Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by kos (administrator) on F-M-F on 07-04-2015 12:17:27
Running from C:\Documents and Settings\kopa\Pulpit\Nowy folder
Loaded Profiles: kos (Available profiles: User & AGr & mba & dda & kos & pmas)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polski
Internet Explorer Version 8 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\WINDOWS\system32\scardsvr.exe
() C:\Program Files\ComArch\ComarchSmartCard\CardServer.exe
(DameWare Development LLC) C:\WINDOWS\dwrcs\DWRCS.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\FrameworkService.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
(McAfee, Inc.) C:\WINDOWS\system32\mfevtps.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\mfeann.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe
(McAfee, Inc.) C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(DameWare Development LLC) C:\WINDOWS\dwrcs\DWRCS.EXE
(DameWare Development) C:\WINDOWS\dwrcs\DWRCST.EXE
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Intel Corporation) C:\WINDOWS\system32\igfxtray.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(McAfee, Inc.) C:\Program Files\McAfee\VirusScan Enterprise\shstat.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Microsoft Corporation) C:\Documents and Settings\kopa\Dane aplikacji\startup\windows process.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Farbar) C:\Documents and Settings\kopa\Pulpit\Nowy folder\FRST(1).exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDCPL] => C:\WINDOWS\RTHDCPL.EXE [19722344 2010-11-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [ShStatEXE] => C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE [215656 2012-08-14] (McAfee, Inc.)
HKLM\...\Run: [McAfeeUpdaterUI] => C:\Program Files\McAfee\Common Framework\udaterui.exe [337440 2013-03-22] (McAfee, Inc.)
HKLM\...\Run: [DameWare MRC Agent] => C:\WINDOWS\dwrcs\DWRCST.exe [277440 2011-10-14] (DameWare Development)
Winlogon\Notify\MRCNotify: C:\WINDOWS\dwrcs\DWRCWXL.dll (DameWare Development LLC)
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 1
HKLM\...\Policies\Explorer: [HideSCAHealth] 1
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [!@#$%^&*] => C:\Documents and Settings\kopa\Dane aplikacji\startup\windows process.exe [397312 2015-04-07] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [IpEPckT79VF5HBMh8] => c:\documents and settings\kopa\dane aplikacji\ipepckt79vf5hbmh8\ipepckt79vf5hbmh8.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [X6jFQF2EIgKyy] => c:\documents and settings\kopa\dane aplikacji\x6jfqf2eigkyy\x6jfqf2eigkyy.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [hWmo1fj8e82cPa8O61270] => c:\documents and settings\kopa\dane aplikacji\hwmo1fj8e82cpa8o61270\hwmo1fj8e82cpa8o61270.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [YGbPFsIlT8] => c:\documents and settings\kopa\dane aplikacji\ygbpfsilt8\ygbpfsilt8.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [puClps3g10] => c:\documents and settings\kopa\dane aplikacji\puclps3g10\puclps3g10.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [kiGK7TSTZxt] => c:\documents and settings\kopa\dane aplikacji\kigk7tstzxt\kigk7tstzxt.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [ILg5qNIXVZw4xFuWC] => c:\documents and settings\kopa\dane aplikacji\ilg5qnixvzw4xfuwc\ilg5qnixvzw4xfuwc.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [AvsK2bgKNLwfyd2] => c:\documents and settings\kopa\dane aplikacji\avsk2bgknlwfyd2\avsk2bgknlwfyd2.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [m3TXGJLuoJt5LTNFWXAl] => "c:\documents and settings\kopa\dane aplikacji\m3txgjluojt5ltnfwxal\m3txgjluojt5ltnfwxal.exe"
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Run: [dx6pbHwbHMC05O] => c:\documents and settings\kopa\dane aplikacji\dx6pbhwbhmc05o\dx6pbhwbhmc05o.exe [638816 2009-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Policies\Explorer: [TaskbarNoNotification] 1
HKU\S-1-5-21-2094431546-3998815993-849199213-6447\...\Policies\Explorer: [HideSCAHealth] 1
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
ShortcutTarget: Adobe Reader Speed Launch.lnk -> C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk
ShortcutTarget: Adobe Reader Synchronizer.lnk -> C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe ()
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Service Manager.lnk
ShortcutTarget: Service Manager.lnk -> C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2094431546-3998815993-849199213-6447\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pl/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2094431546-3998815993-849199213-6447 -> {4400F0C9-8F53-4782-BCD2-4498D0E87200} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Adobe PDF Reader Link Helper -> {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23] (Adobe Systems Incorporated)
BHO: scriptproxy -> {7DB2D5A0-7241-4E79-B68D-6309F01C5231} -> C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20130313081139.dll [2012-09-25] (McAfee, Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-12-21] (Microsoft Corporation)
DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1309439981859
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: saphtmlp - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files\sap\frontend\sapgui\saphtmlp.dll [2011-11-11] (SAP, Walldorf)
Handler: sapr3 - {D1F8BD1E-7967-11D2-B43A-006094B9EADB} - c:\program files\sap\frontend\sapgui\saphtmlp.dll [2011-11-11] (SAP, Walldorf)
Tcpip\Parameters: [DhcpNameServer] 192.168.200.2 192.168.200.28

