Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-04-2014
Ran by Vision (administrator) on JANKOWIA-186EB5 on 19-04-2014 20:52:29
Running from C:\
Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polish
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe
(Mobile Leader Co.,Ltd.) C:\WINDOWS\system32\ScsiCommandService2.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Advanced Micro Devices Inc.) D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(ATI Technologies Inc.) D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
() F:\Viewer.exe
(Microsoft Corporation) C:\WINDOWS\system32\taskmgr.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [StartCCC] => D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2012-03-09] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [20145368 2013-10-04] (Realtek Semiconductor Corp.)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKU\.DEFAULT\...\RunOnce: [FlashPlayerUpdate] - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_11_8_800_168_Plugin.exe [815496 2013-09-12] (Adobe Systems Incorporated)
HKU\S-1-5-21-1757981266-2111687655-682003330-1003\...\MountPoints2: {c94a7373-feaa-11e2-bc3f-ec3678798fc0} - G:\LGAutoRun.exe
Lsa: [Authentication Packages] msv1_0 nwprovau

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.11.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Vision\Dane aplikacji\Mozilla\Firefox\Profiles\zkyjr08q.default-1397913651890
FF Homepage: google.pl
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Documents and Settings\Vision\Ustawienia lokalne\Dane aplikacji\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Extension: Adblock Plus - C:\Documents and Settings\Vision\Dane aplikacji\Mozilla\Firefox\Profiles\zkyjr08q.default-1397913651890\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-19]

========================== Services (Whitelisted) =================

R2 NWCWorkstation; C:\WINDOWS\System32\nwwks.dll [65536 2008-04-15] (Microsoft Corporation)
R2 ScsiCommandService2; C:\WINDOWS\system32\ScsiCommandService2.exe [48128 2011-10-31] (Mobile Leader Co.,Ltd.)

