetup.exe
2015-03-08 12:51 - 2015-03-08 12:51 - 00078978 _____ () C:\Users\Janusz\Downloads\Extras.Txt
2015-03-08 12:50 - 2015-03-08 12:50 - 00123790 _____ () C:\Users\Janusz\Downloads\OTL.Txt
2015-03-08 12:47 - 2015-03-08 12:47 - 23615104 _____ (e-file sp. z o.o. ) C:\Users\Janusz\Downloads\setup_e-pity2014.exe
2015-03-08 12:36 - 2015-03-08 12:37 - 00602112 _____ (OldTimer Tools) C:\Users\Janusz\Downloads\OTL.exe
2015-03-06 19:59 - 2015-03-06 20:04 - 121832491 _____ (Balmora.pl) C:\Users\Janusz\Downloads\balmora_s2.exe.part
2015-03-06 13:20 - 2015-03-06 14:04 - 00000000 ____D () C:\rei
2015-03-06 13:20 - 2015-03-06 14:04 - 00000000 ____D () C:\Program Files\Reimage
2015-03-06 13:20 - 2015-03-06 13:24 - 00000000 ____D () C:\ProgramData\Reimage Protector
2015-03-06 12:08 - 2015-03-06 12:08 - 00000000 _____ () C:\Users\Janusz\Desktop\Nowy dokument tekstowy.txt
2015-02-21 12:57 - 2015-02-22 20:39 - 00000000 ____D () C:\Users\Janusz\Desktop\Nowy folder (2)
2015-02-21 11:17 - 2015-03-06 14:48 - 00000000 ___RD () C:\Users\Janusz\Nikolcia
2015-02-20 19:48 - 2015-02-20 19:48 - 00000000 __SHD () C:\Users\Janusz\AppData\Local\EmieBrowserModeList
2015-02-11 19:25 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-11 19:25 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-11 01:27 - 2015-01-15 08:46 - 00136640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 01:27 - 2015-01-15 08:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 01:27 - 2015-01-15 08:43 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 01:27 - 2015-01-15 08:43 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 01:27 - 2015-01-15 08:42 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 01:27 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 01:27 - 2015-01-15 08:42 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 01:27 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 01:27 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 01:27 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 01:27 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 01:27 - 2015-01-15 05:21 - 00369968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 01:27 - 2015-01-09 02:45 - 02380288 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 01:26 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-02-11 01:26 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 01:26 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 01:26 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 01:26 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 01:26 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 01:26 - 2015-01-12 03:21 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 01:26 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 01:26 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 01:26 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 01:26 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 01:26 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 01:26 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 01:26 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 01:26 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 01:26 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 01:26 - 2015-01-12 02:55 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 01:26 - 2015-01-12 02:48 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 01:26 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 01:26 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 01:26 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 01:26 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 01:26 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 01:26 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 01:26 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 01:26 - 2015-01-12 02:23 - 00684544 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 01:26 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 01:26 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 01:26 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 01:26 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 01:26 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 01:26 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 01:26 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-08 20:18 - 2010-09-11 16:18 - 01328964 _____ () C:\Windows\WindowsUpdate.log
2015-03-08 20:17 - 2012-12-17 12:41 - 00000000 ____D () C:\Users\Janusz\AppData\Roaming\Skype
2015-03-08 20:16 - 2010-09-11 17:06 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-03-08 20:15 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-08 20:14 - 2009-07-14 05:39 - 00638858 _____ () C:\Windows\setupact.log
2015-03-08 16:47 - 2012-10-12 08:13 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-08 15:15 - 2009-07-14 05:34 - 00013440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-08 15:15 - 2009-07-14 05:34 - 00013440 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-07 21:17 - 2013-12-24 20:40 - 00000000 ____D () C:\Users\Janusz\AppData\Roaming\Metin2-Balmora
2015-03-06 14:49 - 2010-09-11 16:24 - 00000000 ____D () C:\Users\Janusz
2015-03-06 14:49 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\wfp
2015-03-06 14:48 - 2010-09-22 08:36 - 00000000 ____D () C:\Users\Janusz\AppData\Local\Hewlett-Packard
2015-03-06 14:48 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2015-03-06 14:48 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\registration
2015-03-06 14:48 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\AppCompat
2015-03-06 11:31 - 2010-09-11 16:26 - 01680500 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-06 11:31 - 2009-07-14 09:07 - 00744854 _____ () C:\Windows\system32\perfh015.dat
2015-03-06 11:31 - 2009-07-14 09:07 - 00152446 _____ () C:\Windows\system32\perfc015.dat
2015-03-05 20:35 - 2010-11-24 09:41 - 00000324 _____ () C:\Windows\Tasks\HPCeeScheduleForJanusz.job
2015-03-02 10:50 - 2013-04-04 11:01 - 00000000 ____D () C:\Users\Janusz\Desktop\Skany
2015-02-27 19:16 - 2010-09-13 07:29 - 00000000 ____D () C:\ProgramData\Temp
2015-02-24 03:23 - 2010-09-11 16:55 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-11 03:30 - 2009-07-14 05:33 - 00417136 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-11 03:27 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\pl-PL
2015-02-11 03:06 - 2013-07-17 16:16 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 03:06 - 2010-09-11 17:00 - 113756392 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 03:05 - 2010-09-11 16:59 - 00000000 ____D () C:\ProgramData\Microsoft Help

