Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-12-2014 ([color=red]ATTENTION: ====> FRST version is 1842 days old and could be outdated[/color]) Ran by szymon (administrator) on SAMSUNG on 27-12-2019 17:20:34 Running from C:\Users\szymon\Desktop\usuwanie Loaded Profile: szymon (Available profiles: szymon) Platform: Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe () C:\Program Files\CDBurnerXP\NMSAccessU.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe () C:\Program Files\CyberLink\Shared Files\RichVideo.exe (Microsoft Corporation) C:\Windows\System32\snmp.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe (SAMSUNG Electronics) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe (SAMSUNG Electronics co., LTD.) C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe (Microsoft Corporation) C:\Windows\WindowsMobile\wmdSync.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe () C:\Program Files\4G Hostless Modem\MegaFon Internet\CheckNDISPort_df.exe () C:\Program Files\4G Hostless Modem\MegaFon Internet\CancelAutoPlay_df.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe (Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Intel Corporation) C:\Windows\System32\igfxext.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\aswidsagent.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Browser\Update\1.4.154.333\AvastBrowserCrashHandler.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Google LLC) C:\Program Files\Google\Update\1.3.35.422\GoogleCrashHandler.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [6111232 2008-04-17] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1029416 2007-10-26] (Synaptics, Inc.) HKLM\...\Run: [RemoteControl] => C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [71216 2007-03-14] (Cyberlink Corp.) HKLM\...\Run: [LanguageShortcut] => C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [52256 2007-01-08] () HKLM\...\Run: [Windows Mobile-based device management] => C:\Windows\WindowsMobile\wmdSync.exe [215552 2008-01-21] (Microsoft Corporation) HKLM\...\Run: [CheckNDISPort01ac00] => C:\Program Files\4G Hostless Modem\MegaFon Internet\CheckNDISPort_df.exe [468736 2015-11-09] () HKLM\...\Run: [CancelAutoPlay_df] => C:\Program Files\4G Hostless Modem\MegaFon Internet\CancelAutoPlay_df.exe [447744 2015-11-09] () HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvLaunch.exe [242392 2018-11-15] (AVAST Software) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [644552 2019-07-04] (Oracle Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\Run: [LightScribe Control Panel] => C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2289664 2008-03-17] (Hewlett-Packard Company) HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\Run: [Skype] => C:\Program Files\Skype\\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.) HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\Run: [AvastBrowserIsDefault] => "C:\Program Files\AVAST Software\Browser\Application\AvastBrowserProtector.exe" --force-protect HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: F - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: G - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: H - H:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {3168420c-9e89-11e2-94fe-d710a21dcda3} - G:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {69300500-c0ce-11de-afea-acbb43663a4d} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {69300511-c0ce-11de-afea-acbb43663a4d} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {695d2417-22a7-11de-b8e6-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {708d157c-aecf-11e3-8d26-d8e90d368216} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {754f9d29-f955-11e2-bb68-906108090fac} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {7e8d2079-f9fd-11e2-908f-a4a989e715d3} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {7e8d2089-f9fd-11e2-908f-9df2729782e7} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {8baf0962-22c4-11de-9eb4-001377988fb5} - G:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {8baf0964-22c4-11de-9eb4-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {d8e650d3-58c6-11e6-9adf-001377988fb5} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {d8e650d7-58c6-11e6-9adf-00a0c6000000} - F:\AutoRun.exe HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {e470a6c5-e855-11e5-8caa-001377988fb5} - F:\AutoRun.exe /s HKU\S-1-5-21-3182861355-789584673-1566108675-1003\...\MountPoints2: {f05c6ab7-22a8-11de-8ca6-001377988fb5} - F:\AutoRun.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\BTTray.lnk ShortcutTarget: BTTray.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) Startup: C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Automatyczne aktualizacje-AKP.lnk ShortcutTarget: RT-Automatyczne aktualizacje-AKP.lnk -> C:\Ross-Tech\VCDS-AKP\VCDS.exe (Ross-Tech, LLC) ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKU\S-1-5-21-3182861355-789584673-1566108675-1003\Software\Microsoft\Internet Explorer\Main,Start Page = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_221\bin\ssv.dll (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_221\bin\jp2ssv.dll (Oracle Corporation) BHO: IEPluginBHO Class -> {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} -> C:\ProgramData\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKU\S-1-5-21-3182861355-789584673-1566108675-1003 -> &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation) Toolbar: HKU\S-1-5-21-3182861355-789584673-1566108675-1003 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} http://www.eska.pl/streamplayers/OggX.ocx DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - No File Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Winsock: Catalog5 01 C:\Windows\system32\NLAapi.dll [48640] (Microsoft Corporation) Winsock: Catalog5 02 C:\Windows\system32\napinsp.dll [50176] (Microsoft Corporation) Winsock: Catalog5 03 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation) Winsock: Catalog5 04 C:\Windows\system32\pnrpnsp.dll [62464] (Microsoft Corporation) Winsock: Catalog5 05 C:\Windows\system32\wshbth.dll [34304] (Microsoft Corporation) Winsock: Catalog5 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog5 07 C:\Windows\system32\winrnr.dll [19968] (Microsoft Corporation) Winsock: Catalog9 01 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 02 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 03 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 04 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 05 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 06 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 07 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 08 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 09 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 10 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 11 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 12 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 13 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 14 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 15 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 16 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 17 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 18 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 19 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 20 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 21 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 22 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 23 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 24 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Winsock: Catalog9 25 C:\Windows\system32\mswsock.dll [223232] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 FireFox: ======== FF ProfilePath: C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_32_0_0_156.dll () FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1225195.dll (Adobe Systems, Inc.) FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin: @java.com/DTPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.221.2 -> C:\Program Files\Java\jre1.8.0_221\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/nppl3260;version=6.0.12.69 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF Plugin: @real.com/nprpjplug;version=6.0.12.69 -> C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.35.422\npGoogleUpdate3.dll (Google LLC) FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.35.422\npGoogleUpdate3.dll (Google LLC) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3182861355-789584673-1566108675-1003: @tools.google.com/Google Update;version=3 -> C:\Users\szymon\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll No File FF Plugin HKU\S-1-5-21-3182861355-789584673-1566108675-1003: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\szymon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Extension: FTdownloader 2 - C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\profiles\extensions\ftdownloader2@ftdownloader.com.xpi [2013-02-11] FF Extension: No Name - C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default\Extensions\sp@avast.com.xpi [2018-08-20] FF Extension: No Name - C:\Users\szymon\AppData\Roaming\Mozilla\Firefox\Profiles\j8o5cyda.default\Extensions\wrc@avast.com.xpi [2018-08-19] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-28] FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [Not Found] Chrome: ======= CHR Profile: C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Default CHR Profile: C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1 CHR Extension: (Slides) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2016-03-05] CHR Extension: (Docs) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2016-03-05] CHR Extension: (Google Drive) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-28] CHR Extension: (YouTube) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-28] CHR Extension: (Google Search) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-28] CHR Extension: (Sheets) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2016-03-05] CHR Extension: (Chrome Web Store Payments) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-28] CHR Extension: (Gmail) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-28] CHR Profile: C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 2 CHR Extension: (Chrome Web Store Payments) - C:\Users\szymon\AppData\Local\Google\Chrome\User Data\Profile 2\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2018-11-10] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - No Path ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AdobeFlashPlayerUpdateSvc; C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [335872 2019-03-13] (Adobe Systems Incorporated) [File not signed] R3 aswbIDSAgent; C:\Program Files\AVAST Software\Avast\aswidsagent.exe [6799632 2018-11-15] (AVAST Software) S2 avast; C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-08-19] (AVAST Software) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [324000 2018-11-15] (AVAST Software) S3 avastm; C:\Program Files\AVAST Software\Browser\Update\AvastBrowserUpdate.exe [164984 2018-08-19] (AVAST Software) R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [819200 