==================== Drivers (Whitelisted) ====================

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 AtiHDAudioService; C:\WINDOWS\System32\drivers\AtihdXP3.sys [100368 2011-12-20] (Advanced Micro Devices)
R1 dtsoftbus01; C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys [243128 2013-12-24] (Disc Soft Ltd)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2008-04-15] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2008-04-15] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2008-04-15] (Microsoft Corporation)
R3 NWRDR; C:\WINDOWS\System32\DRIVERS\nwrdr.sys [163584 2008-04-15] (Microsoft Corporation)
S4 IntelIde; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-19 20:52 - 2014-04-19 20:52 - 00004744 _____ () C:\FRST.txt
2014-04-19 20:49 - 2014-04-19 20:49 - 01043968 _____ (Farbar) C:\FRST.exe
2014-04-19 15:45 - 2014-04-19 15:45 - 00000823 _____ () C:\Documents and Settings\Vision\Pulpit\µTorrent.lnk
2014-04-19 15:45 - 2014-04-19 15:45 - 00000823 _____ () C:\Documents and Settings\Vision\Menu Start\µTorrent.lnk
2014-04-19 15:25 - 2014-04-19 15:26 - 00000000 ____D () C:\AdwCleaner
2014-04-19 15:21 - 2014-04-19 15:21 - 00000000 ____D () C:\Documents and Settings\Vision\Pulpit\Stare dane programu Firefox
2014-04-19 15:19 - 2014-04-19 15:19 - 00000000 ____D () C:\Program Files\WatcHItoAdBllocKE
2014-04-19 15:15 - 2014-04-19 15:15 - 00000000 ____D () C:\Program Files\SaiVeLots
2014-04-19 15:09 - 2014-04-19 15:09 - 00000000 ____D () C:\Program Files\DoWenSaVe
2014-04-19 15:03 - 2014-04-19 15:15 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\79c55f939eee2dda
2014-04-19 13:47 - 2014-04-19 13:47 - 00000628 _____ () C:\Documents and Settings\Vision\Pulpit\Notepad++.lnk
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\Vision\Menu Start\Programy\Notepad++
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\Vision\Dane aplikacji\Notepad++
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Notepad++
2014-04-19 13:44 - 2014-04-19 13:46 - 07624808 _____ () C:\Documents and Settings\Vision\Pulpit\npp.6.5.5.Installer.exe
2014-04-18 23:50 - 2014-04-18 23:50 - 00000682 _____ () C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk
2014-04-18 23:50 - 2014-04-18 23:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-18 23:50 - 2014-04-18 23:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\CCleaner
2014-04-18 23:49 - 2014-04-18 23:49 - 04787368 _____ (Piriform Ltd) C:\Documents and Settings\Vision\Pulpit\ccsetup412.exe
2014-04-18 19:39 - 2014-04-18 19:39 - 00013075 _____ () C:\Documents and Settings\Vision\Pulpit\1.txt
2014-04-18 19:07 - 2014-04-19 20:44 - 00000000 ____D () C:\FRST
2014-04-18 19:05 - 2014-04-18 19:03 - 00719888 _____ () C:\Documents and Settings\Vision\Pulpit\OTL.Txt
2014-04-18 19:05 - 2014-04-18 19:03 - 00037960 _____ () C:\Documents and Settings\Vision\Pulpit\Extras.Txt
2014-04-17 19:13 - 2014-04-19 15:33 - 00762846 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-17 19:09 - 2008-04-14 20:50 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\system32\hidserv.dll
2014-04-13 13:02 - 2014-04-13 13:02 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2922229$
2014-04-06 17:22 - 2014-04-06 17:23 - 00000000 ___SD () C:\ComboFix
2014-04-06 16:59 - 2014-04-06 16:59 - 00000000 _RSHD () C:\cmdcons
2014-04-06 16:59 - 2014-04-05 23:52 - 00000211 _____ () C:\Boot.bak
2014-04-06 16:59 - 2004-08-03 23:00 - 00262400 __RSH () C:\cmldr
2014-04-06 16:55 - 2014-04-06 16:56 - 05193579 ____R (Swearware) C:\Documents and Settings\Vision\Pulpit\ComboFix.exe
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moje wideo
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moje obrazy
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moja muzyka
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Menu Start\Programy\Narzędzia administracyjne
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moje wideo
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moje obrazy
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moja muzyka
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ____D () C:\Qoobox
2014-04-06 12:57 - 2011-06-26 08:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2014-04-06 12:57 - 2010-11-07 19:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2014-04-06 12:57 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2014-04-06 12:57 - 2000-08-31 02:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2014-04-06 12:56 - 2014-04-06 12:56 - 00000000 ____D () C:\WINDOWS\erdnt
2014-04-05 18:44 - 2014-04-05 18:44 - 00000000 ____D () C:\Documents and Settings\Vision\Moje dokumenty\Gameforge Live
2014-04-05 11:41 - 2014-04-05 11:41 - 00000000 ____D () C:\Program Files\Szkola podstawowa klasa 4 - Tajemnice przyrody
2014-04-05 11:41 - 2014-04-05 11:41 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Szkola podstawowa klasa 4
2014-04-03 20:00 - 2014-04-19 15:29 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\DoWenSaVe
2014-03-31 17:08 - 2014-04-19 15:29 - 00000224 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job
2014-03-31 17:08 - 2014-04-08 15:54 - 00000218 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job
2014-03-30 20:52 - 2014-03-30 20:52 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2934207$
2014-03-23 03:06 - 2014-03-23 03:06 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2930275$
2014-03-23 03:06 - 2014-03-23 03:06 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2929961$
2014-03-23 03:04 - 2014-04-13 13:02 - 88028728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-03-23 03:04 - 2014-02-27 01:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\xp_eos.exe
2014-03-23 03:04 - 2014-02-27 01:28 - 00013312 ____N (Microsoft Corporation) C:\WINDOWS\system32\dllcache\xp_eos.exe
2014-03-22 18:17 - 2014-04-19 20:49 - 00000000 ____D () C:\Documents and Settings\Vision\Moje dokumenty\Pobieranie
2014-03-22 00:54 - 2014-04-19 20:20 - 00524288 _____ () C:\WINDOWS\system32\config\ACEEvent.evt

