Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:27-01-2016 Ran by BAZYL (administrator) on BAZYL-PC (29-01-2016 18:42:37) Running from C:\Users\BAZYL\Downloads Loaded Profiles: BAZYL (Available Profiles: BAZYL) Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe () C:\Program Files (x86)\CalendarTool\2.0.0.10764\CalendarServ.exe (Acer Group) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files (x86)\CalendarTool\2.0.0.10764\calendar.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe (Egis Technology Inc.) C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9644576 2009-12-15] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1890088 2009-12-10] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [206208 2010-01-13] () HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [860192 2010-02-05] (Acer Incorporated) HKLM-x32\...\Run: [EgisUpdate] => C:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe [201512 2009-12-25] (Egis Technology Inc.) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [260608 2010-03-08] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-29] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1300560 2010-03-03] (Dritek System Inc.) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [PowerDVD13Agent] => C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe [517144 2013-07-12] (CyberLink Corp.) HKU\S-1-5-21-2777484894-2762145361-3469590425-1000\...\MountPoints2: {fd3bfeda-cf68-11e2-bf8d-705ab6f35b45} - F:\setup_vmb_lite.exe /checkApplicationPresence HKU\S-1-5-21-2777484894-2762145361-3469590425-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll => No File AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll => No File AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\datamngr.dll => No File AppInit_DLLs: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\IEBHO.dll => No File AppInit_DLLs-x32: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\datamngr.dll => No File AppInit_DLLs-x32: C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\IEBHO.dll => No File Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2013-07-02] ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100 Tcpip\..\Interfaces\{1BFAA5F6-36E9-4D01-8C5B-AFADF6395477}: [DhcpNameServer] 194.168.4.100 194.168.8.100 Internet Explorer: ================== HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://en.hao123.com/?tn=sdkw_inner_pop1_01_hao123_us&fr= HKU\S-1-5-21-2777484894-2762145361-3469590425-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://en.hao123.com/?tn=sdkw_inner_pop1_01_hao123_us&fr= HKU\S-1-5-21-2777484894-2762145361-3469590425-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&m=aspire_5551&r=27361210q235l04f4z1i5t5622n62r SearchScopes: HKLM -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_33&cd=2XzuyEtN2Y1L1QzuyBzz0EyEtDtDtC0C0ByDtCyEyDtA0C0CtN0D0Tzu0StCtAtCyBtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2SyByB0EyCyByByDyEtGtDtBzz0CtG0Czz0BzytGyEzy0DtCtG0C0AyB0EyCzyyB0AyBtDyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0B0AyE0DtA0B0CtGtD0CtDtAtGyE0AtB0CtGzy0Ezy0BtGyByByD0E0CyB0AyD0Ezz0C0B2QtN0A0LzuyE&cr=414742246&ir= SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_33&cd=2XzuyEtN2Y1L1QzuyBzz0EyEtDtDtC0C0ByDtCyEyDtA0C0CtN0D0Tzu0StCtAtCyBtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2SyByB0EyCyByByDyEtGtDtBzz0CtG0Czz0BzytGyEzy0DtCtG0C0AyB0EyCzyyB0AyBtDyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0B0AyE0DtA0B0CtGtD0CtDtAtGyE0AtB0CtGzy0Ezy0BtGyByByD0E0CyB0AyD0Ezz0C0B2QtN0A0LzuyE&cr=414742246&ir= SearchScopes: HKLM -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&sr=0&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = SearchScopes: HKLM-x32 -> {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm335YYGB&ptb=oEzS_mpOSCNk1fikiSf9Cg&ind=2011031516&ptnrS=GRxdm335YYGB&si=43578&n=77dde7dc&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = hxxp://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} SearchScopes: HKLM-x32 -> {E80924FE-0599-4254-A7D2-79881CC67960} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_33&cd=2XzuyEtN2Y1L1QzuyBzz0EyEtDtDtC0C0ByDtCyEyDtA0C0CtN0D0Tzu0StCtAtCyBtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2SyByB0EyCyByByDyEtGtDtBzz0CtG0Czz0BzytGyEzy0DtCtG0C0AyB0EyCzyyB0AyBtDyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0B0AyE0DtA0B0CtGtD0CtDtAtGyE0AtB0CtGzy0Ezy0BtGyByByD0E0CyB0AyD0Ezz0C0B2QtN0A0LzuyE&cr=414742246&ir= SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=113480&tt=060612_5_&babsrc=SP_ss&mntrId=683653cc00000000000078e4001cb514 SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {36377DD7-B3EB-42f5-986F-680BAF59BA9D} URL = hxxp://start.iplay.com/searchresults.aspx?o=chrome&q={searchTerms} SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=GRxdm335YYGB&ptb=oEzS_mpOSCNk1fikiSf9Cg&ind=2011031516&ptnrS=GRxdm335YYGB&si=43578&n=77dde7dc&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW_plGB411GB413 SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD22} URL = hxxp://www.dregol.com/results.php?f=4&q={searchTerms}&a=drg_ir_15_33&cd=2XzuyEtN2Y1L1QzuyBzz0EyEtDtDtC0C0ByDtCyEyDtA0C0CtN0D0Tzu0StCtAtCyBtN1L2XzutAtFtCtBtFyDtFtDtN1L1Czu1BtAtN1L1G1B1V1N2Y1L1Qzu2SyByB0EyCyByByDyEtGtDtBzz0CtG0Czz0BzytGyEzy0DtCtG0C0AyB0EyCzyyB0AyBtDyB0A2QtN1M1F1B2Z1V1N2Y1L1Qzu2Szy0B0AyE0DtA0B0CtGtD0CtDtAtGyE0AtB0CtGzy0Ezy0BtGyByByD0E0CyB0AyD0Ezz0C0B2QtN0A0LzuyE&cr=414742246&ir= SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = hxxp://search.bearshare.com/web?src=ieb&systemid=2&q={searchTerms} SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {c9ab6446-7efc-47fe-966c-dc54324eff9f} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=horus SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {E80924FE-0599-4254-A7D2-79881CC67960} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=2&sr=0&q={searchTerms} SearchScopes: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> {EC0AC64E-30DE-4CDE-9CE8-387B73DBEF12} URL = hxxp://search.softonic.com/MOY00002/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=683653cc00000000000078e4001cb514&toi=16087&r=230 BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO: DataMngr -> {B939CF93-F2CB-443d-956C-DC523D85C9DB} -> C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\x64\BROWSE~1.DLL => No File BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-21] (Microsoft Corp.) BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation) BHO-x32: DataMngr -> {B939CF93-F2CB-443d-956C-DC523D85C9DB} -> C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\BROWSE~1.DLL => No File BHO-x32: Wincore Mediabar -> {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} -> C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll => No File BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2011-02-02] (Sun Microsystems, Inc.) BHO-x32: IEPluginBHO Class -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> C:\Users\BAZYL\AppData\Roaming\Gadu-Gadu 10\_userdata\ggbho.2.dll [2009-12-21] (GG Network S.A.) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.) Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKLM-x32 - Wincore Mediabar - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\PROGRA~2\BEARSH~1\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll No File Toolbar: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File Toolbar: HKU\S-1-5-21-2777484894-2762145361-3469590425-1000 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2016-01-08] (Microsoft Corporation) Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2016-01-08] (Microsoft Corporation) StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF ProfilePath: C:\Users\BAZYL\AppData\Roaming\Mozilla\Firefox\Profiles\wsz1wezb.default-1401298108482 FF SearchEngineOrder.1: FF Keyword.URL: FF Plugin: @microsoft.com/GENUINE -> disabled [No File] FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll [2011-02-02] (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE -> disabled [No File] FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @oberon-media.com/ONCAdapter -> C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll [2011-05-24] (Oberon-Media ) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-2777484894-2762145361-3469590425-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\BAZYL\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-08-08] (Unity Technologies ApS) FF Extension: English (GB) Language Pack - C:\Users\BAZYL\AppData\Roaming\Mozilla\Firefox\Profiles\wsz1wezb.default-1401298108482\Extensions\langpack-en-GB@firefox.mozilla.org.xpi [2015-07-25] [not signed] FF Extension: Adblock Plus - C:\Users\BAZYL\AppData\Roaming\Mozilla\Firefox\Profiles\wsz1wezb.default-1401298108482\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-01-29] FF Extension: Skype - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2016-01-06] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-07-02] [not signed] FF HKU\S-1-5-21-2777484894-2762145361-3469590425-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S4 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1433216 2016-01-08] (Microsoft Corporation) S4 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1773696 2016-01-08] (Microsoft Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-03] (Hewlett-Packard) [File not signed] R2 NTI IScheduleSvc; C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [250368 2010-03-08] (NewTech Infosystems, Inc.) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-03] (Hewlett-Packard) [File not signed] R2 TheCalendarService; C:\Program Files (x86)\CalendarTool\2.0.0.10764\CalendarServ.exe [149432 2015-07-21] () R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 ebdrv; C:\Windows\system32\DRIVERS\evbda.sys [3286016 2009-06-10] (Broadcom Corporation) S3 s115bus; C:\Windows\System32\DRIVERS\s115bus.sys [108296 2007-04-23] (MCCI Corporation) S3 s115mdfl; C:\Windows\System32\DRIVERS\s115mdfl.sys [19720 2007-04-23] (MCCI Corporation) S3 s115mdm; C:\Windows\System32\DRIVERS\s115mdm.sys [144648 2007-04-23] (MCCI Corporation) S3 s115mgmt; C:\Windows\System32\DRIVERS\s115mgmt.sys [126216 2007-04-23] (MCCI Corporation) S3 s115obex; C:\Windows\System32\DRIVERS\s115obex.sys [123656 2007-04-23] (MCCI Corporation) R3 vodafone_K380x-z_dc_enum; C:\Windows\System32\DRIVERS\vodafone_K380x-z_dc_enum.sys [75776 2010-05-20] (Vodafone) S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [235520 2010-08-11] (ZTE Incorporated) ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-29 18:11 - 2016-01-29 18:11 - 00003292 _____ C:\Windows\System32\Tasks\{AF31D905-D39D-490D-AF1F-C0A54BA0E7FA} 2016-01-29 12:39 - 2016-01-29 12:39 - 00007621 _____ C:\Users\BAZYL\AppData\Local\Resmon.ResmonCfg 2016-01-29 12:18 - 2016-01-29 12:23 - 00031160 _____ C:\Users\BAZYL\Downloads\Addition.txt 2016-01-29 12:09 - 2016-01-29 18:42 - 00020086 _____ C:\Users\BAZYL\Downloads\FRST.txt 2016-01-29 12:09 - 2016-01-29 18:42 - 00000000 ____D C:\FRST 2016-01-29 12:08 - 2016-01-29 12:08 - 00007935 _____ C:\Users\BAZYL\Desktop\gmer.txt 2016-01-29 11:03 - 2016-01-29 11:04 - 02370560 _____ (Farbar) C:\Users\BAZYL\Downloads\FRST64.exe 2016-01-29 10:52 - 2016-01-29 10:52 - 00380416 _____ C:\Users\BAZYL\Downloads\4g5g2055.exe 2016-01-29 10:46 - 2016-01-29 10:46 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2016-01-29 10:41 - 2016-01-29 10:42 - 00000990 _____ C:\Users\BAZYL\Downloads\lnkfix_vista.zip 2016-01-29 10:37 - 2016-01-29 10:37 - 00000000 ____D C:\Users\BAZYL\AppData\Local\Apps\2.0 ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-01-29 18:40 - 2010-04-12 03:37 - 00000000 ____D C:\Program Files (x86)\EgisTec IPS 2016-01-29 18:32 - 2009-07-14 04:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2016-01-29 18:32 - 2009-07-14 04:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2016-01-29 18:29 - 2009-07-14 05:13 - 00788704 _____ C:\Windows\system32\PerfStringBackup.INI 2016-01-29 18:29 - 2009-07-14 03:20 - 00000000 ____D C:\Windows\inf 2016-01-29 18:24 - 2010-04-12 03:37 - 00000000 ____D C:\ProgramData\EgisTec IPS 2016-01-29 18:24 - 2009-07-14 05:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2016-01-29 18:15 - 2012-06-16 18:13 - 00000000 ____D C:\ProgramData\Tarma Installer 2016-01-29 18:14 - 2015-08-15 20:11 - 00000000 ____D C:\ProgramData\ToolsUpdatePlatform 2016-01-29 17:28 - 2010-04-12 03:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EgisTec 2016-01-29 12:48 - 2010-12-25 15:05 - 00000000 ____D C:\Users\BAZYL\AppData\Roaming\Skype 2016-01-29 10:46 - 2014-11-23 09:28 - 00000000 ____D C:\Users\BAZYL\AppData\Local\Skype 2016-01-29 10:46 - 2014-11-23 09:27 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk 2016-01-29 10:46 - 2014-11-23 09:27 - 00000000 ___RD C:\Program Files (x86)\Skype 2016-01-29 10:46 - 2010-12-25 15:04 - 00000000 ____D C:\ProgramData\Skype 2016-01-29 10:43 - 2011-05-22 18:43 - 00000481 _____ C:\Users\BAZYL\AppData\Roaming\Microsoft\Windows\Start Menu\Szukaj w Onet.pl - wyszukiwarka stron internetowych.website 2016-01-29 10:37 - 2014-12-30 