Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 31-08-2016
Ran by DINO (administrator) on DINO-PC (05-09-2016 18:26:42)
Running from C:\Users\DINO\Downloads
Loaded Profiles: DINO (Available Profiles: DINO & Guest)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: "C:\Program Files (x86)\Firefox\Firefox.exe" "%1")
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(ExWzp Pvt Ltd.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Trend Corp.) C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(WFini LIMITED) C:\ProgramData\swinps\WFini.exe
() C:\Program Files (x86)\WinSaber\WinSaber.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.31.5\GoogleCrashHandler64.exe
(Saitek) C:\Program Files\SmartTechnology\Software\ProfilerU.exe
(Saitek) C:\Program Files\SmartTechnology\Software\SaiMfd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Codeton Software) C:\Program Files (x86)\Paseczek\Paseczek.exe
(Spotify Ltd) C:\Users\DINO\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\DINO\AppData\Roaming\Spotify\Spotify.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Spotify Ltd) C:\Users\DINO\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Spotify Ltd) C:\Users\DINO\AppData\Roaming\Spotify\Spotify.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\32\WacomDesktopCenter.exe
(Spotify Ltd) C:\Users\DINO\AppData\Roaming\Spotify\Spotify.exe
(Mozilla Corporation) C:\Program Files (x86)\Firefox\Firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_22_0_0_209.exe
() C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe
() C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ProfilerU] => C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2012-10-15] (Saitek)
HKLM\...\Run: [SaiMfd] => C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2012-10-15] (Saitek)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2771576 2015-12-16] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1846016 2015-12-16] (NVIDIA Corporation)
HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [Steam] => "D:\PROGRAMY\steam\Steam.exe" -silent
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [Facebook Update] => C:\Users\DINO\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-06-25] (Facebook Inc.)
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [Paseczek] => C:\Program Files (x86)\Paseczek\Paseczek.exe [1616384 2008-03-07] (Codeton Software)
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [Spotify Web Helper] => C:\Users\DINO\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1523312 2016-08-29] (Spotify Ltd)
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [Spotify] => C:\Users\DINO\AppData\Roaming\Spotify\Spotify.exe [6930544 2016-08-29] (Spotify Ltd)
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [918824 2015-04-06] (Kaspersky Lab ZAO)
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\MountPoints2: {28587c08-3459-11e6-a9ce-a6b8768294d7} - J:\intro.exe
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\MountPoints2: {2a1d161c-4ac8-11e2-887f-f6108075ee17} - H:\dvdcheck.exe
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\MountPoints2: {2a1d161e-4ac8-11e2-887f-f6108075ee17} - I:\dvdcheck.exe
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\...\MountPoints2: {3714c949-3cc1-11e2-a69c-806e6f6e6963} - E:\autorun.exe
AppInit_DLLs: C:\ProgramData\Opejob\Singredstrong.dll => No File
AppInit_DLLs-x32: C:\ProgramData\Opejob\Opensanlab.dll => No File
ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll [2014-02-07] (Autodesk, Inc.)
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\..\Interfaces\{4346699D-40FE-42A3-A423-1C3291355C46}: [NameServer] 8.8.8.8,8.8.8.4
Tcpip\..\Interfaces\{7D839327-1905-4820-A948-F51753C72186}: [NameServer] 192.168.0.1,192.168.0.2

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7qNDRR7O5HssxgYHeMF2xQynl7GLhHvGItAUHZBjZDlyy9jruiQvCzaAtJFeGv92xlrPapX7ojg1jZ825FxNry4WYsTTI4c2go-EP7VBrJFObQdxmUl5TaT6YhkMW_gNz2Q7k_MZnaw,,&q={searchTerms}
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7qNDRR7O5HssxgYHeMF2xQynl7GLhHvGItAUHZBjZDlyy9jruiQvCzaAtJFeGv92xlrPapX7ojg1jZ825FxNry4WYsTTI4c2go-EP7VBrJFObQdxmUl5TaT6YhkMW_gNz2Q7k_MZnaw,,&q={searchTerms}
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\Software\Microsoft\Internet Explorer\Main,SearchAssistant = hxxp://%66%65%65%64.%73%6F%6E%69%63-%73%65%61%72%63%68.%63%6F%6D/?p=mKO_AwFzXIpYRaHdGKBPxn49PYmQ6e1krQXBFZY3csf7qNDRR7O5HssxgYHeMF2xQynl7GLhHvGItAUHZBjZDlyy9jruiQvCzaAtJFeGv92xlrPapX7ojg1jZ825FxNry4WYsTTI4c2go-EP7VBrJFObQdxmUl5TaT6YhkMW_gNz2Q7k_MZnaw,,&q={searchTerms}
HKU\S-1-5-21-819675344-3165160550-3345714557-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nuesearch.com/?type=hp&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
SearchScopes: HKU\S-1-5-21-819675344-3165160550-3345714557-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
SearchScopes: HKU\S-1-5-21-819675344-3165160550-3345714557-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nuesearch.com/search/?type=ds&ts=1466009986&z=8a91de2c6a230366785450egbzfq5q8e4ebt1t6tde&from=wpm0614&uid=TOSHIBAXQ300_Y5DB635CKNRX&q={searchTerms}
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-07-10] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-07-10] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
StartMenuInternet: IEXPLORE.EXE - c:\program files (x86)\internet explorer\iexplore.exe hxxp://www.nuesearch.com/?type=sc&ts=1470660500&z=92cd54b43c4a0751522bac0g0zdmaebqaq7eew4e2g&from=wpm0808&uid=TOSHIBAXQ300_Y5DB635CKNRX

