Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 23-01-2014 Ran by AnnaR (administrator) on 40-K-ANNAR on 24-01-2014 11:15:50 Running from C:\Users\AnnaR\Desktop\Nowy folder Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: Polish Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) =================== (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (ComArch S.A.) C:\Program Files\Comarch\ComarchSmartCard\CardServer.exe (ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe (Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe (ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe () C:\Windows\svohost.exe (UltraVNC) C:\Program Files\RemoteControl\winvnc.exe () C:\Program Files\QPrinter Bookmaker\qprintmon.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ACD Systems) C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe (UltraVNC) C:\Program Files\RemoteControl\winvnc.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe () C:\Program Files\Audioteka.pl\Audioteka.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Almeza Company) C:\Users\AnnaR\Documents\Almeza\LeaderCommand\LeaderCommand.exe () C:\Program Files\RocketDock\RocketDock.exe ( ) C:\Program Files\ChomikBox\chomikbox.exe (Spotify Ltd) C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe (Spotify Ltd) C:\Users\AnnaR\AppData\Roaming\Spotify\spotify.exe (Steamcore.se) C:\Screamer Radio\screamer.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\mobsync.exe () C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\PrivacyIconClient.exe () C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Intel Corporation) C:\Program Files\Intel\AMT\LMS.exe (Intel Corporation) C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SoundMAXPnP] - C:\Program Files\Analog Devices\Core\smax4pnp.exe [1314816 2009-04-23] (Analog Devices, Inc.) HKLM\...\Run: [picon] - C:\Program Files\Common Files\Intel\Privacy Icon\PIconStartup.exe [111640 2010-05-21] () HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET Smart Security\egui.exe [2219184 2010-11-04] (ESET) HKLM\...\Run: [StartCCC] - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-11-09] (Advanced Micro Devices, Inc.) HKLM\...\Run: [QPrinter 2.0 monitor] - C:\Program Files\QPrinter Bookmaker\qprintmon --server HKLM\...\Run: [RunAudit] - C:\PCScan\RunAudit.exe [622835 2011-04-27] () HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM\...\Run: [ACSW14EN] - C:\Program Files\ACD Systems\ACDSee\14.0\ACDSeeInTouch2.exe [1231472 2011-11-17] (ACD Systems) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM\...\Run: [PrivitizeVPN] - C:\Program Files\PrivitizeVPN\PrivitizeVPN.exe [196784 2013-02-06] (OOO Industry) HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM\...\Run: [Audioteka] - C:\Program Files\Audioteka.pl\Audioteka.exe [2300064 2012-08-09] () HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKCU\...\Run: [LeaderTask Company Management] - C:\Users\AnnaR\Documents\Almeza\LeaderCommand\LeaderCommand.exe [4881544 2012-03-21] (Almeza Company) HKCU\...\Run: [RocketDock] - C:\Program Files\RocketDock\RocketDock.exe [495616 2007-09-02] () HKCU\...\Run: [ChomikBox] - C:\Program Files\ChomikBox\chomikbox.exe [5979648 2012-12-12] ( ) HKCU\...\Run: [Spotify Web Helper] - C:\Users\AnnaR\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2013-12-19] (Spotify Ltd) HKCU\...\Run: [iCloudServices] - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.) HKCU\...\Run: [ApplePhotoStreams] - C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.) HKCU\...