Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:28-06-2015 01 Ran by zibi (administrator) on ZIBI-KOMPUTER on 30-06-2015 22:11:28 Running from C:\Users\zibi\Downloads Loaded Profiles: zibi & UpdatusUser (Available Profiles: zibi & UpdatusUser) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska) Internet Explorer Version 8 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe () C:\ProgramData\MobileBrServ\mbbService.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe () C:\Windows\SysWOW64\PnkBstrA.exe () C:\Windows\SysWOW64\PnkBstrB.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe (Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe (Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Power Software Ltd) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_190.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_190.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1012000 2013-05-16] (NVIDIA Corporation) HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10394392 2014-04-07] (Logitech Inc.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-27] (Microsoft Corporation) HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [336992 2012-05-31] (Power Software Ltd) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [AVP] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-11-09] (Kaspersky Lab ZAO) HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\Run: [iLivid] => "C:\Users\zibi\AppData\Local\iLivid\iLivid.exe" -autorun HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\Run: [PeenyBee] => C:\Users\zibi\AppData\Local\PennyBee\PennyBeeW.exe HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [22065760 2014-10-01] (Skype Technologies S.A.) HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\Run: [ChomikBox] => C:\Program Files (x86)\ChomikBox\chomikbox.exe [6033408 2014-03-11] ( ) HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\MountPoints2: G - G:\CheckID.exe HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\...\MountPoints2: {353a1106-0b27-11e2-8d9e-001fc63c34d6} - G:\AutoRun.exe Startup: C:\Users\zibi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk [2012-11-30] ShortcutTarget: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120150509 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120150509 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268352 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268352 HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp120150509 HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://isearch.avg.com/?cid={30D4757C-1A9F-4E81-B89E-052C3F0A8F5F}&mid=624e592709e747d084d18965c6f77b90-a3bcec884083189fbe2319d437a293f55a3f7b04&lang=pl&ds=st011&pr=sa&d=2012-10-17 00:02:48&v=11.1.0.7&sap=hp HKU\S-1-5-21-2030126852-3812474721-3917447742-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=hp&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268352 SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-2030126852-3812474721-3917447742-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} SearchScopes: HKU\S-1-5-21-2030126852-3812474721-3917447742-1000 -> {0388404D-6072-4CEB-B521-8F090FEAEE57} URL = http://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=US&install_date=20121018&user_guid=C57FCB49214244CAB53E415CC3AE68C5&machine_id=c70db57d294546fd1b71def832dc4216&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source} SearchScopes: HKU\S-1-5-21-2030126852-3812474721-3917447742-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=2031001FC63C34D6&affID=119357&tsp=4991 SearchScopes: HKU\S-1-5-21-2030126852-3812474721-3917447742-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=ds&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268353&type=default&q={searchTerms} BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-12-12] (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-05-15] (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-12] (Kaspersky Lab ZAO) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation) BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll [2013-12-12] (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2013-12-12] (Kaspersky Lab ZAO) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2006-10-27] (Microsoft Corporation) BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-05-15] (Kaspersky Lab ZAO) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2013-08-27] (Oracle Corporation) BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll [2013-12-12] (Kaspersky Lab ZAO) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2013-08-27] (Oracle