FireFox:
========
FF ProfilePath: C:\Users\DINO\AppData\Roaming\Mozilla\Firefox\Profiles\03s88ok4.default-1467632118373
FF Homepage: hxxp://www.nuesearch.com/?type=hp&ts=1470660500&z=92cd54b43c4a0751522bac0g0zdmaebqaq7eew4e2g&from=wpm0808&uid=TOSHIBAXQ300_Y5DB635CKNRX
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_22_0_0_209.dll [2016-07-16] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_22_0_0_209.dll [2016-07-16] ()
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [2013-11-21] (EA Digital Illusions CE AB)
FF Plugin-x32: @esn/npbattlelog,version=2.4.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.4.0\npbattlelog.dll [2014-05-26] (EA Digital Illusions CE AB)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf -> D:\PROGRAMY\Foxit Reader\plugins\npFoxitReaderPlugin.dll [No File]
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2013-07-16] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-07-10] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll [2013-09-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-12-16] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-07-29] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: PDF Architect 4 -> C:\Program Files (x86)\PDF Architect 4\np-previewer.dll [2015-10-19] (pdfforge GmbH)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin HKU\S-1-5-21-819675344-3165160550-3345714557-1000: @Skype Limited.com/Facebook Video Calling Plugin -> C:\Users\DINO\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll [2014-07-24] (Skype Limited)
FF HKLM-x32\...\Firefox\Extensions: [deskCutv2@gmail.com] - C:\Users\DINO\AppData\Roaming\Mozilla\Firefox\Profiles\uws6d1y7.default\extensions\deskCutv2@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [yahooprotected@gmail.com] - C:\Users\DINO\AppData\Roaming\Mozilla\Firefox\Profiles\uws6d1y7.default\extensions\yahooprotected@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [default_newtabff@gmail.com] - C:\Users\DINO\AppData\Roaming\Mozilla\Firefox\Profiles\uws6d1y7.default\extensions\default_newtabff@gmail.com => not found
FF HKLM-x32\...\Firefox\Extensions: [arthurj8283@gmail.com] - C:\Users\DINO\AppData\Roaming\Mozilla\Firefox\Profiles\uws6d1y7.default\extensions\arthurj8283@gmail.com => not found

Chrome: 
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR HKU\S-1-5-21-819675344-3165160550-3345714557-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [bknbnapaddjdnbilpmlacdkjdkjmbjhd] - hxxp://clients2.google.com/service/update2/crx

Opera: 
=======
StartMenuInternet: (HKLM) OperaStable - C:\Program Files (x86)\Opera\Launcher.exe hxxp://www.nuesearch.com/?type=sc&ts=1470660500&z=92cd54b43c4a0751522bac0g0zdmaebqaq7eew4e2g&from=wpm0808&uid=TOSHIBAXQ300_Y5DB635CKNRX