==================== Files in the root of some directories =======

2010-12-30 11:49 - 2013-06-27 10:11 - 0001849 _____ () C:\Users\Janusz\AppData\Roaming\GhostObjGAFix.xml
2011-11-30 15:30 - 2013-06-11 08:35 - 0013030 _____ () C:\Users\Janusz\AppData\Local\PDOXUSRS.NET
2011-09-30 09:49 - 2011-09-30 09:50 - 0017408 _____ () C:\Users\Janusz\AppData\Local\WebpageIcons.db
2013-02-20 11:21 - 2013-02-20 11:21 - 0000057 _____ () C:\ProgramData\Ament.ini
2010-09-13 09:10 - 2010-11-02 15:00 - 0001141 _____ () C:\ProgramData\hpzinstall.log

Some content of TEMP:
====================
C:\Users\Janusz\AppData\Local\Temp\clp1.exe
C:\Users\Janusz\AppData\Local\Temp\firefoxjre_exe.exe
C:\Users\Janusz\AppData\Local\Temp\FP_PL_PFS_INSTALLER-1.exe
C:\Users\Janusz\AppData\Local\Temp\FP_PL_PFS_INSTALLER.exe
C:\Users\Janusz\AppData\Local\Temp\Fx6_FF_IE_Setup-Stonic-poland.exe
C:\Users\Janusz\AppData\Local\Temp\gveumnnm.dll
C:\Users\Janusz\AppData\Local\Temp\hrtlib.dll
C:\Users\Janusz\AppData\Local\Temp\setupa2.exe
C:\Users\Janusz\AppData\Local\Temp\SetupAC.exe
C:\Users\Janusz\AppData\Local\Temp\silent.exe
C:\Users\Janusz\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Janusz\AppData\Local\Temp\sp50843.exe.exe
C:\Users\Janusz\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Janusz\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Janusz\AppData\Local\Temp\uninst1.exe
C:\Users\Janusz\AppData\Local\Temp\UninstallHPTCA.exe
C:\Users\Janusz\AppData\Local\Temp\_is15C1.exe
C:\Users\Janusz\AppData\Local\Temp\_is49DB.exe
C:\Users\Janusz\AppData\Local\Temp\_is5D6C.exe
C:\Users\Janusz\AppData\Local\Temp\_is67A7.exe
C:\Users\Janusz\AppData\Local\Temp\_is9F1.exe
C:\Users\Janusz\AppData\Local\Temp\_isD548.exe
C:\Users\Janusz\AppData\Local\Temp\_isF3D0.exe
C:\Users\Janusz\AppData\Local\Temp\_isF4B.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 19:44

==================== End Of Log ============================