Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 15-04-2015 04
Ran by Błysku (administrator) on BLYSKU-KOMPUTER on 17-04-2015 10:52:34
Running from C:\Users\Błysku\Desktop
Loaded Profiles: Błysku & Blysku (Available profiles: Błysku & Blysku)
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Polski (Polska)
Internet Explorer Version 10 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Lenovo (Beijing) Limited) C:\Program Files\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files\Lenovo\Energy Management\utility.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Lenovo (Beijing) Limited) C:\Program Files\Lenovo\Energy Management\Energy Management.exe
(Lenovo(beijing) Limited) C:\Program Files\Lenovo\Energy Management\utility.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Energy Management] => C:\Program Files\Lenovo\Energy Management\Energy Management.exe [8943520 2010-12-06] (Lenovo (Beijing) Limited)
HKLM\...\Run: [EnergyUtility] => C:\Program Files\Lenovo\Energy Management\Utility.exe [5117856 2010-12-13] (Lenovo(beijing) Limited)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5227648 2015-03-30] (AVAST Software)
HKU\S-1-5-21-859423121-132849420-3883132106-1000\...\Run: [GG] => C:\Users\Błysku\AppData\Local\GG\Application\gghub.exe [4023872 2015-02-12] (GG Network S.A.)
HKU\S-1-5-21-859423121-132849420-3883132106-1000\...\MountPoints2: {cb66f308-7fc5-11e4-97fe-001eecc2abac} - F:\start.exe
HKU\S-1-5-21-859423121-132849420-3883132106-1001\...\MountPoints2: {cb66f308-7fc5-11e4-97fe-001eecc2abac} - F:\start.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-859423121-132849420-3883132106-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
HKU\S-1-5-21-859423121-132849420-3883132106-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKU\S-1-5-21-859423121-132849420-3883132106-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2011-06-12] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-02-19] (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll [2014-12-09] (AVAST Software)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-02-19] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:
========
FF ProfilePath: C:\Users\Błysku\AppData\Roaming\Mozilla\Firefox\Profiles\58b5g16a.default-1425892031010
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-19] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-19] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: No Name - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-09]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-09]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-09] (AVAST Software)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ACPIVPC; C:\Windows\System32\DRIVERS\AcpiVpc.sys [23136 2010-10-25] (Lenovo Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-12-09] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [70384 2014-12-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-12-09] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-12-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [787800 2014-12-09] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423784 2014-12-09] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [91496 2014-12-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [206248 2014-12-09] ()
R0 LHDmgr; C:\Windows\System32\DRIVERS\LhdX86.sys [32352 2010-01-15] (Lenovo.)
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 10:52 - 2015-04-17 10:53 - 00008432 _____ () C:\Users\Błysku\Desktop\FRST.txt
2015-04-15 07:26 - 2015-04-15 10:55 - 00000000 ____D () C:\Users\Blysku\Desktop\soccerplaner
2015-04-08 13:04 - 2015-04-08 13:04 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-04-04 16:02 - 2015-04-04 16:02 - 00000000 ____D () C:\Users\Blysku\AppData\Roaming\OpenFM
2015-03-21 09:01 - 2015-03-21 09:01 - 00001111 _____ () C:\Users\Blysku\Desktop\Angry Birds Breakfast 1.lnk
2015-03-21 09:01 - 2015-03-21 09:01 - 00000000 ____D () C:\Users\Blysku\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Angry Birds Breakfast 1
2015-03-21 09:01 - 2015-03-21 09:01 - 00000000 ____D () C:\Users\Blysku\AppData\Roaming\com.rovio.AngryBirdsBreakfast1
2015-03-21 09:01 - 2015-03-21 09:01 - 00000000 ____D () C:\Users\Blysku\AppData\Roaming\Angry Birds Breakfast 1

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-17 10:52 - 2015-02-19 12:52 - 00000000 ____D () C:\FRST
2015-04-17 10:49 - 2015-03-09 11:05 - 00000000 ____D () C:\Users\Błysku\Desktop\FRST-OlderVersion
2015-04-17 10:49 - 2015-02-23 12:01 - 01137152 _____ (Farbar) C:\Users\Błysku\Desktop\FRST.exe
2015-04-17 10:48 - 2015-02-19 20:00 - 00000000 ____D () C:\Users\Błysku\AppData\Roaming\GG
2015-04-17 10:45 - 2009-07-14 06:34 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-17 10:45 - 2009-07-14 06:34 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-17 10:42 - 2011-04-12 07:08 - 00737480 _____ () C:\Windows\system32\perfh015.dat
2015-04-17 10:42 - 2011-04-12 07:08 - 00154136 _____ () C:\Windows\system32\perfc015.dat
2015-04-17 10:42 - 2010-11-20 23:01 - 01661232 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-17 10:41 - 2014-12-09 15:27 - 01573823 _____ () C:\Windows\WindowsUpdate.log
2015-04-17 10:38 - 2015-02-19 14:44 - 00006926 _____ () C:\Windows\setupact.log
2015-04-17 10:38 - 2014-12-09 19:49 - 00151552 _____ () C:\Windows\KMSEmulator.exe
2015-04-17 10:38 - 2014-12-09 19:49 - 00000292 _____ () C:\Windows\Tasks\AutoKMS.job
2015-04-17 10:38 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-17 10:13 - 2014-12-09 16:44 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-17 09:13 - 2014-12-09 16:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-17 09:13 - 2014-12-09 16:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-11 10:08 - 2014-12-10 14:45 - 00000000 ____D () C:\Users\Blysku\Documents\FIFA 12
2015-04-08 20:02 - 2015-01-21 12:59 - 00000000 ____D () C:\Users\Blysku\Desktop\KursPAKiS
2015-04-08 18:56 - 2015-03-09 10:50 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2015-04-04 16:02 - 2015-02-18 11:10 - 00000000 ____D () C:\Users\Blysku\AppData\Local\OpenFM
2015-04-04 11:36 - 2015-01-17 13:15 - 00000000 ____D () C:\Users\Blysku\AppData\Local\Crazy Chicken Tales
2015-03-21 09:01 - 2014-12-12 10:31 - 00000000 ____D () C:\Users\Blysku\AppData\Roaming\Rovio Entertainment Ltd

==================== Files in the root of some directories =======

2015-01-17 10:57 - 2015-01-17 10:57 - 0001138 _____ () C:\Program Files\MoorHuhnKartThunder.lnk

Some content of TEMP:
====================
C:\Users\Błysku\AppData\Local\Temp\ggdrive-menu.exe
C:\Users\Błysku\AppData\Local\Temp\ggdrive-overlay.exe
C:\Users\Błysku\AppData\Local\Temp\installstats.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 19:15

==================== End Of Log ============================