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1863688 2016-04-07] ()
S4 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-03] (BitRaider, LLC)
S4 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [915736 2014-04-07] (BitRaider, LLC)
R2 CommandHandler; C:\Program Files (x86)\Firefox\bin\FirefoxCommand.exe [253824 2016-08-02] ()
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2012-12-09] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2012-12-09] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [294912 2010-12-28] (Creative Technology Ltd) [File not signed]
R2 FirefoxU; C:\Program Files (x86)\Firefox\bin\FirefoxUpdate.exe [499072 2016-08-02] ()
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1156216 2015-12-16] (NVIDIA Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 IhPul; C:\Users\DINO\AppData\Roaming\TSv\TSvr.exe [210128 2016-08-08] (Trend Corp.)
R2 kss; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe [918824 2015-04-06] (Kaspersky Lab ZAO)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1872504 2015-12-16] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [8185464 2015-12-16] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [6477432 2015-12-16] (NVIDIA Corporation)
S3 PDF Architect 4; C:\Program Files\PDF Architect 4\ws.exe [2417376 2015-10-19] (pdfforge GmbH)
S3 PDF Architect 4 CrashHandler; C:\Program Files\PDF Architect 4\crash-handler-ws.exe [1038048 2015-10-19] (pdfforge GmbH)
S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]
R2 WdMan; C:\ProgramData\swinps\WFini.exe [564456 2016-08-02] (WFini LIMITED)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 winsaber; C:\Program Files (x86)\WinSaber\WinSaber.exe [432344 2016-07-28] ()
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [1242232 2016-07-27] (ExWzp Pvt Ltd.) <==== ATTENTION
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [730304 2016-01-11] (Wacom Technology, Corp.)
S4 YestonyP; C:\ProgramData\Yestony\Yestony.exe [399768 2016-05-27] ()
S4 YestonyU; C:\Program Files (x86)\Yestony\Update\YestonyUpdate.exe [533400 2016-05-27] ()
S2 NoIPDUCService4; D:\PROGRAMY\No-IP\ducservice.exe [X]
S2 Opejob; C:\ProgramData\Opejob\Opejob.exe [X]
S2 SSFK; C:\Program Files (x86)\SFK\SSFK.exe -s [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30264 2016-05-27] (Disc Soft Ltd)
S3 dtliteusbbus; C:\Windows\System32\DRIVERS\dtliteusbbus.sys [47672 2016-05-27] (Disc Soft Ltd)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-12-20] (DT Soft Ltd)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19576 2015-12-16] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [50472 2015-12-16] (NVIDIA Corporation)
R0 pwdrvio; C:\Windows\System32\pwdrvio.sys [19152 2013-09-30] ()
S3 pwdspio; C:\Windows\system32\pwdspio.sys [12504 2013-09-30] ()
S3 SaiH075C; C:\Windows\System32\DRIVERS\SaiH075C.sys [171144 2007-05-01] (Saitek)
R3 SaiK0CCB; C:\Windows\System32\DRIVERS\SaiK0CCB.sys [180544 2012-09-20] (Saitek)
R3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [24680 2012-10-15] (Saitek)
R3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52200 2012-10-15] (Saitek)
R3 SaiU0CCB; C:\Windows\System32\DRIVERS\SaiU0CCB.sys [47168 2012-09-20] (Saitek)
S3 UHSfiltv; C:\Windows\System32\drivers\UHSfiltv.sys [23552 2011-07-15] (Creative Technology Ltd.)
S3 avchv; system32\DRIVERS\avchv.sys [X]
S3 BRDriver64; \??\C:\programdata\bitraider\BRDriver64.sys [X]
S3 BRDriver64_1_3_3_7ECFDFEA; \??\C:\ProgramData\BitRaider\support\1.3.3\7ECFDFEA\BRDriver64.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
S1 wfdrvr_vt_1_10_0_28; system32\drivers\wfdrvr_vt_1_10_0_28.sys [X]
S1 {31c21995-b861-4864-ab50-4a53fbca73d4}Gw64; system32\drivers\{31c21995-b861-4864-ab50-4a53fbca73d4}Gw64.sys [X]
S1 {371bcf01-e691-44bf-9345-60788e5d16a5}Gw64; system32\drivers\{371bcf01-e691-44bf-9345-60788e5d16a5}Gw64.sys [X]
S1 {df8eec40-f909-439c-9ffe-3fee212f71b9}Gw64; system32\drivers\{df8eec40-f909-439c-9ffe-3fee212f71b9}Gw64.sys [X]
U3 kxtdapob; \??\C:\Users\DINO\AppData\Local\Temp\kxtdapob.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-05 18:26 - 2016-09-05 18:26 - 00024642 _____ C:\Users\DINO\Downloads\FRST.txt
2016-09-05 18:25 - 2016-09-05 18:26 - 00000000 ____D C:\FRST
2016-09-05 18:25 - 2016-09-05 18:25 - 00083475 _____ C:\Users\DINO\Desktop\GMER.txt
2016-09-05 18:14 - 2016-09-05 18:14 - 02397696 _____ (Farbar) C:\Users\DINO\Downloads\FRST64.exe
2016-09-05 18:14 - 2016-09-05 18:14 - 00380928 _____ C:\Users\DINO\Downloads\4df1xwxd.exe
2016-09-05 18:03 - 2016-09-05 18:09 - 00593952 _____ (Duplex Secure Ltd) C:\Users\DINO\Downloads\SPTDinst-v189-x64.exe
2016-09-05 18:03 - 2016-09-05 18:03 - 00496160 _____ (Duplex Secure Ltd) C:\Users\DINO\Downloads\SPTDinst-v189-x86.exe
2016-09-03 20:16 - 2016-09-03 20:16 - 00004608 _____ C:\Users\DINO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-09-01 22:15 - 2016-09-03 10:57 - 00000000 ____D C:\Users\DINO\Desktop\New folder
2016-08-28 17:30 - 2016-08-30 12:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-08 14:48 - 2016-09-05 18:10 - 00000001 _____ C:\Windows\SysWOW64\pl.html
2016-08-08 14:48 - 2016-08-15 22:37 - 00000000 ____D C:\Program Files (x86)\SFK
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\pl_182333.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_205905.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_205422.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_205203.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_204579.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_204439.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_203924.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_203784.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_200367.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_200227.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_189775.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_189619.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_189447.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_189307.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000003 _____ C:\Windows\SysWOW64\EN_185734.html
2016-08-08 14:48 - 2016-08-08 14:48 - 00000000 ____D C:\ProgramData\swinps

