OTL logfile created on: 9/21/2013 10:00:11 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Sławek\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16576)
Locale: 00000409 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
7.86 Gb Total Physical Memory | 6.05 Gb Available Physical Memory | 76.99% Memory free
15.71 Gb Paging File | 13.75 Gb Available in Paging File | 87.53% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 679.04 Gb Total Space | 608.27 Gb Free Space | 89.58% Space Free | Partition Type: NTFS
Drive D: | 7.46 Gb Total Space | 5.93 Gb Free Space | 79.51% Space Free | Partition Type: FAT32
Unable to calculate disk information.
Drive F: | 1863.02 Gb Total Space | 1438.49 Gb Free Space | 77.21% Space Free | Partition Type: NTFS
 
Computer Name: PPP | User Name: Sławek | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2013/09/21 21:02:32 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Sławek\Downloads\OTL.scr
PRC - [2013/07/27 10:41:25 | 001,028,896 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
PRC - [2013/07/27 10:35:36 | 001,889,568 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/09/23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012/04/25 19:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
PRC - [2012/01/18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
PRC - [2011/03/11 22:37:04 | 000,041,496 | ---- | M] () -- C:\Program Files (x86)\Media remote\Media remote.exe
PRC - [2011/02/11 14:49:44 | 000,346,704 | ---- | M] (Dritek System Inc.) -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe
PRC - [2011/01/31 23:55:14 | 000,244,624 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe
PRC - [2011/01/13 04:00:42 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/12/20 12:30:38 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010/12/20 12:30:36 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/11/12 03:21:52 | 000,257,344 | ---- | M] (NTI Corporation) -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
PRC - [2010/01/30 02:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2011/03/11 22:37:04 | 000,041,496 | ---- | M] () -- C:\Program Files (x86)\Media remote\Media remote.exe
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - [2013/07/27 10:49:33 | 014,984,480 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:[b]64bit:[/b] - [2011/01/31 23:55:14 | 000,244,624 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Live Updater Service)
SRV:[b]64bit:[/b] - [2011/01/28 17:44:08 | 000,868,224 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:[b]64bit:[/b] - [2010/10/08 11:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:[b]64bit:[/b] - [2009/09/13 15:00:00 | 000,166,400 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE -- (EPSON_EB_RPCV4_04)
SRV:[b]64bit:[/b] - [2009/09/13 15:00:00 | 000,128,512 | ---- | M] (SEIKO EPSON CORPORATION) [Auto | Running] -- C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE -- (EPSON_PM_RPCV4_04)
SRV:[b]64bit:[/b] - [2009/07/14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/07/27 10:35:36 | 001,889,568 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/09/23 20:43:34 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012/04/25 19:53:38 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe -- (KSS)
SRV - [2012/01/18 06:44:52 | 000,450,848 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe -- (UMVPFSrv)
SRV - [2011/04/21 03:40:20 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/02/11 14:49:44 | 000,346,704 | ---- | M] (Dritek System Inc.) [Auto | Running] -- C:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2011/01/13 04:00:42 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2011/01/12 02:35:04 | 000,318,000 | ---- | M] (Egis Technology Inc. ) [Disabled | Stopped] -- C:\Program Files (x86)\Acer Bio Protection\EgisService.exe -- (EgisTec Service)
SRV - [2011/01/12 02:34:10 | 000,258,096 | ---- | M] (Egis Technology Inc. ) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)
SRV - [2010/12/20 12:30:38 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2010/12/20 12:30:36 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/11/12 03:21:52 | 000,257,344 | ---- | M] (NTI Corporation) [Auto | Running] -- C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/30 02:52:58 | 000,260,640 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2009/06/10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - [2013/06/21 14:06:36 | 000,030,496 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:[b]64bit:[/b] - [2013/05/14 21:28:40 | 000,039,712 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:[b]64bit:[/b] - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2012/08/23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:[b]64bit:[/b] - [2012/08/23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2012/03/01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2012/01/18 06:44:36 | 004,865,568 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)