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll [2013-02-07] ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2007-11-07] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npnul32.dll [2011-07-29] (mozilla.org)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2006-10-23] (Adobe Systems Inc.)
FF Extension: %ScriptScanProductName% - C:\Program Files\Mozilla Firefox\distribution\bundles\{D19CA586-DD6C-4a0a-96F8-14644F340D60} [2013-03-13]

Chrome: 
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\41.0.2272.118\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\41.0.2272.118\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\41.0.2272.118\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
CHR Profile: C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-09-03]
CHR Extension: (Google Drive) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-09-03]
CHR Extension: (YouTube) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-09-03]
CHR Extension: (Puk-Puk) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\cngkcldnnppckgbmndaccoffaikjbemc [2013-09-04]
CHR Extension: (Google Search) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-09-03]
CHR Extension: (Google Wallet) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-03]
CHR Extension: (Gmail) - C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-09-03]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

Locked "kfyarka" service was unlocked successfully. <===== ATTENTION

R2 ComarchCardServer; C:\Program Files\ComArch\ComarchSmartCard\CardServer.exe [118870 2005-11-30] () [File not signed]
R2 dwmrcs; C:\WINDOWS\dwrcs\DWRCS.EXE [588736 2011-10-14] (DameWare Development LLC)
S3 idsvc; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [864256 2007-10-11] (Microsoft Corporation) [File not signed]
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-03-17] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 McAfeeFramework; C:\Program Files\McAfee\Common Framework\FrameworkService.exe [130080 2013-03-22] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [167856 2012-09-25] (McAfee, Inc.)
R2 McTaskManager; C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe [209760 2011-01-12] (McAfee, Inc.)
R2 mfevtp; C:\WINDOWS\system32\mfevtps.exe [160152 2012-09-25] (McAfee, Inc.)
R2 MSSQL$MPSC_DB; C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlservr.exe [7520337 2002-12-17] (Microsoft Corporation) [File not signed]
S3 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [66112 2002-12-17] (Microsoft Corporation) [File not signed]
R2 Net Driver HPZ12; C:\WINDOWS\system32\HPZinw12.dll [45568 2013-05-16] (Hewlett-Packard) [File not signed]
S4 NetTcpPortSharing; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [122880 2007-10-11] (Microsoft Corporation) [File not signed]
R2 Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.dll [55808 2013-05-16] (Hewlett-Packard) [File not signed]
S3 SQLAgent$MPSC_DB; C:\Program Files\Microsoft SQL Server\MSSQL$MPSC_DB\Binn\sqlagent.EXE [311872 2002-12-17] (Microsoft Corporation) [File not signed]
S2 kfyarka; C:\WINDOWS\system32\lkkalcuy.dll [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R3 DwMirror; C:\WINDOWS\System32\DRIVERS\DamewareMini.sys [3712 2007-02-07] (DameWare Development, LLC)
R1 dwvkbd; C:\WINDOWS\System32\DRIVERS\dwvkbd.sys [26624 2007-02-15] (DameWare)
S3 GemCCID; C:\WINDOWS\System32\Drivers\GemCCID.sys [89600 2009-08-10] (Gemalto)
R3 L1c; C:\WINDOWS\System32\DRIVERS\l1c51x86.sys [61552 2010-06-25] (Atheros Communications, Inc.)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [119512 2015-04-07] (Malwarebytes Corporation)
R3 mfeapfk; C:\WINDOWS\System32\drivers\mfeapfk.sys [125600 2012-09-25] (McAfee, Inc.)
R3 mfeavfk; C:\WINDOWS\System32\drivers\mfeavfk.sys [218760 2012-09-25] (McAfee, Inc.)
S3 mfebopk; C:\WINDOWS\System32\drivers\mfebopk.sys [63128 2012-09-25] (McAfee, Inc.)
R0 mfehidk; C:\WINDOWS\System32\drivers\mfehidk.sys [481320 2012-09-25] (McAfee, Inc.)
S3 mferkdet; C:\WINDOWS\System32\drivers\mferkdet.sys [87816 2012-09-25] (McAfee, Inc.)
R1 mfetdi2k; C:\WINDOWS\System32\drivers\mfetdi2k.sys [90368 2012-09-25] (McAfee, Inc.)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R3 MTsensor; C:\WINDOWS\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] ()
U2 CertPropSvc; No ImagePath
S4 IntelIde; No ImagePath
U3 mfeavfk01; No ImagePath
U1 WS2IFSL; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

