Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-09-2014 Ran by Adam (administrator) on ADAM-KOMPUTER on 28-09-2014 17:47:58 Running from C:\Users\Adam\Downloads Loaded Profile: Adam (Available profiles: Adam) Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Polski (Polska) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Windows\System32\audiodg.exe (AMD) C:\Windows\System32\atieclxx.exe () C:\ProgramData\DatacardService\HWDeviceService64.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe () C:\ProgramData\MobileBrServ\mbbService.exe () C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe (Microsoft Corporation) C:\Windows\System32\UI0Detect.exe () C:\Program Files (x86)\PLAY ONLINE\PLAY ONLINE.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Policies\Explorer\Run: [Help and Restore] => C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe [56472 2014-03-21] ( (Microsoft Corporation)) HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {094bcb59-513e-11e3-bfad-806e6f6e6963} - E:\vcd_play.exe -fs HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {0a290c84-5cd4-11e3-9e27-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {0e885258-52c7-11e3-b189-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {1768fcfa-9b28-11e3-96aa-bc5ff41f1675} - J:\NokiaPCIA_Autorun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {231a038e-5d2f-11e3-a3b2-bc5ff41f1675} - M:\OriginInstaller.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {2fc70dee-3815-11e4-98be-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {4fce2763-5b6e-11e3-ba23-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {5569f8eb-534c-11e3-b58f-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {5569f8f6-534c-11e3-b58f-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {6c3a0cad-0bca-11e4-923d-fe71faa58312} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {78c8c6ce-449b-11e4-a83c-bc5ff41f1675} - N:\LGAutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {a6fa3197-ca2d-11e3-bb82-bc5ff41f1675} - L:\Autorun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {a8699c7c-513e-11e3-9fdf-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {b1691bd2-0aae-11e4-9fee-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {b1691be0-0aae-11e4-9fee-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {b1691c05-0aae-11e4-9fee-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {c8639bea-cf9e-11e3-906c-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {c8639bf8-cf9e-11e3-906c-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {c8639c22-cf9e-11e3-906c-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {e43ea962-d2e2-11e3-a7ac-bc5ff41f1675} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {ede3d70e-ecc3-11e3-af4c-c544baed8b1e} - J:\windows\Install\Install.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {fc453206-efe6-11e3-9522-c299431d4071} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {fc453228-efe6-11e3-9522-c299431d4071} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\MountPoints2: {fc453238-efe6-11e3-9522-c299431d4071} - J:\AutoRun.exe HKU\S-1-5-21-968353270-2445360347-1696007631-1000\...\Winlogon: [Shell] explorer.exe,"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe" <==== ATTENTION GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://istart.webssearches.com/?type=hp&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://istart.webssearches.com/web/?type=ds&ts=1411652405&from=wpc&uid=WDCXWD5000AAKS-00V1A0_WD-WMAWF204686646866&q={searchTerms} BHO: No Name -> {122735e5-21b1-4899-93bc-0cdd6380a60a} -> No File BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: No Name -> {122735e5-21b1-4899-93bc-0cdd6380a60a} -> No File BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\..\Interfaces\{1E31C139-4A9A-45AA-AE1E-7AD94815553D}: [NameServer] 89.108.195.20 89.108.202.20 Tcpip\..