Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-10-2013 01 Ran by Rej (administrator) on REJESTRACJA on 28-10-2013 21:01:18 Running from D:\JP\Vir20131018\DoFix2 Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Polish Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe (HP) C:\Windows\system32\HPSIsvc.exe (TeamViewer GmbH) C:\Program Files\TeamViewer\Version5\TeamViewer_Service.exe (UltraVNC) C:\Program Files\UltraVNC\WinVNC.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (UltraVNC) C:\Program Files\UltraVNC\WinVNC.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) C:\Program Files\OpenOffice.org 3\program\soffice.bin ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [995176 2013-08-12] (Microsoft Corporation) MountPoints2: F - F:\AutoRun.exe MountPoints2: {26bd90bd-f043-11e2-a938-00241d75e834} - K:\SISetup.exe MountPoints2: {679ab5af-a265-11e2-8b14-00241d75e834} - F:\AutoRun.exe Startup: C:\Users\Rej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\KSPL.lnk ShortcutTarget: KSPL.lnk -> D:\KS\KS-PLW\KSPL.EXE (KAMSOFT S.A.) Startup: C:\Users\Rej\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.1.lnk ShortcutTarget: OpenOffice.org 3.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://csm-swd.nfz.gov.pl/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcf.pl SearchScopes: HKCU - DefaultScope {0E11525C-ABB5-4C92-82DB-C030D9E3E025} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} SearchScopes: HKCU - {0E11525C-ABB5-4C92-82DB-C030D9E3E025} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage} BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 194.204.159.1 194.204.152.34 ========================== Services (Whitelisted) ================= R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [81920 2009-02-27] (Firebird Project) R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2732032 2009-02-27] (Firebird Project) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-08-12] (Microsoft Corporation) S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [295376 2013-08-12] (Microsoft Corporation) R2 uvnc_service; C:\Program Files\UltraVNC\WinVNC.exe [1590216 2009-12-06] (UltraVNC) ==================== Drivers (Whitelisted) ==================== R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation) R3 MonitorFunction; C:\Windows\System32\DRIVERS\TVMonitor.sys [13304 2011-01-12] (TeamViewer GmbH) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [211560 2013-06-18] (Microsoft Corporation) R1 MpKsled77cd04; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{785EBB48-8F93-4A9F-9D65-F0E6C352869D}\MpKsled77cd04.sys [40392 2013-10-28] (Microsoft Corporation) R3 mv2; C:\Windows\System32\DRIVERS\mv2.sys [12096 2010-07-18] (UVNC BVBA) R2 npf; C:\Windows\System32\drivers\npf.sys [34064 2009-02-08] (CACE Technologies) S3 gfiark; system32\drivers\gfiark.sys [x] S2 sbapifs; system32\DRIVERS\sbapifs.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-28 20:56 - 2013-10-28 20:56 - 05240004 _____ C:\video0.dat 2013-10-28 19:15 - 2013-10-28 18:42 - 00018799 _____ C:\FIX.TXT 2013-10-28 19:12 - 2012-09-10 21:25 - 00454056 _____ (Helge Klein) C:\Windows\SetACL.exe 2013-10-28 12:23 - 2013-10-28 12:23 - 00009728 _____ C:\Users\Rej\Desktop\RKreport[0]_D_10282013_122320.txt 2013-10-28 12:22 - 2013-10-28 12:22 - 00006515 _____ C:\Users\Rej\Desktop\RKreport[0]_S_10282013_122251.txt 2013-10-28 12:21 - 2013-10-28 12:26 - 00000000 ____D C:\Users\Rej\Desktop\RK_Quarantine 2013-10-25 12:37 - 2013-10-25 12:37 - 00000000 ____D C:\FRST 2013-10-21 20:50 - 2012-08-31 14:01 - 01511424 _____ C:\Windows\system32\HP1100SM.EXE 2013-10-21 20:50 - 2012-08-31 14:01 - 00151552 _____ C:\Windows\system32\HP1100LM.DLL 2013-10-21 20:50 - 2010-11-24 10:01 - 00099896 _____ (HP) C:\Windows\system32\HPSIsvc.exe 2013-10-21 20:20 - 2013-10-21 20:20 - 00001268 _____ C:\Users\Rej\Documents\cc_20131021_212000.reg 2013-10-21 20:08 - 2013-10-21 20:08 - 00002756 _____ C:\Users\Rej\Documents\HP13.reg 2013-10-21 20:06 - 2013-10-21 20:06 - 00013832 _____ C:\Users\Rej\Documents\HP12.reg 2013-10-21 20:04 - 2013-10-21 20:04 - 00004428 _____ C:\Users\Rej\Documents\HP11.reg 2013-10-21 20:03 - 2013-10-21 20:03 - 00001404 _____ C:\Users\Rej\Documents\HP10.reg 2013-10-21 20:00 - 2013-10-21 20:00 - 00001886 _____ C:\Users\Rej\Documents\HP9.reg 2013-10-21 19:58 - 2013-10-21 19:58 - 00005308 _____ C:\Users\Rej\Documents\HP8.reg 2013-10-21 19:55 - 2013-10-21 19:55 - 00002418 _____ C:\Users\Rej\Documents\HP7.reg 2013-10-21 19:54 - 2013-10-21 19:54 - 00015998 _____ C:\Users\Rej\Documents\hp6.reg 2013-10-21 19:52 - 2013-10-21 19:52 - 00000720 _____ C:\Users\Rej\Documents\hp4.reg 2013-10-21 19:52 - 2013-10-21 19:52 - 00000486 _____ C:\Users\Rej\Documents\hp5.reg 2013-10-21 19:50 - 2013-10-21 19:50 - 00001430 _____ C:\Users\Rej\Documents\HP3.reg 2013-10-21 19:48 - 2013-10-21 19:48 - 00002764 _____ C:\Users\Rej\Documents\HP2.reg 2013-10-21 19:47 - 2013-10-21 19:47 - 00000562 _____ C:\Users\Rej\Documents\HP1.reg 2013-10-21 14:53 - 2013-10-21 14:53 - 00045956 _____ C:\lxcgunst.csv 2013-10-20 18:09 - 2013-10-20 18:09 - 01078600 _____ C:\Users\Rej\Downloads\Unlocker1.9.2.exe 2013-10-20 18:06 - 2013-10-20 18:07 - 00685248 _____ C:\Users\Rej\Downloads\Unlocker(12240) (1).exe 2013-10-20 14:27 - 2013-10-20 18:14 - 00001912 _____ C:\Windows\epplauncher.mif 2013-10-20 14:27 - 2013-10-20 18:13 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-20 07:42 - 2013-10-20 07:42 - 00000000 _____ C:\Users\Rej\Downloads\Unlocker(12240).exe.0gfagkw.partial 2013-10-20 07:26 - 2013-10-20 07:26 - 00000000 ___HD C:\Windows\PIF 2013-10-20 05:02 - 2013-10-20 05:02 - 00031276 _____ C:\Users\Rej\Documents\cc_20131020_060234.reg 2013-10-20 01:44 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2013-10-20 01:44 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2013-10-20 01:39 - 2013-10-20 01:39 - 00000000 ____D C:\ProgramData\Oracle 2013-10-20 01:39 - 2013-10-20 01:39 - 00000000 ____D C:\Program Files\Common Files\Java 2013-10-20 01:39 - 2013-10-20 01:38 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-20 01:39 - 2013-10-20 01:38 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-20 01:39 - 2013-10-20 01:38 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-20 01:39 - 2013-10-20 01:38 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2013-10-20 01:38 - 2013-10-20 01:38 - 00000000 ____D C:\Program Files\Java 2013-10-20 01:28 - 2013-10-28 20:20 - 00660870 _____ C:\Windows\WindowsUpdate.log 2013-10-18 21:37 - 2013-10-28 20:17 - 00003336 _____ C:\Windows\setupact.log 2013-10-18 21:37 - 2013-10-18 21:37 - 00001460 _____ C:\Windows\PFRO.log 2013-10-18 21:37 - 2013-10-18 21:37 - 00000000 _____ C:\Windows\setuperr.log 2013-10-18 21:06 - 2013-10-20 08:13 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2013-10-18 19:29 - 2013-10-18 21:04 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0 2013-10-18 11:22 - 2013-10-18 11:22 - 00000000 ____D C:\Users\Rej\AppData\Local\Google 2013-10-18 11:22 - 2013-10-18 11:22 - 00000000 ____D C:\Program Files\Google 2013-10-11 17:04 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-10-11 17:04 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-10-11 17:04 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-10-11 17:04 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-10-11 17:04 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-10-11 17:04 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-10-11 17:04 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-10-11 06:12 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2013-10-11 06:12 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-10-11 06:12 