OTL logfile created on: 2013-07-09 11:51:58 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Slimowski\Downloads Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,96 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 51,77% Memory free 6,12 Gb Paging File | 4,67 Gb Available in Paging File | 76,26% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,44 Gb Total Space | 7,21 Gb Free Space | 6,19% Space Free | Partition Type: NTFS Drive D: | 232,88 Gb Total Space | 69,69 Gb Free Space | 29,92% Space Free | Partition Type: NTFS Drive E: | 114,98 Gb Total Space | 2,28 Gb Free Space | 1,98% Space Free | Partition Type: NTFS Drive H: | 1,83 Gb Total Space | 1,03 Gb Free Space | 56,25% Space Free | Partition Type: FAT Computer Name: SLIMOWSKI-PC | User Name: Slimowski | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013-07-09 11:51:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Slimowski\Downloads\OTL.exe PRC - [2013-07-08 13:00:21 | 000,239,496 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\1.3.21.149\GoogleCrashHandler.exe PRC - [2013-06-26 11:40:50 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2013-06-26 11:40:05 | 000,076,856 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2013-06-26 11:39:59 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2013-06-26 11:39:58 | 000,345,144 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2013-05-10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011-08-08 13:43:58 | 000,690,072 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe PRC - [2011-08-08 13:36:58 | 000,087,960 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe PRC - [2011-05-09 16:06:02 | 002,750,376 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe PRC - [2011-04-01 17:41:44 | 000,152,496 | ---- | M] (TOSHIBA CORPORATION) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe PRC - [2011-01-14 18:19:00 | 002,885,056 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtProc.exe PRC - [2010-11-02 10:38:00 | 000,341,392 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosOBEX.exe PRC - [2010-10-06 22:28:12 | 003,768,176 | ---- | M] (Stardock) -- C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe PRC - [2010-09-06 16:18:00 | 000,746,384 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe PRC - [2009-04-11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2009-04-03 18:17:00 | 000,447,816 | ---- | M] (TOSHIBA CORPORATION.) -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosAVRC.exe PRC - [2008-07-15 16:16:58 | 000,106,496 | ---- | M] (TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe PRC - [2006-11-06 17:14:44 | 000,034,352 | ---- | M] () -- C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013-06-15 03:28:42 | 000,393,168 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll MOD - [2013-06-15 03:28:40 | 004,051,408 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll MOD - [2013-06-15 03:27:48 | 001,597,392 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\ffmpegsumo.dll MOD - [2011-04-20 03:21:00 | 000,037,376 | ---- | M] () -- C:\Windows\System32\atitmpxx.dll MOD - [2011-03-17 00:11:16 | 004,297,568 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF MOD - [2010-10-04 19:54:31 | 000,053,760 | ---- | M] () -- C:\Program Files\Stardock\ObjectDockFree\zlib.dll MOD - [2010-10-04 19:54:29 | 000,807,936 | ---- | M] () -- C:\Program Files\Stardock\ObjectDockFree\CrashRpt.dll MOD - [2010-10-04 19:54:29 | 000,675,840 | ---- | M] () -- C:\Program Files\Stardock\ObjectDockFree\DockShellHook.dll MOD - [2006-11-06 17:14:44 | 000,034,352 | ---- | M] () -- C:\Program Files\TOSHIBA\Utilities\KeNotify.exe [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2013-06-26 11:40:50 | 000,084,024 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2013-06-26 11:39:59 | 000,108,088 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2013-06-21 09:53:36 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2013-06-18 16:21:21 | 000,117,144 | ---- | M] (Mozilla Foundation) [Disabled | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013-05-10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012-10-02 13:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Disabled | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012-09-20 14:28:48 | 030,785,672 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service) SRV - [2012-08-23 20:55:54 | 000,655,624 | ---- | M] (Acresso Software Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2012-04-12 