Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-12-2014 ([color=red]ATTENTION: ====> FRST version is 941 days old and could be outdated[/color]) Ran by szymon (administrator) on SAMSUNG on 09-07-2017 09:01:20 Running from C:\Users\szymon\Downloads Loaded Profile: szymon (Available profiles: szymon) Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe () C:\Program Files\CDBurnerXP\NMSAccessU.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\wsc_proxy.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe () C:\Program Files\4G Hostless Modem\MegaFon Internet\CheckNDISPort_df.exe () C:\Program Files\4G Hostless Modem\MegaFon Internet\CancelAutoPlay_df.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Google Inc.) C:\Program Files\Google\Update\1.3.33.5\GoogleCrashHandler.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-10-26] (Synaptics, Inc.) HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [CheckNDISPort01ac00] => C:\Program Files\4G Hostless Modem\MegaFon Internet\CheckNDISPort_df.exe [468736 2015-11-09] () HKLM\...\Run: [CancelAutoPlay_df] => C:\Program Files\4G Hostless Modem\MegaFon Internet\CancelAutoPlay_df.exe [447744 2015-11-09] () HKLM\...\Run: [vProt] => "C:\Program Files\AVG Web TuneUp\vprot.exe" HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [213832 2017-07-08] (AVAST Software) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [587288 2017-03-15] (Oracle Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: F - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: G - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {3168420c-9e89-11e2-94fe-d710a21dcda3} - G:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {69300500-c0ce-11de-afea-acbb43663a4d} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {69300511-c0ce-11de-afea-acbb43663a4d} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {695d2417-22a7-11de-b8e6-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {708d157c-aecf-11e3-8d26-d8e90d368216} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {754f9d29-f955-11e2-bb68-906108090fac} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {7e8d2079-f9fd-11e2-908f-a4a989e715d3} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {7e8d2089-f9fd-11e2-908f-9df2729782e7} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {8baf0962-22c4-11de-9eb4-001377988fb5} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {8baf0964-22c4-11de-9eb4-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {d8e650d3-58c6-11e6-9adf-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {d8e650d7-58c6-11e6-9adf-00a0c6000000} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {e470a6c5-e855-11e5-8caa-001377988fb5} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {f05c6ab7-22a8-11de-8ca6-001377988fb5} - F:\AutoRun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Automatyczne aktualizacje-AKP.lnk ShortcutTarget: RT-Automatyczne aktualizacje-AKP.lnk -> C:\Ross-Tech\VCDS-AKP\VCDS.exe (Ross-Tech, LLC) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKU\S-1-5-21-3182861355-789584673-1566108675-1003\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={3BAC7F41-9BA9-46E9-8151-87FDAF5BD6B7}&mid=65dc52c9b60b47d1a7ed7b845693f755-862601dd4d5fd094e5eb86225258b6219715b1f2&lang=pl&ds=AVG&coid=avgtbavg&cmpid=ZenTest_B_0&pr=fr&d=2017-05-26 22:20:28&v=4.3.7.452&pid=wtu&sg=&sap=hp SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3182861355-789584673-1566108675-1003 -> {95B7759C-8C7F-4BF1-B163-73684A933233} URL = https://mysearch.avg.com/search?cid={3BAC7F41-9BA9-46E9-8151-87FDAF5BD6B7}&mid=65dc52c9b60b47d1a7ed7b845693f755-862601dd4d5fd094e5eb86225258b6219715b1f2&lang=pl&ds=AVG&coid=avgtbavg&cmpid=ZenTest_B_0&pr=fr&d=2017-05-26 22:20:28&v=4.3.7.452&pid=wtu&sg=&sap=dsp&q={searchTerms} BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_131\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: AVG Web TuneUp -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG Web TuneUp\4.3.7.452\AVG Web TuneUp.dll No File BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_131\bin\jp2ssv.dll (Oracle Corporation) BHO: IEPluginBHO Class -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> C:\ProgramData\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKU\S-1-5-21-3182861355-789584673-1566108675-1003 -> &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation) Toolbar: HKU\S-1-5-21-3182861355-789584673-1566108675-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} http://www.eska.pl/streamplayers/OggX.ocx DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Winsock: Catalog5 01 C:\Windows\system32\NLAapi.dll [48640] (Microsoft Corporation) Winsock: Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation) Winsock: Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation) Winsock: Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation) Winsock: Catalog5 05 C:\Windows\system32\wshbth.dll [34304] (Microsoft Corporation) Winsock: Catalog5 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog5 07 C:\Windows\system32\winrnr.dll [19968] (Microsoft Corporation) Winsock: Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 19 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 20 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 21 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 22 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 23 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 24 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 25 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_26_0_0_131.