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2013-10-11 06:12 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-10-11 06:12 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-10-11 06:12 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-10-11 06:12 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2013-10-11 06:12 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2013-10-11 06:12 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-10-11 06:12 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2013-10-11 06:12 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2013-10-11 06:12 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2013-10-11 06:12 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2013-10-11 06:12 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2013-10-11 06:12 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2013-10-11 06:12 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2013-10-11 06:12 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2013-10-11 06:12 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2013-10-11 06:12 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2013-10-11 06:12 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2013-10-11 06:12 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2013-10-11 06:12 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2013-10-11 06:12 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2013-10-11 06:12 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2013-10-11 06:12 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2013-10-10 14:35 - 2013-10-21 14:53 - 00000294 _____ C:\lxcg.log ==================== One Month Modified Files and Folders ======= 2013-10-28 20:56 - 2013-10-28 20:56 - 05240004 _____ C:\video0.dat 2013-10-28 20:24 - 2009-07-14 05:34 - 00014848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-28 20:24 - 2009-07-14 05:34 - 00014848 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-28 20:21 - 2009-10-29 16:58 - 01549696 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-28 20:21 - 2009-07-14 09:07 - 00697674 _____ C:\Windows\system32\perfh015.dat 2013-10-28 20:21 - 2009-07-14 09:07 - 00134784 _____ C:\Windows\system32\perfc015.dat 2013-10-28 20:20 - 2013-10-20 01:28 - 00660870 _____ C:\Windows\WindowsUpdate.log 2013-10-28 20:17 - 2013-10-18 21:37 - 00003336 _____ C:\Windows\setupact.log 2013-10-28 20:17 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-28 19:19 - 2009-12-20 18:43 - 00000000 ____D C:\Users\Rej\AppData\Roaming\Skype 2013-10-28 18:42 - 2013-10-28 19:15 - 00018799 _____ C:\FIX.TXT 2013-10-28 18:26 - 2009-10-30 13:13 - 00000037 _____ C:\Windows\dirsaver.ini 2013-10-28 17:28 - 2011-06-27 06:05 - 00000000 _____ C:\Windows\dtime.dat 2013-10-28 12:26 - 2013-10-28 12:21 - 00000000 ____D C:\Users\Rej\Desktop\RK_Quarantine 2013-10-28 12:23 - 2013-10-28 12:23 - 00009728 _____ C:\Users\Rej\Desktop\RKreport[0]_D_10282013_122320.txt 2013-10-28 12:22 - 2013-10-28 12:22 - 00006515 _____ C:\Users\Rej\Desktop\RKreport[0]_S_10282013_122251.txt 2013-10-28 07:51 - 2010-09-01 15:34 - 00000376 _____ C:\Users\Rej\Desktop\SIMP.url 2013-10-25 12:37 - 2013-10-25 12:37 - 00000000 ____D C:\FRST 2013-10-21 20:48 - 2010-05-26 19:55 - 00000000 ____D C:\Program Files\HP 2013-10-21 20:20 - 2013-10-21 20:20 - 00001268 _____ C:\Users\Rej\Documents\cc_20131021_212000.reg 2013-10-21 20:08 - 2013-10-21 20:08 - 00002756 _____ C:\Users\Rej\Documents\HP13.reg 2013-10-21 20:06 - 2013-10-21 20:06 - 00013832 _____ C:\Users\Rej\Documents\HP12.reg 2013-10-21 20:04 - 2013-10-21 20:04 - 00004428 _____ C:\Users\Rej\Documents\HP11.reg 2013-10-21 20:03 - 2013-10-21 20:03 - 00001404 _____ C:\Users\Rej\Documents\HP10.reg 2013-10-21 20:00 - 2013-10-21 20:00 - 00001886 _____ C:\Users\Rej\Documents\HP9.reg 2013-10-21 19:58 - 2013-10-21 19:58 - 00005308 _____ C:\Users\Rej\Documents\HP8.reg 2013-10-21 19:55 - 2013-10-21 19:55 - 00002418 _____ C:\Users\Rej\Documents\HP7.reg 2013-10-21 19:54 - 2013-10-21 19:54 - 00015998 _____ C:\Users\Rej\Documents\hp6.reg 2013-10-21 19:52 - 2013-10-21 19:52 - 00000720 _____ C:\Users\Rej\Documents\hp4.reg 2013-10-21 19:52 - 2013-10-21 19:52 - 00000486 _____ C:\Users\Rej\Documents\hp5.reg 2013-10-21 19:50 - 2013-10-21 19:50 - 00001430 _____ C:\Users\Rej\Documents\HP3.reg 2013-10-21 19:48 - 2013-10-21 19:48 - 00002764 _____ C:\Users\Rej\Documents\HP2.reg 2013-10-21 19:47 - 2013-10-21 19:47 - 00000562 _____ C:\Users\Rej\Documents\HP1.reg 2013-10-21 19:31 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\NDF 2013-10-21 17:01 - 2009-12-19 00:28 - 00002000 ____H C:\Users\Rej\Documents\Default.rdp 2013-10-21 14:53 - 2013-10-21 14:53 - 00045956 _____ C:\lxcgunst.csv 2013-10-21 14:53 - 2013-10-10 14:35 - 00000294 _____ C:\lxcg.log 2013-10-21 14:53 - 2010-09-01 15:37 - 00000000 ____D C:\Program Files\Lexmark 2300 Series 2013-10-20 18:46 - 2013-03-12 13:34 - 00013030 _____ C:\PDOXUSRS.NET 2013-10-20 18:14 - 2013-10-20 14:27 - 00001912 _____ C:\Windows\epplauncher.mif 2013-10-20 18:13 - 2013-10-20 14:27 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-10-20 18:09 - 2013-10-20 18:09 - 01078600 _____ C:\Users\Rej\Downloads\Unlocker1.9.2.exe 2013-10-20 18:07 - 2013-10-20 18:06 - 00685248 _____ C:\Users\Rej\Downloads\Unlocker(12240) (1).exe 2013-10-20 08:13 - 2013-10-18 21:06 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2013-10-20 07:42 - 2013-10-20 07:42 - 00000000 _____ C:\Users\Rej\Downloads\Unlocker(12240).exe.0gfagkw.partial 2013-10-20 07:26 - 2013-10-20 07:26 - 00000000 ___HD C:\Windows\PIF 2013-10-20 05:02 - 2013-10-20 05:02 - 00031276 _____ C:\Users\Rej\Documents\cc_20131020_060234.reg 2013-10-20 02:52 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache 2013-10-20 02:17 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\pl-PL 2013-10-20 02:02 - 2009-12-20 18:42 - 00000000 ___RD C:\Program Files\Skype 2013-10-20 02:02 - 2009-12-20 18:42 - 00000000 ____D C:\ProgramData\Skype 2013-10-20 01:39 - 2013-10-20 01:39 - 00000000 ____D C:\ProgramData\Oracle 2013-10-20 01:39 - 2013-10-20 01:39 - 00000000 ____D C:\Program Files\Common Files\Java 2013-10-20 01:38 - 2013-10-20 01:39 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-10-20 01:38 - 2013-10-20 01:39 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-10-20 01:38 - 2013-10-20 01:39 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-10-20 01:38 - 2013-10-20 01:39 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2013-10-20 01:38 - 2013-10-20 01:38 - 00000000 ____D C:\Program Files\Java 2013-10-18 21:37 - 2013-10-18 21:37 - 00001460 _____ C:\Windows\PFRO.log 2013-10-18 21:37 - 2013-10-18 21:37 - 00000000 _____ C:\Windows\setuperr.log 2013-10-18 21:04 - 2013-10-18 19:29 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0 2013-10-18 11:22 - 2013-10-18 11:22 - 00000000 ____D C:\Users\Rej\AppData\Local\Google 2013-10-18 11:22 - 2013-10-18 11:22 - 00000000 ____D C:\Program Files\Google 2013-10-14 06:14 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-10-14 05:58 - 2009-07-14 05:33 - 00426088 _____ C:\Windows\system32\FNTCACHE.DAT 2013-10-11 17:06 - 2013-08-14 15:59 - 00000000 ____D C:\Windows\system32\MRT 2013-10-11 17:05 - 2009-10-29 17:15 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-10-04 08:13 - 2013-03-13 17:35 - 00000000 ____D C:\Users\Rej\Desktop\druki Some content of TEMP: ==================== C:\Users\Rej\AppData\Local\Temp\ntdll_dump.dll C:\Users\Rej\AppData\Local\Temp\siinst.exe C:\Users\Rej\AppData\Local\Temp\siuninst.exe C:\Users\Rej\AppData\Local\Temp\strings.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-21 22:43 ==================== End Of Log ============================