05:27:08 | 000,069,640 | ---- | M] (Nalpeiron Ltd.) [Disabled | Stopped] -- C:\Windows\System32\NLSSRV32.EXE -- (nlsX86cc) SRV - [2012-04-12 05:27:00 | 000,175,624 | ---- | M] (Nitro PDF Software) [Disabled | Stopped] -- C:\Program Files\Nitro PDF\Professional 7\NitroPDFDriverService2.exe -- (NitroDriverReadSpool2) SRV - [2011-06-06 19:13:24 | 000,008,192 | ---- | M] () [Disabled | Stopped] -- C:\Windows\System32\srvany.exe -- (KMService) SRV - [2011-04-20 04:04:06 | 000,176,128 | ---- | M] (AMD) [Disabled | Stopped] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2011-04-01 17:41:44 | 000,152,496 | ---- | M] (TOSHIBA CORPORATION) [Auto | Running] -- C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\TosBtSrv.exe -- (TOSHIBA Bluetooth Service) SRV - [2010-03-25 14:39:22 | 000,490,280 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files\Nero\Update\NASvc.exe -- (NAUpdate) SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard) SRV - [2008-07-15 16:16:58 | 000,106,496 | ---- | M] (TOSHIBA Corporation) [Auto | Running] -- C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe -- (TOSHIBA SMART Log Service) SRV - [2008-01-19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\Toshidpt.sys -- (toshidpt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\drivers\AtihdLH3.sys -- (AtiHDAudioService) DRV - [2013-03-28 00:02:47 | 000,135,136 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2013-03-28 00:02:47 | 000,084,744 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2013-03-28 00:02:47 | 000,037,352 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2013-03-01 14:25:18 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2013-01-31 10:19:50 | 000,181,344 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) DRV - [2013-01-31 10:19:50 | 000,083,168 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) DRV - [2011-08-05 10:21:52 | 000,236,728 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfbd.sys -- (tosrfbd) DRV - [2011-07-12 19:07:40 | 000,016,064 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfec.sys -- (tosrfec) DRV - [2011-05-26 08:21:18 | 000,144,984 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\jmcr.sys -- (JMCR) DRV - [2011-04-20 04:43:40 | 007,772,160 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2011-04-20 04:43:40 | 007,772,160 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2011-04-20 03:22:08 | 000,243,712 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2011-02-09 14:26:44 | 000,023,640 | ---- | M] (JMicron Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\johci.sys -- (johci) DRV - [2011-01-27 15:26:16 | 000,056,888 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosrfusb.sys -- (Tosrfusb) DRV - [2011-01-19 12:20:08 | 006,923,264 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETwNv32.sys -- (NETwNv32) DRV - [2010-11-29 11:47:00 | 000,070,448 | ---- | M] (TOSHIBA Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\tosrfcom.sys -- (Tosrfcom) DRV - [2010-11-23 18:33:00 | 000,263,464 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RtHDMIV.sys -- (RTHDMIAzAudService) DRV - [2010-11-11 10:26:00 | 000,042,672 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfbnp.sys -- (tosrfbnp) DRV - [2010-08-30 10:48:00 | 000,080,064 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Tosrfhid.sys -- (Tosrfhid) DRV - [2009-08-05 12:55:00 | 000,061,168 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TosRfSnd.sys -- (TosRfSnd) DRV - [2009-07-24 11:31:00 | 000,021,608 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\tosrfnds.sys -- (tosrfnds) DRV - [2009-07-14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (winusb) DRV - [2009-06-17 11:59:00 | 000,046,984 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tosporte.sys -- (tosporte) DRV - [2008-11-17 15:40:22 | 003,668,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) DRV - [2008-10-21 07:57:16 | 000,124,928 | ---- | M] (Realtek Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169) DRV - [2008-07-15 19:59:06 | 000,017,960 | ---- | M] (Chicony Electronics Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\UVCFTR_S.SYS -- (UVCFTR) DRV - [2008-05-07 11:30:12 | 000,025,896 | ---- | M] (COMPAL ELECTRONIC INC.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\LPCFilter.sys -- (LPCFilter) DRV - [2008-02-07 00:23:46 | 000,166,448 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Apfiltr.sys -- (ApfiltrService) DRV - [2008-01-14 12:06:32 | 000,021,632 | ---- | M] (ManyCam LLC.