NETSVC: kfyarka -> C:\WINDOWS\system32\lkkalcuy.dll ==> No File.

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 12:15 - 2015-04-07 12:15 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\dx6pbHwbHMC05O
2015-04-07 12:13 - 2015-04-07 12:13 - 00000188 ___SH () C:\Documents and Settings\pma\ntuser.ini
2015-04-07 12:13 - 2015-04-07 12:13 - 00000000 ____D () C:\Documents and Settings\pma
2015-04-07 12:13 - 2012-11-28 09:07 - 00000000 __SHD () C:\Documents and Settings\pma\IETldCache
2015-04-07 12:13 - 2012-11-28 09:07 - 00000000 __RHD () C:\Documents and Settings\pma\Dane aplikacji
2015-04-07 12:13 - 2012-11-28 09:07 - 00000000 ____D () C:\Documents and Settings\pma\Dane aplikacji\McAfee
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ___RD () C:\Documents and Settings\pma\Menu Start\Programy\Autostart
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ___RD () C:\Documents and Settings\pma\Menu Start
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ___HD () C:\Documents and Settings\pma\Ustawienia lokalne\Historia
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ___HD () C:\Documents and Settings\pma\Ustawienia lokalne
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ____D () C:\Documents and Settings\pma\Ustawienia lokalne\Temp
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ____D () C:\Documents and Settings\pma\Ulubione
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ____D () C:\Documents and Settings\pma\Pulpit
2015-04-07 12:13 - 2011-06-30 22:40 - 00000000 ____D () C:\Documents and Settings\pma\Moje dokumenty
2015-04-07 12:13 - 2011-06-30 14:47 - 00001599 _____ () C:\Documents and Settings\pma\Menu Start\Programy\Pomoc zdalna.lnk
2015-04-07 12:13 - 2011-06-30 14:47 - 00000792 _____ () C:\Documents and Settings\pma\Menu Start\Programy\Windows Media Player.lnk
2015-04-07 12:13 - 2011-06-30 14:47 - 00000000 ___RD () C:\Documents and Settings\pma\Menu Start\Programy\Akcesoria
2015-04-07 12:13 - 2011-06-30 14:47 - 00000000 ___RD () C:\Documents and Settings\pma\Menu Start\Programy
2015-04-07 12:13 - 2011-06-30 14:47 - 00000000 ___HD () C:\Documents and Settings\pma\Ustawienia lokalne\Dane aplikacji
2015-04-07 12:13 - 2011-06-30 14:44 - 00000000 ___HD () C:\Documents and Settings\pma\Szablony
2015-04-07 12:10 - 2015-04-07 12:17 - 00000000 ____D () C:\FRST
2015-04-07 12:06 - 2015-04-07 12:06 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\m3TXGJLuoJt5LTNFWXAl
2015-04-07 12:02 - 2015-04-07 12:02 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\AvsK2bgKNLwfyd2
2015-04-07 11:51 - 2015-04-07 11:51 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\ILg5qNIXVZw4xFuWC
2015-04-07 11:47 - 2015-04-07 11:49 - 00000000 ____D () C:\AdwCleaner
2015-04-07 11:30 - 2015-04-07 11:46 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes' Anti-Malware (portable)
2015-04-07 11:28 - 2015-04-07 11:28 - 00000000 ____D () C:\Documents and Settings\kopa\Pulpit\aaaa
2015-04-07 11:27 - 2015-04-07 11:27 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\kiGK7TSTZxt
2015-04-07 11:15 - 2015-04-07 11:15 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\puClps3g10
2015-04-07 11:11 - 2015-04-07 11:11 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\YGbPFsIlT8
2015-04-07 11:07 - 2015-04-07 12:17 - 00119512 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-04-07 11:07 - 2015-04-07 11:28 - 00120024 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-04-07 11:07 - 2015-04-07 11:07 - 00000777 _____ () C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk
2015-04-07 11:07 - 2015-04-07 11:07 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2015-04-07 11:07 - 2015-04-07 11:07 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\hWmo1fj8e82cPa8O61270
2015-04-07 11:07 - 2015-04-07 11:07 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes Anti-Malware
2015-04-07 11:07 - 2015-04-07 11:07 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
2015-04-07 11:07 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-04-07 11:06 - 2015-04-07 12:17 - 00000000 ____D () C:\Documents and Settings\kopa\Pulpit\Nowy folder
2015-04-07 11:03 - 2015-04-07 11:03 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\X6jFQF2EIgKyy
2015-04-07 10:36 - 2015-04-07 10:36 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\startup
2015-04-07 10:36 - 2015-04-07 10:36 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\IpEPckT79VF5HBMh8
2015-04-07 09:15 - 2015-04-07 09:15 - 00000212 _____ () C:\Documents and Settings\kopa\Dane aplikacji\jhuikloyhj
2015-03-31 14:47 - 2015-03-31 14:47 - 00009986 _____ () C:\Documents and Settings\kopa\Pulpit\Zeszyt1.xlsx
2015-03-31 14:42 - 2015-03-31 14:42 - 00018657 _____ () C:\Documents and Settings\kopa\Pulpit\warta.xlsx
2015-03-09 16:34 - 2015-03-09 16:34 - 00173418 _____ () C:\Documents and Settings\kopa\Pulpit\310030.XML