2008-05-23] (Intel(R) Corporation) [File not signed] R2 LightScribeService; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [73728 2008-03-17] (Hewlett-Packard Company) [File not signed] S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation) R2 NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2009-07-13] () R2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-05-23] (Intel(R) Corporation) [File not signed] R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] () S2 Samsung Update Plus; C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe [77480 2008-05-13] () [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AMTFLASH; C:\Windows\System32\drivers\AmtFlash.sys [37632 2011-09-07] (AMT-Cartech Ltd.) R1 aswArPot; C:\Windows\System32\drivers\aswArPot.sys [167480 2018-11-15] (AVAST Software) R1 aswbidsdriver; C:\Windows\System32\drivers\aswbidsdriverx.sys [188976 2018-11-15] (AVAST Software) R0 aswbidsh; C:\Windows\System32\drivers\aswbidshx.sys [165384 2018-11-15] (AVAST Software) R0 aswblog; C:\Windows\System32\drivers\aswblogx.sys [284256 2018-11-15] (AVAST Software) R0 aswbuniv; C:\Windows\System32\drivers\aswbunivx.sys [57904 2018-11-15] (AVAST Software) R1 aswHdsKe; C:\Windows\System32\drivers\aswHdsKe.sys [183176 2018-11-26] (AVAST Software) S3 aswHwid; C:\Windows\System32\drivers\aswHwid.sys [42736 2018-11-15] (AVAST Software) R1 aswKbd; C:\Windows\System32\drivers\aswKbd.sys [40688 2018-11-15] (AVAST Software) R2 aswMonFlt; C:\Windows\System32\drivers\aswMonFlt.sys [135200 2019-01-18] (AVAST Software) R1 aswRdr; C:\Windows\System32\drivers\aswRdr.sys [70640 2018-11-15] (AVAST Software) R0 aswRvrt; C:\Windows\System32\drivers\aswRvrt.sys [72800 2018-11-15] (AVAST Software) R1 aswSnx; C:\Windows\System32\drivers\aswSnx.sys [784552 2019-05-23] (AVAST Software) R1 aswSP; C:\Windows\System32\drivers\aswSP.sys [397984 2019-05-23] (AVAST Software) R3 aswStmXP; C:\Windows\System32\drivers\aswStmXP.sys [146584 2018-11-15] (AVAST Software) R0 aswVmm; C:\Windows\System32\drivers\aswVmm.sys [310200 2018-11-15] (AVAST Software) R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [393368 2017-12-05] (Symantec Corporation) S3 FTD2XX; C:\Windows\System32\Drivers\OPCOMUSB.sys [57800 2009-10-22] (FTDI Ltd.) S3 FTDIBUS; C:\Windows\System32\drivers\opcomusb.sys [57800 2009-10-22] (FTDI Ltd.) R2 KMDFMEMIO; C:\Windows\System32\DRIVERS\kmdfmemio.sys [13312 2007-05-23] (SAMSUNG ELECTRONICS CO., LTD.) S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [80256 2014-05-12] (Ross-Tech LLC) S3 slabbus; C:\Windows\System32\DRIVERS\slabbus.sys [55312 2005-08-16] (MCCI) [File not signed] S3 slabser; C:\Windows\System32\DRIVERS\slabser.sys [89808 2005-08-16] (MCCI) [File not signed] R3 VMC326; C:\Windows\System32\Drivers\VMC326.sys [238464 2008-09-03] (Vimicro Corporation) [File not signed] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 massfilter_lte; \??\C:\Windows\system32\drivers\massfilter_lte.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] S3 zgdcat; system32\DRIVERS\zgdcat.sys [X] S3 zgdcdiag; system32\DRIVERS\zgdcdiag.sys [X] S3 zgdcmdm; system32\DRIVERS\zgdcmdm.sys [X] S3 zgdcnet; system32\DRIVERS\zgdcnet.sys [X] S3 zgdcnmea; system32\DRIVERS\zgdcnmea.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2019-12-27 15:25 - 2019-12-27 15:25 - 08237744 _____ (Malwarebytes) C:\Users\szymon\Desktop\AdwCleaner.exe 2019-12-27 15:08 - 2019-12-27 15:08 - 00000000 __SHD () C:\found.002 2019-12-27 13:45 - 2019-12-27 13:45 - 00000000 ____D () C:\Users\szymon\Desktop\z3 zdjecia 2019-12-21 11:42 - 2019-12-21 11:42 - 00000981 _____ () C:\Users\szymon\Desktop\Faultcodes_2004_Vectra-C S_Silnik__Z 19 DTH_201912211142.txt 2019-12-06 19:19 - 2019-12-06 19:19 - 00131072 _____ () C:\Users\szymon\Desktop\WinOLS (Audi A6 (tun_v2)cs- 358127) ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2019-12-27 17:20 - 2014-12-12 20:20 - 00000000 ____D () C:\Users\szymon\Desktop\usuwanie 2019-12-27 17:20 - 2014-12-11 18:55 - 00000000 ____D () C:\FRST 2019-12-27 17:20 - 2009-01-18 00:36 - 01108484 _____ () C:\Windows\WindowsUpdate.log 2019-12-27 17:02 - 2009-04-03 13:59 - 00000000 ____D () C:\Users\szymon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink DVD Suite 2019-12-27 17:01 - 2006-11-02 13:58 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2019-12-27 17:01 - 2006-11-02 13:45 - 00004384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2019-12-27 17:01 - 2006-11-02 13:45 - 00004384 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2019-12-27 17:00 - 2015-11-04 18:06 - 00000000 ____D () C:\AdwCleaner 2019-12-27 17:00 - 2008-07-30 00:52 - 00000012 _____ () C:\Windows\bthservsdp.dat 2019-12-27 17:00 - 2006-11-02 13:58 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2019-12-27 16:51 - 2011-08-03 20:44 - 00000000 ____D () C:\Users\szymon\AppData\Local\CrashDumps 2019-12-27 15:12 - 2008-01-21 04:02 - 02401900 _____ () C:\Windows\PFRO.log 2019-12-27 13:48 - 2009-04-03 14:50 - 00044544 _____ () C:\Users\szymon\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini Some content of TEMP: ==================== C:\Users\szymon\AppData\Local\Temp\jre-8u141-windows-au.exe C:\Users\szymon\AppData\Local\Temp\jre-8u151-windows-au.exe C:\Users\szymon\AppData\Local\Temp\jre-8u221-windows-au.exe C:\Users\szymon\AppData\Local\Temp\libeay32.dll C:\Users\szymon\AppData\Local\Temp\msvcr120.dll C:\Users\szymon\AppData\Local\Temp\Quarantine.exe C:\Users\szymon\AppData\Local\Temp\sqlite3.dll C:\Users\szymon\AppData\Local\Temp\vcds_hook.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2019-12-27 17:09 ==================== End Of Log ============================