Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-03-2014 01
Ran by x (administrator) on PECECIK on 12-03-2014 23:53:05
Running from C:\Documents and Settings\x\Pulpit\frst
Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polish
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Lexmark International, Inc.) C:\WINDOWS\system32\LEXBCES.EXE
(Lexmark International, Inc.) C:\WINDOWS\system32\LEXPPS.EXE
() C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jqs.exe
() C:\Program Files\iPlus\iPlusChecker.exe
(RealNetworks, Inc.) C:\Program Files\Real\RealPlayer\update\realsched.exe
(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Realtek Semiconductor Corp.) C:\WINDOWS\RTHDCPL.EXE
(Cyberlink Corp.) C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
(Microsoft Corporation) C:\Program Files\Messenger\msmsgs.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
() C:\Program Files\Mobile Partner\Mobile Partner.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] - C:\WINDOWS\system32\NvCpl.dll [13762560 2009-07-08] (NVIDIA Corporation)
HKLM\...\Run: [iPlusManager] - C:\Program Files\iPlus\iPlusChecker.exe [446464 2010-01-04] ()
HKLM\...\Run: [TkBellExe] - C:\Program Files\Real\RealPlayer\update\realsched.exe [273544 2011-02-12] (RealNetworks, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [249064 2010-10-29] (Sun Microsystems, Inc.)
HKLM\...\Run: [WinampAgent] - C:\Program Files\Winamp\winampa.exe [74752 2010-07-12] (Nullsoft, Inc.)
HKLM\...\Run: [RTHDCPL] - C:\WINDOWS\RTHDCPL.EXE [18789920 2009-12-08] (Realtek Semiconductor Corp.)
HKLM\...\Run: [RemoteControl] - C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [32768 2004-11-02] (Cyberlink Corp.)
HKLM\...\Run: [nwiz] - nwiz.exe /installquiet
HKLM\...\Run: [NvMediaCenter] - C:\WINDOWS\system32\NvMcTray.dll [86016 2009-07-08] (NVIDIA Corporation)
HKLM\...\Run: [NeroFilterCheck] - C:\WINDOWS\system32\NeroCheck.exe [155648 2001-07-09] (Ahead Software Gmbh)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [uTorrent] - C:\Program Files\uTorrent\uTorrent.exe [328568 2010-11-05] (BitTorrent, Inc.)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [MSMSGS] - C:\Program Files\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [IPLA!] - C:\Program Files\ipla\ipla.exe [21205088 2013-09-12] (Redefine Sp z o.o.)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [Gadu-Gadu 10] - C:\Program Files\Gadu-Gadu 10\gg.exe [12653152 2010-09-08] (GG Network S.A.)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [Facebook Update] - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Facebook\Update\FacebookUpdate.exe [138096 2013-04-05] (Facebook Inc.)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\Run: [MSConfig] - C:\Documents and Settings\x\rvmqszdn.exe [46972928 2014-03-12] (The UPX Team http://upx.sf.net)
HKU\S-1-5-21-839522115-484763869-1417001333-1003\...\MountPoints2: {746aeaf3-8d6a-11e2-98b2-6cf049d09004} - G:\AutoRun.exe
Lsa: [Authentication Packages] msv1_0 nwprovau

==================== Internet (Whitelisted) ====================

SearchScopes: HKLM - DefaultScope value is missing.
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Tcpip\Parameters: [DhcpNameServer] 212.2.96.51 212.2.96.52

Chrome: 
=======
CHR Plugin: (Widevine Content Decryption Module) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\33.0.1750.146\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\33.0.1750.146\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\33.0.1750.146\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U24) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft® DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
CHR Extension: (Dokumenty Google) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-02]
CHR Extension: (Dysk Google) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-02]
CHR Extension: (YouTube) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-02]
CHR Extension: (Szukaj w Google) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-02]
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk [2013-06-02]
CHR Extension: (Google Wallet) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-25]
CHR Extension: (Gmail) - C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-02]
CHR HKLM\...\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\Documents and Settings\All Users\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx [2011-02-12]