\Interfaces\{3C1A4947-B031-4F36-B704-3CE9DE73636D}: [NameServer] 217.116.104.104 217.116.100.100 FireFox: ======== FF ProfilePath: C:\Users\Adam\AppData\Roaming\Mozilla\Firefox\Profiles\lsbeiidj.default-1411918682540 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll () FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB) FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPSWF32.dll () Chrome: ======= CHR HomePage: Default -> hxxp://www.google.pl/ CHR StartupUrls: Default -> "hxxp://www.google.pl/" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (GuoSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aedjecglgkjccpaalcgpocfjbcjohfko [2014-09-25] CHR Extension: (AdBlock) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-09-25] CHR Extension: (GoSSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\leolnijocgbaebibcjhgjojpmeppkapo [2014-09-25] CHR Extension: (Google Wallet) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-26] CHR Extension: (GuoSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\aedjecglgkjccpaalcgpocfjbcjohfko\2.0 [2014-09-25] CHR Extension: (GoSSave) - C:\Users\Adam\AppData\Local\Google\Chrome\User Data\Default\Extensions\leolnijocgbaebibcjhgjojpmeppkapo\2.0 [2014-09-25] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] () S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [224096 2011-06-17] () R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [233344 2012-06-28] () S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2014-07-14] () ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R3 cmudaxp; C:\Windows\System32\drivers\cmudaxp.sys [2725376 2011-03-10] (C-Media Inc) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-04-23] (Disc Soft Ltd) R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [239104 2012-09-18] (Huawei Technologies Co., Ltd.) R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2013-12-04] (Duplex Secure Ltd.) R1 {29b136c9-938d-4d3d-8df8-d649d9b74d02}Gw64; C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}Gw64.sys [61120 2014-04-24] (StdLib) R1 {29b136c9-938d-4d3d-8df8-d649d9b74d02}w64; C:\Windows\System32\drivers\{29b136c9-938d-4d3d-8df8-d649d9b74d02}w64.sys [60704 2014-05-22] (StdLib) U3 afhb2vk8; C:\Windows\System32\Drivers\afhb2vk8.sys [0 ] (Advanced Micro Devices) S3 VGPU; System32\drivers\rdvgkmd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-28 17:47 - 2014-09-28 17:48 - 00014774 _____ () C:\Users\Adam\Downloads\FRST.txt 2014-09-28 17:45 - 2014-09-28 17:45 - 00380416 _____ () C:\Users\Adam\Desktop\b8j3lz8s.exe 2014-09-28 17:44 - 2014-09-28 17:48 - 00000000 ____D () C:\FRST 2014-09-28 17:44 - 2014-09-28 17:44 - 02108928 _____ (Farbar) C:\Users\Adam\Downloads\FRST64.exe 2014-09-28 17:44 - 2014-09-28 17:44 - 00602112 _____ (OldTimer Tools) C:\Users\Adam\Desktop\OTL.exe 2014-09-28 17:39 - 2014-09-28 17:39 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Adam\Downloads\SpyHunter-installer.exe 2014-09-28 17:38 - 2014-09-28 17:38 - 00000000 ____D () C:\Users\Adam\Desktop\Stare dane programu Firefox 2014-09-26 23:08 - 2014-09-28 16:28 - 00000336 _____ () C:\Windows\setupact.log 2014-09-26 23:08 - 2014-09-26 23:08 - 00000000 _____ () C:\Windows\setuperr.log 2014-09-26 19:26 - 2014-09-28 17:33 - 00039929 _____ () C:\Windows\WindowsUpdate.log 2014-09-26 19:16 - 2014-09-26 19:16 - 00003132 _____ () C:\Windows\System32\Tasks\{67F24D36-E541-429A-8687-9075EC5CAB17} 2014-09-26 17:57 - 2014-09-26 18:12 - 00000050 _____ () C:\Users\Adam\Desktop\Nowy dokument tekstowy.txt 2014-09-26 16:51 - 2014-09-26 18:14 - 00000000 ____D () C:\ProgramData\NextCioup 2014-09-26 16:51 - 2014-09-26 18:13 - 00000000 ____D () C:\Program Files (x86)\NextCioup 2014-09-26 16:51 - 2014-09-26 16:51 - 03254784 _____ () C:\Windows\SysWOW64\setup.exe 2014-09-26 06:38 - 2014-09-26 06:38 - 00000000 _____ () C:\Users\Adam\Desktop\505-386-772---Arek.txt 2014-09-25 16:00 - 2014-09-25 21:53 - 00000000 ____D () C:\Users\Adam\Documents\FIFA 14 2014-09-25 16:00 - 2014-09-25 16:00 - 00000834 _____ () C:\Users\Public\Desktop\FIFA 14.lnk 2014-09-25 16:00 - 2014-09-25 16:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FIFA 14 2014-09-25 15:47 - 2014-09-26 16:52 - 00000000 ____D () C:\ProgramData\GuoSave 2014-09-25 15:44 - 2014-09-25 15:44 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\EZDownloader 2014-09-25 15:43 - 2014-09-28 16:56 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-09-25 15:43 - 2014-09-25 15:57 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-09-25 