Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-04-2015 01 Ran by Robert (administrator) on ROBERT-PC on 18-04-2015 15:46:09 Running from D:\Użytki\Wir_2015 Loaded Profiles: Robert (Available profiles: Robert) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English (United States) Internet Explorer Version 9 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe (Agere Systems) C:\Windows\System32\agrsmsvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (TOSHIBA CORPORATION) C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (TOSHIBA) C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (SafeNet Inc.) C:\Windows\System32\hasplms.exe () C:\ProgramData\DatacardService\HWDeviceService.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe (pdfforge GmbH) C:\Program Files\PDF Architect\HelperService.exe (pdfforge GmbH) C:\Program Files\PDF Architect\ConversionService.exe () C:\Toshiba\IVP\ISM\pinger.exe () C:\Toshiba\IVP\swupdate\swupdtmr.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA CORPORATION) C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (Ulead Systems, Inc.) C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_17_0_0_169_ActiveX.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe () C:\Users\Robert\Desktop\gmer.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [180224 2006-09-12] (Alps Electric Co., Ltd.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4444160 2007-04-25] (Realtek Semiconductor) HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [411192 2007-03-29] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [538744 2007-04-27] (TOSHIBA Corporation) HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [726320 2015-04-10] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated) HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM\...\Run: [Avira Systray] => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\Run: [TOSCDSPD] => C:\Program Files\TOSHIBA\TOSCDSPD\TOSCDSPD.exe [417792 2007-01-22] (TOSHIBA) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\RunOnce: [Adobe Speed Launcher] => 1429292406 HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {4a9c0996-4914-11e3-ae2a-001b381e2405} - G:\Startme.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {5a0ef322-11d0-11e4-a313-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {5a0ef334-11d0-11e4-a313-001b381e2405} - H:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {a4d18fcf-e1c3-11e3-959e-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {c72db925-3680-11e2-a3cd-001b381e2405} - H:\LaunchU3.exe -a HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea06-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea09-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea14-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea15-0fc1-11e2-a763-001b381e2405} - F:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea17-0fc1-11e2-a763-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...\MountPoints2: {ee81ea1b-0fc1-11e2-a763-001b381e2405} - G:\AutoRun.exe HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [294912 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...0c966feabec1\InprocServer32: [Default-shell32] ATTENTION! ====> ZeroAccess? HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...409d6c4515e9\InprocServer32: [Default-shell32] <==== ATTENTION! HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\...A8F59079A8D5}\localserver32: <==== ATTENTION! Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AutorunsDisabled () ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.) ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=56626&homepage=http://fr.msn.com/ HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pl/ HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome SearchScopes: HKLM -> DefaultScope {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKLM -> {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> DefaultScope {EE3BE3F5-9CDD-422C-A85C-AF79C0477D43} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {0E3F87BF-3B86-4614-B5E5-729F4C268F92} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {A453183E-5546-4F67-B7FC-5D4C37E733FA} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}; SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {CFF4DB9B-135F-47c0-9269-B4C6572FD61A} URL = http://mystart.incredimail.com/mb68/?search={searchTerms}&loc=search_box&u=92541684122227008 SearchScopes: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> {EE3BE3F5-9CDD-422C-A85C-AF79C0477D43} URL = https://www.google.com/search?q={searchTerms} BHO: PDF Architect Helper -> {3A2D5EBA-F86D-4BD3-A177-019765996711} -> C:\Program