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-07 12:17 - 2013-02-27 09:04 - 00000000 ____D () C:\Documents and Settings\kopa\Ustawienia lokalne\Temp
2015-04-07 12:16 - 2011-07-29 08:12 - 00000464 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{AC5A4525-ABB5-4D3F-9102-CA09339C0FDA}.job
2015-04-07 12:15 - 2013-10-11 08:25 - 00001032 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-07 12:15 - 2013-02-27 09:04 - 00011742 __RSH () C:\Documents and Settings\kopa\ntuser.pol
2015-04-07 12:15 - 2013-02-27 09:04 - 00000188 ___SH () C:\Documents and Settings\kopa\ntuser.ini
2015-04-07 12:15 - 2013-02-27 09:04 - 00000000 __RHD () C:\Documents and Settings\kopa\Dane aplikacji
2015-04-07 12:15 - 2013-02-27 09:04 - 00000000 ____D () C:\Documents and Settings\kopa
2015-04-07 12:15 - 2011-07-25 15:02 - 00000120 _____ () C:\WINDOWS\system32\config\netlogon.ftl
2015-04-07 12:15 - 2008-04-15 19:00 - 00013646 _____ () C:\WINDOWS\system32\wpa.dbl
2015-04-07 12:14 - 2013-10-11 08:25 - 00001036 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-07 12:06 - 2011-06-30 22:40 - 01149876 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-04-07 12:06 - 2008-04-15 19:00 - 00512330 _____ () C:\WINDOWS\system32\perfh015.dat
2015-04-07 12:06 - 2008-04-15 19:00 - 00092944 _____ () C:\WINDOWS\system32\perfc015.dat
2015-04-07 12:02 - 2011-06-30 22:42 - 00000157 _____ () C:\WINDOWS\wiadebug.log
2015-04-07 12:02 - 2011-06-30 22:42 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2015-04-07 12:01 - 2011-06-30 14:57 - 00032138 _____ () C:\WINDOWS\SchedLgU.Txt
2015-04-07 12:01 - 2011-06-30 14:57 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-07 12:01 - 2011-06-30 14:46 - 01709907 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-07 11:57 - 2011-06-30 14:58 - 00000000 ____D () C:\Documents and Settings\User\Ustawienia lokalne\Temp
2015-04-07 11:56 - 2011-07-28 08:16 - 00000000 ____D () C:\Documents and Settings\dda\Ustawienia lokalne\Temp
2015-04-07 11:56 - 2011-07-28 08:13 - 00000000 ____D () C:\Documents and Settings\agreda\Ustawienia lokalne\Temp
2015-04-07 11:55 - 2013-02-27 09:04 - 00000000 ____D () C:\Documents and Settings\kopa\Pulpit