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ManyCam.sys -- (ManyCam) DRV - [2007-11-09 05:00:52 | 000,023,640 | ---- | M] (TOSHIBA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\TVALZ_O.SYS -- (TVALZ) DRV - [2007-08-20 01:03:00 | 000,227,488 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\V0270Dev.sys -- (VF0270Dev) DRV - [2007-03-05 18:45:04 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\V0270Vfx.sys -- (VF0270Vfx) DRV - [2006-11-02 09:41:50 | 000,983,552 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://msn.gazeta.pl/msn/0,0.html?pc=UP97&ocid=UP97DHP&dt=070513 IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3958440826-2036700987-1971538616-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Bing " FF - prefs.js..browser.search.order.3: "Bing " FF - prefs.js..browser.search.selectedEngine: "Bing " FF - prefs.js..browser.startup.homepage: "http://msn.gazeta.pl/msn/0,0.html?pc=UP97&ocid=UP97DHP&dt=070513" FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF - prefs.js..keyword.URL: "http://www.bing.com/search?FORM=UP97DF&PC=UP97&dt=070513&q=" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Slimowski\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Slimowski\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Slimowski\AppData\Local\Google\Update\1.3.21.149\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.4\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2013-06-03 12:48:08 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.4\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2011-05-25 09:46:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Slimowski\AppData\Roaming\mozilla\Extensions [2011-05-25 09:46:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Slimowski\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2013-06-28 21:28:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Slimowski\AppData\Roaming\mozilla\Firefox\Profiles\y3mcwqmy.default-1372445440954\extensions [2013-07-05 05:26:34 | 000,002,402 | ---- | M] () -- C:\Users\Slimowski\AppData\Roaming\mozilla\firefox\profiles\y3mcwqmy.default-1372445440954\searchplugins\bingp.xml [2013-07-01 09:02:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2013-07-01 09:02:07 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs CHR - default_search_provider: suggest_url = https://www.google.com/complete/search?q={searchTerms}, CHR - homepage: http://msn.gazeta.pl/msn/0,0.html?pc=UP97&ocid=UP97DHP&dt=070513 CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Slimowski\AppData\Local\Google\Chrome\Application\27.0.1453.116\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.7.4 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.7.4 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.7.4 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.7.4 (Disabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL CHR - plugin: Microsoft Office 2010 (Enabled) = C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.145\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) (Enabled) = C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Facebook Video Calling Plugin (Enabled) = C:\Users\Slimowski\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll CHR - plugin: Java Deployment Toolkit 7.0.250.17 (Enabled) = C:\Windows\system32\npDeployJava1.dll CHR - Extension: Eliminator Slajd\u00F3w = C:\Users\Slimowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\eplekpmdodlgejgogbojajncdlapamff\1.5.1_0\ CHR - Extension: AdBlock = C:\Users\Slimowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.2_0\ CHR - Extension: Skype Click to Call = C:\Users\Slimowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\ O1 HOSTS File: ([2011-06-01 18:50:04 | 000,001,518 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 practivate.adobe.com O1 - Hosts: 127.0.0.1 ereg.adobe.com O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com O1 - Hosts: 127.0.0.1 wip3.adobe.com O1 - Hosts: 127.0.0.1 3dns-3.adobe.com O1 - Hosts: 127.0.0.1 3dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com O1 - Hosts: 127.0.0.1 activate-sea.adobe.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com O1 - Hosts: 127.0.0.1 adobe.activate.com O1 - Hosts: 127.0.0.1 adobeereg.com O1 - Hosts: 127.0.0.1 www.adobeereg.com O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com O1 - Hosts: 127.0.0.1 125.252.224.90 O1 - Hosts: 127.0.0.1 125.252.224.91 O1 - Hosts: 127.0.0.1 hl2rcv.adobe.com O2 - BHO: (YouTube To ALLPlayer) - {61DB16C5-B733-43F4-872E-B20DC9E72740} - C:\Program Files\ALLPlayer\YouTubeToALLPlayer.dll (ALLPlayer.org) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) O4 - HKLM..