Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 24-01-2015 01
Ran by Tomi (administrator) on TOMEK-844232D6B on 24-01-2015 21:04:31
Running from C:\Documents and Settings\Tomi\Moje dokumenty\Downloads
Loaded Profiles: Tomi (Available profiles: Tomi & Administrator)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polski
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
() C:\DOCUME~1\Tomi\USTAWI~1\temp\eowwal.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [17887232 2011-03-02] (Realtek Semiconductor Corp.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [404712 2010-10-29] (Sun Microsystems, Inc.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [100648 2006-10-27] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [122936 2010-06-09] (Hewlett-Packard)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [5225064 2014-12-09] (AVAST Software)
Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)
HKU\S-1-5-19\...\Policies\Explorer: [ForceClassicControlPanel] 1
HKU\S-1-5-20\...\Policies\Explorer: [ForceClassicControlPanel] 1
HKU\S-1-5-18\...\RunOnce: [_nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-18\...\Policies\Explorer: [ForceClassicControlPanel] 1
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)
AlternateShell: 

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-1078081533-1202660629-682003330-1003\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-1078081533-1202660629-682003330-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://pl.yahoo.com?fr=fp-comodo
HKU\S-1-5-21-1078081533-1202660629-682003330-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1078081533-1202660629-682003330-1003 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
SearchScopes: HKU\S-1-5-21-1078081533-1202660629-682003330-1003 -> {CD6824E8-490A-4E2F-A6C4-0180D5DC7FB1} URL = http://www.bing.com/search?FORM=MSNTLB&PC=MSNTDF&q={searchTerms}&src=IE-SearchBox
BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: JQSIEStartDetectorImpl Class -> {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -> C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
ShellExecuteHooks:  - {AEB6717E-7E19-11d0-97EE-00C04FD91972} -  No File [ ]
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @java.com/JavaPlugin -> C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] - C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2013-11-01]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2013-11-01]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-12-09]

Chrome: 
=======
CHR HomePage: Default -> hxxp://pl.yahoo.com?fr=fpc-comodo
CHR StartupUrls: Default -> "hxxp://www.google.com/"
CHR Profile: C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default
CHR Extension: (Dokumenty Google) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-01]
CHR Extension: (Dysk Google) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-11-01]
CHR Extension: (YouTube) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-11-01]
CHR Extension: (Szukaj w Google) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-11-01]
CHR Extension: (Tampermonkey) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2015-01-10]
CHR Extension: (Avast Online Security) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-12-09]
CHR Extension: (StarCraft:BroodWar) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\mghdkfklkddcigfpddcncplfhiappfjm [2013-11-01]
CHR Extension: (Google Wallet) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-01]
CHR Extension: (Gmail) - C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-11-01]
CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-12-09]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S4 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-12-09] (AVAST Software) [File not signed]
S2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [153376 2013-11-01] (Sun Microsystems, Inc.)
S3 Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [139552 2006-10-27] (Microsoft Corporation) [File not signed]
S3 npggsvc; C:\WINDOWS\system32\GameMon.des [3299328 2014-11-26] (INCA Internet Co., Ltd.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1684736 2011-03-02] (Creative)
R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [36864 2011-03-02] (Advanced Micro Devices)
R3 AR9271; C:\WINDOWS\System32\DRIVERS\athuw.sys [1714176 2011-03-02] (Atheros Communications, Inc.)
R2 aswHwid; C:\WINDOWS\system32\drivers\aswHwid.sys [24184 2014-12-09] ()
R2 aswMonFlt; C:\WINDOWS\system32\drivers\aswMonFlt.sys [70384 2014-12-09] (AVAST Software)
S4 aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [55240 2014-12-09] (AVAST Software)
R0 aswRvrt; C:\WINDOWS\system32\Drivers\aswRvrt.sys [49944 2014-12-09] ()
R1 aswSnx; C:\WINDOWS\system32\drivers\aswSnx.sys [787800 2014-12-09] (AVAST Software)
S4 aswSP; C:\WINDOWS\system32\Drivers\aswSP.sys [423784 2014-12-09] (AVAST Software)
S4 aswTdi; C:\WINDOWS\system32\drivers\aswTdi.sys [57928 2014-12-09] (AVAST Software)
R0 aswVmm; C:\WINDOWS\system32\Drivers\aswVmm.sys [206248 2014-12-09] ()
R3 AtiHDAudioService; C:\WINDOWS\System32\drivers\AtihdXP3.sys [101904 2011-03-02] (ATI Technologies, Inc.)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1389056 2011-03-02] (Creative Technology Ltd.)