Files\PDF Architect\PDFIEHelper.dll [2013-04-08] (pdfforge GmbH) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-18] (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-05] (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-18] (Oracle Corporation) Toolbar: HKLM - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files\PDF Architect\PDFIEPlugin.dll [2013-04-08] (pdfforge GmbH) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-05] (Google Inc.) Toolbar: HKU\S-1-5-21-4238259638-2096468534-2137148216-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2015-03-05] (Google Inc.) DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0067-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_67-windows-i586.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2001-06-20] (Microsoft Corporation) Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Winsock: Catalog9 57 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG) Tcpip\Parameters: [DhcpNameServer] 62.179.1.63 192.168.0.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-16] () FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google) FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-18] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-18] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-14] (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-14] (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-11-13] FF HKLM\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files\PDF Architect\FFPDFArchitectExt FF Extension: PDF Architect Converter For Firefox - C:\Program Files\PDF Architect\FFPDFArchitectExt [2013-12-01] FF HKLM\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon FF Extension: Bytemobile Optimization Client - C:\Program Files\T-Mobile\InternetManager_H\OCx32\addon [2014-07-22] Chrome: ======= CHR HomePage: Default -> hxxp://startsear.ch/?aff=1 CHR StartupUrls: Default -> "hxxp://startsear.ch/?aff=1" CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.270.7) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll No File CHR Plugin: (Java(TM) Platform SE 6 U27) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\pdf.dll No File CHR Plugin: (Babylon Chrome Plugin) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.0_0\BabylonChromePI.dll No File CHR Plugin: (vShare.tv plug-in) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj\1.3_0\chvsharetvplg.dll No File CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File CHR Plugin: (Windows Presentation Foundation) - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) CHR Plugin: (Default Plug-in) - default_plugin No File CHR Profile: C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Avira SafeSearch) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffalmjohbhdhlkajphgkhloccibhmoog [2014-08-12] CHR Extension: (Avira Browser Safety) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-12] CHR Extension: (Google Wallet) - C:\Users\Robert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18] CHR HKLM\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files\BabylonToolbar\BabylonToolbar\1.4.19.19\BabylonToolbar.crx [Not Found] CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - No Path Or update_url value CHR HKLM\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files\vShare.tv plugin\vshareplg.crx [Not Found] CHR HKU\S-1-5-21-4238259638-2096468534-2137148216-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [gaiilaahiahdejapggenmdmafpmbipje] - C:\Program Files\DealPly\DealPly.crx [Not Found] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [815352 2015-04-10] (Avira Operations GmbH & Co. KG) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [434424 2015-04-10] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [434424 2015-04-10] (Avira Operations GmbH & Co. KG) R2 Avira.OE.ServiceHost; C:\Program Files\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG) R2 CFSvcs; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [40960 2006-11-15] (TOSHIBA CORPORATION) [File not signed] S3 GoogleDesktopManager; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [1862144 2007-05-21] (Google) [File not signed] R2 hasplms; C:\Windows\system32\hasplms.exe [4883400 2011-10-18] (SafeNet Inc.) R2 HWDeviceService.exe; C:\ProgramData\DatacardService\HWDeviceService.exe [271712 2011-03-14] () S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed] S2 Internet Manager. RunOuc; C:\Program Files\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2014-07-22] () R2 PDF Architect Helper Service; C:\Program Files\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH) R2 PDF Architect Service; C:\Program