2015-04-07 11:30 - 2011-06-30 22:40 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji
2015-04-07 11:20 - 2011-07-01 10:53 - 00131072 _____ () C:\WINDOWS\system32\config\OAlerts.evt
2015-04-07 11:20 - 2011-07-01 10:31 - 00000000 __HDC () C:\WINDOWS\$NtUninstallKB981997$
2015-04-07 11:07 - 2011-06-30 22:40 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2015-04-07 11:07 - 2011-06-30 22:40 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2015-04-07 08:45 - 2013-06-05 08:21 - 00002419 _____ () C:\Documents and Settings\kopa\Pulpit\faktury fii_2.mdb — skrót NOWY.lnk
2015-04-07 08:24 - 2013-02-27 11:16 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\SAP
2015-04-07 08:24 - 2013-02-27 09:43 - 00000000 ____D () C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji\SAP
2015-04-07 08:24 - 2013-02-27 09:41 - 00000000 ____D () C:\Documents and Settings\kopa\Moje dokumenty\SAP
2015-04-07 08:05 - 2013-02-27 09:44 - 00000000 ____D () C:\Documents and Settings\kopa\Moje dokumenty\Pliki programu Outlook
2015-04-07 08:04 - 2011-06-30 22:34 - 00000000 ____D () C:\WINDOWS\security
2015-04-03 13:40 - 2013-02-27 09:04 - 00000000 ___HD () C:\Documents and Settings\kopa\Ustawienia lokalne\Dane aplikacji
2015-04-03 13:39 - 2013-06-04 11:25 - 00000000 ____D () C:\Documents and Settings\kopa\Dane aplikacji\PrimoPDF
2015-04-03 11:04 - 2013-08-01 17:39 - 00000000 ____D () C:\Documents and Settings\kopa\Pulpit\karty
2015-04-01 08:56 - 2013-02-27 11:55 - 00046592 _____ () C:\Documents and Settings\kopa\Pulpit\Nowe PC.xls
2015-03-31 15:55 - 2013-04-23 12:08 - 00000000 ____D () C:\Documents and Settings\kopa\Pulpit\POTWIERDZENIA
2015-03-30 08:17 - 2011-08-18 08:52 - 00052890 __RSH () C:\Documents and Settings\All Users\ntuser.pol
2015-03-11 10:49 - 2011-06-30 22:34 - 00000000 ____D () C:\WINDOWS\Help

==================== Files in the root of some directories =======

2015-04-07 09:15 - 2015-04-07 09:15 - 0016896 _____ () C:\Documents and Settings\kopa\Dane aplikacji\29 A Sorted Ending.mp3
2015-04-07 09:15 - 2015-04-07 09:15 - 0000212 _____ () C:\Documents and Settings\kopa\Dane aplikacji\jhuikloyhj

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed

==================== End Of Log ============================