Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01 Ran by Szymon (administrator) on SZYMON-PC on 01-07-2015 17:13:05 Running from E:\downloads Loaded Profiles: Szymon (Available Profiles: Szymon) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 8 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) E:\Program Files\AVAST Software\Avast\AvastSvc.exe (XTab system) C:\Program Files (x86)\MiuiTab\ProtectService.exe (Realtek) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe (SearchProtect) C:\Program Files (x86)\MiuiTab\CmdShell.exe (Realtek Semiconductor Corp.) C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (StarWind Software) E:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (Akamai Technologies, Inc.) C:\Users\Szymon\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\Szymon\AppData\Local\Akamai\netsession_win.exe () E:\Program Files (x86)\screenSHU\screenSHU.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (AVAST Software) E:\Program Files\AVAST Software\Avast\avastui.exe (KYE Genius) C:\Program Files (x86)\Genius\X-G510\mousehid.exe (KYE Genius) C:\Program Files (x86)\Genius\X-G510\trayicon.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe (OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 2.4\program\soffice.bin (ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe (Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe (Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe (XTab system) C:\Program Files (x86)\MiuiTab\HPNotify.exe (KYE Genius) C:\Program Files (x86)\Genius\X-G510\OSD.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_16_0_0_305_ActiveX.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe (Opera Software) C:\Program Files (x86)\Opera\30.0.1835.88\opera.exe () E:\downloads\0hwq9lcc.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7634648 2000-01-01] (Realtek Semiconductor) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation) HKLM-x32\...\Run: [AvastUI.exe] => e:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-13] (AVAST Software) HKLM-x32\...\Run: [X-G510] => C:\Program Files (x86)\Genius\X-G510\mousehid.exe [267776 2013-01-15] (KYE Genius) HKLM-x32\...\Run: [BCSSync] => E:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-05-05] (Raptr, Inc) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [EADM] => e:\Program Files (x86)\Origin\Origin.exe [3632472 2015-04-28] (Electronic Arts) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [28785792 2015-06-02] (Skype Technologies S.A.) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [uTorrent] => C:\Users\Szymon\AppData\Roaming\uTorrent\uTorrent.exe [1694560 2015-05-06] (BitTorrent Inc.) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [AlcoholAutomount] => f:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Szymon\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-30] (Akamai Technologies, Inc.) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\Run: [screenSHU] => e:\Program Files (x86)\screenSHU\screenSHU.exe [2112000 2013-09-04] () HKU\S-1-5-21-3972903673-1391813168-638966357-1000\...\MountPoints2: {18465afc-f614-11e4-8599-d43d7eb4708a} - J:\LG_PC_Programs.exe Startup: C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk [2014-10-26] ShortcutTarget: OpenOffice.org 2.4.lnk -> C:\Program Files (x86)\OpenOffice.org 2.4\program\quickstart.exe () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => e:\Program Files\AVAST Software\Avast\ashShA64.dll [2014-09-13] (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=ds&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://isearch.omiga-plus.com/web/?type=dspp&ts=1423307065&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hppp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97 HKU\S-1-5-21-3972903673-1391813168-638966357-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://isearch.omiga-plus.com/web/?type=dspp&ts=1423307065&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=dspp&ts=1434543209&from=xtab&uid=B63D0C882ED54aedB2869013EEC0CF97&q={searchTerms} SearchScopes: HKU\S-1-5-21-3972903673-1391813168-638966357-1000 -> {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = http://isearch.omiga-plus.com/web/?utm_source=b&utm_medium=smt&utm_campaign=install_ie&utm_content=ds&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671&ts=1423307087&type=default&q={searchTerms} BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: LuckyTab Class -> {51D26BB4-4D2C-4AE4-9873-5FF41B6DED1F} -> C:\Program Files (x86)\MiuiTab\SupTab.dll [2015-06-16] (Thinknice Co. Limited) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-14] (Oracle Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> E:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-14] (Oracle Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 0.0.0.0 Tcpip\..