Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-04-2014 03 Ran by Aleksandra (administrator) on SZEF on 27-04-2014 08:18:09 Running from D:\Downloads\FRST Windows Vista (TM) Ultimate Service Pack 2 (X64) OS Language: Polish Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe () C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Tonec Inc.) C:\Program Files (x86)\Internet Download Manager\IDMan.exe (Microsoft Corporation) C:\Windows\system32\conime.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-19] (Microsoft Corporation) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1657128 2008-10-31] (Synaptics, Inc.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6962208 2008-12-26] (Realtek Semiconductor) HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2008-12-26] (Realtek Semiconductor Corp.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [OnekeyDM] => C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe [471552 2008-12-23] () HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-14] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [1073312 2012-03-09] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [180304 2014-04-15] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-628482503-715703045-1814460480-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-19] (Microsoft Corporation) HKU\S-1-5-21-628482503-715703045-1814460480-1000\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-628482503-715703045-1814460480-1000\...\Policies\Explorer: [] HKU\S-1-5-21-628482503-715703045-1814460480-1000\...\MountPoints2: {b37c8a2e-75f4-11e3-8432-00242ce8b8a4} - J:\LaunchU3.exe -a HKLM\...\AppCertDlls: [x64] -> c:\program files (x86)\settings manager\systemk\x64\sysapcrt.dll HKLM\...\AppCertDlls: [x86] -> c:\program files (x86)\settings manager\systemk\sysapcrt.dll ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.default-search.net?sid=476&aid=132&itype=n&ver=12349&tm=329&src=hmp HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=147 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=147 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2476} URL = http://www.default-search.net/search?sid=476&aid=132&itype=n&ver=12349&tm=329&src=ds&p={searchTerms} BHO: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll (Internet Download Manager, Tonec Inc.) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: IDMIEHlprObj Class - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.) BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: FlashGetBHO - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Aleksandra\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll (Trend Media Group) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 62.179.1.63 62.179.1.62 FireFox: ======== FF ProfilePath: C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default FF SearchEngineOrder.1: default-search.net FF Homepage: www.onet.pl FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\browser\plugins\npVividasPlayer.dll ( ) FF SearchPlugin: C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\searchplugins\webde-suche.xml FF Extension: Settings Manager - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\Extensions\{E729C6EC-E9FF-E59F-355C-EC59F2795E4E} [2014-04-26] FF Extension: Add Google Search To New Tab Page - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\Extensions\newtabgoogle@graememcc.co.uk.xpi [2013-04-24] FF Extension: Private Tab - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\Extensions\privateTab@infocatcher.xpi [2013-04-23] FF Extension: YouTube Cinema Mode . - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\Extensions\youtube-cinemode@gmail.com.xpi [2013-04-23] FF Extension: Adblock Plus - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\7xo4fpg5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-04-23] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [] FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 FF Extension: IDM CC - C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 [2013-04-24] FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 FF Extension: IDM CC - C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 [2013-04-24] ==================== Services (Whitelisted) ================= R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-14] (Avira Operations GmbH & Co. KG) S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-14] (Avira Operations GmbH & Co. KG) R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.) R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [122448 2014-04-15] (Avira Operations GmbH & Co. KG) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation) ==================== Drivers (Whitelisted) ==================== R1 appliand; C:\Windows\System32\DRIVERS\appliand.sys [30304 2013-02-06] (Applian Technologies Inc.) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2014-02-14] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-14] (Avira Operations GmbH & Co. KG) R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2009-02-10] (EZB Systems, Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-27] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation) S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-04-16] (Research In Motion Limited) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [503352 2013-04-23] () S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-04-27 08:17 - 2014-04-27 08:18 - 00000000 ____D () C:\FRST 2014-04-27 06:20 - 2014-04-27 06:54 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-27 06:19 - 2014-04-27 06:19 - 00000980 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-04-27 06:19 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-27 06:19 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-27 06:19 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-27 05:52 - 2014-04-27 06:49 - 00008248 _____ () C:\Windows\PFRO.log 2014-04-26 19:34 - 2014-04-26 19:34 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-04-26 19:33 - 2014-04-27 06:15 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-04-26 19:17 - 2014-04-26 19:17 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\VS Revo Group 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\ProgramData\VS Revo Group 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-04-26 19:16 - 2009-12-30 10:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys 2014-04-26 19:11 - 2014-04-26 19:11 - 00002496 _____ () C:\Users\Aleksandra\Documents\cc_20140426_191109.reg 2014-04-26 07:57 - 2014-04-26 19:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft 2014-04-26 07:57 - 2014-04-26 19:04 - 00000000 ____D () C:\Program Files (x86)\Anvisoft 2014-04-26 07:57 - 2014-04-26 07:57 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\Anvisoft 2014-04-26 07:30 - 2014-04-27 06:49 - 00000000 ____D () C:\Program Files (x86)\Settings Manager 2014-04-26 07:30 - 2014-04-26 07:56 - 00000000 ____D () C:\Program Files\Sokoban 2014-04-26 07:30 - 2014-04-26 07:30 - 00808815 _____ () C:\Users\Aleksandra\Desktop\Sokoban.exe 2014-04-26 07:30 - 2014-04-26 07:30 - 00000783 _____ () C:\Users\Aleksandra\Desktop\Sokoban.lnk 2014-04-26 07:30 - 2014-04-26 07:30 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sokoban 2014-04-23 05:58 - 2014-04-23 05:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-23 05:57 - 2014-04-23 05:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-04-23 05:55 - 2014-04-23 05:55 - 00921512 _____ (Oracle Corporation) C:\Users\Aleksandra\Downloads\jxpiinstall.exe 2014-04-23 05:54 - 2014-04-23 05:55 - 00004976 _____ () C:\Users\Aleksandra\Documents\cc_20140423_055451.reg 2014-04-23 05:23 - 2014-04-23 05:24 - 00004100 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log 2014-04-21 22:18 - 2014-04-21 22:18 - 02240512 _____ () C:\Users\Aleksandra\Desktop\Banner.psd 2014-04-21 19:14 - 2014-04-21 19:14 - 00044790 _____ () C:\Users\Aleksandra\Desktop\poznaj vitafon.psd 2014-04-21 13:16 - 2014-04-21 13:16 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Unity 2014-04-21 12:59 - 2014-04-26 19:19 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\Unity 2014-04-21 12:59 - 2014-04-21 12:59 - 01070496 _____ (Unity Technologies ApS) C:\Users\Aleksandra\Downloads\UnityWebPlayer.exe 2014-04-19 16:43 - 2014-04-19 16:43 - 03996062 _____ () C:\Users\Aleksandra\Desktop\Alternative.zip 