========================== Services (Whitelisted) =================

R2 HWDeviceService.exe; C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe [271712 2011-03-14] ()
R2 JavaQuickStarterService; C:\Program Files\Java\jre6\bin\jqs.exe [153376 2011-02-02] (Sun Microsystems, Inc.)
R2 LexBceS; C:\WINDOWS\system32\LEXBCES.EXE [303104 2003-02-25] (Lexmark International, Inc.)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 Mobile Partner. RunOuc; C:\Program Files\Mobile Partner\UpdateDog\ouc.exe [655744 2012-09-22] ()
R2 NWCWorkstation; C:\WINDOWS\System32\nwwks.dll [65536 2009-09-10] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 Ambfilt; C:\WINDOWS\System32\drivers\Ambfilt.sys [1691480 2009-11-18] (Creative)
R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [43520 2006-07-01] (Advanced Micro Devices)
S3 AndNetDiag; C:\WINDOWS\System32\DRIVERS\lgandnetdiag.sys [23168 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\WINDOWS\System32\DRIVERS\lgandnetmodem.sys [27776 2013-06-28] (LG Electronics Inc.)
S3 FsUsbExDisk; C:\WINDOWS\system32\FsUsbExDisk.SYS [36608 2009-04-07] ()
R3 huawei_cdcacm; C:\WINDOWS\System32\DRIVERS\ew_jucdcacm.sys [96000 2012-08-20] (Huawei Technologies Co., Ltd.)
R3 huawei_cdcecm; C:\WINDOWS\System32\DRIVERS\ew_jucdcecm.sys [69760 2012-08-20] (Huawei Technologies Co., Ltd.)
R3 huawei_ext_ctrl; C:\WINDOWS\System32\DRIVERS\ew_juextctrl.sys [27520 2012-08-20] (Huawei Technologies Co., Ltd.)
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
S3 Monfilt; C:\WINDOWS\System32\drivers\Monfilt.sys [1395800 2009-11-18] (Creative Technology Ltd.)
R0 nvatabus; C:\WINDOWS\system32\Drivers\nvatabus.sys [100736 2009-09-10] (NVIDIA Corporation)
R3 NVENETFD; C:\WINDOWS\System32\DRIVERS\NVENETFD.sys [66688 2009-07-01] (NVIDIA Corporation)
R0 nvgts; C:\WINDOWS\System32\DRIVERS\nvgts.sys [164896 2009-06-30] (NVIDIA Corporation)
R3 nvnetbus; C:\WINDOWS\System32\DRIVERS\nvnetbus.sys [13824 2009-07-01] (NVIDIA Corporation)
R2 NwlnkIpx; C:\WINDOWS\System32\DRIVERS\nwlnkipx.sys [88320 2009-09-10] (Microsoft Corporation)
R2 NwlnkNb; C:\WINDOWS\System32\DRIVERS\nwlnknb.sys [63232 2009-09-10] (Microsoft Corporation)
R2 NwlnkSpx; C:\WINDOWS\System32\DRIVERS\nwlnkspx.sys [55936 2009-09-10] (Microsoft Corporation)
R3 NWRDR; C:\WINDOWS\System32\DRIVERS\nwrdr.sys [163584 2009-09-10] (Microsoft Corporation)
R1 prodrv06; C:\WINDOWS\System32\drivers\prodrv06.sys [54272 2004-04-08] (Protection Technology)
R0 prohlp02; C:\WINDOWS\System32\drivers\prohlp02.sys [70400 2004-04-08] (Protection Technology)
R0 prosync1; C:\WINDOWS\System32\drivers\prosync1.sys [6944 2003-09-06] (Protection Technology)
R0 sfhlp01; C:\WINDOWS\System32\drivers\sfhlp01.sys [4832 2003-12-01] (Protection Technology)
R0 Si3112; C:\WINDOWS\system32\Drivers\Si3112.sys [62336 2009-09-10] (Silicon Image, Inc.)
S0 Si3114r5; C:\WINDOWS\system32\Drivers\Si3114r5.sys [195072 2009-09-10] (Silicon Image, Inc)
R0 Si3124; C:\WINDOWS\system32\Drivers\Si3124.sys [69248 2009-09-10] (Silicon Image, Inc.)
R0 Si3132; C:\WINDOWS\system32\Drivers\Si3132.sys [74672 2009-09-10] (Silicon Image, Inc.)
R0 Si3132r5; C:\WINDOWS\system32\Drivers\Si3132r5.sys [215856 2009-09-10] (Silicon Image, Inc)
R0 Si3531; C:\WINDOWS\system32\Drivers\Si3531.sys [212520 2009-09-10] (Silicon Image, Inc)
R1 StarOpen; C:\WINDOWS\system32\Drivers\StarOpen.sys [5632 2006-07-24] ()
S4 IntelIde; No ImagePath
U1 WS2IFSL; 