Corporation) BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll [2013-12-12] (Kaspersky Lab ZAO) BHO-x32: Crazy Score -> {f439aa7e-a2a0-4635-99a2-164180e848ca} -> C:\Program Files (x86)\Crazy Score\Extensions\f439aa7e-a2a0-4635-99a2-164180e848ca.dll No File Toolbar: HKU\S-1-5-21-2030126852-3812474721-3917447742-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2015-05-01] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation) Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation) Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{0836EF75-D9C5-403B-8B29-28AFF8E221DB}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{35BD961C-0D5A-4331-9A65-ADC6AE7EC0C6}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{41DF51C3-D802-482A-9001-35F70C992735}: [DhcpNameServer] 192.168.1.1 Tcpip\..\Interfaces\{919B747F-C1B7-445D-A735-A7C13753A43A}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{D2D1FD25-28CC-4A55-8A19-D95F4A28249E}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{DF6F2F7A-F5B7-4AAE-BA78-49412C54EB8B}: [DhcpNameServer] 192.168.1.1 192.168.1.1 Tcpip\..\Interfaces\{F1817A99-958F-4415-9488-057150BC8611}: [DhcpNameServer] 192.168.1.1 192.168.1.1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268352 FireFox: ======== FF ProfilePath: C:\Users\zibi\AppData\Roaming\Mozilla\Firefox\Profiles\uvb9jvgn.default FF NewTab: hxxp://www.delta-homes.com/newtab/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=nt&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380268352 FF SearchEngineOrder.1: Ask.com FF SelectedSearchEngine: Allegro FF Homepage: www.wp.pl/?src01=dp120150509 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-25] () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-25] () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-08-27] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2013-08-27] (Oracle Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2013-06-21] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2013-06-21] (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.) FF user.js: detected! => C:\Users\zibi\AppData\Roaming\Mozilla\Firefox\Profiles\uvb9jvgn.default\user.js [2015-05-09] FF SearchPlugin: C:\Users\zibi\AppData\Roaming\Mozilla\Firefox\Profiles\uvb9jvgn.default\searchplugins\Ask.xml [2014-09-20] FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml [2014-09-20] FF Extension: Xmarks - C:\Users\zibi\AppData\Roaming\Mozilla\Firefox\Profiles\uvb9jvgn.default\Extensions\foxmarks@kei.com [2015-06-30] FF Extension: Crazy Score - C:\Users\zibi\AppData\Roaming\Mozilla\Firefox\Profiles\uvb9jvgn.default\Extensions\{64955d58-a14d-421d-9649-9c4bedba4a14}.xpi [2015-05-09] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-09] FF HKLM-x32\...\Firefox\Extensions: [url_advisor@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013-11-09] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013-11-09] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013-11-09] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013-11-09] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com FF Extension: No Name - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013-11-09] Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [lpoimibckejjdjcfbdnajaicnklhfplh] - https://chrome.google.com/webstore/detail/lpoimibckejjdjcfbdnajaicnklhfplh CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx [Not Found] Opera: ======= StartMenuInternet: (HKLM) Opera - C:\Program Files (x86)\Opera\Opera.exe http://www.delta-homes.com/?utm_source=b&utm_medium=newgdp&utm_campaign=eXQ&utm_content=sc&from=newgdp&uid=HitachiXHDS721010CLA332_JP9911HZ0R9TZU0R9TZUX&ts=1380372360 ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356128 2013-11-09] (Kaspersky Lab ZAO) R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation) R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation) R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [232288 2012-03-12] () R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2012-10-17] () R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [107832 2012-10-17] () R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458336 2013-12-12] (Kaspersky Lab ZAO) U5 klflt; C:\Windows\System32\Drivers\klflt.sys [91008 2014-05-15] (Kaspersky Lab ZAO) [File not signed] R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [628320 2014-05-15] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29792 2013-12-12] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29280 2013-11-09] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-11-09] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-11-09] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-11-09] (Kaspersky Lab ZAO) R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-05-14] () R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-05-09] (Duplex Secure Ltd.) S3 ALSysIO; \??