R0 nvatabus; C:\WINDOWS\system32\Drivers\nvatabus.sys [100736 2011-03-02] (NVIDIA Corporation) [File not signed]
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [70912 2011-03-02] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [13824 2011-03-02] (NVIDIA Corporation)
R0 Si3112; C:\WINDOWS\system32\Drivers\Si3112.sys [62208 2011-03-02] (Silicon Image, Inc.) [File not signed]
R1 Tcpip; C:\WINDOWS\System32\DRIVERS\tcpip.sys [361344 2011-03-02] (Microsoft Corporation) [File not signed]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S4 IntelIde; No ImagePath
U3 fxpiraow; \??\C:\DOCUME~1\Tomi\USTAWI~1\Temp\fxpiraow.sys [X]

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 21:03 - 2015-01-24 21:04 - 00000000 ____D () C:\FRST
2015-01-24 20:59 - 2015-01-24 20:59 - 00010312 _____ () C:\Documents and Settings\Tomi\Pulpit\UsbFix_Report.txt
2015-01-24 20:25 - 2015-01-24 20:59 - 00000000 ____D () C:\UsbFix
2015-01-24 20:25 - 2015-01-24 20:25 - 00001364 _____ () C:\Documents and Settings\Tomi\Pulpit\UsbFix.lnk
2015-01-24 20:15 - 2015-01-24 20:21 - 00000188 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2015-01-24 20:15 - 2015-01-24 20:16 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji
2015-01-24 20:15 - 2015-01-24 20:15 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\temp
2015-01-24 20:15 - 2015-01-24 20:15 - 00000000 ____D () C:\Documents and Settings\Administrator
2015-01-24 20:15 - 2015-01-24 20:10 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne
2015-01-24 20:15 - 2013-11-17 15:39 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\COMODO
2015-01-24 20:15 - 2013-11-01 12:38 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart
2015-01-24 20:15 - 2013-11-01 12:38 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start
2015-01-24 20:15 - 2013-11-01 12:38 - 00000000 ____D () C:\Documents and Settings\Administrator\Ulubione
2015-01-24 20:15 - 2013-11-01 12:38 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty
2015-01-24 20:15 - 2013-11-01 11:49 - 00000291 _____ () C:\Documents and Settings\Administrator\JAUReg.log
2015-01-24 20:15 - 2013-11-01 11:49 - 00000219 _____ () C:\Documents and Settings\Administrator\AUCHECK_PARSER.txt
2015-01-24 20:15 - 2013-11-01 11:48 - 00001620 _____ () C:\Documents and Settings\Administrator\Pulpit\Odkurzacz 12.5.lnk
2015-01-24 20:15 - 2013-11-01 11:48 - 00001564 _____ () C:\Documents and Settings\Administrator\Pulpit\ALLPlayer.lnk
2015-01-24 20:15 - 2013-11-01 11:48 - 00000148 _____ () C:\Documents and Settings\Administrator\jusched.log
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 __RHD () C:\Documents and Settings\Administrator\Dane aplikacji
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\nro.log
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Menu Start\Programy\WinRAR
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\is-F8ROA.tmp
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Sun
2015-01-24 20:15 - 2013-11-01 11:48 - 00000000 ____D () C:\Documents and Settings\Administrator\7ZipSfx.000
2015-01-24 20:15 - 2013-11-01 11:47 - 00001599 _____ () C:\Documents and Settings\Administrator\Menu Start\Programy\Pomoc zdalna.lnk
2015-01-24 20:15 - 2013-11-01 11:47 - 00001497 _____ () C:\Documents and Settings\Administrator\Pulpit\Nero Burning ROM.lnk