==================== One Month Modified Files and Folders =======

2014-04-19 20:52 - 2014-04-19 20:52 - 00004744 _____ () C:\FRST.txt
2014-04-19 20:50 - 2013-08-06 19:45 - 00000000 ____D () C:\Documents and Settings\Vision\Dane aplikacji\uTorrent
2014-04-19 20:49 - 2014-04-19 20:49 - 01043968 _____ (Farbar) C:\FRST.exe
2014-04-19 20:49 - 2014-03-22 18:17 - 00000000 ____D () C:\Documents and Settings\Vision\Moje dokumenty\Pobieranie
2014-04-19 20:44 - 2014-04-18 19:07 - 00000000 ____D () C:\FRST
2014-04-19 20:43 - 2013-08-21 21:29 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-04-19 20:20 - 2014-03-22 00:54 - 00524288 _____ () C:\WINDOWS\system32\config\ACEEvent.evt
2014-04-19 15:47 - 2013-08-06 16:34 - 01176097 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-19 15:45 - 2014-04-19 15:45 - 00000823 _____ () C:\Documents and Settings\Vision\Pulpit\µTorrent.lnk
2014-04-19 15:45 - 2014-04-19 15:45 - 00000823 _____ () C:\Documents and Settings\Vision\Menu Start\µTorrent.lnk
2014-04-19 15:45 - 2013-08-06 16:40 - 00000000 ___RD () C:\Documents and Settings\Vision\Menu Start
2014-04-19 15:45 - 2013-08-06 16:40 - 00000000 ____D () C:\Documents and Settings\Vision\Pulpit
2014-04-19 15:33 - 2014-04-17 19:13 - 00762846 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-19 15:33 - 2008-04-15 14:00 - 00119622 _____ () C:\WINDOWS\system32\perfc015.dat
2014-04-19 15:33 - 2008-04-15 14:00 - 00000478 _____ () C:\WINDOWS\system32\perfh015.dat
2014-04-19 15:29 - 2014-04-03 20:00 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\DoWenSaVe
2014-04-19 15:29 - 2014-03-31 17:08 - 00000224 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job
2014-04-19 15:29 - 2014-02-03 12:18 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\WatcHItoAdBllocKE
2014-04-19 15:29 - 2013-12-31 12:11 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\SaiVeLots
2014-04-19 15:29 - 2013-12-11 15:24 - 00000000 ____D () C:\Support
2014-04-19 15:29 - 2013-08-06 18:14 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji
2014-04-19 15:29 - 2013-08-06 16:39 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-19 15:27 - 2013-08-06 16:40 - 00000188 ___SH () C:\Documents and Settings\Vision\ntuser.ini
2014-04-19 15:27 - 2013-08-06 16:39 - 00032452 _____ () C:\WINDOWS\SchedLgU.Txt
2014-04-19 15:26 - 2014-04-19 15:25 - 00000000 ____D () C:\AdwCleaner
2014-04-19 15:26 - 2013-08-06 16:40 - 00000000 __RHD () C:\Documents and Settings\Vision\Dane aplikacji
2014-04-19 15:26 - 2013-08-06 16:40 - 00000000 ___HD () C:\Documents and Settings\Vision\Ustawienia lokalne\Dane aplikacji
2014-04-19 15:21 - 2014-04-19 15:21 - 00000000 ____D () C:\Documents and Settings\Vision\Pulpit\Stare dane programu Firefox
2014-04-19 15:19 - 2014-04-19 15:19 - 00000000 ____D () C:\Program Files\WatcHItoAdBllocKE
2014-04-19 15:15 - 2014-04-19 15:15 - 00000000 ____D () C:\Program Files\SaiVeLots
2014-04-19 15:15 - 2014-04-19 15:03 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\79c55f939eee2dda
2014-04-19 15:12 - 2013-08-06 16:40 - 00000000 ___RD () C:\Documents and Settings\Vision\Menu Start\Programy
2014-04-19 15:09 - 2014-04-19 15:09 - 00000000 ____D () C:\Program Files\DoWenSaVe
2014-04-19 13:52 - 2013-11-04 02:01 - 00000008 __RSH () C:\Documents and Settings\Vision\ntuser.pol
2014-04-19 13:52 - 2013-08-06 16:40 - 00000000 ____D () C:\Documents and Settings\Vision
2014-04-19 13:51 - 2014-02-03 12:18 - 00000008 __RSH () C:\Documents and Settings\All Users\ntuser.pol
2014-04-19 13:48 - 2013-12-11 23:36 - 00000940 _____ () C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk
2014-04-19 13:48 - 2013-11-04 02:01 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-04-19 13:48 - 2013-08-06 18:40 - 00000946 _____ () C:\Documents and Settings\All Users\Menu Start\Programy\Mozilla Firefox.lnk
2014-04-19 13:48 - 2013-08-06 18:30 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-19 13:48 - 2013-08-06 18:14 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2014-04-19 13:48 - 2013-08-06 18:14 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2014-04-19 13:48 - 2013-08-06 16:41 - 00001037 _____ () C:\Documents and Settings\Vision\Menu Start\Programy\Internet Explorer.lnk
2014-04-19 13:48 - 2013-08-06 16:39 - 00000000 ____D () C:\Documents and Settings\NetworkService\Dane aplikacji
2014-04-19 13:47 - 2014-04-19 13:47 - 00000628 _____ () C:\Documents and Settings\Vision\Pulpit\Notepad++.lnk
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\Vision\Menu Start\Programy\Notepad++
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\Vision\Dane aplikacji\Notepad++
2014-04-19 13:47 - 2014-04-19 13:47 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Notepad++
2014-04-19 13:46 - 2014-04-19 13:44 - 07624808 _____ () C:\Documents and Settings\Vision\Pulpit\npp.6.5.5.Installer.exe