\Interfaces\{AE77193F-BC2F-4A71-A62F-841A59AAF7DE}: [DhcpNameServer] 192.168.1.1 0.0.0.0 Tcpip\..\Interfaces\{DE21215F-4E27-4234-9746-2120A86DEC12}: [NameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://isearch.omiga-plus.com/?type=sc&ts=1423307037&from=smt&uid=WDCXWD1002FAEX-00Z3A0_WD-WCATR442467124671 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-05] () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.5 -> e:\Program Files\VideoLAN\VLC\npvlc.dll [2014-09-23] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.) FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-14] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-14] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> E:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> E:\PROGRA~1\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin HKU\S-1-5-21-3972903673-1391813168-638966357-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Szymon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2015-05-11] (Unity Technologies ApS) FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - e:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: Avast Online Security - e:\Program Files\AVAST Software\Avast\WebRep\FF [2014-09-13] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - e:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2015-07-01] Opera: ======= OPR Extension: (Adblock Plus) - C:\Users\Szymon\AppData\Roaming\Opera Software\Opera Stable\Extensions\oidhhegpmlfpoeialbgcdocjalghfpkp [2014-11-01] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; e:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-13] (AVAST Software) S2 AxAutoMntSrv; e:\Program Files (x86)\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team) S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [238376 2015-06-17] (EasyAntiCheat Ltd) R2 IHProtect Service; C:\Program Files (x86)\MiuiTab\ProtectService.exe [125056 2015-06-16] (XTab system) S3 Origin Client Service; E:\Program Files (x86)\Origin\OriginClientService.exe [1931632 2015-04-28] (Electronic Arts) R2 Realtek11nCU; C:\Program Files (x86)\Realtek\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed] R2 StarWindServiceAE; e:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed] R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 AndnetBus; C:\Windows\System32\DRIVERS\lgandnetbus64.sys [20992 2014-05-27] (LG Electronics Inc.) S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2014-07-07] (LG Electronics Inc.) S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2014-07-07] (LG Electronics Inc.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-07-01] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [89944 2015-07-01] (Avast Software s.r.o.) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-07-01] (Avast Software s.r.o.) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-07-01] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-07-01] (Avast Software s.r.o.) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [442264 2015-07-01] (Avast Software s.r.o.) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [137288 2015-07-01] (Avast Software s.r.o.) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [272248 2015-07-01] () R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2015-02-07] (Disc Soft Ltd) S3 ELANUSB; C:\Windows\System32\Drivers\elanusb.sys [27136 2008-06-24] (Windows (R) Codename Longhorn DDK provider) [File not signed] R3 ISCT; C:\Windows\System32\DRIVERS\ISCTD64.sys [46568 2013-01-19] () R3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [848384 2011-02-11] (Realtek Semiconductor Corporation ) R3 rtlss; C:\Windows\System32\Drivers\rtlss.sys [27240 2010-06-21] (Realtek Semiconductor Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-10-25] (Duplex Secure Ltd.) S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2015-04-26] () S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [116296 2014-09-09] (Oracle Corporation) U3 a979w1il; C:\Windows\System32\Drivers\a979w1il.