Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:02-08-2015 01 Ran by Właściciel (administrator) on TERMINAL-3 (06-08-2015 10:54:29) Running from C:\Documents and Settings\Właściciel\Moje dokumenty\Pobrane Loaded Profiles: Właściciel (Available Profiles: Właściciel) Platform: Microsoft Windows XP Home Edition Dodatek Service Pack 3 (X86) Language: Polski Internet Explorer Version 8 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe () C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\hnss88.tmp () C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\jnsy7F.tmp (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE () C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\knst70.tmpfs (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe (Murray Hurps Software Pty Ltd) C:\Program Files\Ad Muncher\AdMunch.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\CisTray.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cis.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdupd.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2012-07-03] (Advanced Micro Devices, Inc.) HKLM\...\Run: [KernelFaultCheck] => %systemroot%\system32\dumprep 0 -k HKLM\...\Run: [Ad Muncher] => C:\Program Files\Ad Muncher\AdMunch.exe [560760 2015-06-01] (Murray Hurps Software Pty Ltd) HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1359064 2015-04-01] (COMODO) Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll [2012-07-04] (ATI Technologies Inc.) HKU\S-1-5-19\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32 HKU\S-1-5-20\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32 HKU\S-1-5-18\...\RunOnce: [nltide_2] => regsvr32 /s /n /i:U shell32 ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-854245398-1454471165-682003330-1003\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = Tcpip\Parameters: [DhcpNameServer] 192.168.8.1 192.168.8.1 Tcpip\..\Interfaces\{6B5DF8A7-F13A-460F-A077-9C02E3F4D5AF}: [DhcpNameServer] 192.168.8.1 192.168.8.1 Tcpip\..\Interfaces\{B146F4AA-2ED9-41EE-8096-0861B430E51F}: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF ProfilePath: C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\ohus80ol.default FF Homepage: hxxp://www.wp.pl FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-14] () FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation) FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.) FF Extension: Google Translator for Firefox - C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\ohus80ol.default\Extensions\translator@zoli.bod.xpi [2015-06-25] FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2012-09-03] FF Extension: Google Translator for Firefox - C:\Documents and Settings\Właściciel\Dane aplikacji\Mozilla\Firefox\Profiles\ohus80ol.default\extensions\translator@zoli.bod.xpi [2015-06-25] FF Extension: No Name - C:\Documents and Settings\W [not found] FF Extension: No Name - C:\Documents and Settings\W [not found] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [4351816 2015-04-01] (COMODO) R3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1664728 2015-04-01] (COMODO) R2 comyninu; C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\hnss88.tmp [161792 2015-08-05] () [File not signed] R2 hyverumu; C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\jnsy7F.tmp [209920 2015-08-05] () [File not signed] R2 xymunype; C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF\knst70.tmpfs [X] ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative) R1 AmdPPM; C:\WINDOWS\System32\DRIVERS\AmdPPM.sys [33792 2007-04-16] (Advanced Micro Devices) R3 AtiHDAudioService; C:\WINDOWS\System32\drivers\AtihdXP3.sys [103040 2012-05-14] (Advanced Micro Devices) R1 cmderd; C:\WINDOWS\System32\DRIVERS\cmderd.sys [15576 2015-04-01] (COMODO) R1 cmdGuard; C:\WINDOWS\System32\DRIVERS\cmdguard.sys [627032 2015-04-01] (COMODO) R1 cmdHlp; C:\WINDOWS\System32\DRIVERS\cmdhlp.sys [29912 2015-04-01] (COMODO) R0 Inspect; C:\WINDOWS\System32\DRIVERS\inspect.sys [105688 2015-04-01] (COMODO) S3 KMWDFILTER; C:\WINDOWS\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows (R) Codename Longhorn DDK provider) S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.) R0 nvata; C:\WINDOWS\System32\DRIVERS\nvata.sys [100736 2006-04-24] (NVIDIA Corporation) R0 nvatabus; C:\WINDOWS\system32\Drivers\nvatabus.sys [105344 2012-03-09] (NVIDIA Corporation) [File not signed] R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [52736 2006-03-22] (NVIDIA Corporation) R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [18944 2006-03-22] (NVIDIA Corporation) R3 RtlWlanu; C:\WINDOWS\System32\DRIVERS\rtwlanu_xp.sys [2501592 2014-01-10] (Realtek Semiconductor Corporation ) R0 Si3112; C:\WINDOWS\system32\Drivers\Si3112.sys [62208 2012-03-09] (Silicon Image, Inc.) [File not signed] S3 whfltr2k; C:\WINDOWS\System32\DRIVERS\whfltr2k.sys [7424 2000-01-01] () [File not signed] S4 IntelIde; No