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1229199.dll (Adobe Systems, Inc.) FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin -> C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\40.3.7\\npsitesafety.dll No File FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.131.2 -> C:\Program Files\Java\jre1.8.0_131\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.33.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3182861355-789584673-1566108675-1003: @tools.google.com/Google Update;version=3 -> C:\Users\szymon\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File FF Plugin HKU\S-1-5-21-3182861355-789584673-1566108675-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\szymon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default\searchplugins\avg-secure-search.xml FF Extension: FTdownloader 2 - C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\profiles\extensions\ftdownloader2@ftdownloader.com.xpi [2013-02-11] FF Extension: No Name - C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default\Extensions\avg@toolbar.xpi [2017-05-27] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-28] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [Not Found] Chrome: ======= CHR Profile: C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Default CHR Profile: C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1 CHR Extension: (Google Slides) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-05] CHR Extension: (Google Docs) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-05] CHR Extension: (Google Drive) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-28] CHR Extension: (YouTube) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-28] CHR Extension: (Google Search) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-28] CHR Extension: (Google Sheets) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-03-05] CHR Extension: (Chrome Web Store Payments) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-28] CHR Extension: (Gmail) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-28] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - No Path CHR HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\Chrome\Extension: [chfdnecihphmhljaaejmgoiahnihplgn] - No Path ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AdobeFlashPlayerUpdateSvc; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [272384 2017-06-16] (Adobe Systems Incorporated) [File not signed] S3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [5815840 2017-07-08] (AVAST Software s.r.o.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [263312 2017-07-08] (AVAST Software) R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [819200 2008-05-23] (Intel(R) Corporation) [File not signed] S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation) R2 NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2009-07-13] () R2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-05-23] (Intel(R) Corporation) [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] () S2 Samsung Update Plus; C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe [77480 2008-05-13] () [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AMTFLASH; C:\Windows\System32\drivers\AmtFlash.sys [37632 2011-09-07] (AMT-Cartech Ltd.) S3 aswbidsdriver; C:\Windows\system32\drivers\aswbidsdriverx.sys [266976 2017-07-08] (AVAST Software s.r.o.) S3 aswbidsh; C:\Windows\system32\drivers\aswbidshx.sys [157384 2017-07-08] (AVAST Software s.r.o.) S3 aswblog; C:\Windows\system32\drivers\aswblogx.sys [276704 2017-07-08] (AVAST Software s.r.o.) S3 aswbuniv; C:\Windows\system32\drivers\aswbunivx.sys [50352 2017-07-08] (AVAST Software s.r.o.) S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [42824 2017-07-08] (AVAST Software) S3 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [39752 2017-07-08] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [123896 2017-07-08] (AVAST Software) S3 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [70088 2017-07-08] (AVAST Software) R0 aswRvrt; C:\Windows\system32\drivers\aswRvrt.sys [70840 2017-07-08] (AVAST Software) S3 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [774288 2017-07-08] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [496976 2017-07-08] (AVAST Software) S3 aswStmXP; C:\Windows\system32\drivers\aswStmXP.sys [202688 2017-07-08] (AVAST Software) S3 aswVmm; C:\Windows\system32\drivers\aswVmm.sys [296312 2017-07-08] (AVAST Software) S3 FTD2XX; C:\Windows\System32\Drivers\OPCOMUSB.sys [57800 2009-10-22] (FTDI Ltd.) S3 FTDIBUS; C:\Windows\System32\drivers\opcomusb.sys [57800 2009-10-22] (FTDI Ltd.) R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-05-23] (SAMSUNG ELECTRONICS CO., LTD.) S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [80256 2014-05-12] (Ross-Tech LLC) R3 VMC326; C:\Windows\System32\Drivers\VMC326.sys [238464 2008-09-03] (Vimicro Corporation) [File not signed] U3 aswbdisk; No ImagePath U3 aswStm; No ImagePath S1 ESProtectionDriver; \??