2014-04-19 16:43 - 2014-04-19 16:43 - 02475617 _____ () C:\Users\Aleksandra\Desktop\peruka z opisem.zip 2014-04-19 16:43 - 2014-04-19 16:43 - 01504987 _____ () C:\Users\Aleksandra\Desktop\Flower.zip 2014-04-19 12:32 - 2014-04-19 18:14 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Flower 2014-04-19 09:38 - 2014-04-20 13:59 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Alternative 2014-04-18 16:47 - 2014-04-20 08:46 - 06486669 _____ () C:\Users\Aleksandra\Desktop\peruka z opisem.psd 2014-04-17 05:48 - 2014-04-17 05:48 - 00001079 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-04-16 17:42 - 2014-04-17 00:21 - 00000819 _____ () C:\Users\Aleksandra\Desktop\Nowy dokument tekstowy.txt 2014-04-14 18:02 - 2014-04-14 18:02 - 00000132 _____ () C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu GIF CS6 firmy Adobe 2014-04-13 20:15 - 2014-04-21 21:18 - 00000132 _____ () C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu PNG CS6 firmy Adobe 2014-04-13 20:15 - 2014-04-19 07:47 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Peruki www 2014-04-13 18:28 - 2014-04-13 18:28 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2014-04-13 18:27 - 2014-04-13 18:27 - 00001058 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk 2014-04-13 18:26 - 2014-04-13 18:27 - 00000000 ____D () C:\Program Files\Adobe 2014-04-13 18:26 - 2014-04-13 18:26 - 00001020 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk 2014-04-13 18:23 - 2014-04-13 18:23 - 00001389 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk 2014-04-13 18:23 - 2014-04-13 18:23 - 00001227 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk 2014-04-13 18:21 - 2014-04-13 18:21 - 00354208 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistMSI0BE5.txt 2014-04-13 18:21 - 2014-04-13 18:21 - 00011560 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistUI0BE5.txt 2014-04-13 18:20 - 2014-04-13 18:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-04-13 18:20 - 2014-04-13 18:20 - 00366252 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistMSI0B6C.txt 2014-04-13 18:20 - 2014-04-13 18:20 - 00011592 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistUI0B6C.txt 2014-04-13 10:19 - 2014-04-13 10:19 - 00000000 ____D () C:\Users\Aleksandra\Documents\RRR2 2014-04-13 10:18 - 2014-04-13 10:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft 2014-04-13 10:17 - 2014-04-13 10:17 - 00000000 ____D () C:\Program Files (x86)\Ubisoft 2014-04-13 06:56 - 2014-04-13 06:56 - 00809318 _____ () C:\Users\Aleksandra\Downloads\blue_business_2.tar.gz 2014-04-12 19:46 - 2014-04-14 17:56 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Nowy folder 2014-04-12 15:56 - 2014-04-13 05:50 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Peruki 2014-04-12 07:05 - 2014-04-12 07:06 - 00045230 _____ () C:\Users\Aleksandra\Documents\cc_20140412_070543.reg 2014-04-11 09:30 - 2014-03-08 06:54 - 17848832 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-04-11 09:30 - 2014-03-08 06:06 - 10926592 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-04-11 09:30 - 2014-03-08 05:49 - 02334720 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-04-11 09:30 - 2014-03-08 05:41 - 01347072 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-04-11 09:30 - 2014-03-08 05:40 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-04-11 09:30 - 2014-03-08 05:39 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-04-11 09:30 - 2014-03-08 05:38 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-04-11 09:30 - 2014-03-08 05:37 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-04-11 09:30 - 2014-03-08 05:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-04-11 09:30 - 2014-03-08 05:34 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-04-11 09:30 - 2014-03-08 05:33 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-04-11 09:30 - 2014-03-08 05:32 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-04-11 09:30 - 2014-03-08 05:32 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-04-11 09:30 - 2014-03-08 05:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-04-11 09:30 - 2014-03-08 05:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-04-11 09:30 - 2014-03-08 05:24 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-04-11 09:30 - 2014-03-08 01:51 - 12347904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-04-11 09:30 - 2014-03-08 01:20 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-04-11 09:30 - 2014-03-08 01:12 - 01806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-04-11 09:30 - 2014-03-08 01:03 - 01105408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-04-11 09:30 - 2014-03-08 01:02 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-04-11 09:30 - 2014-03-08 01:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-04-11 09:30 - 2014-03-08 01:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-04-11 09:30 - 2014-03-08 00:59 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-04-11 09:30 - 2014-03-08 00:57 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-04-11 09:30 - 2014-03-08 00:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-04-11 09:30 - 2014-03-08 00:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-04-11 09:30 - 2014-03-08 00:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-04-11 09:30 - 2014-03-08 00:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-04-11 09:30 - 2014-03-08 00:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-04-11 09:30 - 2014-03-08 00:52 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-04-11 09:30 - 2014-03-08 00:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-04-10 15:21 - 2014-02-06 06:21 - 01212416 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-04-10 15:21 - 2014-02-06 03:57 - 00861696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-04-05 17:34 - 2014-04-09 14:59 - 00098577 _____ () C:\Users\Aleksandra\Desktop\badania.pptx 2014-04-05 17:34 - 2014-04-09 14:56 - 00544768 _____ () C:\Users\Aleksandra\Desktop\zielony.ppt 2014-03-29 12:42 - 2014-03-29 12:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox ==================== One Month Modified Files and Folders ======= 2014-04-27 08:18 - 2014-04-27 08:17 - 00000000 ____D () C:\FRST 2014-04-27 08:16 - 2006-11-02 17:26 - 01448311 _____ () C:\Windows\WindowsUpdate.log 2014-04-27 08:11 - 2013-06-29 08:34 - 00000000 ____D () C:\Users\Aleksandra\Documents\Pliki programu Outlook 2014-04-27 07:55 - 2013-04-23 09:27 - 00137474 _____ () C:\ProgramData\nvModes.001 2014-04-27 07:20 - 2013-04-23 10:48 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-04-27 07:01 - 2013-04-23 08:52 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\VirtualStore 2014-04-27 06:54 - 2014-04-27 06:20 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-04-27 06:51 - 2013-04-23 09:26 - 00137474 _____ () C:\ProgramData\nvModes.dat 2014-04-27 06:51 - 2006-11-02 17:21 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-04-27 06:51 - 2006-11-02 17:21 - 00003648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-04-27 06:50 - 2006-11-02 17:40 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-04-27 06:49 - 2014-04-27 05:52 - 00008248 _____ () C:\Windows\PFRO.log 2014-04-27 06:49 - 2014-04-26 07:30 - 00000000 ____D () C:\Program Files (x86)\Settings Manager 2014-04-27 06:49 - 2006-11-02 17:06 - 00000000 ____D () C:\Windows\DigitalLocker 2014-04-27 06:48 - 2013-04-23 08:44 - 00005340 _____ () C:\Windows\bthservsdp.dat 2014-04-27 06:48 - 2006-11-02 17:40 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-04-27 06:19 - 2014-04-27 06:19 - 00000980 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-04-27 06:19 - 2014-04-27 06:19 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-04-27 06:15 - 2014-04-26 19:33 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-04-26 22:23 - 2013-04-24 18:05 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\DMCache 2014-04-26 19:34 - 2014-04-26 19:34 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-04-26 19:19 - 2014-04-21 12:59 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\Unity 2014-04-26 19:17 - 2014-04-26 19:17 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\VS Revo Group 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\ProgramData\VS Revo Group 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro 2014-04-26 19:16 - 2014-04-26 19:16 - 00000000 ____D () C:\Program Files\VS Revo Group 2014-04-26 19:11 - 2014-04-26 19:11 - 00002496 _____ () C:\Users\Aleksandra\Documents\cc_20140426_191109.reg 2014-04-26 19:04 - 2014-04-26 07:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft 2014-04-26 19:04 - 2014-04-26 07:57 - 00000000 ____D () C:\Program Files (x86)\Anvisoft 2014-04-26 18:55 - 2014-02-23 08:57 - 00000000 ____D () C:\AdwCleaner 2014-04-26 07:57 - 2014-04-26 07:57 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\Anvisoft 2014-04-26 07:56 - 2014-04-26 07:30 - 00000000 ____D () C:\Program Files\Sokoban 2014-04-26 07:30 - 2014-04-26 07:30 - 00808815 _____ () C:\Users\Aleksandra\Desktop\Sokoban.exe 2014-04-26 07:30 - 2014-04-26 07:30 - 00000783 _____ () C:\Users\Aleksandra\Desktop\Sokoban.lnk 2014-04-26 07:30 - 2014-04-26 07:30 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sokoban 2014-04-26 05:44 - 2013-04-24 18:08 - 00000000 ____D () C:\Users\Aleksandra\Downloads\Video 2014-04-25 13:49 - 2006-12-05 09:17 - 00748008 _____ () C:\Windows\system32\perfh015.dat 2014-04-25 13:49 - 2006-12-05 09:17 - 00168672 _____ () C:\Windows\system32\perfc015.dat 2014-04-25 13:49 - 2006-11-02 14:46 - 01710520 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-04-23 05:58 - 2013-11-04 07:18 - 00000000 ____D () C:\ProgramData\Oracle 2014-04-23 05:57 - 2014-04-23 05:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-04-23 05:57 - 2014-04-23 05:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-04-23 05:57 - 2014-04-23 05:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-04-23 05:57 - 2013-05-12 06:54 - 00000000 ____D () C:\Program Files (x86)\Java 2014-04-23 05:55 - 2014-04-23 05:55 - 00921512 _____ (Oracle Corporation) C:\Users\Aleksandra\Downloads\jxpiinstall.exe 2014-04-23 05:55 - 2014-04-23 05:54 - 00004976 _____ () C:\Users\Aleksandra\Documents\cc_20140423_055451.reg 2014-04-23 05:24 - 2014-04-23 05:23 - 00004100 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_55-b14.log 2014-04-21 22:18 - 2014-04-21 22:18 - 02240512 _____ () C:\Users\Aleksandra\Desktop\Banner.psd 2014-04-21 21:18 - 2014-04-13 20:15 - 00000132 _____ () C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu PNG CS6 firmy Adobe 2014-04-21 19:14 - 2014-04-21 19:14 - 00044790 _____ () C:\Users\Aleksandra\Desktop\poznaj vitafon.psd 2014-04-21 13:16 - 2014-04-21 13:16 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Unity 2014-04-21 12:59 - 2014-04-21 12:59 - 01070496 _____ (Unity Technologies ApS) C:\Users\Aleksandra\Downloads\UnityWebPlayer.exe 2014-04-20 13:59 - 2014-04-19 09:38 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Alternative 2014-04-20 08:46 - 2014-04-18 16:47 - 06486669 _____ () C:\Users\Aleksandra\Desktop\peruka z opisem.psd 2014-04-19 18:14 - 2014-04-19 12:32 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Flower 2014-04-19 16:43 - 2014-04-19 16:43 - 03996062 _____ () C:\Users\Aleksandra\Desktop\Alternative.zip 2014-04-19 16:43 - 2014-04-19 16:43 - 02475617 _____ () C:\Users\Aleksandra\Desktop\peruka z opisem.zip 2014-04-19 16:43 - 2014-04-19 16:43 - 01504987 _____ () C:\Users\Aleksandra\Desktop\Flower.zip 2014-04-19 07:47 - 2014-04-13 20:15 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Peruki www 2014-04-19 05:38 - 2013-09-25 09:13 - 00000680 _____ () C:\Users\Aleksandra\AppData\Local\d3d9caps.dat 2014-04-18 19:00 - 2013-04-24 07:22 - 00002611 _____ () C:\Users\Aleksandra\Desktop\Word.lnk 2014-04-17 05:49 - 2014-02-23 10:24 - 00000000 ____D () C:\ProgramData\Package Cache 2014-04-17 05:48 - 2014-04-17 05:48 - 00001079 _____ () C:\Users\Public\Desktop\Avira.lnk 2014-04-17 05:48 - 2014-02-23 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira 2014-04-17 05:48 - 2014-02-23 10:24 - 00000000 ____D () C:\Program Files (x86)\Avira 2014-04-17 00:21 - 2014-04-16 17:42 - 00000819 _____ () C:\Users\Aleksandra\Desktop\Nowy dokument tekstowy.txt 2014-04-17 00:13 - 2014-03-05 21:09 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Skype 2014-04-14 21:09 - 2013-05-02 16:43 - 00000000 ____D () C:\Users\Aleksandra\AppData\Local\Adobe 2014-04-14 18:02 - 