Files\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH) R2 pinger; C:\Toshiba\IVP\ISM\pinger.exe [136816 2007-01-26] () S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software) R2 Swupdtmr; c:\Toshiba\IVP\swupdate\swupdtmr.exe [63096 2007-01-26] () R2 TNaviSrv; C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe [114688 2007-04-28] (TOSHIBA Corporation) [File not signed] R2 TODDSrv; C:\Windows\system32\TODDSrv.exe [114688 2006-05-26] (TOSHIBA Corporation) [File not signed] R2 UleadBurningHelper; C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [49152 2006-08-24] (Ulead Systems, Inc.) [File not signed] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-19] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aksfridge; C:\Windows\System32\DRIVERS\aksfridge.sys [367560 2011-10-04] (SafeNet Inc.) S3 akshasp; C:\Windows\System32\DRIVERS\akshasp.sys [238208 2010-09-27] (Aladdin Knowledge Systems Ltd.) S3 akshhl; C:\Windows\System32\DRIVERS\akshhl.sys [46720 2011-08-25] (SafeNet Inc.) S3 aksusb; C:\Windows\System32\DRIVERS\aksusb.sys [16512 2011-08-03] (SafeNet Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-11] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-11] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG) R0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [13184 2014-07-22] (Bytemobile, Inc.) [File not signed] S3 DrvAgent32; C:\Windows\system32\Drivers\DrvAgent32.sys [23456 2014-05-18] (Phoenix Technologies) [File not signed] R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-12] (DT Soft Ltd) R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [596424 2011-08-10] (SafeNet Inc.) R2 Haspnt; C:\Windows\system32\drivers\Haspnt.sys [47616 2003-12-18] (Aladdin Knowledge Systems) [File not signed] S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [90368 2014-07-22] (Huawei Technologies Co., Ltd.) S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [64384 2014-07-22] (Huawei Technologies Co., Ltd.) S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [26624 2014-07-22] (Huawei Technologies Co., Ltd.) S4 KR10I; C:\Windows\system32\drivers\kr10i.sys [216320 2006-02-14] (TOSHIBA CORPORATION) [File not signed] S4 KR10N; C:\Windows\system32\drivers\kr10n.sys [207104 2005-09-28] (TOSHIBA CORPORATION) [File not signed] S4 KR3NPXP; C:\Windows\system32\drivers\kr3npxp.sys [479488 2006-09-28] (TOSHIBA CORPORATION) [File not signed] R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [19456 2006-07-29] (COMPAL ELECTRONIC INC.) R2 port_nt; c:\windows\system32\drivers\port_nt.sys [3608 2000-10-24] () [File not signed] S3 s0016bus; C:\Windows\System32\DRIVERS\s0016bus.sys [89256 2008-05-16] (MCCI Corporation) S3 s0016mdfl; C:\Windows\System32\DRIVERS\s0016mdfl.sys [15016 2008-05-16] (MCCI Corporation) S3 s0016mdm; C:\Windows\System32\DRIVERS\s0016mdm.sys [120744 2008-05-16] (MCCI Corporation) S3 s0016mgmt; C:\Windows\System32\DRIVERS\s0016mgmt.sys [114216 2008-05-16] (MCCI Corporation) S3 s0016nd5; C:\Windows\System32\DRIVERS\s0016nd5.sys [25512 2008-05-16] (MCCI Corporation) S3 s0016obex; C:\Windows\System32\DRIVERS\s0016obex.sys [110632 2008-05-16] (MCCI Corporation) S3 s0016unic; C:\Windows\System32\DRIVERS\s0016unic.sys [115752 2008-05-16] (MCCI Corporation) S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [124016 2010-03-15] (MCCI Corporation) R1 SAVRKBootTasks; C:\Windows\system32\SAVRKBootTasks.sys [18816 2010-05-26] (Sophos Plc) [File not signed] R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [24192 2014-07-22] (Bytemobile, Inc.) [File not signed] S3 XXLHASP; c:\windows\system32\drivers\XXLHASP.sys [821248 2012-01-30] () [File not signed] S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [235392 2014-07-22] (Huawei Technologies Co., Ltd.) S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 Tosrfcom; No ImagePath S3 TpChoice; system32\DRIVERS\TpChoice.sys [X] U3 uwliqpow; \??\C:\Users\Robert\AppData\Local\Temp\uwliqpow.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-18 15:42 - 2015-04-18 15:46 - 00000000 ____D () C:\FRST 2015-04-18 09:25 - 2014-01-28 18:36 - 00380416 _____ () C:\Users\Robert\Desktop\gmer.exe 2015-04-18 09:24 - 2015-04-18 09:24 - 00370943 _____ () C:\Users\Robert\Desktop\gmer.zip 2015-04-16 23:46 - 2015-03-09 03:01 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2015-04-16 23:36 - 2015-03-05 04:24 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2015-04-16 23:35 - 2015-03-05 04:32 - 00244152 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys 2015-04-16 23:35 - 2015-03-05 04:23 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll 2015-04-16 23:34 - 2015-03-14 04:21 