\Run: [Spotify] - C:\Users\AnnaR\AppData\Roaming\Spotify\spotify.exe [6118400 2013-12-19] (Spotify Ltd) MountPoints2: {a8218be8-1e92-11e3-b9bd-00219b807518} - N:\USB_test.exe Startup: C:\Users\AnnaR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Baza.bat () Startup: C:\Users\AnnaR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Screamer.lnk ShortcutTarget: Screamer.lnk -> C:\Screamer Radio\screamer.exe (Steamcore.se) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://searchab.com/?aff=7&uid=4b08393e-7050-11e2-859f-00219b807518 SearchScopes: HKLM - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = ${SEARCH_URL}{searchTerms} SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://searchab.com/?aff=7&uid=4b08393e-7050-11e2-859f-00219b807518&q={searchTerms} SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://searchab.com/?aff=7&uid=4b08393e-7050-11e2-859f-00219b807518&q={searchTerms} SearchScopes: HKCU - {1238E4C4-C915-4AD1-8D2A-D1714BCA2F14} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=98FEC050-06BC-4392-9E81-A33A225719FB&apn_sauid=AC80A584-103A-400A-BF04-457A1ACC4266 SearchScopes: HKCU - {6D7E0EBF-5CFE-4AAE-89CB-9B8E2F01583B} URL = http://search.babylon.com/?q={searchTerms}&affID=110823&tt=120912_nocpc_3812_8&babsrc=SP_ss&mntrId=965b916400000000000000219b807518 BHO: YouTube To ALLPlayer - {61DB16C5-B733-43F4-872E-B20DC9E72740} - C:\Program Files\ALLPlayer\YouTubeToALLPlayer.dll (ALLPlayer.org) BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_35-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 62.233.233.233 87.204.204.204 FireFox: ======== FF ProfilePath: C:\Users\AnnaR\AppData\Roaming\Mozilla\Firefox\Profiles\i3jv147z.default-1378361078525 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin: @audioteka.pl/Audioteka.pl,version=1.0.0.1 - C:\Program Files\Audioteka.pl\Plugins\npaudiotekadesktop.dll (Audioteka.pl) FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\AnnaR\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\babylon.xml FF Extension: PEKAO S.A. Sign Plugin - C:\Users\AnnaR\AppData\Roaming\Mozilla\Firefox\Profiles\i3jv147z.default-1378361078525\Extensions\SignPlugin@pekao.pl [2013-09-05] FF Extension: Raiffeisen SignPlugin - C:\Users\AnnaR\AppData\Roaming\Mozilla\Firefox\Profiles\i3jv147z.default-1378361078525\Extensions\SignPlugin@Raiffeisen.com [2013-09-05] FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-19] FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2012-01-18] ========================== Services (Whitelisted) ================= R2 ComarchCardServer; C:\Program Files\Comarch\ComarchSmartCard\CardServer.exe [151552 2010-05-12] (ComArch S.A.) S3 EhttpSrv; C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe [33584 2010-11-04] (ESET) R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [810144 2010-11-04] (ESET) S3 RmcSvc; C:\Windows\System32\rmc.exe [74328 2011-07-07] () R2 svohost; C:\Windows\svohost.exe [388184 2011-10-25] () R2 UNS; C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [2071064 2010-05-21] (Intel Corporation) R2 uvnc_service; C:\Program Files\RemoteControl\winvnc.exe [1738184 2011-07-27] (UltraVNC) ==================== Drivers (Whitelisted) ==================== S3 BIFLAK; C:\PcScan\biflak.sys [2822 2011-11-02] () R3 e1kexpress; C:\Windows\System32\DRIVERS\e1k6032.sys [164864 2009-07-13] (Intel Corporation) R2 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [137144 2010-09-03] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [115008 2010-07-29] (ESET) R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [134512 2010-07-29] (ESET) R3 Epfwndis; C:\Windows\System32\DRIVERS\Epfwndis.sys [32608 2010-07-29] (ESET) R2 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [41336 2010-07-29] (ESET) R3 GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [96640 2012-03-28] (Gemalto) S3 MHIKEY10; C:\Windows\System32\Drivers\MHIKEY10.sys [52096 2010-10-01] (Generic USB smartcard reader) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) U3 kwrcruoc; \??