\C:\Windows\system32\drivers\mbae.sys [X] S3 IntcAzAudAddService; system32\drivers\RTKVHDA.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 massfilter_lte; \??\C:\Windows\system32\drivers\massfilter_lte.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 zgdcat; system32\DRIVERS\zgdcat.sys [X] S3 zgdcdiag; system32\DRIVERS\zgdcdiag.sys [X] S3 zgdcmdm; system32\DRIVERS\zgdcmdm.sys [X] S3 zgdcnet; system32\DRIVERS\zgdcnet.sys [X] S3 zgdcnmea; system32\DRIVERS\zgdcnmea.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2017-07-09 08:32 - 2017-07-09 08:32 - 00000000 ____D () C:\ProgramData\SWCUTemp 2017-07-09 01:22 - 2017-07-09 01:22 - 01782784 _____ (Farbar) C:\Users\szymon\Downloads\FRST (2).exe 2017-07-09 01:22 - 2017-07-09 01:22 - 01782784 _____ (Farbar) C:\Users\szymon\Downloads\FRST (1).exe 2017-07-09 00:52 - 2017-07-09 00:53 - 04110280 _____ () C:\Users\szymon\Downloads\adwcleaner_6.047 (3).exe 2017-07-08 23:38 - 2017-07-08 23:38 - 63035592 _____ (Malwarebytes ) C:\Users\szymon\Downloads\Malwarebytes Free 3.1.2.1733 [1].exe 2017-07-08 23:38 - 2017-07-08 23:38 - 00000000 ____D () C:\Program Files\Malwarebytes 2017-07-08 23:23 - 2017-07-09 01:00 - 00000000 ____D () C:\AdwCleaner 2017-07-08 23:18 - 2017-07-08 23:19 - 04110280 _____ () C:\Users\szymon\Downloads\adwcleaner_6.047 (2).exe 2017-07-08 22:54 - 2017-07-08 22:54 - 04110280 _____ () C:\Users\szymon\Downloads\adwcleaner_6.047_www.INSTALKI.pl.exe 2017-07-08 22:36 - 2017-07-08 22:36 - 00000000 _____ () C:\Users\szymon\Downloads\Niepotwierdzony 5377.crdownload 2017-07-08 22:29 - 2017-07-08 22:29 - 00000000 ____D () C:\Program Files\Common Files\Java 2017-07-08 22:26 - 2017-07-08 22:27 - 04110280 _____ () C:\Users\szymon\Downloads\adwcleaner_6.047 (1).exe 2017-07-08 21:12 - 2017-07-08 21:12 - 00000000 ____D () C:\ProgramData\WindowsSearch 2017-07-08 20:53 - 2017-07-09 08:35 - 00001680 _____ () C:\Windows\system32\debug.log 2017-07-08 20:42 - 2017-07-08 20:42 - 00039752 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys 2017-07-08 20:38 - 2017-07-08 20:38 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\AVAST Software 2017-07-08 20:38 - 2017-07-08 20:38 - 00000000 _____ () C:\Windows\setuperr.log 2017-07-08 20:38 - 2017-07-08 20:38 - 00000000 _____ () C:\Windows\setupact.log 2017-07-08 20:37 - 2017-07-08 20:37 - 00296312 _____ (AVAST Software) C:\Windows\system32\Drivers\aswvmm.sys 2017-07-08 20:37 - 2017-07-08 20:37 - 00001829 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2017-07-08 20:37 - 2017-07-08 20:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2017-07-08 20:37 - 2017-07-08 20:36 - 00774288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00496976 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00202688 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStmXP.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00123896 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00070840 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00070088 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr.sys 2017-07-08 20:37 - 2017-07-08 20:36 - 00042824 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys 2017-07-08 20:37 - 2017-07-08 20:35 - 00276704 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswblogx.sys 2017-07-08 20:37 - 2017-07-08 20:35 - 00266976 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidsdriverx.sys 2017-07-08 20:37 - 2017-07-08 20:35 - 00157384 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbidshx.sys 2017-07-08 20:37 - 2017-07-08 20:35 - 00050352 _____ (AVAST Software s.r.o.) C:\Windows\system32\Drivers\aswbunivx.sys 2017-07-08 20:36 - 2017-07-08 20:36 - 00921280 _____ (Microsoft Corporation) C:\Windows\ucrtbase.dll 2017-07-08 20:36 - 2017-07-08 20:36 - 00303280 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe 2017-07-08 20:32 - 2017-07-08 20:32 - 06922168 _____ (AVAST Software) C:\Users\szymon\Downloads\avast_free_antivirus_setup_online.exe 2017-07-08 19:57 - 2017-07-08 19:57 - 00047633 _____ () C:\Users\szymon\Downloads\Niepotwierdzony 911924.crdownload 2017-07-08 19:50 - 2017-07-08 19:50 - 00000000 _____ () C:\Users\szymon\Downloads\Niepotwierdzony 636496.crdownload 2017-07-08 19:06 - 2017-07-08 19:06 - 00735240 _____ (Opera Software) C:\Users\szymon\Downloads\OperaSetupWinxpvista.