2014-04-19 12:17 - 2014-03-07 21:19 - 00000000 ____D () C:\Documents and Settings\Vision\Pulpit\Zdjęcia ;)
2014-04-19 11:36 - 2013-08-24 21:36 - 00000123 _____ () C:\Documents and Settings\NetworkService\Dane aplikacji\WB.CFG
2014-04-19 11:14 - 2013-12-11 15:23 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\ShoppingChip
2014-04-18 23:52 - 2013-08-08 12:06 - 00000000 ____D () C:\Documents and Settings\Vision\Dane aplikacji\DAEMON Tools Lite
2014-04-18 23:51 - 2014-02-07 12:52 - 00000000 ____D () C:\WINDOWS\Minidump
2014-04-18 23:50 - 2014-04-18 23:50 - 00000682 _____ () C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk
2014-04-18 23:50 - 2014-04-18 23:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-04-18 23:50 - 2014-04-18 23:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\CCleaner
2014-04-18 23:49 - 2014-04-18 23:49 - 04787368 _____ (Piriform Ltd) C:\Documents and Settings\Vision\Pulpit\ccsetup412.exe
2014-04-18 23:01 - 2013-12-11 15:23 - 00000000 ____D () C:\Program Files\ShoppingChip
2014-04-18 19:39 - 2014-04-18 19:39 - 00013075 _____ () C:\Documents and Settings\Vision\Pulpit\1.txt
2014-04-18 19:03 - 2014-04-18 19:05 - 00719888 _____ () C:\Documents and Settings\Vision\Pulpit\OTL.Txt
2014-04-18 19:03 - 2014-04-18 19:05 - 00037960 _____ () C:\Documents and Settings\Vision\Pulpit\Extras.Txt
2014-04-18 18:50 - 2013-08-06 16:40 - 00000000 ___HD () C:\Documents and Settings\Vision\Ustawienia lokalne
2014-04-18 12:21 - 2013-10-07 18:03 - 03928064 ___SH () C:\Documents and Settings\Vision\Pulpit\Thumbs.db
2014-04-13 13:02 - 2014-04-13 13:02 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2922229$
2014-04-13 13:02 - 2014-03-23 03:04 - 88028728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-04-08 18:00 - 2008-04-15 14:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-04-08 15:54 - 2014-03-31 17:08 - 00000218 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job
2014-04-06 17:23 - 2014-04-06 17:22 - 00000000 ___SD () C:\ComboFix
2014-04-06 16:59 - 2014-04-06 16:59 - 00000000 _RSHD () C:\cmdcons
2014-04-06 16:59 - 2013-08-06 18:12 - 00000327 __RSH () C:\boot.ini
2014-04-06 16:56 - 2014-04-06 16:55 - 05193579 ____R (Swearware) C:\Documents and Settings\Vision\Pulpit\ComboFix.exe
2014-04-06 16:47 - 2013-08-06 18:40 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moje wideo
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moje obrazy
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty\Moja muzyka
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\Vision\Menu Start\Programy\Narzędzia administracyjne
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moje wideo
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moje obrazy
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty\Moja muzyka
2014-04-06 12:57 - 2014-04-06 12:57 - 00000000 ____D () C:\Qoobox
2014-04-06 12:57 - 2013-08-06 18:14 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty
2014-04-06 12:57 - 2013-08-06 16:40 - 00000000 ___RD () C:\Documents and Settings\Vision\Moje dokumenty
2014-04-06 12:56 - 2014-04-06 12:56 - 00000000 ____D () C:\WINDOWS\erdnt
2014-04-06 11:15 - 2013-08-06 18:13 - 00105416 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-04-05 23:52 - 2014-04-06 16:59 - 00000211 _____ () C:\Boot.bak
2014-04-05 23:52 - 2008-04-15 14:00 - 00000507 _____ () C:\WINDOWS\win.ini
2014-04-05 23:52 - 2008-04-15 14:00 - 00000246 _____ () C:\WINDOWS\system.ini
2014-04-05 18:44 - 2014-04-05 18:44 - 00000000 ____D () C:\Documents and Settings\Vision\Moje dokumenty\Gameforge Live
2014-04-05 18:43 - 2013-11-30 13:51 - 00000000 ____D () C:\Program Files\GameforgeLive
2014-04-05 11:41 - 2014-04-05 11:41 - 00000000 ____D () C:\Program Files\Szkola podstawowa klasa 4 - Tajemnice przyrody
2014-04-05 11:41 - 2014-04-05 11:41 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Szkola podstawowa klasa 4
2014-03-30 20:52 - 2014-03-30 20:52 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2934207$
2014-03-29 20:18 - 2013-12-26 18:58 - 00000010 _____ () C:\WINDOWS\silcom_p.ini
2014-03-29 20:18 - 2013-09-27 21:45 - 00000000 ____D () C:\Documents and Settings\Vision\Dane aplikacji\Skype
2014-03-29 20:18 - 2013-09-27 21:45 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Skype
2014-03-29 20:18 - 2013-08-07 14:32 - 00000000 ____D () C:\Program Files\Common Files\InstallShield
2014-03-23 15:22 - 2013-11-27 23:59 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-03-23 03:06 - 2014-03-23 03:06 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2930275$
2014-03-23 03:06 - 2014-03-23 03:06 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB2929961$
2014-03-23 02:29 - 2013-08-06 17:45 - 00000000 ____D () C:\WINDOWS\Microsoft.NET