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-12 23:43 - 2014-03-12 23:47 - 00000000 ____D () C:\AdwCleaner
2014-03-12 23:17 - 2014-03-12 23:17 - 25608192 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\jneikrvf.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 18817024 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\qulprycm.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 11026432 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\hlcgiptd.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 08159232 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\mqhlnuyi.exe
2014-03-12 23:16 - 2014-03-12 23:17 - 32276480 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\xbswyfjt.exe
2014-03-12 23:15 - 2014-03-12 23:17 - 46972928 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\rvmqszdn.exe
2014-03-12 23:08 - 2014-03-12 23:53 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\frst
2014-03-10 23:08 - 2014-03-10 23:08 - 00111902 _____ () C:\Documents and Settings\x\Pulpit\OTL.Txt
2014-03-10 23:08 - 2014-03-10 23:08 - 00028300 _____ () C:\Documents and Settings\x\Pulpit\Extras.Txt
2014-03-10 23:01 - 2014-03-10 23:01 - 02359350 _____ () C:\Documents and Settings\x\Pulpit\blad.bmp
2014-03-10 22:50 - 2014-03-10 22:49 - 00090112 _____ () C:\WINDOWS\Minidump\Mini031014-01.dmp
2014-03-10 22:48 - 2014-03-10 22:48 - 00046162 _____ () C:\Documents and Settings\x\Pulpit\Shortcut.txt
2014-03-10 22:45 - 2014-03-10 22:48 - 00030664 _____ () C:\Documents and Settings\x\Pulpit\Addition.txt
2014-03-10 22:43 - 2014-03-10 22:48 - 00039769 _____ () C:\Documents and Settings\x\Pulpit\FRST.txt
2014-03-10 22:41 - 2014-03-12 23:19 - 00000000 ____D () C:\FRST
2014-03-10 22:39 - 2014-03-10 22:39 - 00051339 _____ () C:\Documents and Settings\x\Pulpit\gmer.txt
2014-03-03 20:50 - 2014-03-03 20:50 - 00000676 _____ () C:\Documents and Settings\All Users\Menu Start\Programy\e-Deklaracje.lnk
2014-03-03 20:50 - 2014-03-03 20:50 - 00000670 _____ () C:\Documents and Settings\All Users\Pulpit\e-Deklaracje.lnk
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Program Files\e-Deklaracje
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\e-Deklaracje
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\Default User\Dane aplikacji\Macromedia
2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-03-02 20:43 - 2014-03-02 20:43 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\mp3
2014-02-28 19:43 - 2014-03-02 20:37 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\Nowy folder
2014-02-23 22:31 - 2014-02-23 22:59 - 00065536 _____ () C:\WINDOWS\system32\config\TuneUp.evt
2014-02-23 22:31 - 2014-02-23 22:31 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\TuneUp Software
2014-02-23 22:30 - 2014-02-23 22:31 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2014-02-23 22:29 - 2014-02-23 22:42 - 00000000 __SHD () C:\Documents and Settings\All Users\Dane aplikacji\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2014-02-23 21:25 - 2014-02-23 21:25 - 00000000 ____D () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2014-02-23 20:51 - 2014-02-23 20:51 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\Malwarebytes
2014-02-23 20:50 - 2014-02-23 20:50 - 00000784 _____ () C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes' Anti-Malware
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
2014-02-23 20:50 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-02-23 20:29 - 2014-03-12 23:49 - 00000270 _____ () C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-839522115-484763869-1417001333-1003.job
2014-02-23 20:10 - 2014-02-23 20:10 - 00000000 ____D () C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\ESET
2014-02-23 19:55 - 2014-02-23 19:55 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\BinarySense
2014-02-23 19:55 - 2014-02-23 19:55 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Licenses
2014-02-23 18:36 - 2014-02-23 18:36 - 00000000 ____D () C:\Documents and Settings\Default User\Ustawienia lokalne\Dane aplikacji\Google