DRV:[b]64bit:[/b] - [2011/08/17 10:04:34 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64)
DRV:[b]64bit:[/b] - [2011/08/17 09:58:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)
DRV:[b]64bit:[/b] - [2011/08/17 09:58:22 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltx64.sys -- (upperdev)
DRV:[b]64bit:[/b] - [2011/08/17 09:58:20 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)
DRV:[b]64bit:[/b] - [2011/08/17 09:58:16 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)
DRV:[b]64bit:[/b] - [2011/04/21 03:22:57 | 000,035,888 | ---- | M] (EgisTec) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\FPSensor.sys -- (FPSensor)
DRV:[b]64bit:[/b] - [2011/03/11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2011/03/11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2011/01/30 18:04:42 | 000,174,168 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR)
DRV:[b]64bit:[/b] - [2011/01/27 02:57:12 | 012,273,408 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2011/01/13 03:51:44 | 000,439,320 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2010/12/10 22:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:[b]64bit:[/b] - [2010/12/10 22:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:[b]64bit:[/b] - [2010/11/20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010/11/20 12:43:57 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)
DRV:[b]64bit:[/b] - [2010/10/26 05:08:08 | 000,406,632 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2010/10/19 10:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:[b]64bit:[/b] - [2010/10/14 18:28:16 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:[b]64bit:[/b] - [2010/10/08 11:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:[b]64bit:[/b] - [2010/07/15 23:57:34 | 002,350,952 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:[b]64bit:[/b] - [2010/07/09 05:51:50 | 000,017,408 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UBHelper.sys -- (UBHelper)
DRV:[b]64bit:[/b] - [2010/07/02 01:46:58 | 000,029,288 | ---- | M] (Quanta Computer) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\qicflt.sys -- (qicflt)
DRV:[b]64bit:[/b] - [2010/07/01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | "Start" not found. | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)
DRV:[b]64bit:[/b] - [2010/04/20 04:35:14 | 000,018,432 | ---- | M] (NTI Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NTIDrvr.sys -- (NTIDrvr)
DRV:[b]64bit:[/b] - [2009/07/14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009/07/14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009/07/14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009/07/14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:[b]64bit:[/b] - [2009/07/14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:[b]64bit:[/b] - [2009/06/10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009/06/10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009/06/10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009/06/10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009/07/14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST9750423AS_5WS0TT0KXXXX5WS0TT0K&ts=1379786357
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST9750423AS_5WS0TT0KXXXX5WS0TT0K&ts=1379786357
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9750423AS_5WS0TT0KXXXX5WS0TT0K&ts=1379768435&type=default&q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=AARTDF&pc=MAAR&src=IE-SearchBox
IE - HKLM\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9750423AS_5WS0TT0KXXXX5WS0TT0K&ts=1379768435&type=default&q={searchTerms}
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pl/
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\..\URLSearchHook: {3bbd3c14-4c16-4989-8366-95bc9179779d} - No CLSID value found
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://www2.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=D6CAF655F9B73B43&affID=120695&tsp=5004
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\..\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}: "URL" = http://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST9750423AS_5WS0TT0KXXXX5WS0TT0K&ts=1379786306&type=default&q={searchTerms}