Some content of TEMP:
====================
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\72969uninstall.exe
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\bi_cleaner.exe
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\libcurl-4.dll
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\minerd.exe
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\pthreadGC2.dll
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\Quarantine.exe
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\Sqlite3.dll
C:\Documents and Settings\Vision\Ustawienia lokalne\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe
[2008-04-15 14:00] - [2008-04-15 14:00] - 1035264 ____A (Microsoft Corporation) c791ed9eac5e76d9525e157b1d7a599a 

C:\WINDOWS\system32\winlogon.exe
[2008-04-15 14:00] - [2008-04-15 14:00] - 0510464 ____A (Microsoft Corporation) 51fd2e13d723857b9ca239ae77150f48 

C:\WINDOWS\system32\svchost.exe
[2008-04-15 14:00] - [2008-04-15 14:00] - 0014336 ____A (Microsoft Corporation) 8607d35d92528e2df386f19a960d23ce 

C:\WINDOWS\system32\services.exe
[2008-04-15 14:00] - [2009-02-09 13:25] - 0111104 ____A (Microsoft Corporation) 02a467e27af55f7064c5b251e587315f 

C:\WINDOWS\system32\User32.dll
[2008-04-15 14:00] - [2008-04-15 14:00] - 0580096 ____A (Microsoft Corporation) a435c5c069afd901751ac323ad238793 

C:\WINDOWS\system32\userinit.exe
[2008-04-15 14:00] - [2008-04-15 14:00] - 0026624 ____A (Microsoft Corporation) 2a5b37d520508be6570a3ea79695f5b5 

C:\WINDOWS\system32\rpcss.dll
[2008-04-15 14:00] - [2009-02-09 12:53] - 0401408 ____A (Microsoft Corporation) a37311d9d628c1042a2836731787f0f3 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2008-04-15 14:00] - [2008-04-15 14:00] - 0052864 ____A (Microsoft Corporation) 56b191ac5fc0df219949c95a6c87afe7 


==================== End Of Log ============================