2015-01-24 20:15 - 2013-11-01 11:47 - 00000788 _____ () C:\Documents and Settings\Administrator\Menu Start\Programy\Windows Media Player.lnk
2015-01-24 20:15 - 2013-11-01 11:47 - 00000000 __SHD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Historia
2015-01-24 20:15 - 2013-11-01 11:47 - 00000000 __SHD () C:\Documents and Settings\Administrator\IETldCache
2015-01-24 20:15 - 2013-11-01 11:47 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy\Akcesoria
2015-01-24 20:15 - 2013-11-01 11:44 - 00000000 ___HD () C:\Documents and Settings\Administrator\Szablony
2015-01-24 20:10 - 2015-01-24 21:04 - 00000000 ____D () C:\Documents and Settings\Tomi\Ustawienia lokalne\temp
2015-01-24 20:10 - 2015-01-24 20:10 - 00000000 ____D () C:\Documents and Settings\NetworkService\Ustawienia lokalne\temp
2015-01-24 20:10 - 2015-01-24 20:10 - 00000000 ____D () C:\Documents and Settings\LocalService\Ustawienia lokalne\temp
2015-01-24 20:10 - 2015-01-24 20:10 - 00000000 ____D () C:\Documents and Settings\Default User\Ustawienia lokalne\temp
2015-01-24 20:06 - 2015-01-24 20:06 - 00008192 ____H () C:\WINDOWS\system32\config\SECURITY.tmp.LOG
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 ____H () C:\WINDOWS\system32\config\system.tmp.LOG
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 ____H () C:\WINDOWS\system32\config\software.tmp.LOG
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 ____H () C:\WINDOWS\system32\config\SAM.tmp.LOG
2015-01-24 20:06 - 2015-01-24 20:06 - 00000000 ____H () C:\WINDOWS\system32\config\default.tmp.LOG
2015-01-24 20:02 - 2011-06-26 07:45 - 00256000 _____ () C:\WINDOWS\PEV.exe
2015-01-24 20:02 - 2010-11-07 18:20 - 00208896 _____ () C:\WINDOWS\MBR.exe
2015-01-24 20:02 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00098816 _____ () C:\WINDOWS\sed.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00080412 _____ () C:\WINDOWS\grep.exe
2015-01-24 20:02 - 2000-08-31 01:00 - 00068096 _____ () C:\WINDOWS\zip.exe
2015-01-24 20:01 - 2015-01-24 20:10 - 00000000 ____D () C:\Qoobox
2015-01-24 20:01 - 2015-01-24 20:08 - 00000000 ____D () C:\WINDOWS\erdnt
2015-01-24 20:01 - 2015-01-24 20:01 - 00000000 ___RD () C:\Documents and Settings\Tomi\Menu Start\Programy\Narzędzia administracyjne
2015-01-24 19:56 - 2015-01-24 20:34 - 00000000 ____D () C:\AdwCleaner
2015-01-24 19:40 - 2015-01-24 19:40 - 00000000 ____D () C:\WINDOWS\pss
2015-01-04 00:16 - 2015-01-04 00:16 - 00000000 ____D () C:\Program Files\Common Files\INCA Shared
2015-01-04 00:16 - 2014-11-26 15:10 - 03299328 _____ (INCA Internet Co., Ltd.) C:\WINDOWS\system32\GameMon.des
2015-01-04 00:16 - 2004-12-30 13:43 - 00004682 _____ (INCA Internet Co., Ltd.) C:\WINDOWS\system32\npptNT2.sys
2015-01-04 00:16 - 2003-07-15 22:17 - 00005174 _____ () C:\WINDOWS\system32\nppt9x.vxd
2015-01-04 00:02 - 2015-01-04 00:02 - 00000453 _____ () C:\Documents and Settings\All Users\Pulpit\Rappelz.lnk
2014-12-25 12:02 - 2008-04-14 22:50 - 00159232 _____ (Microsoft Corporation) C:\WINDOWS\system32\ptpusd.dll
2014-12-25 12:02 - 2001-10-26 17:29 - 00005632 _____ (Microsoft Corporation) C:\WINDOWS\system32\ptpusb.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-01-24 20:59 - 2013-11-01 11:53 - 00000000 ___HD () C:\Documents and Settings\Tomi\Ustawienia lokalne
2015-01-24 20:59 - 2013-11-01 11:53 - 00000000 ____D () C:\Documents and Settings\Tomi\Pulpit