IE - HKU\S-1-5-21-569376730-1857852993-86280356-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.defaultenginename: "qvo6"
FF - prefs.js..browser.search.order.1: "qvo6"
FF - prefs.js..browser.search.selectedEngine: "qvo6"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"
FF - prefs.js..extensions.enabledAddons: %7Bd40f5e7b-d2cf-4856-b441-cc613eeffbe3%7D:1.68
FF - prefs.js..extensions.enabledAddons: %7B3d7eb24f-2740-49df-8937-200b1cc08f8a%7D:1.5.17
FF - prefs.js..extensions.enabledAddons: grabthemall%40zelazko.info:0.6.6
FF - prefs.js..extensions.enabledAddons: bloodyvikings%40ffs.bplaced.net:0.5.5
FF - prefs.js..extensions.enabledAddons: adblockpopups%40jessehakanen.net:0.9.1
FF - prefs.js..extensions.enabledAddons: %7B1018e4d6-728f-4b20-ad56-37578a4de76b%7D:4.2.12
FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.8.1
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
 
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{41ecbc0b-34d5-4cd4-935f-253a30e2cb7e}: C:\Program Files (x86)\Acer Bio Protection\FFExt [2011/04/21 03:42:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files (x86)\McAfee\SiteAdvisor
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012/07/18 16:54:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\Extensions
[2013/09/21 20:20:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions
[2013/09/13 18:06:41 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2013/09/05 17:28:43 | 000,000,000 | ---D | M] (Flagfox) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2013/06/21 05:43:02 | 000,000,000 | ---D | M] (Flashblock) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a}
[2013/09/21 20:01:46 | 000,000,000 | ---D | M] (Ant Video Downloader) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\anttoolbar@ant.com
[2013/07/28 15:00:41 | 000,000,000 | ---D | M] (Bloody Vikings!) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\bloodyvikings@ffs.bplaced.net
[2013/06/21 05:43:03 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Sławek\AppData\Roaming\mozilla\Firefox\Profiles\63u36efb.default\extensions\support@lastpass.com
[2013/08/22 11:54:03 | 000,128,676 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\adblockpopups@jessehakanen.net.xpi
[2013/08/30 20:05:59 | 000,355,782 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\client@anonymox.net.xpi
[2013/06/21 05:33:04 | 000,088,614 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\extension@ciuvo.com.xpi
[2013/08/31 20:06:00 | 001,314,979 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\firefox@ghostery.com.xpi
[2013/07/26 07:00:01 | 000,025,851 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\grabthemall@zelazko.info.xpi
[2013/08/22 12:03:16 | 000,342,166 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\langpack-en-GB@firefox.mozilla.org.xpi
[2013/06/21 05:43:02 | 000,164,858 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\{37E4D8EA-8BDA-4831-8EA1-89053939A250}.xpi
[2013/09/21 20:01:44 | 000,534,729 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013/08/01 08:19:01 | 000,824,302 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013/06/21 05:43:02 | 000,138,614 | ---- | M] () (No name found) -- C:\Users\Sławek\AppData\Roaming\mozilla\firefox\profiles\63u36efb.default\extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
[2013/09/13 21:56:40 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\Extensions
[2013/08/22 12:02:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2013/08/22 12:02:53 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\{1018E4D6-728F-4B20-AD56-37578A4DE76B}
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\{3D7EB24F-2740-49DF-8937-200B1CC08F8A}
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\{D40F5E7B-D2CF-4856-B441-CC613EEFFBE3}.XPI
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\ADBLOCKPOPUPS@JESSEHAKANEN.NET.XPI
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\BLOODYVIKINGS@FFS.BPLACED.NET
File not found (No name found) -- C:\USERS\SĹ‚AWEK\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\63U36EFB.DEFAULT\EXTENSIONS\GRABTHEMALL@ZELAZKO.INFO.XPI
[2013/09/21 15:00:35 | 000,000,812 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\qvo6.xml
 
O1 HOSTS File: ([2009/06/10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:[b]64bit:[/b] - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\Acer Bio Protection\x64\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (EgisPBIE Class) - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files (x86)\Acer Bio Protection\EgisPBIE.dll (Egis Technology Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\Sławek\AppData\Roaming\Mozilla\Firefox\Profiles\63u36efb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin64-0.98.38.dll File not found