==================== One Month Modified Files and Folders =======

2014-03-12 23:53 - 2014-03-12 23:08 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\frst
2014-03-12 23:51 - 2013-06-06 10:35 - 06363089 _____ () C:\Documents and Settings\x\debug.log
2014-03-12 23:51 - 2010-09-10 23:07 - 00000000 ___HD () C:\Documents and Settings\x\Ustawienia lokalne
2014-03-12 23:50 - 2013-04-04 15:31 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-03-12 23:50 - 2010-11-05 12:04 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\uTorrent
2014-03-12 23:50 - 2010-09-13 11:08 - 00001022 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-12 23:50 - 2010-09-10 22:59 - 00388109 _____ () C:\WINDOWS\WindowsUpdate.log
2014-03-12 23:50 - 2010-09-10 18:39 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\ipla
2014-03-12 23:49 - 2014-02-23 20:29 - 00000270 _____ () C:\WINDOWS\Tasks\RealUpgradeLogonTaskS-1-5-21-839522115-484763869-1417001333-1003.job
2014-03-12 23:49 - 2013-04-04 15:31 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-03-12 23:49 - 2010-09-11 00:53 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji
2014-03-12 23:49 - 2010-09-10 23:05 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-03-12 23:49 - 2009-07-08 09:58 - 00237301 _____ () C:\WINDOWS\system32\NvApps.xml
2014-03-12 23:48 - 2010-09-10 23:07 - 00000188 ___SH () C:\Documents and Settings\x\ntuser.ini
2014-03-12 23:48 - 2010-09-10 23:05 - 00032536 _____ () C:\WINDOWS\SchedLgU.Txt
2014-03-12 23:47 - 2014-03-12 23:43 - 00000000 ____D () C:\AdwCleaner
2014-03-12 23:47 - 2010-09-10 23:07 - 00000000 __RHD () C:\Documents and Settings\x\Dane aplikacji
2014-03-12 23:47 - 2010-09-10 23:07 - 00000000 ___RD () C:\Documents and Settings\x\Moje dokumenty
2014-03-12 23:47 - 2010-09-10 23:07 - 00000000 ___HD () C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji
2014-03-12 23:35 - 2010-09-13 11:08 - 00001026 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-12 23:30 - 2010-09-10 23:07 - 00000000 ___RD () C:\Documents and Settings\x\Menu Start\Programy
2014-03-12 23:25 - 2010-09-10 23:07 - 00000000 ____D () C:\Documents and Settings\x\Pulpit
2014-03-12 23:19 - 2014-03-10 22:41 - 00000000 ____D () C:\FRST
2014-03-12 23:17 - 2014-03-12 23:17 - 25608192 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\jneikrvf.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 18817024 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\qulprycm.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 11026432 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\hlcgiptd.exe
2014-03-12 23:17 - 2014-03-12 23:17 - 08159232 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\mqhlnuyi.exe
2014-03-12 23:17 - 2014-03-12 23:16 - 32276480 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\xbswyfjt.exe
2014-03-12 23:17 - 2014-03-12 23:15 - 46972928 ____H (The UPX Team http://upx.sf.net) C:\Documents and Settings\x\rvmqszdn.exe
2014-03-12 23:17 - 2010-09-10 23:07 - 00000000 ____D () C:\Documents and Settings\x
2014-03-12 23:08 - 2011-02-12 14:57 - 00000278 _____ () C:\WINDOWS\Tasks\RealUpgradeScheduledTaskS-1-5-21-839522115-484763869-1417001333-1003.job
2014-03-12 23:03 - 2014-01-06 15:50 - 00005755 _____ () C:\Documents and Settings\x\daemonprocess.txt
2014-03-12 23:01 - 2009-09-10 14:45 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-03-10 23:08 - 2014-03-10 23:08 - 00111902 _____ () C:\Documents and Settings\x\Pulpit\OTL.Txt
2014-03-10 23:08 - 2014-03-10 23:08 - 00028300 _____ () C:\Documents and Settings\x\Pulpit\Extras.Txt
2014-03-10 23:01 - 2014-03-10 23:01 - 02359350 _____ () C:\Documents and Settings\x\Pulpit\blad.bmp
2014-03-10 22:50 - 2010-11-02 11:07 - 00000000 ____D () C:\WINDOWS\Minidump
2014-03-10 22:49 - 2014-03-10 22:50 - 00090112 _____ () C:\WINDOWS\Minidump\Mini031014-01.dmp
2014-03-10 22:48 - 2014-03-10 22:48 - 00046162 _____ () C:\Documents and Settings\x\Pulpit\Shortcut.txt
2014-03-10 22:48 - 2014-03-10 22:45 - 00030664 _____ () C:\Documents and Settings\x\Pulpit\Addition.txt
2014-03-10 22:48 - 2014-03-10 22:43 - 00039769 _____ () C:\Documents and Settings\x\Pulpit\FRST.txt
2014-03-10 22:39 - 2014-03-10 22:39 - 00051339 _____ () C:\Documents and Settings\x\Pulpit\gmer.txt
2014-03-10 21:25 - 2013-04-05 11:20 - 00000986 _____ () C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-484763869-1417001333-1003UA.job
2014-03-08 02:59 - 2010-12-18 21:25 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\AIMP