\C:\Temp\kwrcruoc.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-01-24 11:15 - 2014-01-24 11:15 - 00000000 ____D C:\FRST 2014-01-24 10:42 - 2014-01-24 11:15 - 00000000 ____D C:\Users\AnnaR\Desktop\Nowy folder 2014-01-21 08:36 - 2014-01-21 08:42 - 00016384 _____ C:\Users\AnnaR\Desktop\Sprzedaz.xls 2014-01-21 08:32 - 2014-01-21 08:32 - 00000000 ____D C:\ProgramData\Oracle 2014-01-21 08:32 - 2014-01-21 08:32 - 00000000 ____D C:\Program Files\Common Files\Java 2014-01-21 08:32 - 2013-12-18 21:10 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2014-01-21 08:32 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2014-01-21 08:32 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2014-01-21 08:32 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2014-01-21 08:31 - 2014-01-21 08:32 - 00005753 _____ C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-01-17 06:52 - 2014-01-17 06:52 - 00000000 ____D C:\Users\AnnaR\Desktop\reklamacje dom do załatwienia 2014-01-15 06:49 - 2013-11-27 02:14 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-01-15 06:49 - 2013-11-27 02:13 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-01-15 06:49 - 2013-11-26 12:11 - 00240576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-01-15 06:49 - 2013-11-26 11:10 - 02349056 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-01-13 16:10 - 2014-01-17 15:11 - 00000000 ____D C:\Users\AnnaR\Desktop\Glasmark 2014 2014-01-13 09:51 - 2014-01-13 09:51 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup 2014-01-10 18:19 - 2014-01-10 18:21 - 83564401 _____ C:\Users\AnnaR\Downloads\Cała Góra Barwinków - Kocham Kłopoty 2010.zip 2014-01-09 15:07 - 2014-01-09 15:07 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Asseco Business Solutions 2014-01-08 15:32 - 2014-01-08 15:32 - 00000000 ____D C:\Users\AnnaR\Podcasts 2014-01-08 15:32 - 2014-01-08 15:32 - 00000000 ____D C:\Users\AnnaR\Documents\Media Go 2014-01-08 15:31 - 2014-01-08 15:31 - 00001861 _____ C:\Users\Public\Desktop\Media Go.lnk 2014-01-08 15:31 - 2014-01-08 15:31 - 00000000 ____D C:\Program Files\Common Files\Sony Shared 2014-01-08 15:24 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2014-01-08 15:22 - 2014-01-08 15:34 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Sony 2014-01-08 15:22 - 2014-01-08 15:29 - 00000000 ____D C:\Program Files\Sony Media Go Install 2014-01-08 15:22 - 2014-01-08 15:22 - 00002107 _____ C:\Users\Public\Desktop\NWZ-W270S WALKMAN Guide.lnk 2014-01-08 15:19 - 2014-01-08 15:33 - 00000000 ____D C:\ProgramData\Sony Corporation 2014-01-08 15:19 - 2014-01-08 15:31 - 00000000 ____D C:\Program Files\Sony 2014-01-08 15:19 - 2014-01-08 15:19 - 00000536 _____ C:\Windows\wmsetup.log 2014-01-08 08:18 - 2014-01-10 06:26 - 00001131 _____ C:\Users\Public\Desktop\WF-Mag dla Windows.lnk 2014-01-07 12:53 - 2014-01-07 15:18 - 00000000 ____D C:\Users\AnnaR\Desktop\FOTO DOM 2014-01-06 20:23 - 2014-01-06 20:23 - 04558848 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr 2014-01-03 10:09 - 2014-01-03 10:09 - 17437173 _____ C:\Users\AnnaR\Downloads\Thermomix Dobre gotowanie.rar 2014-01-03 10:03 - 2014-01-03 10:04 - 51191427 _____ C:\Users\AnnaR\Downloads\THERMOMIX.rar 2014-01-03 10:02 - 2014-01-03 10:02 - 03237312 _____ C:\Users\AnnaR\Downloads\Thermomix_dla_najm__322_odszych.rar 2014-01-03 09:30 - 2014-01-17 14:47 - 00000000 ____D C:\Users\AnnaR\Desktop\Thermomix