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (FireShot) - {6E6E744E-4D20-4ce3-9A7A-26DFFFE22F68} - C:\Users\Sławek\AppData\Roaming\Mozilla\Firefox\Profiles\63u36efb.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\library\fsaddin-0.98.38.dll File not found
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Media remote] C:\Program Files (x86)\Media remote\Media remote.exe ()
O4:[b]64bit:[/b] - HKLM..\Run: [Nvtmru] C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe (NVIDIA Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-569376730-1857852993-86280356-1005..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-569376730-1857852993-86280356-1005..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-569376730-1857852993-86280356-1005..\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-569376730-1857852993-86280356-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8:[b]64bit:[/b] - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:[b]64bit:[/b] - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert link target to existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:[b]64bit:[/b] - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{95CAFA80-1845-4449-AA7E-A9B771E527A4}: DhcpNameServer = 50.40.0.20
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B16B2F38-0F7F-4B90-AA88-F7B8B2DFC001}: DhcpNameServer = 192.168.1.254
O18:[b]64bit:[/b] - Protocol\Handler\ipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\PROGRA~2\COMMON~1\System\OLEDB~1\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:[b]64bit:[/b] - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation)
O20:[b]64bit:[/b] - AppInit_DLLs: (C:\PROGRA~1\NVIDIA~1\NVSTRE~1\rxinput.dll) - C:\Program Files\NVIDIA Corporation\NvStreamSrv\rxinput.dll (NVIDIA Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/07/28 18:21:01 | 000,044,400 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ]
O32 - AutoRun File - [2011/04/05 15:52:20 | 000,000,000 | RHSD | M] - D:\Autorun.inf -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2013/09/21 21:57:15 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2013/09/21 21:04:58 | 000,000,000 | ---D | C] -- C:\FRST
[2013/09/21 20:53:18 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/09/21 20:13:42 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Roaming\Malwarebytes
[2013/09/21 20:13:31 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/09/21 20:13:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/09/21 20:13:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/09/21 20:13:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/09/21 20:00:38 | 000,000,000 | ---D | C] -- C:\ProgramData\eSafe
[2013/09/21 15:00:35 | 000,000,000 | ---D | C] -- C:\User Data
[2013/09/13 21:56:34 | 000,000,000 | ---D | C] -- C:\ProgramData\DSearchLink
[2013/09/13 21:56:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon
[2013/09/13 21:55:50 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Roaming\DesktopIconGoodgame
[2013/09/08 21:05:16 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Local\calibre-cache
[2013/09/08 21:04:38 | 000,000,000 | ---D | C] -- C:\Users\Sławek\Documents\Calibre
[2013/09/08 21:02:33 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Roaming\calibre
[2013/09/08 20:54:12 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Roaming\IsolatedStorage
[2013/09/08 20:54:12 | 000,000,000 | ---D | C] -- C:\ProgramData\IsolatedStorage
[2013/09/08 20:54:04 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Local\_
[2013/08/28 21:56:20 | 000,000,000 | ---D | C] -- C:\Users\Sławek\AppData\Roaming\Softland
[2013/08/28 21:56:19 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\GdiPlus.dll
[2013/08/28 21:56:19 | 000,025,920 | ---- | C] (Softland) -- C:\Windows\SysNative\dopdfmn7.dll
[2013/08/28 21:56:19 | 000,021,312 | ---- | C] (Softland) -- C:\Windows\SysNative\dopdfmi7.dll
[2013/08/28 21:56:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\doPDF 7
[2013/08/28 21:56:18 | 000,000,000 | ---D | C] -- C:\Program Files\Softland
[1999/05/17 14:58:52 | 000,099,840 | ---- | C] (Symantec Corp.) -- C:\Program Files (x86)\Common Files\IRAABOUT.DLL
[1998/12/09 02:53:54 | 000,186,368 | ---- | C] (Symantec Corp., Peter Norton Computing Group) -- C:\Program Files (x86)\Common Files\IRAREG.DLL