2015-01-24 20:59 - 2013-11-01 11:46 - 00325306 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-24 20:57 - 2013-11-01 11:52 - 00032606 _____ () C:\WINDOWS\SchedLgU.Txt
2015-01-24 20:57 - 2013-11-01 11:52 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-24 20:55 - 2014-12-09 17:35 - 00000312 ____H () C:\WINDOWS\Tasks\avast! Emergency Update.job
2015-01-24 20:55 - 2013-11-01 12:31 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-01-24 20:55 - 2013-11-01 12:31 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2015-01-24 20:55 - 2013-11-01 12:13 - 00001032 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-24 20:40 - 2014-01-10 19:46 - 00000476 _____ () C:\WINDOWS\Tasks\At2.job
2015-01-24 20:31 - 2013-11-01 12:13 - 00001036 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-24 20:24 - 2013-11-01 12:28 - 00005966 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-24 20:24 - 2008-04-15 09:00 - 00532552 _____ () C:\WINDOWS\system32\perfh015.dat
2015-01-24 20:24 - 2008-04-15 09:00 - 00093546 _____ () C:\WINDOWS\system32\perfc015.dat
2015-01-24 20:19 - 2013-11-01 12:28 - 00064709 _____ () C:\WINDOWS\iis6.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00029500 _____ () C:\WINDOWS\ocgen.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00023871 _____ () C:\WINDOWS\comsetup.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00023625 _____ () C:\WINDOWS\FaxSetup.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00019608 _____ () C:\WINDOWS\tsoc.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00015646 _____ () C:\WINDOWS\msmqinst.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00014802 _____ () C:\WINDOWS\ntdtcsetup.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00005478 _____ () C:\WINDOWS\netfxocm.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00002638 _____ () C:\WINDOWS\MedCtrOC.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00002121 _____ () C:\WINDOWS\tabletoc.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00001917 _____ () C:\WINDOWS\imsins.log
2015-01-24 20:19 - 2013-11-01 12:28 - 00001658 _____ () C:\WINDOWS\ocmsn.log
2015-01-24 20:13 - 2013-11-01 11:53 - 00000188 ___SH () C:\Documents and Settings\Tomi\ntuser.ini
2015-01-24 20:12 - 2014-11-28 21:01 - 00000000 ____D () C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Unity
2015-01-24 20:10 - 2013-11-01 12:38 - 00000000 __RHD () C:\Documents and Settings\Default User\Ustawienia lokalne
2015-01-24 20:10 - 2013-11-01 11:52 - 00000000 ___HD () C:\Documents and Settings\NetworkService\Ustawienia lokalne
2015-01-24 20:10 - 2013-11-01 11:52 - 00000000 ___HD () C:\Documents and Settings\LocalService\Ustawienia lokalne
2015-01-24 20:08 - 2008-04-15 09:00 - 00000262 _____ () C:\WINDOWS\system.ini
2015-01-24 20:07 - 2013-11-01 12:27 - 00262144 _____ () C:\WINDOWS\system32\config\SECURITY.bak
2015-01-24 20:07 - 2013-11-01 12:27 - 00262144 _____ () C:\WINDOWS\system32\config\SAM.bak
2015-01-24 20:07 - 2013-11-01 12:25 - 28573696 _____ () C:\WINDOWS\system32\config\software.bak
2015-01-24 20:07 - 2013-11-01 12:25 - 04980736 _____ () C:\WINDOWS\system32\config\system.bak
2015-01-24 20:07 - 2013-11-01 12:25 - 00786432 _____ () C:\WINDOWS\system32\config\default.bak
2015-01-24 20:07 - 2013-11-01 11:44 - 00000000 ____D () C:\WINDOWS\system32\Restore