\Run: [00TCrdMain] C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [HSON] C:\Program Files\TOSHIBA\TBS\HSON.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.) O4 - HKLM..\Run: [ITSecMng] C:\Program Files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe (TOSHIBA CORPORATION) O4 - HKLM..\Run: [KeNotify] C:\Program Files\TOSHIBA\Utilities\KeNotify.exe () O4 - HKLM..\Run: [Onet.pl AutoUpdate] "C:\Program Files\Common Files\Onet.pl\NewAutoUpdate.exe" /updateexetsr File not found O4 - HKLM..\Run: [SmoothView] C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) O4 - HKLM..\Run: [TaskTray] File not found O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - Startup: C:\Users\Slimowski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDockFree\ObjectDock.exe (Stardock) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Wyślij &do programu OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 10.25.2) O16 - DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 1.7.0_25) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Java Plug-in 10.25.2) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 217.17.34.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{98E65389-757F-41DB-BA9A-03127B6EA86A}: DhcpNameServer = 8.8.8.8 217.17.34.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CA6321F9-8CFC-4F33-8FB8-878C8AF991D8}: DhcpNameServer = 192.168.137.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Program Files\Stardock\ObjectDockFree\ODMenu.dll (Stardock) O24 - Desktop WallPaper: C:\Users\Slimowski\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\Slimowski\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013-07-08 09:42:43 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\.thumbnails [2013-07-08 09:35:15 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\gegl-0.2 [2013-07-08 09:35:15 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\.gimp-2.8 [2013-07-08 09:28:22 | 000,000,000 | ---D | C] -- C:\Program Files\GIMP 2 [2013-07-05 20:11:20 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2013-07-05 20:10:44 | 000,263,592 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2013-07-05 20:10:18 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2013-07-05 20:10:18 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\java.exe [2013-07-05 20:10:18 | 000,094,632 | ---- | C] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2013-07-05 11:21:10 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\{CFCDC81A-BC5F-4E07-A0EC-9C94BF668278} [2013-07-03 11:35:24 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\{8D2F8DD9-580F-481F-85E4-3B4C67782C9A} [2013-07-02 07:41:52 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\{6645DD3D-E7F3-43AC-9021-F2D88D2A50B9} [2013-07-01 18:20:01 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\{84B28E1A-2A4C-4FFE-BE23-785FF985E72B} [2013-07-01 14:59:36 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\Desktop\Daft.Punk.Random.Access.Memories [2013-07-01 13:18:18 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\Desktop\biegam dwa [2013-07-01 09:02:06 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2013-06-29 23:58:34 | 000,692,104 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013-06-29 23:58:34 | 000,071,048 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013-06-29 18:16:35 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Local\{272EB386-1745-4DA4-8836-8C00914C135C} [2013-06-29 09:50:02 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome [2013-06-23 20:51:47 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\Desktop\GINGER [2013-06-22 11:54:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes [2013-06-22 11:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes [2013-06-22 11:53:53 | 000,000,000 | ---D | C] -- C:\Program Files\iPod [2013-06-22 11:51:28 | 000,000,000 | ---D | C] -- C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1 [2013-06-13 09:00:16 | 000,000,000 | ---D | C] -- C:\Users\Slimowski\Desktop\2013 [2013-06-13 06:16:12 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb [2013-06-13 06:16:08 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll [2013-06-13 06:16:08 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll [2013-06-13 06:16:08 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe [2013-06-13 06:16:08 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll [2013-06-13 06:16:07 | 001,800,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll [2013-06-13 06:16:06 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll [2013-06-13 06:16:05 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl [2013-06-12 21:23:45 | 000,037,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\printcom.dll [2013-06-12 21:23:40 | 000,812,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certutil.exe [2013-06-12 21:23:39 | 000,041,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\certenc.dll [2013-06-12 21:23:28 | 003,603,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe [2013-06-12 21:23:27 | 003,551,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe [2013-06-12 21:23:15 | 000,024,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\cryptdlg.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013-07-09 11:48:37 | 000,001,038 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013-07-09 11:47:54 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2013-07-09 11:47:54 | 000,003,664 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2013-07-09 11:47:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013-07-09 09:41:00 | 000,001,074 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3958440826-2036700987-1971538616-1000UA.job [2013-07-09 09:05:00 | 000,001,042 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013-07-09 08:07:08 | 000,001,022 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3958440826-2036700987-1971538616-1000Core.job [2013-07-09 08:00:38 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3958440826-2036700987-1971538616-1000UA.job [2013-07-08 14:28:50 | 000,106,496 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013-07-08 10:12:00 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3958440826-2036700987-1971538616-1000Core.job [2013-07-08 09:50:30 | 000,000,132 | ---- | M] () -- C:\Users\Slimowski\AppData\Roaming\Adobe PNG Format CS5 Prefs [2013-07-08 09:42:43 | 000,000,851 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\recently-used.xbel [2013-07-05 20:10:01 | 000,094,632 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\WindowsAccessBridge.dll [2013-07-05 20:09:54 | 000,263,592 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaws.exe [2013-07-05 20:09:54 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe [2013-07-05 20:09:54 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\java.exe [2013-07-05 20:09:53 | 000,867,240 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\npDeployJava1.dll [2013-07-05 20:09:53 | 000,789,416 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\deployJava1.dll [2013-07-05 19:40:56 | 003,976,304 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2013-07-05 18:54:41 | 000,362,029 | ---- | M] () -- C:\Windows\System32\sqlite3.dll [2013-07-05 12:16:41 | 108,357,749 | ---- | M] () -- C:\Users\Slimowski\Desktop\20130611_191330.mp4 [2013-06-30 00:14:59 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe [2013-06-30 00:14:58 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2013-06-29 09:50:02 | 000,002,067 | ---- | M] () -- C:\Users\Slimowski\Desktop\Google Chrome.lnk [2013-06-28 03:02:57 | 000,674,024 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2013-06-28 03:02:56 | 000,597,330 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2013-06-28 03:02:56 | 000,130,994 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2013-06-28 03:02:56 | 000,104,206 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2013-06-27 07:14:24 | 000,031,816 | ---- | M] () -- C:\Windows\Launcher.exe [2013-06-25 22:26:26 | 328,114,006 | ---- | M] () -- C:\Windows\MEMORY.DMP [2013-06-22 23:21:57 | 000,007,944 | ---- | M] () -- C:\Users\Slimowski\AppData\Local\d3d9caps.dat [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013-07-08 09:42:43 | 000,000,851 | ---- | C] () -- C:\Users\Slimowski\AppData\Local\recently-used.xbel [2013-07-08 09:34:07 | 000,000,885 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk [2013-07-05 18:54:41 | 000,362,029 | ---- | C] () -- C:\Windows\System32\sqlite3.dll [2013-07-01 09:02:11 | 000,000,863 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk [2013-06-29 09:50:02 | 000,002,067 | ---- | C] () -- C:\Users\Slimowski\Desktop\Google Chrome.lnk [2013-06-25 22:26:26 | 328,114,006 | ---- | C] () -- C:\Windows\MEMORY.DMP [2013-06-13 09:08:46 | 108,357,749 | ---- | C] () -- C:\Users\Slimowski\Desktop\20130611_191330.mp4 [2013-04-28 13:09:08 | 000,031,816 | ---- | C] () -- C:\Windows\Launcher.exe [2012-12-24 15:37:21 | 020,044,657 | ---- | C] () -- C:\Users\Slimowski\kato_wice.psd [2012-12-18 11:06:10 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe [2012-12-18 11:06:06 | 000,974,848 | ---- | C] () -- C:\Windows\System32\cis-2.4.dll [2012-12-18 11:06:06 | 000,081,920 | ---- | C] () -- C:\Windows\System32\issacapi_bs-2.3.dll [2012-12-18 11:06:06 | 000,065,536 | ---- | C] () -- C:\Windows\System32\issacapi_pe-2.3.dll [2012-12-18 11:06:06 | 000,057,344 | ---- | C] () -- C:\Windows\System32\issacapi_se-2.3.dll [2012-11-21 20:17:19 | 000,314,935 | ---- | C] () -- C:\Users\Slimowski\prowokacja.jpg [2012-08-30 18:06:53 | 000,000,000 | ---- | C] () -- C:\Windows\ViewNX.INI [2012-08-30 16:45:20 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Legacy [2012-08-30 16:45:20 | 000,000,268 | RH-- | C] () -- C:\Users\Slimowski\AppData\Roaming\Keyboard Layouts [2012-08-30 16:45:20 | 000,000,012 | RH-- | C] () -- C:\ProgramData\MIDI Devices [2012-08-30 16:45:19 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT [2012-06-02 22:00:08 | 000,079,872 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2012-04-20 22:20:21 | 000,080,384 | ---- | C] () -- C:\Windows\System32\mkzlib.dll [2012-04-20 22:20:19 | 000,024,576 | ---- | C] () -- C:\Windows\System32\mkunicode.dll [2012-02-24 17:20:26 | 018,082,846 | ---- | C] () -- C:\Users\Slimowski\tlo.psd [2012-02-24 17:20:13 | 000,182,904 | ---- | C] () -- C:\Users\Slimowski\tlo.png [2012-02-24 17:14:45 | 005,107,503 | ---- | C] () -- C:\Users\Slimowski\profilowe.png [2012-02-24 17:12:31 | 000,187,158 | ---- | C] () -- C:\Users\Slimowski\profilowe.jpg [2012-02-24 17:11:47 | 055,625,376 | ---- | C] () -- C:\Users\Slimowski\profilowe.psd [2011-12-15 21:08:51 | 000,000,091 | ---- | C] () -- C:\Windows\fnerr.dat [2011-12-10 14:23:05 | 001,398,603 | ---- | C] () -- C:\Users\Slimowski\361d6cb6a3ffa9b0ba5a291b324e463b-jpg.jpg [2011-12-08 12:04:58 | 000,111,813 | ---- | C] () -- C:\Users\Slimowski\10-11lg.jpg [2011-11-27 19:11:26 | 000,130,732 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2011-11-20 21:53:41 | 000,003,058 | ---- | C] () -- C:\Users\Slimowski\elf.jpg [2011-11-20 21:23:44 | 000,015,695 | ---- | C] () -- C:\Users\Slimowski\Excoffon_Wiewiorka.jpg [2011-11-18 21:32:50 | 000,034,998 | ---- | C] () -- C:\Users\Slimowski\How Sex And The City sold its soul Since Carrie & Co hit the big screen they've turned into man-obsessed morons 6.jpg [2011-11-13 22:03:59 | 000,102,451 | ---- | C] () -- C:\Users\Slimowski\5042328b7321613489d85eb3e611522e.jpg [2011-10-31 15:15:22 | 000,085,935 | ---- | C] () -- C:\Users\Slimowski\h&m 2.jpg [2011-10-31 15:14:08 | 000,068,073 | ---- | C] () -- C:\Users\Slimowski\h&m.jpg [2011-10-05 16:25:17 | 000,095,880 | ---- | C] () -- C:\Users\Slimowski\IMG_0312.jpg [2011-09-13 19:21:14 | 000,741,376 | ---- | C] () -- C:\Users\Slimowski\do_pracy.indd [2011-08-31 12:10:14 | 000,000,132 | ---- | C] () -- C:\Users\Slimowski\AppData\Roaming\Adobe PNG Format CS5 Prefs [2011-08-25 12:11:01 | 001,985,565 | ---- | C] () -- C:\Users\Slimowski\suknia.pdf [2011-08-25 12:10:42 | 000,778,240 | ---- | C] () -- C:\Users\Slimowski\suknia.indd [2011-08-25 12:01:50 | 001,865,137 | ---- | C] () -- C:\Users\Slimowski\kwioty.pdf [2011-08-25 12:01:17 | 002,564,096 | ---- | C] () -- C:\Users\Slimowski\kwiot.indd [2011-08-25 11:58:43 | 090,973,371 | ---- | C] () -- C:\Users\Slimowski\kwioty.psd [2011-05-25 12:02:47 | 000,106,496 | ---- | C] () -- C:\Users\Slimowski\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-24 23:49:14 | 000,007,944 | ---- | C] () -- C:\Users\Slimowski\AppData\Local\d3d9caps.dat [2011-02-21 20:12:36 | 000,528,384 | ---- | C] () -- C:\Users\Slimowski\kanapki.indd [2010-12-29 20:58:32 | 000,039,188 | ---- | C] () -- C:\Users\Slimowski\bmf.png [2010-12-29 20:58:24 | 000,432,186 | ---- | C] () -- C:\Users\Slimowski\bmf.psd [2010-12-13 15:47:21 | 000,296,631 | ---- | C] () -- C:\Users\Slimowski\tapeta.jpg [2010-12-13 15:47:17 | 007,349,608 | ---- | C] () -- C:\Users\Slimowski\tapeta.psd [2010-12-10 11:53:44 | 000,659,456 | ---- | C] () -- C:\Users\Slimowski\brutal.indd [2010-12-09 11:09:54 | 113,999,824 | ---- | C] () -- C:\Users\Slimowski\dworzec pkp.psd [2010-07-18 16:25:33 | 000,033,053 | ---- | C] () -- C:\Users\Slimowski\foto.jpg [2010-06-23 09:04:03 | 001,499,500 | ---- | C] () -- C:\Users\Slimowski\wp.psd [2010-05-25 