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2015-04-16 23:34 - 2015-03-13 03:51 - 03604920 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2015-04-16 23:34 - 2015-03-13 03:51 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-04-16 21:56 - 2015-03-10 00:57 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-04-16 21:56 - 2015-03-10 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-04-16 21:56 - 2015-03-10 00:55 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2015-04-16 21:56 - 2015-03-10 00:55 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2015-04-16 21:55 - 2015-03-10 01:06 - 12377600 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-04-16 21:55 - 2015-03-10 01:03 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2015-04-16 21:55 - 2015-03-10 01:02 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-04-16 21:55 - 2015-03-10 01:00 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-04-16 21:55 - 2015-03-10 00:57 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-04-16 21:55 - 2015-03-10 00:56 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-04-16 21:55 - 2015-03-10 00:56 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-04-16 21:55 - 2015-03-10 00:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-04-16 21:55 - 2015-03-10 00:56 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2015-04-16 21:55 - 2015-03-10 00:56 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-04-16 21:55 - 2015-03-10 00:55 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-04-16 21:55 - 2015-03-10 00:55 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-04-16 21:55 - 2015-03-10 00:55 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2015-04-10 19:53 - 2015-04-10 19:53 - 00000967 _____ () C:\Users\Public\Desktop\Avira.lnk 2015-03-25 19:53 - 2015-03-25 19:54 - 00000137 _____ () C:\Users\Robert\Desktop\compensa.txt 2015-03-22 14:37 - 2015-03-22 14:37 - 00008774 _____ () C:\Users\Robert\Documents\LWSM.xlsx ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-18 15:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-18 15:39 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-18 15:37 - 2010-10-08 08:51 - 01951779 _____ () C:\Windows\WindowsUpdate.log 2015-04-18 15:27 - 2010-10-09 21:45 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-04-18 15:08 - 2012-04-22 14:37 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-18 11:27 - 2014-11-24 20:06 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1d0081168b7e9b0.job 2015-04-18 09:23 - 2013-11-15 20:16 - 00000000 ____D () C:\ProgramData\Oracle 2015-04-18 08:52 - 2014-10-16 20:39 - 00000000 ____D () C:\Program Files\Java 2015-04-18 08:49 - 2015-01-25 13:19 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2015-04-17 23:23 - 2014-05-21 19:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Geodezja 2015-04-17 23:23 - 2012-09-08 23:58 - 00000000 ____D () C:\MikroMap 2015-04-17 22:13 - 2010-10-09 21:45 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-04-17 20:44 - 2010-10-10 17:27 - 00000000 ____D () C:\Windows\Minidump 2015-04-17 19:50 - 2012-02-27 19:35 - 00000000 ____D () C:\C-GEO 2015-04-17 19:46 - 2006-11-02 12:33 - 00776914 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-04-17 19:39 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-16 23:46 - 2013-08-19 03:24 - 00000000 ____D () C:\Windows\system32\MRT 2015-04-16 23:46 - 2006-11-02 15:01 - 00032644 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-16 23:40 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET 2015-04-16 23:37 - 2006-11-02 12:24 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2015-04-16 23:36 - 2010-10-08 08:58 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-04-16 23:09 - 2012-04-22 14:37 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-04-16 23:09 - 2012-01-08 18:26 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-04-10 20:11 - 2012-10-16 19:15 - 00000000 ____D () C:\Users\Robert\AppData\Roaming\Avira 2015-04-10 20:09 - 2014-05-21 19:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2015-04-10 19:53 - 2014-08-12 15:53 - 00000000 ____D () C:\ProgramData\Package Cache 2015-04-10 19:53 - 2011-10-18 22:20 - 00000000 ____D () C:\Program Files\Avira 2015-03-29 17:15 - 2014-06-16 19:07 - 00000000 ____D () C:\Users\Robert\AppData\Local\Adobe 2015-03-22 21:01 - 2012-02-26 12:08 - 00000000 ____D () C:\Users\Robert\AppData\Roaming\KomaMail 2015-03-22 15:48 - 2011-05-31 22:21 - 07339044 _____ () C:\Users\Robert\Documents\AutoRuns.arn 2015-03-20 22:45 - 2014-02-23 13:38 - 00051322 _____ () C:\Users\Robert\Documents\Vba_Do_while_Loop.xlsm ==================== Files in the root