przepisy 2014-01-03 09:27 - 2014-01-03 09:27 - 05544833 _____ C:\Users\AnnaR\Downloads\Thermomix_na_bankiecie.rar 2014-01-03 09:26 - 2014-01-03 09:27 - 05434503 _____ C:\Users\AnnaR\Downloads\Boże narodzenie z thermomixem.rar 2014-01-03 09:25 - 2014-01-03 09:38 - 417745761 _____ C:\Users\AnnaR\Downloads\szybkie obiady - przepisy THERMOMIX.rar 2014-01-03 09:25 - 2014-01-03 09:31 - 162933797 _____ C:\Users\AnnaR\Downloads\Lekka kuchnia - thermomix.zip 2013-12-26 13:06 - 2014-01-17 14:02 - 00000000 ____D C:\Users\AnnaR\Desktop\inspiracje grudzień 2013 ==================== One Month Modified Files and Folders ======= 2014-01-24 11:15 - 2014-01-24 11:15 - 00000000 ____D C:\FRST 2014-01-24 11:15 - 2014-01-24 10:42 - 00000000 ____D C:\Users\AnnaR\Desktop\Nowy folder 2014-01-24 11:04 - 2013-03-01 09:26 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Spotify 2014-01-24 11:00 - 2012-04-26 09:16 - 00001034 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-01-24 10:51 - 2012-09-04 07:19 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-01-24 10:44 - 2011-04-12 06:08 - 00697896 _____ C:\Windows\system32\perfh015.dat 2014-01-24 10:44 - 2011-04-12 06:08 - 00135006 _____ C:\Windows\system32\perfc015.dat 2014-01-24 10:44 - 2010-11-20 22:01 - 01549932 _____ C:\Windows\system32\PerfStringBackup.INI 2014-01-24 10:42 - 2013-02-20 19:49 - 00023366 _____ C:\Windows\setupact.log 2014-01-24 08:31 - 2009-07-14 05:34 - 00021904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-01-24 08:31 - 2009-07-14 05:34 - 00021904 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-01-24 08:28 - 2012-01-18 08:42 - 01251005 _____ C:\Windows\WindowsUpdate.log 2014-01-24 08:25 - 2012-05-21 12:30 - 00000000 ____D C:\Users\AnnaR\.gstreamer-0.10 2014-01-24 08:24 - 2013-02-20 19:49 - 00000053 _____ C:\Windows\svohost.log 2014-01-24 08:24 - 2012-04-26 09:16 - 00001030 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-01-24 08:24 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2014-01-21 08:42 - 2014-01-21 08:36 - 00016384 _____ C:\Users\AnnaR\Desktop\Sprzedaz.xls 2014-01-21 08:41 - 2013-05-06 08:07 - 00000000 ____D C:\Users\AnnaR\ANALIZY 2014-01-21 08:32 - 2014-01-21 08:32 - 00000000 ____D C:\ProgramData\Oracle 2014-01-21 08:32 - 2014-01-21 08:32 - 00000000 ____D C:\Program Files\Common Files\Java 2014-01-21 08:32 - 2014-01-21 08:31 - 00005753 _____ C:\Windows\system32\jupdate-1.7.0_51-b13.log 2014-01-21 08:32 - 2012-01-24 18:26 - 00000000 ____D C:\Program Files\Java 2014-01-17 16:24 - 2012-01-25 08:07 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Skype 2014-01-17 15:11 - 2014-01-13 16:10 - 00000000 ____D C:\Users\AnnaR\Desktop\Glasmark 2014 2014-01-17 14:47 - 2014-01-03 09:30 - 00000000 ____D C:\Users\AnnaR\Desktop\Thermomix przepisy 2014-01-17 14:02 - 2013-12-26 13:06 - 00000000 ____D C:\Users\AnnaR\Desktop\inspiracje grudzień 2013 2014-01-17 10:04 - 2013-12-10 10:34 - 00000000 ____D C:\Users\AnnaR\Desktop\inspiracje 10 grudzień 2013 2014-01-17 08:16 - 2012-01-18 09:05 - 00000000 ____D C:\Users\AnnaR 2014-01-17 06:52 - 2014-01-17 06:52 - 00000000 ____D C:\Users\AnnaR\Desktop\reklamacje dom do załatwienia 2014-01-16 14:12 - 2012-02-03 13:45 - 00000000 ____D C:\AnoMail 2007 2014-01-16 09:05 - 2012-04-26 09:16 - 00002141 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2014-01-16 08:12 - 2009-07-14 05:33 - 00403104 _____ C:\Windows\system32\FNTCACHE.DAT 2014-01-15 16:49 - 2012-01-19 13:36 - 00000000 ____D C:\ProgramData\Microsoft Help 2014-01-15 16:48 - 2013-08-19 13:18 - 00000000 ____D C:\Windows\system32\MRT 2014-01-15 16:47 - 2012-01-18 09:41 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-01-15 