15:41 - 2014-09-25 15:41 - 00004032 _____ () C:\Windows\System32\Tasks\LaunchSignup 2014-09-25 15:38 - 2014-09-25 15:48 - 00002720 _____ () C:\Windows\System32\Tasks\SW-Booster-S-792098896 2014-09-25 15:38 - 2014-09-25 15:38 - 00000000 ____D () C:\ProgramData\Trusted Publisher 2014-09-25 15:36 - 2014-09-26 19:24 - 00000000 ____D () C:\ProgramData\YouutUbeADBlocke 2014-09-25 15:36 - 2014-09-26 19:24 - 00000000 ____D () C:\Program Files (x86)\YouutUbeADBlocke 2014-09-25 15:35 - 2014-09-26 19:24 - 00000000 ____D () C:\ProgramData\db930178e28582b9 2014-09-25 15:35 - 2014-09-26 16:51 - 00000402 __RSH () C:\ProgramData\ntuser.pol 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Gość\AppData\Local\Torch 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Gość\AppData\Local\Google 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Gość\AppData\Local\Comodo 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Gość\AppData\Local\Chromatic Browser 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Gość 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Administrator 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Adam\AppData\Local\Torch 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Adam\AppData\Local\Comodo 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\Users\Adam\AppData\Local\Chromatic Browser 2014-09-25 15:35 - 2014-09-25 15:35 - 00000000 ____D () C:\ProgramData\GoeSave 2014-09-25 15:24 - 2014-09-25 15:24 - 00002956 _____ () C:\Windows\System32\Tasks\{341443FB-7B9B-4C5F-B02A-D2AF441C4A47} 2014-09-25 15:23 - 2014-09-25 15:23 - 00003122 _____ () C:\Windows\System32\Tasks\{72CD88D3-5260-4DCB-BF57-1EDA9BB2CEDA} 2014-09-25 14:54 - 2014-09-25 15:50 - 00000000 ____D () C:\ProgramData\Solidshield 2014-09-25 14:48 - 2014-09-25 16:07 - 00000000 ____D () C:\ProgramData\Electronic Arts 2014-09-25 14:48 - 2014-09-25 14:48 - 00000000 ____D () C:\ProgramData\EA Core 2014-09-25 14:46 - 2014-09-25 14:46 - 00000444 _____ () C:\Users\Adam\Desktop\Crysis® 2 — skrót.lnk 2014-09-25 14:38 - 2014-09-25 09:08 - 03932214 _____ () C:\Users\Adam\Desktop\Cennik Sieci komórkowych.bmp 2014-09-25 13:43 - 2014-09-25 13:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-09-25 07:03 - 2014-09-25 07:03 - 00000009 _____ () C:\END 2014-09-25 06:37 - 2014-09-25 06:41 - 00000192 _____ () C:\Users\Adam\Desktop\Pakiety Internetowe Orange..txt 2014-09-25 00:05 - 2014-09-25 00:05 - 00000000 ____D () C:\Users\Adam\Documents\Battlefield 4 2014-09-24 23:21 - 2014-09-24 23:21 - 00003074 _____ () C:\Windows\System32\Tasks\{93568A7B-8273-4464-AA82-A40848C575BD} 2014-09-24 23:09 - 2014-09-25 00:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES 2014-09-18 07:55 - 2014-09-18 07:55 - 00001121 _____ () C:\Users\Adam\Desktop\Service Center.lnk 2014-09-10 07:49 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll 2014-09-10 07:49 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll 2014-09-10 07:20 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-09-10 07:20 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-09-10 07:20 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-09-10 07:20 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-09-10 07:20 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-09-10 06:49 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-09-10 06:49 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-09-10 06:35 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-09-10 06:35 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-09-09 22:50 - 2014-09-09 22:50 - 00000000 ____D () C:\Users\Adam\Downloads\Inne 2014-09-09 22:49 - 2014-09-09 22:50 - 00000000 ____D () C:\Users\Adam\Downloads\Dokumenty 2014-09-09 22:49 - 2014-09-09 22:49 - 00000000 ____D () C:\Users\Adam\Downloads\Audio 2014-09-09 22:48 - 2014-09-09 22:49 - 00000000 ____D () C:\Users\Adam\Downloads\Video 2014-09-09 22:46 - 2014-09-09 23:56 - 00001474 _____ () C:\Users\Adam\Desktop\videoto3gp — skrót.lnk 2014-09-09 22:45 - 2014-09-09 22:45 - 00000000 ____D () C:\Users\Adam\Desktop\Tytuły 2014-09-09 22:41 - 2014-09-09 22:41 - 00000000 ____D () C:\Users\Adam\Downloads\Torrenty 2014-09-09 22:39 - 2014-09-09 22:46 - 00000000 ____D () C:\Users\Adam\Desktop\Nie Ruszać!!! 