2014-03-07 23:35 - 2013-11-14 16:20 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\muzyka
2014-03-07 12:25 - 2013-04-05 11:20 - 00000964 _____ () C:\WINDOWS\Tasks\FacebookUpdateTaskUserS-1-5-21-839522115-484763869-1417001333-1003Core.job
2014-03-05 19:38 - 2010-09-22 14:49 - 00000116 ____C () C:\WINDOWS\NeroDigital.ini
2014-03-03 20:50 - 2014-03-03 20:50 - 00000676 _____ () C:\Documents and Settings\All Users\Menu Start\Programy\e-Deklaracje.lnk
2014-03-03 20:50 - 2014-03-03 20:50 - 00000670 _____ () C:\Documents and Settings\All Users\Pulpit\e-Deklaracje.lnk
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Program Files\e-Deklaracje
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\e-Deklaracje
2014-03-03 20:50 - 2014-03-03 20:50 - 00000000 ____D () C:\Documents and Settings\Default User\Dane aplikacji\Macromedia
2014-03-03 20:50 - 2012-02-21 08:38 - 00000000 ____D () C:\Program Files\Adobe
2014-03-03 20:50 - 2010-09-11 00:53 - 00000000 __RHD () C:\Documents and Settings\Default User\Dane aplikacji
2014-03-03 20:50 - 2010-09-11 00:53 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2014-03-03 20:50 - 2010-09-11 00:53 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2014-03-03 20:50 - 2010-09-10 17:20 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Adobe
2014-03-03 20:49 - 2014-03-03 20:49 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-03-03 20:43 - 2010-09-10 17:21 - 00000000 ____D () C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Adobe
2014-03-03 20:43 - 2010-09-10 17:21 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\Adobe
2014-03-02 20:43 - 2014-03-02 20:43 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\mp3
2014-03-02 20:37 - 2014-02-28 19:43 - 00000000 ____D () C:\Documents and Settings\x\Pulpit\Nowy folder
2014-02-23 22:59 - 2014-02-23 22:31 - 00065536 _____ () C:\WINDOWS\system32\config\TuneUp.evt
2014-02-23 22:42 - 2014-02-23 22:29 - 00000000 __SHD () C:\Documents and Settings\All Users\Dane aplikacji\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2014-02-23 22:42 - 2012-01-19 15:04 - 00000000 ____D () C:\Documents and Settings\x\Menu Start\Programy\DoubleGames
2014-02-23 22:42 - 2012-01-04 22:36 - 00000000 ____D () C:\Documents and Settings\x\Menu Start\Programy\FoxTab PDF Creator
2014-02-23 22:42 - 2011-02-18 18:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\NapiProjekt
2014-02-23 22:42 - 2010-12-08 20:40 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Liceum klasa 2
2014-02-23 22:42 - 2010-09-11 13:02 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Winamp
2014-02-23 22:42 - 2010-09-11 12:08 - 00000000 ____D () C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Downloaded Installations
2014-02-23 22:42 - 2010-09-10 23:07 - 00000000 ___RD () C:\Documents and Settings\x\Menu Start\Programy\Autostart
2014-02-23 22:42 - 2010-09-10 23:07 - 00000000 ___RD () C:\Documents and Settings\x\Menu Start
2014-02-23 22:42 - 2010-09-10 17:23 - 00000000 ____D () C:\Documents and Settings\x\Menu Start\Programy\XP Codec Pack 2.4.3
2014-02-23 22:31 - 2014-02-23 22:31 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\TuneUp Software
2014-02-23 22:31 - 2014-02-23 22:30 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software
2014-02-23 22:31 - 2013-06-05 16:17 - 00000000 ____D () C:\a
2014-02-23 21:25 - 2014-02-23 21:25 - 00000000 ____D () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET
2014-02-23 21:25 - 2010-09-10 23:05 - 00000000 ___HD () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji
2014-02-23 20:51 - 2014-02-23 20:51 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\Malwarebytes
2014-02-23 20:50 - 2014-02-23 20:50 - 00000784 _____ () C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes' Anti-Malware
2014-02-23 20:50 - 2014-02-23 20:50 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
2014-02-23 20:10 - 2014-02-23 20:10 - 00000000 ____D () C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\ESET
2014-02-23 19:55 - 2014-02-23 19:55 - 00000000 ____D () C:\Documents and Settings\x\Dane aplikacji\BinarySense
2014-02-23 19:55 - 2014-02-23 19:55 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Licenses
2014-02-23 18:40 - 2014-01-06 14:59 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Google Drive
2014-02-23 18:36 - 2014-02-23 18:36 - 00000000 ____D () C:\Documents and Settings\Default User\Ustawienia lokalne\Dane aplikacji\Google
2014-02-23 18:36 - 2010-09-11 00:53 - 00000000 ___HD () C:\Documents and Settings\Default User\Ustawienia lokalne\Dane aplikacji