\C:\Users\zibi\AppData\Local\Temp\ALSysIO64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-30 22:10 - 2015-06-30 22:11 - 00030741 _____ C:\Users\zibi\Downloads\Addition.txt 2015-06-30 22:09 - 2015-06-30 22:11 - 00021149 _____ C:\Users\zibi\Downloads\FRST.txt 2015-06-30 22:09 - 2015-06-30 22:11 - 00000000 ____D C:\FRST 2015-06-30 22:09 - 2015-06-30 22:09 - 02112512 _____ (Farbar) C:\Users\zibi\Downloads\FRST64.exe 2015-06-30 22:09 - 2015-06-30 22:09 - 01636352 _____ (Farbar) C:\Users\zibi\Downloads\FRST.exe 2015-06-27 13:37 - 2015-06-27 13:37 - 00001170 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2015-06-27 13:37 - 2015-06-27 13:37 - 00001158 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2015-06-27 13:37 - 2015-06-27 13:37 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-06-30 22:08 - 2012-11-27 10:38 - 00003982 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{83C8A67C-2394-49B3-919E-601BD2866C07} 2015-06-30 22:08 - 2012-10-28 17:03 - 00000000 ____D C:\Users\zibi\AppData\Roaming\Skype 2015-06-30 22:03 - 2012-09-30 21:53 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-06-30 19:13 - 2015-05-09 13:37 - 00000000 ____D C:\Users\zibi\AppData\Local\ChomikBox 2015-06-30 16:48 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-06-30 16:48 - 2009-07-14 06:45 - 00021856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-06-30 16:45 - 2011-04-12 15:21 - 00737242 _____ C:\Windows\system32\perfh015.dat 2015-06-30 16:45 - 2011-04-12 15:21 - 00153930 _____ C:\Windows\system32\perfc015.dat 2015-06-30 16:45 - 2009-07-14 07:13 - 01661232 _____ C:\Windows\system32\PerfStringBackup.INI 2015-06-30 16:44 - 2012-09-30 19:36 - 01767709 _____ C:\Windows\WindowsUpdate.log 2015-06-30 16:41 - 2015-05-09 13:37 - 00000000 ____D C:\Users\zibi\.gstreamer-0.10 2015-06-30 16:41 - 2013-11-09 19:08 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2015-06-30 16:41 - 2013-06-05 20:35 - 00000350 _____ C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job 2015-06-30 16:41 - 2012-10-13 17:46 - 00000000 ____D C:\ProgramData\NVIDIA 2015-06-30 16:41 - 2010-11-21 05:47 - 00015292 _____ C:\Windows\PFRO.log 2015-06-30 16:41 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-06-30 16:41 - 2009-07-14 06:51 - 00097866 _____ C:\Windows\setupact.log 2015-06-30 16:39 - 2015-05-09 14:45 - 00000000 ____D C:\ProgramData\Nero 2015-06-28 01:26 - 2012-10-18 12:14 - 00000000 ____D C:\Users\zibi\AppData\Roaming\AIMP3 2015-06-27 13:37 - 2015-05-09 13:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-06-25 18:03 - 2012-09-30 21:53 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-06-25 18:03 - 2012-09-30 21:53 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-06-25 18:03 - 2012-09-30 21:53 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-06-24 17:34 - 2014-12-24 11:09 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task ==================== Files in the root of some directories ======= 2013-04-24 16:02 - 2013-04-24 16:02 - 0033134 _____ () C:\Users\zibi\AppData\Roaming\UserTile.png Some files in TEMP: ==================== C:\Users\zibi\AppData\Local\Temp\AVG.exe C:\Users\zibi\AppData\Local\Temp\avguidx.dll C:\Users\zibi\AppData\Local\Temp\AxSFADownloader.exe C:\Users\zibi\AppData\Local\Temp\CloudBackup8254.exe C:\Users\zibi\AppData\Local\Temp\CommonInstaller.exe C:\Users\zibi\AppData\Local\Temp\drm_dyndata_7380009.dll C:\Users\zibi\AppData\Local\Temp\DseShExt-x64.dll C:\Users\zibi\AppData\Local\Temp\DseShExt-x86.dll C:\Users\zibi\AppData\Local\Temp\iGearedHelper.dll C:\Users\zibi\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih[1].exe C:\Users\zibi\AppData\Local\Temp\MachineIdCreator.exe C:\Users\zibi\AppData\Local\Temp\nv3DVStreaming.dll C:\Users\zibi\AppData\Local\Temp\nvSCPAPI.dll C:\Users\zibi\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\zibi\AppData\Local\Temp\nvStereoApiI.dll C:\Users\zibi\AppData\Local\Temp\nvStInst.exe C:\Users\zibi\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\zibi\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\zibi\AppData\Local\Temp\SkypeSetup.exe C:\Users\zibi\AppData\Local\Temp\ToolbarInstaller.exe C:\Users\zibi\AppData\Local\Temp\ubiD58A.tmp.exe C:\Users\zibi\AppData\Local\Temp\uninst1.exe C:\Users\zibi\AppData\Local\Temp\UNINSTALL.EXE ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-06-25 21:13 ==================== End of log ============================