11:14:34 | 000,079,741 | ---- | C] () -- C:\Users\Slimowski\tap.png [2010-04-07 10:37:04 | 000,154,762 | ---- | C] () -- C:\Users\Slimowski\gruzinskie rugby.jpg [2010-03-11 21:02:44 | 000,126,662 | ---- | C] () -- C:\Users\Slimowski\upper.png [2010-02-16 22:58:03 | 000,537,560 | ---- | C] () -- C:\Users\Slimowski\dyplom_1.pdf [2009-06-26 22:46:01 | 000,493,595 | ---- | C] () -- C:\Users\Slimowski\Wideo005.3gp [2009-06-26 22:45:40 | 002,684,878 | ---- | C] () -- C:\Users\Slimowski\Wideo003.3gp [2009-01-15 00:12:25 | 000,005,809 | ---- | C] () -- C:\Users\Slimowski\wygaszacz.swf [2009-01-15 00:12:21 | 000,114,688 | ---- | C] () -- C:\Users\Slimowski\wygaszacz.fla [2009-01-07 00:52:52 | 064,432,826 | ---- | C] () -- C:\Users\Slimowski\forum_gkw_katowice_pl_Zobacz_temat_-_Katowice_Przebudowa_r_d.avi [2009-01-06 13:42:54 | 003,964,635 | ---- | C] () -- C:\Users\Slimowski\Comp 1.swf [2008-07-03 14:49:29 | 032,676,437 | ---- | C] () -- C:\Users\Slimowski\indesign_cs4_help_ang.pdf [2008-07-03 14:48:45 | 038,663,805 | ---- | C] () -- C:\Users\Slimowski\indesign_cs4_help.pdf [2008-06-13 23:53:08 | 011,141,577 | ---- | C] () -- C:\Users\Slimowski\The_new_CHANEL_N_5_film.mp4 [2008-06-13 23:51:31 | 009,655,848 | ---- | C] () -- C:\Users\Slimowski\nicole_kidman_chanel_commercial.mp4 [2008-06-13 23:43:18 | 015,776,507 | ---- | C] () -- C:\Users\Slimowski\adidas.mp4 [color=#E56717]========== ZeroAccess Check ==========[/color] [2006-11-02 14:54:22 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012-06-08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009-04-11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009-04-11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2011-10-21 12:02:27 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\AnvSoft [2011-06-08 16:11:50 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\AutoUpdate [2012-04-18 18:07:39 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Downloaded Installations [2013-07-05 12:16:18 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Dropbox [2012-03-27 11:28:41 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\FMZilla [2012-02-21 13:55:13 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Gadu-Gadu 10 [2013-07-07 11:11:51 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\GG [2013-07-05 20:12:45 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Kamerzysta [2011-06-08 16:27:09 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\ManyCam [2012-08-16 19:49:08 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\NapiProjekt [2012-08-30 16:48:34 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Nikon [2012-04-18 18:12:46 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Nitro PDF [2013-04-19 23:32:31 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Nokia [2011-10-25 18:19:23 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Nowe Gadu-Gadu [2011-06-14 09:23:43 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\OpenFM [2012-04-24 21:37:27 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Opera [2011-08-09 13:00:46 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\PDF Writer [2013-02-17 13:19:05 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Samsung [2011-05-30 10:24:11 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\SharePod [2012-08-16 12:33:24 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1 [2011-05-25 01:02:24 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Stardock [2012-06-05 17:09:55 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\TaboretSoft [2012-01-25 15:02:45 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\TeamViewer [2011-05-25 09:46:50 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Thunderbird [2011-05-29 23:15:16 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\toshiba [2013-03-01 18:23:23 | 000,000,000 | ---D | M] -- C:\Users\Slimowski\AppData\Roaming\Windows Live Writer [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 64 bytes -> C:\Users\Slimowski\The_new_CHANEL_N_5_film.mp4:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Slimowski\nicole_kidman_chanel_commercial.mp4:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Slimowski\forum_gkw_katowice_pl_Zobacz_temat_-_Katowice_Przebudowa_r_d.avi:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Slimowski\Desktop\20130611_191330.mp4:TOC.WMV @Alternate Data Stream - 64 bytes -> C:\Users\Slimowski\adidas.mp4:TOC.WMV @Alternate Data Stream - 192 bytes -> C:\Windows:nlsPreferences < End of report >