Files to move or delete:
====================
C:\Documents and Settings\x\hlcgiptd.exe
C:\Documents and Settings\x\jneikrvf.exe
C:\Documents and Settings\x\mqhlnuyi.exe
C:\Documents and Settings\x\qulprycm.exe
C:\Documents and Settings\x\rvmqszdn.exe
C:\Documents and Settings\x\xbswyfjt.exe


Some content of TEMP:
====================
C:\Documents and Settings\x\Ustawienia lokalne\Temp\ahgys.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\ctgmu.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\gg10.upgr.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\InstHelper.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\jtotmhta.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\lbdbtbmx.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\mkoli.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\omrtqd.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\pzymgp.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\Quarantine.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\sffztl.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\vsxsjok.exe
C:\Documents and Settings\x\Ustawienia lokalne\Temp\xqxew.exe


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe
[2009-09-10 14:45] - [2009-09-10 14:45] - 1035264 ____A (Microsoft Corporation) c791ed9eac5e76d9525e157b1d7a599a 

C:\WINDOWS\system32\winlogon.exe
[2009-09-10 14:45] - [2009-09-10 14:45] - 0510464 ____A (Microsoft Corporation) 51fd2e13d723857b9ca239ae77150f48 

C:\WINDOWS\system32\svchost.exe
[2009-09-10 14:45] - [2009-09-10 14:45] - 0014336 ____A (Microsoft Corporation) 8607d35d92528e2df386f19a960d23ce 

C:\WINDOWS\system32\services.exe
[2009-09-10 14:45] - [2009-09-10 14:45] - 0111104 ____A (Microsoft Corporation) 8816e60bf654353e8e0d35ed98875445 

C:\WINDOWS\system32\User32.dll
[2009-09-10 14:45] - [2009-09-10 14:45] - 0580096 ____A (Microsoft Corporation) a435c5c069afd901751ac323ad238793 

C:\WINDOWS\system32\userinit.exe
[2009-09-10 14:45] - [2009-09-10 14:45] - 0026624 ____A (Microsoft Corporation) 2a5b37d520508be6570a3ea79695f5b5 

C:\WINDOWS\system32\rpcss.dll
[2009-09-10 14:45] - [2009-09-10 14:45] - 0401408 ____A (Microsoft Corporation) c9e5ac78d9a00b1de8ce2ad1bdde7e42 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2009-09-10 14:45] - [2009-09-10 14:45] - 0052864 ____A (Microsoft Corporation) 56b191ac5fc0df219949c95a6c87afe7 


==================== End Of Log ============================