of some directories ======= 2012-07-14 01:54 - 2012-07-14 01:54 - 0002528 _____ () C:\Users\Robert\AppData\Roaming\$_hpcst$.hpc 2010-11-14 01:20 - 2010-11-14 01:20 - 0000691 _____ () C:\Users\Robert\AppData\Roaming\GetValue.vbs 2010-11-14 01:20 - 2010-11-14 01:20 - 0000035 _____ () C:\Users\Robert\AppData\Roaming\SetValue.bat 2010-11-09 22:19 - 2013-01-09 22:00 - 0001356 _____ () C:\Users\Robert\AppData\Local\d3d9caps.dat 2010-11-14 00:27 - 2015-01-16 00:52 - 0043008 _____ () C:\Users\Robert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-01-06 01:24 - 2013-01-06 01:27 - 0004096 ____H () C:\Users\Robert\AppData\Local\keyfile3.drm 2012-10-02 19:57 - 2012-10-02 19:58 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempaC5260.html 2012-04-06 13:24 - 2012-04-06 22:37 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempal3340.html 2011-12-01 20:56 - 2011-12-01 23:36 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempAl5144.html 2012-03-26 19:16 - 2012-03-26 20:21 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempbJ1944.html 2012-09-05 18:03 - 2012-09-05 18:03 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempcc4256.html 2012-07-04 18:01 - 2012-07-04 23:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempck4616.html 2013-01-11 22:50 - 2013-01-11 23:51 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempCo2856.html 2011-12-19 20:27 - 2011-12-20 02:28 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempcW6044.html 2013-07-10 12:02 - 2013-07-10 12:14 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempcx5968.html 2011-12-29 12:05 - 2011-12-30 00:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempdC3284.html 2012-11-04 13:58 - 2012-11-05 00:29 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempdQ5880.html 2012-06-03 14:04 - 2012-06-03 17:19 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempDx5852.html 2011-12-01 20:56 - 2011-12-01 23:36 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempec5144.html 2012-11-08 20:07 - 2012-11-09 00:26 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempEF4720.html 2012-09-28 20:45 - 2012-09-29 01:38 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempEY4224.html 2012-09-17 21:51 - 2012-09-17 23:10 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempfe6040.html 2012-09-04 19:44 - 2012-09-04 22:41 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempfLU976.html 2012-04-28 13:26 - 2012-04-28 15:43 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempFr1324.html 2012-03-26 19:16 - 2012-03-26 20:21 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempgB1944.html 2012-09-18 18:18 - 2012-09-18 23:29 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempGi1216.html 2012-10-20 19:54 - 2012-10-20 20:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempgk5824.html 2012-04-06 13:25 - 2012-04-06 22:37 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempGq3340.html 2011-12-01 20:56 - 2011-12-01 20:57 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempho5144.html 2012-06-29 14:16 - 2012-06-29 21:07 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempiJ5220.html 2012-01-05 18:43 - 2012-01-06 01:14 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempiO1748.html 2012-09-17 21:51 - 2012-09-17 23:10 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempIs6040.html 2012-10-02 19:58 - 2012-10-02 20:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempji5872.html 2012-09-30 17:39 - 2012-09-30 17:39 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempjJ5748.html 2012-09-04 19:44 - 2012-09-04 22:41 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempjNX976.html 2012-02-16 21:12 - 2012-02-17 00:27 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempJt4724.html 2012-04-06 13:24 - 2012-04-06 22:37 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempjw3340.html 2012-11-14 19:51 - 2012-11-14 21:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempKb2560.html 2011-12-29 12:05 - 2011-12-30 00:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempKc3284.html 2012-10-02 19:57 - 2012-10-02 19:58 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempKc5260.html 2012-04-24 22:26 - 2012-04-24 22:52 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempkRx848.html 2012-10-20 19:54 - 2012-10-20 20:30 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempLA5824.html 2012-03-03 22:12 - 2012-03-03 22:12 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempmH4568.html 2012-09-29 09:57 - 2012-09-30 00:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempmR4476.html 2012-02-15 13:40 - 2012-02-16 00:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempNW5116.html 