[1998/12/09 02:53:54 | 000,070,144 | ---- | C] (Symantec Corp., Peter Norton Computing Group) -- C:\Program Files (x86)\Common Files\IRAMDMTR.DLL
[1998/12/09 02:53:54 | 000,048,640 | ---- | C] (Symantec Corp., Peter Norton Computing Group) -- C:\Program Files (x86)\Common Files\IRALPTTR.DLL
[1998/12/09 02:53:54 | 000,031,744 | ---- | C] (Symantec Corp., Peter Norton Computing Group) -- C:\Program Files (x86)\Common Files\IRAWEBTR.DLL
[1998/12/09 02:53:54 | 000,017,920 | ---- | C] (Symantec Corp.) -- C:\Program Files (x86)\Common Files\IRASRIAL.DLL
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2013/09/21 21:57:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/09/21 21:57:08 | 2030,981,119 | -HS- | M] () -- C:\hiberfil.sys
[2013/09/21 21:57:07 | 664,401,764 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2013/09/21 21:31:40 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/21 21:31:40 | 000,009,920 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/21 21:28:45 | 001,661,232 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/09/21 21:28:45 | 000,737,480 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2013/09/21 21:28:45 | 000,651,648 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/09/21 21:28:45 | 000,154,136 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2013/09/21 21:28:45 | 000,120,580 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/09/21 21:24:50 | 000,325,376 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/09/21 20:51:25 | 000,034,364 | ---- | M] () -- C:\Users\Sławek\Documents\cc_20130921_205117.reg
[2013/09/21 20:13:31 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/21 19:56:28 | 000,215,982 | ---- | M] () -- C:\Users\Sławek\Desktop\list_motywacyjny_KAM_Poczta_Polska.pdf
[2013/09/21 19:54:27 | 000,290,676 | ---- | M] () -- C:\Users\Sławek\Desktop\CV_Slawomir_Kubiczek_Poczta_Polska_SA.pdf
[2013/09/21 19:38:05 | 000,037,483 | ---- | M] () -- C:\Users\Sławek\Desktop\adnotacja.jpg
[2013/09/14 12:09:38 | 000,188,419 | ---- | M] () -- C:\Users\Sławek\Documents\Wykaz dokumentów do wypełnienia przy rejetsracji spółki.pdf
[2013/09/14 12:07:23 | 003,077,415 | ---- | M] () -- C:\Users\Sławek\Documents\Wniosek do ZUS.pdf
[2013/09/14 12:05:12 | 009,259,093 | ---- | M] () -- C:\Users\Sławek\Documents\Wniosek o nadanie NIP.pdf
[2013/09/14 12:03:09 | 003,627,537 | ---- | M] () -- C:\Users\Sławek\Documents\Wniosek o wpis do KRS.pdf
[2013/09/14 00:07:54 | 000,016,618 | ---- | M] () -- C:\Users\Sławek\Desktop\Pope-John-Paul-II-0308.jpg
[2013/09/14 00:05:45 | 000,652,704 | ---- | M] () -- C:\Users\Sławek\Desktop\pope-john-paul-ii-0222.jpg
[2013/09/13 22:27:51 | 001,965,767 | ---- | M] () -- C:\Users\Sławek\Documents\letter for ATO.pdf
[2013/09/13 22:26:40 | 000,200,369 | ---- | M] () -- C:\Users\Sławek\Documents\list do ATO.pdf
[2013/09/13 22:22:40 | 001,764,185 | ---- | M] () -- C:\Users\Sławek\Documents\Medicare Certificate.pdf
[2013/09/12 18:42:13 | 001,081,211 | ---- | M] () -- C:\Users\Sławek\Documents\Certificate for ATO.pdf
[2013/09/12 11:51:36 | 001,652,863 | ---- | M] () -- C:\Users\Sławek\Documents\Scan0003.pdf
[2013/09/12 11:51:19 | 001,652,863 | ---- | M] () -- C:\Users\Sławek\Documents\Scan0002.pdf
[2013/09/08 21:43:46 | 000,001,071 | ---- | M] () -- C:\Users\Sławek\Documents\document1.pdf
[2013/09/05 17:44:47 | 000,002,023 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/08/29 21:28:49 | 029,993,763 | ---- | M] () -- C:\Users\Sławek\Desktop\Galaxy N7100.pdf
[2013/08/29 13:28:04 | 000,154,493 | ---- | M] () -- C:\Users\Sławek\Documents\Resume_Slawomir_Kubiczek.pdf
[2013/08/28 21:58:09 | 000,187,018 | ---- | M] () -- C:\Users\Sławek\Documents\Cover Letter of Slawomir Kubiczek for HSBC Management Info….pdf
[2013/08/26 14:21:14 | 000,009,449 | ---- | M] () -- C:\Users\Sławek\Documents\lista zakupów.rtf
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2013/09/21 21:57:07 | 664,401,764 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2013/09/21 21:24:11 | 000,325,376 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/09/21 20:51:22 | 000,034,364 | ---- | C] () -- C:\Users\Sławek\Documents\cc_20130921_205117.reg
[2013/09/21 20:13:31 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/21 19:56:25 | 000,215,982 | ---- | C] () -- C:\Users\Sławek\Desktop\list_motywacyjny_KAM_Poczta_Polska.pdf
[2013/09/21 19:54:12 | 000,290,676 | ---- | C] () -- C:\Users\Sławek\Desktop\CV_Slawomir_Kubiczek_Poczta_Polska_SA.pdf
[2013/09/21 19:38:01 | 000,037,483 | ---- | C] () -- C:\Users\Sławek\Desktop\adnotacja.jpg