2014-09-09 21:25 - 2014-09-09 21:25 - 00000000 ____D () C:\Users\Adam\Desktop\Teledyski 2014-09-09 19:03 - 2014-09-09 19:03 - 00004096 _____ () C:\Windows\d3dx.dat 2014-09-02 00:34 - 2014-09-02 00:34 - 00000438 _____ () C:\Users\Adam\Desktop\Battlefield 4™.lnk 2014-09-01 21:35 - 2014-09-10 00:01 - 00000000 ___RD () C:\Users\Adam\Desktop\Marchewa Nutaa ;D ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-09-28 16:55 - 2014-05-26 02:44 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-09-28 16:28 - 2014-05-26 02:44 - 00001040 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-09-28 16:28 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-09-26 23:07 - 2009-07-14 06:45 - 00021776 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-09-26 23:07 - 2009-07-14 06:45 - 00021776 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-09-26 23:03 - 2013-12-06 05:09 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\Winamp 2014-09-26 19:22 - 2014-04-23 01:28 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\uTorrent 2014-09-26 17:53 - 2013-11-22 22:48 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-09-26 17:39 - 2014-06-03 17:29 - 00000000 ____D () C:\Windows\pss 2014-09-26 16:57 - 2014-04-23 01:12 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\DAEMON Tools Lite 2014-09-26 16:57 - 2014-02-21 23:43 - 00000000 ____D () C:\Users\Adam\AppData\Local\CrashDumps 2014-09-26 16:57 - 2013-11-19 22:15 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\Media Player Classic 2014-09-26 14:39 - 2013-11-22 11:16 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-09-25 16:01 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-09-25 15:57 - 2013-11-22 17:13 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-09-25 15:57 - 2013-11-22 17:13 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-09-25 15:35 - 2014-05-26 02:44 - 00000000 ____D () C:\Users\Adam\AppData\Local\Google 2014-09-25 15:35 - 2014-05-26 02:44 - 00000000 ____D () C:\Program Files (x86)\Google 2014-09-25 15:35 - 2009-07-14 05:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy 2014-09-25 15:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy 2014-09-25 15:28 - 2013-11-19 21:16 - 00000000 ____D () C:\Users\Adam\Documents\Traktor3 2014-09-25 14:47 - 2014-05-15 09:58 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2014-09-25 13:01 - 2011-04-12 15:07 - 00740098 _____ () C:\Windows\system32\perfh015.dat 2014-09-25 13:01 - 2011-04-12 15:07 - 00155672 _____ () C:\Windows\system32\perfc015.dat 2014-09-25 13:01 - 2009-07-14 07:13 - 01669190 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-09-25 00:49 - 2013-11-22 23:40 - 00000000 ____D () C:\ProgramData\Norton 2014-09-24 20:22 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-09-18 07:55 - 2013-11-19 21:16 - 00000000 ____D () C:\Users\Adam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Native Instruments 2014-09-18 07:55 - 2013-11-19 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Native Instruments 2014-09-18 03:00 - 2014-03-18 19:27 - 00000000 ____D () C:\Users\Adam\Desktop\bajki 2014-09-18 02:42 - 2014-01-31 17:03 - 00000000 ____D () C:\Users\Adam\Desktop\realizacje 2014-09-14 21:48 - 2014-04-23 00:25 - 00000000 ___RD () C:\Users\Adam\Desktop\nowe bajki 2014-09-13 01:10 - 2014-04-25 01:54 - 00005039 _____ () C:\Users\Adam\Desktop\modlitwy.txt 2014-09-10 17:53 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache 2014-09-10 07:54 - 2014-05-08 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-09-09 23:26 - 2014-03-03 23:04 - 00000000 ____D () C:\Users\Adam\Desktop\muza 2014-09-09 23:17 - 2013-12-05 00:23 - 00000124 _____ () C:\Users\Adam\Documents\ax_files.xml 2014-08-29 09:00 - 2009-07-14 06:45 - 00413264 _____ () C:\Windows\system32\FNTCACHE.DAT Files to move or delete: ==================== C:\Users\Adam\jaijaeq.exe C:\Users\Adam\AppData\Roaming\msconfig.ini Some content of TEMP: ==================== C:\Users\Adam\AppData\Local\Temp\SHSetup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-26 15:06 ==================== End Of Log ============================