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-09-05 18:21 - 2016-05-27 12:50 - 00000000 _____ C:\Users\Public\Documents\report.dat
2016-09-05 18:15 - 2015-07-02 19:39 - 00000000 ____D C:\Users\DINO\AppData\Roaming\Spotify
2016-09-05 18:15 - 2009-07-14 07:13 - 00781582 _____ C:\Windows\system32\PerfStringBackup.INI
2016-09-05 18:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-09-05 18:12 - 2016-01-08 09:16 - 00000000 ____D C:\Program Files (x86)\WinZipper
2016-09-05 18:10 - 2016-04-16 08:27 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-09-05 18:10 - 2015-07-02 19:40 - 00000000 ____D C:\Users\DINO\AppData\Local\Spotify
2016-09-05 18:09 - 2012-12-02 23:19 - 00000000 ____D C:\ProgramData\NVIDIA
2016-09-05 18:09 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-09-05 18:09 - 2009-07-14 06:45 - 00020368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-09-05 18:09 - 2009-07-14 06:45 - 00020368 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-09-05 17:43 - 2013-01-17 19:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-09-05 17:42 - 2016-04-16 08:27 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-09-04 21:05 - 2013-06-25 15:00 - 00000924 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-819675344-3165160550-3345714557-1000UA.job
2016-09-04 15:05 - 2013-06-25 15:00 - 00000902 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-819675344-3165160550-3345714557-1000Core.job
2016-09-03 09:04 - 2016-03-11 22:59 - 00000000 ____D C:\Users\DINO\AppData\Local\CrashDumps
2016-09-01 19:31 - 2014-08-20 20:14 - 00198144 _____ C:\Users\DINO\Documents\Nowy Microsoft Excel Worksheet.xls
2016-08-30 12:18 - 2012-12-02 23:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-08-08 14:48 - 2016-08-05 08:38 - 00000000 ____D C:\Windows\SysWOW64\_SSpm
2016-08-08 14:48 - 2016-01-08 09:15 - 00000000 ____D C:\Users\DINO\AppData\Roaming\TSv

==================== Files in the root of some directories =======

2015-05-05 21:05 - 2015-05-05 21:05 - 0000079 _____ () C:\Program Files\prefs.js
2016-03-11 22:59 - 2016-03-11 22:59 - 2459593 _____ (tBank) C:\Program Files (x86)\SSFK.exe
2014-05-25 19:24 - 2014-05-25 19:24 - 0000132 _____ () C:\Users\DINO\AppData\Roaming\Preferencje formatu Targa CS6 firmy Adobe
2016-09-03 20:16 - 2016-09-03 20:16 - 0004608 _____ () C:\Users\DINO\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-01-03 23:20 - 2016-01-03 23:20 - 0007602 _____ () C:\Users\DINO\AppData\Local\Resmon.ResmonCfg
2016-01-08 09:15 - 2016-03-17 17:51 - 0000074 _____ () C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat

Files to move or delete:
====================
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat


Some files in TEMP:
====================
C:\Users\DINO\AppData\Local\Temp\bitool.dll
C:\Users\DINO\AppData\Local\Temp\haha.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2010-11-21 05:24] - [2012-12-02 22:51] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2010-11-21 05:24] - [2012-12-02 22:51] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-08-29 07:34

==================== End of FRST.txt ============================