ImagePath S3 massfilter; system32\drivers\massfilter.sys [X] U1 WS2IFSL; No ImagePath S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-08-06 10:54 - 2015-08-06 10:54 - 00000000 ____D C:\FRST 2015-08-06 10:53 - 2015-08-06 10:53 - 00010336 _____ C:\WINDOWS\system32\Drivers\fvstore.dat 2015-08-06 10:53 - 2015-08-06 10:53 - 00000000 ___HD C:\VTRoot 2015-08-06 10:44 - 2015-08-06 10:44 - 00000000 ____D C:\MSIab353.tmp 2015-08-06 10:33 - 2015-08-06 10:44 - 00000048 _____ C:\RB.rdat 2015-08-06 10:33 - 2015-08-06 10:44 - 00000048 _____ C:\License_Time.rdat 2015-08-06 10:15 - 2015-08-06 10:54 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job 2015-08-06 10:15 - 2015-08-06 10:48 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job 2015-08-06 10:15 - 2015-08-06 10:48 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job 2015-08-06 10:15 - 2015-08-06 10:48 - 00000440 _____ C:\WINDOWS\Tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job 2015-08-06 10:15 - 2015-08-06 10:45 - 00078801 _____ C:\WINDOWS\system32\Drivers\sfi.dat 2015-08-06 10:14 - 2015-08-06 10:14 - 00000000 ____D C:\Program Files\COMODO 2015-08-05 17:32 - 2015-08-05 17:48 - 00000000 ____D C:\Program Files\SecurityXploded 2015-08-05 17:32 - 2015-08-05 17:32 - 00000000 ____D C:\Program Files\FFFFFFFF-1438788731-FFFF-FFFF-FFFFFFFFFFFF 2015-08-05 17:32 - 2001-10-30 13:00 - 00000742 _____ C:\WINDOWS\system32\Drivers\etc\hp.bak 2015-08-05 17:31 - 2015-08-06 10:48 - 00001058 _____ C:\WINDOWS\Tasks\gsgM2rKhmvUAvKNu6Pz.job 2015-08-05 12:51 - 2009-07-13 18:16 - 00016896 _____ (Microsoft Corporation) C:\WINDOWS\system32\winusb.dll 2015-08-05 12:51 - 2009-07-13 16:51 - 00034944 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\winusb.sys 2015-08-05 12:38 - 2013-01-23 11:31 - 00075264 _____ (Nokia) C:\WINDOWS\system32\nmwcdcls.dll 2015-08-03 12:29 - 2015-08-03 12:29 - 00020992 _____ (Copyright (c) Code Industry Ltd ) C:\WINDOWS\system32\mpelocalmon.dll 2015-08-03 12:29 - 2015-08-03 12:29 - 00013824 _____ (Copyright (c) Code Industry Ltd ) C:\WINDOWS\system32\mpelocalui.dll 2015-08-03 12:29 - 2015-08-03 12:29 - 00000000 ____D C:\Program Files\Code Industry 2015-07-23 23:44 - 2015-07-23 23:44 - 00875472 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr110.dll 2015-07-23 23:44 - 2015-07-23 23:44 - 00535008 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcp110.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-08-06 10:53 - 2015-06-20 09:11 - 00000930 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2015-08-06 10:50 - 2012-08-11 16:13 - 01764602 _____ C:\WINDOWS\WindowsUpdate.log 2015-08-06 10:50 - 2008-06-22 01:03 - 00173940 _____ C:\WINDOWS\setupapi.log 2015-08-06 10:49 - 2012-09-01 18:03 - 00065536 _____ C:\WINDOWS\system32\config\ACEEvent.evt 2015-08-06 10:48 - 2012-12-05 18:13 - 00000452 _____ C:\WINDOWS\Tasks\CIS_{15198508-521A-4D69-8E5B-B94A6CCFF805}.job 2015-08-06 10:48 - 2012-08-11 16:17 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2015-08-06 10:48 - 2008-06-22 01:05 - 00000157 _____ C:\WINDOWS\wiadebug.log 2015-08-06 10:48 - 2008-06-22 01:05 - 00000050 _____ C:\WINDOWS\wiaservc.log 2015-08-06 10:45 - 2012-08-11 16:17 - 00032328 _____ C:\WINDOWS\SchedLgU.Txt 2015-08-06 10:14 - 2015-05-23 13:42 - 00492242 _____ C:\WINDOWS\system32\prfh0415.dat 2015-08-06 10:14 - 2015-05-23 13:42 - 00085138 _____ C:\WINDOWS\system32\prfc0415.dat 2015-08-05 17:24 - 2001-10-30 13:00 - 00013646 _____ C:\WINDOWS\system32\wpa.dbl 2015-08-05 17:23 - 2015-05-23 13:42 - 00065536 _____ C:\WINDOWS\system32\config\COMODO I.evt 2015-08-05 13:25 - 2008-06-22 01:03 - 00204120 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2015-08-05 13:18 - 2015-05-23 13:18 - 00000376 _____ C:\WINDOWS\Tasks\SlimCleaner Plus (Scheduled Scan - Właściciel).job 2015-08-05 12:23 - 2008-06-22 01:03 - 00203272 _____ C:\WINDOWS\setupact.log 2015-08-05 11:56 - 2013-11-29 11:54 - 00000000 ____D C:\Program Files\LibreOffice 4 2015-07-15 17:52 - 2015-05-20 17:58 - 00000000 ____D C:\WINDOWS\system32\MRT 2015-07-15 14:54 - 2012-08-30 19:11 - 00778416 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2015-07-15 14:54 - 2012-08-30 19:11 - 00142512 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2015-07-08 15:00 - 2015-05-20 18:01 - 00000226 _____ C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job ==================== Files in the root of some directories ======= 2015-04-14 18:28 - 2015-04-14 18:28 - 0004387 _____ () C:\Documents and Settings\Właściciel\Dane aplikacji\gsgM2rKhmvUAvKNu6Pz 2015-04-20 16:05 - 2015-04-20 16:05 - 1246720 _____ () C:\Documents and Settings\Właściciel\Dane aplikacji\gsgM2rKhmvUAvKNu6Pz.exe 2015-08-05 17:37 - 2015-08-05 17:37 - 0333506 _____ (AnySend.com) C:\Documents and Settings\Właściciel\Ustawienia lokalne\Dane aplikacji\nsn3F.tmp ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed ==================== End of log ============================