[2013/09/14 12:09:38 | 000,188,419 | ---- | C] () -- C:\Users\Sławek\Documents\Wykaz dokumentów do wypełnienia przy rejetsracji spółki.pdf
[2013/09/14 12:07:21 | 003,077,415 | ---- | C] () -- C:\Users\Sławek\Documents\Wniosek do ZUS.pdf
[2013/09/14 12:05:08 | 009,259,093 | ---- | C] () -- C:\Users\Sławek\Documents\Wniosek o nadanie NIP.pdf
[2013/09/14 12:03:06 | 003,627,537 | ---- | C] () -- C:\Users\Sławek\Documents\Wniosek o wpis do KRS.pdf
[2013/09/14 00:07:54 | 000,016,618 | ---- | C] () -- C:\Users\Sławek\Desktop\Pope-John-Paul-II-0308.jpg
[2013/09/14 00:05:45 | 000,652,704 | ---- | C] () -- C:\Users\Sławek\Desktop\pope-john-paul-ii-0222.jpg
[2013/09/13 22:27:51 | 001,965,767 | ---- | C] () -- C:\Users\Sławek\Documents\letter for ATO.pdf
[2013/09/13 22:22:38 | 001,764,185 | ---- | C] () -- C:\Users\Sławek\Documents\Medicare Certificate.pdf
[2013/09/13 21:50:03 | 000,200,369 | ---- | C] () -- C:\Users\Sławek\Documents\list do ATO.pdf
[2013/09/12 18:42:12 | 001,081,211 | ---- | C] () -- C:\Users\Sławek\Documents\Certificate for ATO.pdf
[2013/09/12 11:51:35 | 001,652,863 | ---- | C] () -- C:\Users\Sławek\Documents\Scan0003.pdf
[2013/09/12 11:51:19 | 001,652,863 | ---- | C] () -- C:\Users\Sławek\Documents\Scan0002.pdf
[2013/09/08 21:43:46 | 000,001,071 | ---- | C] () -- C:\Users\Sławek\Documents\document1.pdf
[2013/09/05 17:44:47 | 000,002,023 | ---- | C] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2013/09/05 17:44:46 | 000,002,441 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
[2013/08/29 21:28:48 | 029,993,763 | ---- | C] () -- C:\Users\Sławek\Desktop\Galaxy N7100.pdf
[2013/08/28 21:59:21 | 000,154,493 | ---- | C] () -- C:\Users\Sławek\Documents\Resume_Slawomir_Kubiczek.pdf
[2013/08/28 21:58:08 | 000,187,018 | ---- | C] () -- C:\Users\Sławek\Documents\Cover Letter of Slawomir Kubiczek for HSBC Management Info….pdf
[2013/08/28 21:56:19 | 000,007,549 | ---- | C] () -- C:\Windows\SysNative\dopdf7.ctm
[2013/08/26 14:21:14 | 000,009,449 | ---- | C] () -- C:\Users\Sławek\Documents\lista zakupów.rtf
[2013/06/09 22:48:11 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2012/10/12 01:50:42 | 000,049,738 | ---- | C] () -- C:\Program Files (x86)\AutoMapa EU.md5
[2012/09/08 17:27:10 | 000,000,391 | ---- | C] () -- C:\Windows\asfbinwin.INI
[2012/09/05 10:02:43 | 007,421,127 | ---- | C] () -- C:\Users\Sławek\Wiza.7z
[2012/09/05 07:15:14 | 001,637,498 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012/08/26 03:40:06 | 000,000,056 | -H-- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2012/07/21 17:42:26 | 000,000,064 | ---- | C] () -- C:\Windows\wininit.ini
[2012/06/28 12:59:20 | 000,000,418 | ---- | C] () -- C:\Windows\ODBC.INI
[2012/06/28 12:59:20 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini
[2012/01/18 06:44:00 | 010,920,984 | ---- | C] () -- C:\Windows\SysWow64\LogiDPP.dll
[2012/01/18 06:44:00 | 000,336,408 | ---- | C] () -- C:\Windows\SysWow64\DevManagerCore.dll
[2012/01/18 06:44:00 | 000,104,472 | ---- | C] () -- C:\Windows\SysWow64\LogiDPPApp.exe
[2011/03/09 12:01:14 | 000,131,984 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/02/27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/02/27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2013/09/08 21:07:20 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\calibre
[2013/09/13 21:55:50 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\DesktopIconGoodgame
[2012/09/05 05:29:16 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\EPSON
[2013/08/13 15:27:03 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\EurekaLog
[2013/07/26 07:02:40 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\FireShot
[2013/09/08 20:54:12 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\IsolatedStorage
[2013/06/21 06:17:03 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\KeePass
[2012/07/22 03:44:22 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\Leadertech
[2012/07/29 08:39:22 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\NapiProjekt
[2013/02/15 05:32:08 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\Opera
[2012/11/15 15:35:40 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\SoftGrid Client
[2013/08/28 21:56:20 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\Softland
[2012/09/05 07:15:56 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\TP
[2013/09/21 20:43:49 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\uTorrent
[2012/08/19 11:21:31 | 000,000,000 | ---D | M] -- C:\Users\Sławek\AppData\Roaming\VS Revo Group
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 119 bytes -> C:\ProgramData\Temp:E3C56885

< End of report >