08:12 - 2012-01-25 06:56 - 00000000 ____D C:\Users\AnnaR\Documents\FPHU GLASMARK MAREK RYGIEL 2014-01-14 13:58 - 2012-08-01 12:32 - 00000000 ___HD C:\Users\AnnaR\[Originals] 2014-01-13 16:08 - 2012-11-28 14:20 - 00000000 ___HD C:\Users\AnnaR\Desktop\[Originals] 2014-01-13 09:51 - 2014-01-13 09:51 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google+ Auto Backup 2014-01-13 08:46 - 2013-12-20 12:43 - 00000000 ____D C:\Users\AnnaR\Desktop\Swiata2013 2014-01-10 18:30 - 2012-06-14 12:36 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\AIMP3 2014-01-10 18:21 - 2014-01-10 18:19 - 83564401 _____ C:\Users\AnnaR\Downloads\Cała Góra Barwinków - Kocham Kłopoty 2010.zip 2014-01-10 06:26 - 2014-01-08 08:18 - 00001131 _____ C:\Users\Public\Desktop\WF-Mag dla Windows.lnk 2014-01-09 15:07 - 2014-01-09 15:07 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Asseco Business Solutions 2014-01-09 08:03 - 2013-02-20 19:48 - 00003584 _____ C:\Windows\PFRO.log 2014-01-08 15:34 - 2014-01-08 15:22 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Sony 2014-01-08 15:33 - 2014-01-08 15:19 - 00000000 ____D C:\ProgramData\Sony Corporation 2014-01-08 15:33 - 2012-11-29 15:04 - 00000000 ____D C:\Users\AnnaR\AppData\Roaming\Sony Corporation 2014-01-08 15:32 - 2014-01-08 15:32 - 00000000 ____D C:\Users\AnnaR\Podcasts 2014-01-08 15:32 - 2014-01-08 15:32 - 00000000 ____D C:\Users\AnnaR\Documents\Media Go 2014-01-08 15:31 - 2014-01-08 15:31 - 00001861 _____ C:\Users\Public\Desktop\Media Go.lnk 2014-01-08 15:31 - 2014-01-08 15:31 - 00000000 ____D C:\Program Files\Common Files\Sony Shared 2014-01-08 15:31 - 2014-01-08 15:19 - 00000000 ____D C:\Program Files\Sony 2014-01-08 15:29 - 2014-01-08 15:22 - 00000000 ____D C:\Program Files\Sony Media Go Install 2014-01-08 15:22 - 2014-01-08 15:22 - 00002107 _____ C:\Users\Public\Desktop\NWZ-W270S WALKMAN Guide.lnk 2014-01-08 15:19 - 2014-01-08 15:19 - 00000536 _____ C:\Windows\wmsetup.log 2014-01-08 13:54 - 2013-01-05 14:36 - 00000000 ____D C:\Users\AnnaR\Desktop\GLASMARK 2013 2014-01-08 08:18 - 2013-08-22 07:33 - 00002202 _____ C:\Users\Public\Desktop\WF-Analizy.lnk 2014-01-08 08:18 - 2012-01-25 07:14 - 00000000 ____D C:\ProgramData\WA-PRO 2014-01-08 08:18 - 2012-01-25 07:14 - 00000000 ____D C:\Program Files\Common Files\WA-PRO 2014-01-08 08:17 - 2012-01-25 07:14 - 00000000 ____D C:\Program Files\WA-PRO 2014-01-07 15:53 - 2013-08-22 07:38 - 00000000 ____D C:\Users\AnnaR\Documents\Pliki programu WF-Analizy 2014-01-07 15:18 - 2014-01-07 12:53 - 00000000 ____D C:\Users\AnnaR\Desktop\FOTO DOM 2014-01-06 20:23 - 2014-01-06 20:23 - 04558848 _____ (Google Inc.) C:\Windows\system32\GPhotos.scr 2014-01-03 10:09 - 2014-01-03 10:09 - 17437173 _____ C:\Users\AnnaR\Downloads\Thermomix Dobre gotowanie.rar 2014-01-03 10:04 - 2014-01-03 10:03 - 51191427 _____ C:\Users\AnnaR\Downloads\THERMOMIX.rar 2014-01-03 10:02 - 2014-01-03 10:02 - 03237312 _____ C:\Users\AnnaR\Downloads\Thermomix_dla_najm__322_odszych.rar 2014-01-03 09:38 - 2014-01-03 09:25 - 417745761 _____ C:\Users\AnnaR\Downloads\szybkie obiady - przepisy THERMOMIX.rar 2014-01-03 09:31 - 2014-01-03 09:25 - 162933797 _____ C:\Users\AnnaR\Downloads\Lekka kuchnia - thermomix.zip 2014-01-03 09:27 - 2014-01-03 09:27 - 05544833 _____ C:\Users\AnnaR\Downloads\Thermomix_na_bankiecie.rar 2014-01-03 09:27 - 2014-01-03 09:26 - 05434503 _____ C:\Users\AnnaR\Downloads\Boże narodzenie z thermomixem.rar 2014-01-03 09:08 - 2012-01-25 07:03 - 00000000 ____D C:\Users\AnnaR\Desktop\WYCIĄGI BANKOWE ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-24 09:06 ==================== End Of Log ============================