20:35 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2016-01-29 10:31 - 2015-08-10 13:16 - 00000000 ____D C:\Program Files (x86)\AbleWord 2016-01-29 10:30 - 2014-08-22 23:47 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D6109626-30DD-41ED-95E0-933B24DDE0D1} ==================== Files in the root of some directories ======= 2015-08-15 20:15 - 2015-08-15 20:15 - 0000045 _____ () C:\Users\BAZYL\AppData\Roaming\WB.CFG 2011-01-01 00:21 - 2013-04-22 10:00 - 0009216 _____ () C:\Users\BAZYL\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2016-01-29 12:39 - 2016-01-29 12:39 - 0007621 _____ () C:\Users\BAZYL\AppData\Local\Resmon.ResmonCfg 2012-11-16 14:16 - 2012-11-16 14:16 - 0017408 _____ () C:\Users\BAZYL\AppData\Local\WebpageIcons.db 2010-04-12 03:17 - 2010-01-27 14:40 - 0131472 _____ () C:\ProgramData\FullRemove.exe 2013-07-02 11:39 - 2013-07-02 12:08 - 0000786 _____ () C:\ProgramData\hpzinstall.log 2012-08-02 10:14 - 2012-08-02 10:15 - 0000051 _____ () C:\ProgramData\kfhxpvepfielxmc Files to move or delete: ==================== C:\Users\BAZYL\setup.exe Some files in TEMP: ==================== C:\Users\BAZYL\AppData\Local\Temp\1439670399.exe C:\Users\BAZYL\AppData\Local\Temp\1454091267.exe C:\Users\BAZYL\AppData\Local\Temp\BullseyeCoverage-2-x86.dll C:\Users\BAZYL\AppData\Local\Temp\InstallHelper.exe C:\Users\BAZYL\AppData\Local\Temp\nsuEEE0.exe C:\Users\BAZYL\AppData\Local\Temp\spark_install.exe C:\Users\BAZYL\AppData\Local\Temp\_isD7C8.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\dnsapi.dll => File is digitally signed C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed ==================== BCD ================================ Windows Boot Manager -------------------- identifier {bootmgr} device partition=\Device\HarddiskVolume2 description Windows Boot Manager locale en-US inherit {globalsettings} default {current} resumeobject {0200602e-6536-11df-93a6-95f58568c495} displayorder {current} toolsdisplayorder {memdiag} timeout 30 Windows Boot Loader ------------------- identifier {current} device partition=C: path \Windows\system32\winload.exe description Windows 7 locale en-US inherit {bootloadersettings} recoverysequence {02006030-6536-11df-93a6-95f58568c495} recoveryenabled Yes osdevice partition=C: systemroot \Windows resumeobject {0200602e-6536-11df-93a6-95f58568c495} nx OptIn Windows Boot Loader ------------------- identifier {02006030-6536-11df-93a6-95f58568c495} device ramdisk=[C:]\Recovery\02006030-6536-11df-93a6-95f58568c495\Winre.wim,{02006031-6536-11df-93a6-95f58568c495} path \windows\system32\winload.exe description Windows Recovery Environment inherit {bootloadersettings} osdevice ramdisk=[C:]\Recovery\02006030-6536-11df-93a6-95f58568c495\Winre.wim,{02006031-6536-11df-93a6-95f58568c495} systemroot \windows nx OptIn winpe Yes Resume from Hibernate --------------------- identifier {0200602e-6536-11df-93a6-95f58568c495} device partition=C: path \Windows\system32\winresume.exe description Windows Resume Application locale en-US inherit {resumeloadersettings} filedevice partition=C: filepath \hiberfil.sys debugoptionenabled No Windows Memory Tester --------------------- identifier {memdiag} device partition=\Device\HarddiskVolume2 path \boot\memtest.exe description Windows Memory Diagnostic locale en-US inherit {globalsettings} badmemoryaccess Yes EMS Settings ------------ identifier {emssettings} bootems Yes Debugger Settings ----------------- identifier {dbgsettings} debugtype Serial debugport 1 baudrate 115200 RAM Defects ----------- identifier {badmemory} Global Settings --------------- identifier {globalsettings} inherit {dbgsettings} {emssettings} {badmemory} Boot Loader Settings -------------------- identifier {bootloadersettings} inherit {globalsettings} {hypervisorsettings} Hypervisor Settings ------------------- identifier {hypervisorsettings} hypervisordebugtype Serial hypervisordebugport 1 hypervisorbaudrate 115200 Resume Loader Settings ---------------------- identifier {resumeloadersettings} inherit {globalsettings} Device options -------------- identifier {02006031-6536-11df-93a6-95f58568c495} description Ramdisk Options ramdisksdidevice partition=C: ramdisksdipath \Recovery\02006030-6536-11df-93a6-95f58568c495\boot.sdi LastRegBack: 2015-08-20 21:00 ==================== End of FRST.txt ============================