2015-01-24 20:03 - 2013-11-01 11:53 - 00000000 __RHD () C:\Documents and Settings\Tomi\Dane aplikacji
2015-01-24 20:01 - 2013-11-01 11:53 - 00000000 ___RD () C:\Documents and Settings\Tomi\Menu Start\Programy
2015-01-24 19:58 - 2013-11-01 11:53 - 00000000 ___HD () C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji
2015-01-24 19:58 - 2013-11-01 11:53 - 00000000 ____D () C:\Documents and Settings\Tomi
2015-01-24 19:46 - 2014-01-10 19:46 - 00000476 _____ () C:\WINDOWS\Tasks\At3.job
2015-01-24 19:40 - 2013-11-01 12:25 - 00000211 ___SH () C:\boot.ini
2015-01-24 19:40 - 2008-04-15 09:00 - 00000582 _____ () C:\WINDOWS\win.ini
2015-01-23 21:24 - 2013-11-01 12:15 - 00001819 _____ () C:\Documents and Settings\All Users\Pulpit\Google Chrome.lnk
2015-01-21 19:33 - 2008-04-15 09:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2015-01-18 14:00 - 2014-01-10 19:46 - 00000476 _____ () C:\WINDOWS\Tasks\At4.job
2015-01-18 10:10 - 2014-01-10 19:46 - 00000476 _____ () C:\WINDOWS\Tasks\At1.job
2015-01-12 18:06 - 2013-11-01 12:27 - 00835476 _____ () C:\WINDOWS\setupapi.log
2015-01-05 16:19 - 2014-09-11 16:51 - 00000069 _____ () C:\WINDOWS\NeroDigital.ini
2015-01-05 16:19 - 2013-12-06 16:25 - 00007168 _____ () C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-01-04 00:02 - 2013-11-01 12:38 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2015-01-04 00:02 - 2013-11-01 12:38 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2015-01-03 23:26 - 2013-11-01 12:35 - 00000000 ___RD () C:\Documents and Settings\Tomi\Pulpit\Nowy folder
2015-01-02 13:27 - 2013-11-01 11:56 - 00220616 _____ () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2015-01-02 13:27 - 2013-11-01 11:52 - 00000000 ___HD () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji
2015-01-02 13:24 - 2013-11-13 21:25 - 00000000 ____D () C:\WINDOWS\SxsCaPendDel
2015-01-02 13:24 - 2013-11-01 12:38 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
2015-01-02 13:24 - 2013-11-01 12:33 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Comodo
2015-01-02 13:23 - 2013-11-06 22:18 - 00000000 ____D () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\COMODO
2015-01-02 13:21 - 2013-11-13 16:59 - 00000000 ____D () C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\Overwolf
2014-12-26 23:32 - 2013-11-01 17:22 - 00541920 _____ () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1078081533-1202660629-682003330-1003-0.dat
2014-12-26 23:32 - 2013-11-01 17:22 - 00269046 _____ () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat
2014-12-25 12:04 - 2014-12-12 18:37 - 242671512 _____ () C:\Documents and Settings\Tomi\Pulpit\Obraz 001.avi
2014-12-25 12:04 - 2014-12-12 18:37 - 21280680 _____ () C:\Documents and Settings\Tomi\Pulpit\Obraz 002.avi

==================== Files in the root of some directories =======

2013-12-06 16:25 - 2015-01-05 16:19 - 0007168 _____ () C:\Documents and Settings\Tomi\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

Files to move or delete:
====================
C:\Windows\Tasks\At1.job
C:\Windows\Tasks\At2.job
C:\Windows\Tasks\At3.job
C:\Windows\Tasks\At4.job


Some content of TEMP:
====================
C:\Documents and Settings\Tomi\Ustawienia lokalne\temp\eowwal.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================