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder) U3 aqm5fhvl; C:\Windows\System32\Drivers\aqm5fhvl.sys [0 ] (Microsoft Corporation) <==== ATTENTION (zero byte File/Folder) S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X] S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] S3 MSICDSetup; \??\G:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\G:\NTIOLib_X64.sys [X] S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X] U3 uxdiqpoc; \??\C:\Users\Szymon\AppData\Local\Temp\uxdiqpoc.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-01 17:11 - 2015-07-01 17:13 - 00000000 ____D C:\FRST 2015-07-01 17:11 - 2015-07-01 17:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2015-07-01 17:11 - 2015-07-01 17:11 - 00000000 ____D C:\Program Files\avast software 2015-07-01 17:10 - 2015-07-01 17:10 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe 2015-07-01 17:10 - 2015-07-01 17:10 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr 2015-07-01 17:10 - 2014-11-21 22:02 - 01041168 _____ (AVAST Software) C:\Windows\system32\Drivers\asw4794.tmp 2015-07-01 17:10 - 2014-09-13 10:02 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\asw4CF6.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00224896 _____ C:\Windows\system32\Drivers\asw4EAC.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\asw4A05.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00092008 _____ (AVAST Software) C:\Windows\system32\Drivers\asw4FA6.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\asw4B5E.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00065776 _____ C:\Windows\system32\Drivers\asw4C2A.tmp 2015-07-01 17:10 - 2014-09-13 10:01 - 00029208 _____ C:\Windows\system32\Drivers\asw4AB2.tmp 2015-07-01 15:51 - 2015-07-01 15:52 - 00000000 ___HD C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8} 2015-06-30 14:59 - 2015-06-30 14:59 - 00001015 _____ C:\Users\Public\Desktop\World of Warcraft.lnk 2015-06-30 14:59 - 2015-06-30 14:59 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft 2015-06-29 20:05 - 2015-06-30 15:00 - 00000659 _____ C:\Users\Szymon\Documents\Uninstall STAR WARS The Old Republic.log 2015-06-29 14:47 - 2015-06-29 14:47 - 00000031 _____ C:\Users\Szymon\Desktop\blizzardo.txt 2015-06-29 14:43 - 2015-06-29 15:42 - 00022295 _____ C:\Users\Szymon\Desktop\sprawozdanie z zajęć korekcyjno-komensacyjnych.odt 2015-06-23 20:54 - 2015-07-01 15:39 - 00000000 ____D C:\Users\Szymon\AppData\Local\screenSHU 2015-06-23 20:54 - 2015-06-23 20:54 - 00000720 _____ C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\screenSHU.lnk 2015-06-20 09:38 - 2015-06-29 20:32 - 00000000 ____D C:\Users\Szymon\Desktop\Sponsoring 2015-06-17 18:51 - 2015-06-17 18:51 - 00238376 _____ (EasyAntiCheat Ltd) C:\Windows\SysWOW64\EasyAntiCheat.exe 2015-06-17 14:08 - 2015-06-17 14:08 - 00000000 ____D C:\Program Files (x86)\MiuiTab 2015-06-14 15:34 - 2015-06-14 15:38 - 00000000 ____D C:\ProgramData\Oracle 2015-06-14 15:34 - 2015-06-14 15:34 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2015-06-14 15:34 - 2015-06-14 15:34 - 00000000 ____D C:\ProgramData\Sun 2015-06-14 15:34 - 2015-06-14 15:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2015-06-14 15:34 - 2015-06-14 15:34 - 00000000 ____D C:\Program Files (x86)\Java 2015-06-13 10:38 - 2015-06-13 10:38 - 00000000 ____D C:\Users\Szymon\Documents\AutomaticSolution Software 2015-06-13 10:38 - 2015-06-13 10:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GS Auto Clicker ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-01 17:11 - 2014-09-13 10:02 - 00442264 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswsp.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00272248 _____ C:\Windows\system32\Drivers\aswVmm.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00137288 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00089944 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00065736 _____ C:\Windows\system32\Drivers\aswRvrt.