2012-02-15 13:40 - 2012-02-16 00:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempOR5116.html 2011-10-19 22:35 - 2011-10-19 23:00 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempOU5248.html 2011-12-29 12:05 - 2011-12-30 00:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemppA3284.html 2011-12-19 20:27 - 2011-12-20 02:28 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemppF6044.html 2011-10-19 22:35 - 2011-10-19 23:00 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempPL5248.html 2013-07-10 12:02 - 2013-07-10 12:14 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempQB5968.html 2012-03-10 22:06 - 2012-03-10 22:06 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempqk5476.html 2012-08-05 11:48 - 2012-08-05 17:44 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempQM3648.html 2012-09-18 18:18 - 2012-09-18 23:29 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempQR1216.html 2012-06-29 14:16 - 2012-06-29 21:07 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempqs5220.html 2012-04-28 13:26 - 2012-04-28 15:43 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempRC1324.html 2012-03-10 22:06 - 2012-03-10 22:06 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempRw5476.html 2012-08-29 22:39 - 2012-08-29 22:51 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempTq3396.html 2012-01-09 19:59 - 2012-01-10 00:16 - 0002432 _____ () C:\Users\Robert\AppData\Local\TemptV2788.html 2012-10-02 19:58 - 2012-10-02 20:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Temptv5872.html 2012-07-04 18:01 - 2012-07-04 23:08 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempUD4616.html 2011-12-29 12:05 - 2011-12-30 00:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempUI3284.html 2012-06-03 14:04 - 2012-06-03 17:19 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempuM5852.html 2012-09-28 20:45 - 2012-09-29 01:38 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempUO4224.html 2012-08-29 22:39 - 2012-08-29 22:51 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempUQ3396.html 2012-03-03 22:12 - 2012-03-03 22:12 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempus4568.html 2012-04-24 22:26 - 2012-04-24 22:52 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempuTf848.html 2013-01-11 22:50 - 2013-01-11 23:51 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempuU2856.html 2012-09-29 09:57 - 2012-09-30 00:08 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempvr4476.html 2013-01-06 21:06 - 2013-01-06 23:44 - 0002089 _____ () C:\Users\Robert\AppData\Local\Tempvu5412.html 2012-03-12 23:26 - 2012-03-12 23:36 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempVv5304.html 2013-01-06 21:06 - 2013-01-06 23:44 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempwr5412.html 2012-09-05 18:03 - 2012-09-05 18:03 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempxb4256.html 2012-04-06 13:25 - 2012-04-06 22:37 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempxL3340.html 2012-03-12 23:26 - 2012-03-12 23:36 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempXR5304.html 2012-01-02 21:18 - 2012-01-02 22:33 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempyb5456.html 2012-11-14 19:51 - 2012-11-14 21:30 - 0002432 _____ () C:\Users\Robert\AppData\Local\Tempyl2560.html 2012-01-03 00:04 - 2012-01-03 00:04 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempYt4480.html 2012-08-05 11:48 - 2012-08-05 17:44 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempzH3648.html 2012-09-30 17:39 - 2012-09-30 17:39 - 0002432 _____ () C:\Users\Robert\AppData\Local\TempZK5748.html 2012-02-16 21:12 - 2012-02-17 00:27 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempzS4724.html 2012-11-08 20:07 - 2012-11-09 00:26 - 0002089 _____ () C:\Users\Robert\AppData\Local\TempZZ4720.html 2011-04-19 21:14 - 2013-04-11 19:15 - 0004103 _____ () C:\Users\Robert\AppData\Local\unins000.dat 2013-04-11 19:15 - 2013-04-11 19:15 - 0707504 _____ () C:\Users\Robert\AppData\Local\unins000.exe 2013-04-11 19:15 - 2013-04-11 19:15 - 0011761 _____ () C:\Users\Robert\AppData\Local\unins000.msg 2013-01-08 20:42 - 2013-01-09 21:52 - 95023320 ____T () C:\ProgramData\dsgsdgdsgdsgw.pad Files to move or delete: ==================== C:\ProgramData\dsgsdgdsgdsgw.pad C:\Users\Robert\HKEY_LOCAL_MACHINE.reg Some content of TEMP: ==================== C:\Users\Robert\AppData\Local\Temp\avgnt.exe C:\Users\Robert\AppData\Local\Temp\GLB1A2B.EXE C:\Users\Robert\AppData\Local\Temp\jre-8u45-windows-au.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-18 07:52 ==================== End Of Log ============================