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2017-07-09 09:01 - 2014-12-11 19:55 - 00022598 _____ () C:\Users\szymon\Downloads\FRST.txt 2017-07-09 09:01 - 2014-12-11 19:55 - 00000000 ____D () C:\FRST 2017-07-09 08:47 - 2009-01-18 01:36 - 01917290 _____ () C:\Windows\WindowsUpdate.log 2017-07-09 08:29 - 2006-11-02 14:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2017-07-09 08:29 - 2006-11-02 14:45 - 00004384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2017-07-09 08:29 - 2006-11-02 14:45 - 00004384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2017-07-09 01:31 - 2008-07-30 01:52 - 00000012 _____ () C:\Windows\bthservsdp.dat 2017-07-09 01:31 - 2006-11-02 14:58 - 00032532 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2017-07-09 01:28 - 2014-12-11 19:56 - 00018426 _____ () C:\Users\szymon\Downloads\Addition.txt 2017-07-09 01:11 - 2008-01-21 05:02 - 01184808 _____ () C:\Windows\PFRO.log 2017-07-09 00:50 - 2011-08-03 21:44 - 00000000 ____D () C:\Users\szymon\AppData\Local\CrashDumps 2017-07-09 00:09 - 2009-12-22 19:07 - 00000000 ____D () C:\Users\szymon\Desktop\nowa muzyka 2017-07-09 00:01 - 2012-04-18 18:52 - 00000000 ____D () C:\ProgramData\InstallMate 2017-07-08 22:27 - 2016-11-13 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2017-07-08 22:26 - 2016-11-13 18:42 - 00095808 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2017-07-08 22:24 - 2016-11-13 18:41 - 00000000 ____D () C:\Program Files\Java 2017-07-08 22:22 - 2013-07-18 18:44 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR 2017-07-08 22:22 - 2013-07-18 18:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR 2017-07-08 22:22 - 2013-04-22 22:05 - 00000000 ____D () C:\Program Files\WinRAR 2017-07-08 21:03 - 2015-12-08 19:05 - 00000000 ____D () C:\ProgramData\Avg 2017-07-08 21:03 - 2011-05-16 22:12 - 00000000 ____D () C:\Program Files\AVG 2017-07-08 21:02 - 2017-05-21 16:54 - 00000000 ____D () C:\Users\szymon\AppData\Local\AvgSetupLog 2017-07-08 20:57 - 2011-10-30 22:56 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\AVG 2017-07-08 20:42 - 2011-04-10 00:12 - 00000000 ____D () C:\ProgramData\AVAST Software 2017-07-08 20:42 - 2011-04-10 00:12 - 00000000 ____D () C:\Program Files\AVAST Software 2017-07-05 18:03 - 2014-11-19 18:09 - 00000000 ____D () C:\Users\szymon\AppData\Local\Avg 2017-07-04 19:14 - 2017-05-27 00:14 - 00135872 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\asw6640816a330e8c41.tmp 2017-06-16 23:28 - 2014-12-11 20:45 - 00803328 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2017-06-16 23:28 - 2014-12-11 20:45 - 00144896 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2017-06-16 23:28 - 2008-07-29 10:13 - 00000000 ____D () C:\Windows\system32\Macromed 2017-06-15 01:40 - 2016-11-20 13:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox 2017-06-15 01:40 - 2015-05-01 14:03 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2017-06-15 01:13 - 2008-07-29 09:59 - 00000000 ____D () C:\Windows\system32\RTCOM 2017-06-15 01:13 - 2008-07-29 09:58 - 00319456 _____ (Microsoft Corporation) C:\Windows\DIFxAPI.dll 2017-06-15 01:13 - 2008-07-29 09:56 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2017-06-15 01:09 - 2009-04-03 20:39 - 00000000 ____D () C:\ProgramData\CyberLink 2017-06-15 01:09 - 2009-04-03 14:59 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2017-06-15 01:05 - 2009-04-07 20:31 - 00000000 ___RD () C:\Program Files\Skype 2017-06-15 01:05 - 2009-04-07 20:31 - 00000000 ____D () C:\ProgramData\Skype 2017-06-15 00:46 - 2009-09-29 15:43 - 00000000 ____D () C:\Users\szymon\AppData\Local\Microsoft Help 2017-06-15 00:46 - 2009-04-07 20:33 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\Skype 2017-06-15 00:46 - 2008-07-29 10:26 - 00000000 ____D () C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3} 2017-06-15 00:45 - 2011-10-30 22:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011 2017-06-15 00:45 - 2011-08-09 20:49 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\NirSoft IE PassView 2017-06-15 00:45 - 2010-12-28 23:42 - 00000000 ___RD () C:\Users\szymon\Desktop\instalowane 2017-06-15 00:45 - 2009-04-26 11:56 - 00000000 ____D () C:\Windows\Minidump 2017-06-11 16:43 - 2008-07-29 08:39 - 00797272 _____ () C:\Windows\system32\perfh015.dat 2017-06-11 16:43 - 2008-07-29 08:39 - 00180876 _____ () C:\Windows\system32\perfc015.dat 2017-06-11 16:43 - 2006-11-02 12:33 - 01835248 _____ () C:\Windows\system32\PerfStringBackup.INI Some content of TEMP: ==================== C:\Users\szymon\AppData\Local\Temp\libeay32.dll C:\Users\szymon\AppData\Local\Temp\msvcr120.dll C:\Users\szymon\AppData\Local\Temp\Quarantine.exe C:\Users\szymon\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2017-07-09 08:38 ==================== End Of Log ============================