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00029168 _____ C:\Windows\system32\Drivers\aswHwid.sys 2015-07-01 17:10 - 2014-09-13 10:02 - 00003924 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2015-07-01 16:57 - 2014-10-18 19:03 - 00000000 ____D C:\Users\Szymon\AppData\Local\Battle.net 2015-07-01 16:53 - 2014-09-13 10:35 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\Skype 2015-07-01 16:52 - 2009-07-14 06:51 - 00091754 _____ C:\Windows\setupact.log 2015-07-01 16:40 - 2014-11-22 19:23 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-01 15:49 - 2014-09-17 11:48 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\uTorrent 2015-07-01 15:42 - 2014-09-13 09:36 - 01816523 _____ C:\Windows\WindowsUpdate.log 2015-07-01 15:40 - 2014-10-26 18:28 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\OpenOffice.org2 2015-07-01 15:39 - 2014-09-28 16:47 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\Raptr 2015-07-01 15:38 - 2014-09-13 09:34 - 00000000 ____D C:\Users\Szymon 2015-07-01 15:38 - 2010-11-21 05:47 - 00131122 _____ C:\Windows\PFRO.log 2015-07-01 15:38 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-01 12:59 - 2014-09-13 09:53 - 00000000 ____D C:\Program Files (x86)\Opera 2015-07-01 10:27 - 2015-05-17 00:16 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Open Broadcaster Software 2015-06-30 23:44 - 2014-09-13 15:41 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\TS3Client 2015-06-30 15:03 - 2014-10-18 11:29 - 00000000 ____D C:\Users\Szymon\Documents\My Games 2015-06-30 15:03 - 2014-10-03 21:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Mechanics 2015-06-30 15:00 - 2014-09-13 09:34 - 00001443 _____ C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-06-30 15:00 - 2014-09-13 09:34 - 00001409 _____ C:\Users\Szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2015-06-30 14:20 - 2014-09-13 10:26 - 00000000 ____D C:\ProgramData\Origin 2015-06-29 20:01 - 2014-09-28 16:44 - 00000000 ____D C:\ProgramData\Package Cache 2015-06-29 19:59 - 2014-09-13 09:58 - 00068136 _____ C:\Users\Szymon\AppData\Local\GDIPFONTCACHEV1.DAT 2015-06-29 19:58 - 2009-07-14 06:45 - 00317288 _____ C:\Windows\system32\FNTCACHE.DAT 2015-06-28 17:34 - 2015-01-27 18:14 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\CodeBlocks 2015-06-25 12:58 - 2014-09-13 09:53 - 00003832 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1410594791 2015-06-24 11:52 - 2015-05-24 11:23 - 00000000 ____D C:\Users\Szymon\Documents\The Witcher 3 2015-06-22 11:42 - 2015-03-13 16:51 - 00000000 ____D C:\Users\Szymon\Documents\Heroes of the Storm 2015-06-20 12:49 - 2009-07-14 07:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI 2015-06-17 19:35 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-06-17 19:35 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-06-17 14:09 - 2015-02-07 13:04 - 00000000 ____D C:\Program Files (x86)\XTab 2015-06-14 14:20 - 2015-02-08 14:39 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\vlc 2015-06-10 16:51 - 2014-09-13 10:34 - 00000000 ____D C:\ProgramData\Skype 2015-06-08 12:56 - 2015-05-17 00:16 - 00000000 ____D C:\Users\Szymon\AppData\Roaming\OBS Some files in TEMP: ==================== C:\Users\Szymon\AppData\Local\Temp\AskPIP_FF_.exe C:\Users\Szymon\AppData\Local\Temp\AxSFADownloader.exe C:\Users\Szymon\AppData\Local\Temp\bitool.dll C:\Users\Szymon\AppData\Local\Temp\BRSVC_2632392_hlp.exe C:\Users\Szymon\AppData\Local\Temp\devcon64.exe C:\Users\Szymon\AppData\Local\Temp\EslWireSetup-1.18.0.8085-x64.exe C:\Users\Szymon\AppData\Local\Temp\EslWireSetup-1.18.0.8101-x64.exe C:\Users\Szymon\AppData\Local\Temp\ICReinstall_Everest-Home-Edition(11558)-dp.exe C:\Users\Szymon\AppData\Local\Temp\MSIAFTERBURNERSETUP.EXE C:\Users\Szymon\AppData\Local\Temp\ochelper.exe C:\Users\Szymon\AppData\Local\Temp\raptrpatch.exe C:\Users\Szymon\AppData\Local\Temp\raptr_stub.exe C:\Users\Szymon\AppData\Local\Temp\SETUP_AFTERBURNER.EXE C:\Users\Szymon\AppData\Local\Temp\smt_omiga-plus.exe C:\Users\Szymon\AppData\Local\Temp\vcredist_x64.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-06-27 16:39 ==================== End of log ============================