2014-04-14 18:02 - 00000132 _____ () C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu GIF CS6 firmy Adobe 2014-04-14 17:56 - 2014-04-12 19:46 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Nowy folder 2014-04-14 05:37 - 2006-11-02 17:21 - 05072568 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-04-13 20:09 - 2013-04-23 10:48 - 00000000 ____D () C:\Users\Aleksandra\AppData\Roaming\Adobe 2014-04-13 20:09 - 2013-04-23 08:52 - 00132840 _____ () C:\Users\Aleksandra\AppData\Local\GDIPFONTCACHEV1.DAT 2014-04-13 18:28 - 2014-04-13 18:28 - 00000000 ____D () C:\ProgramData\regid.1986-12.com.adobe 2014-04-13 18:28 - 2013-04-23 13:00 - 00000000 ____D () C:\ProgramData\Adobe 2014-04-13 18:27 - 2014-04-13 18:27 - 00001058 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk 2014-04-13 18:27 - 2014-04-13 18:26 - 00000000 ____D () C:\Program Files\Adobe 2014-04-13 18:27 - 2014-04-13 18:20 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2014-04-13 18:26 - 2014-04-13 18:26 - 00001020 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk 2014-04-13 18:26 - 2013-04-24 18:31 - 00000000 ____D () C:\Program Files (x86)\Adobe 2014-04-13 18:23 - 2014-04-13 18:23 - 00001389 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk 2014-04-13 18:23 - 2014-04-13 18:23 - 00001227 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk 2014-04-13 18:21 - 2014-04-13 18:21 - 00354208 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistMSI0BE5.txt 2014-04-13 18:21 - 2014-04-13 18:21 - 00011560 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistUI0BE5.txt 2014-04-13 18:20 - 2014-04-13 18:20 - 00366252 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistMSI0B6C.txt 2014-04-13 18:20 - 2014-04-13 18:20 - 00011592 _____ () C:\Users\Aleksandra\AppData\Local\dd_vcredistUI0B6C.txt 2014-04-13 10:19 - 2014-04-13 10:19 - 00000000 ____D () C:\Users\Aleksandra\Documents\RRR2 2014-04-13 10:18 - 2014-04-13 10:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft 2014-04-13 10:17 - 2014-04-13 10:17 - 00000000 ____D () C:\Program Files (x86)\Ubisoft 2014-04-13 10:17 - 2013-05-05 16:26 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-04-13 06:56 - 2014-04-13 06:56 - 00809318 _____ () C:\Users\Aleksandra\Downloads\blue_business_2.tar.gz 2014-04-13 05:50 - 2014-04-12 15:56 - 00000000 ____D () C:\Users\Aleksandra\Desktop\Peruki 2014-04-12 07:06 - 2014-04-12 07:05 - 00045230 _____ () C:\Users\Aleksandra\Documents\cc_20140412_070543.reg 2014-04-12 06:53 - 2013-04-23 19:47 - 00000000 ____D () C:\Program Files\CCleaner 2014-04-11 09:33 - 2013-04-24 07:00 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-04-11 09:27 - 2013-07-24 21:51 - 00000000 ____D () C:\Windows\system32\MRT 2014-04-11 09:22 - 2006-11-02 14:35 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-04-09 14:59 - 2014-04-05 17:34 - 00098577 _____ () C:\Users\Aleksandra\Desktop\badania.pptx 2014-04-09 14:56 - 2014-04-05 17:34 - 00544768 _____ () C:\Users\Aleksandra\Desktop\zielony.ppt 2014-04-09 10:29 - 2013-04-23 10:48 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-04-09 10:29 - 2013-04-23 10:48 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-04-09 10:29 - 2013-04-23 10:48 - 00003784 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-04-03 09:51 - 2014-04-27 06:19 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-04-03 09:51 - 2014-04-27 06:19 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-04-03 09:50 - 2014-04-27 06:19 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-04-02 20:30 - 2013-04-24 18:08 - 00000000 ____D () C:\Users\Aleksandra\Downloads\Compressed 2014-03-29 23:07 - 2013-04-23 11:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-03-29 12:42 - 2014-03-29 12:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox Some content of TEMP: ==================== C:\Users\Aleksandra\AppData\Local\Temp\avgnt.exe C:\Users\Aleksandra\AppData\Local\Temp\Quarantine.exe C:\Users\Aleksandra\AppData\Local\Temp\SettingsManagerSetup.exe C:\Users\Aleksandra\AppData\Local\Temp\SHSetup.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-04-27 06:59 ==================== End Of Log ============================