Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 22-04-2014
Ran by Administrator (administrator) on D630-D3A527AA04 on 22-04-2014 16:21:56
Running from C:\Documents and Settings\Administrator\Pulpit\OTL
Microsoft Windows XP Dodatek Service Pack 3 (X86) OS Language: Polish
Internet Explorer Version 8
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(IObit) C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe
(Microsoft Corporation) C:\WINDOWS\System32\SCardSvr.exe
(HP) C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe


==================== Registry (Whitelisted) ==================

HKU\.DEFAULT\...\Run: [DWQueuedReporting] => C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE [519584 2010-12-21] (Microsoft Corporation)
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\RunOnce: [FlashPlayerUpdate] - C:\WINDOWS\system32\Macromed\Flash\FlashUtil32_12_0_0_77_Plugin.exe [841096 2014-03-12] (Adobe Systems Incorporated)
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {3b45a4fe-522e-11e1-83d0-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {4eb02c40-522d-11e1-83ce-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {6f487b34-4d95-11e1-83c7-001e37fceac4} - F:\Startme.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {bcb54df8-4286-11e1-83b1-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {bcb54dfb-4286-11e1-83b1-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {c7e698f8-a535-11e3-8835-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {c7e698f9-a535-11e3-8835-001e37fceac4} - F:\AutoRun.exe
HKU\S-1-5-21-1292428093-1123561945-725345543-500\...\MountPoints2: {e1138ab2-5a1d-11e1-83e4-001e37fceac4} - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL index.html

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pl/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm
SearchScopes: HKLM - DefaultScope {a5b9c0f5-5616-47cd-a95f-e43b488faccf} URL = 
SearchScopes: HKCU - {221F6852-E080-49F1-B197-742D9433BAD4} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000027&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_uid=9BA0E5AD-23D3-4972-8369-A5289D880B1F&apn_sauid=2E7E7D22-87BB-425A-95DD-ADF9CB911CA5
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL = 
SearchScopes: HKCU - {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://pl.search.yahoo.com/search?p={searchTerms}&fr=chr-comodo
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit)
BHO: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Advanced SystemCare Browser Protection - {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - C:\Program Files\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM - No Name - {d43723ae-1ae1-4a25-a6a4-bf0929273cab} -  No File
Toolbar: HKLM - ExplorerWnd Helper - {10921475-03CE-4E04-90CE-E2E7EF20C814} - C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer32.dll (IObit)
Toolbar: HKCU - &Adres - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU - &Łącza - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKCU - No Name - {D43723AE-1AE1-4A25-A6A4-BF0929273CAB} -  No File
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
Tcpip\Parameters: [DhcpNameServer] 10.0.0.2 192.160.1.1

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default
FF user.js: detected! => C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\user.js
FF SelectedSearchEngine: Google
FF Keyword.URL: hxxp://pl.search.yahoo.com/search?fr=ytff-comodo&p=
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\WINDOWS\system32\Adobe\Director\np32dsw_1168638.dll (Adobe Systems, Inc.)
FF Plugin: @canon.com/EPPEX - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFFICE.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npVividasPlayer.dll ( )
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\browser\plugins\npVividasPlayer.dll ( )
FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\searchplugins\ashampoo-po-customized-web-search.xml
FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\searchplugins\BitGuard.xml
FF SearchPlugin: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\searchplugins\BrowserDefender.xml
FF Extension: TelevisionFanatic - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\64ffxtbr@TelevisionFanatic.com [2014-04-22]
FF Extension: YoutubeAdblocker - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\7hl47cweqeq@syeoi-gkbr.edu [2014-02-10]
FF Extension: Advanced SystemCare Surfing Protection - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\ascsurfingprotection@iobit.com [2014-04-18]
FF Extension: Vividas player plugin - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\player@vividas.com [2012-02-02]
FF Extension: PrivDog - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\PrivDog@AdTrustMedia.com [2014-04-22]
FF Extension: Websaave - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\wqwb.5cphp@ggcuoe-aeei.net [2014-02-10]
FF Extension: Ashampoo PO  - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\{d43723ae-1ae1-4a25-a6a4-bf0929273cab} [2014-04-02]
FF Extension: Microsoft .NET Framework Assistant - C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\yq4fckfq.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-10-06]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

Chrome: 
=======
CHR HomePage: hxxp://pl.yahoo.com?fr=fpc-comodo
CHR StartupUrls: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=74DB001F3BBCBAD7&affID=119357&tsp=4948", "hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=74DB001F3BBCBAD7&affID=125032&tsp=5026"
CHR DefaultSearchKeyword: delta-search.com
CHR DefaultSearchProvider: Delta Search
CHR DefaultSearchURL: http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=74DB001F3BBCBAD7&affID=119357&tsp=4948
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL No File
CHR Plugin: (Chrome NaCl) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.116\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation)
CHR Plugin: (Microsoft DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Search-Gol Toolbar) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\aipfmkinhleccnodemkoofnnofpbbpac [2013-10-05]
CHR Extension: (YTBookMArk) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\bnglhmahoakmdlkdoodmpjhegiefmpgf [2014-02-10]
CHR Extension: (YoutubeAdblocker) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\jbpakkpeaijpccblckfbkknmklnkldia [2014-02-10]
CHR Extension: (Websaave) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\ldggcolhekepgoejloppmaaaenafhlag [2014-02-10]

========================== Services (Whitelisted) =================

R2 AdvancedSystemCareService7; C:\Program Files\IObit\Advanced SystemCare 7\ASCService.exe [881952 2014-01-14] (IObit)
R2 HP LaserJet Service; C:\Program Files\HP\HPLaserJetService\HPLaserJetService.exe [145920 2010-10-25] (HP)
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-04-16] (Oracle Corporation)
S4 KMService; C:\WINDOWS\system32\srvany.exe [8192 2012-01-12] ()
S4 LiveUpdateSvc; C:\Program Files\IObit\LiveUpdate\LiveUpdate.exe [2151200 2013-12-03] (IObit)
S4 STacSV; C:\WINDOWS\system32\StacSV.exe [94208 2007-05-10] (SigmaTel, Inc.)
S2 winmgmt; C:\WINDOWS\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 guardian2; C:\WINDOWS\System32\Drivers\oz776.sys [68696 2007-12-23] (O2Micro)
R3 HSFHWAZL; C:\WINDOWS\System32\DRIVERS\HSFHWAZL.sys [211200 2007-08-02] (Conexant Systems, Inc.)
R3 HSF_DPV; C:\WINDOWS\System32\DRIVERS\HSF_DPV.sys [989952 2007-08-02] (Conexant Systems, Inc.)
R3 NETw5x32; C:\WINDOWS\System32\DRIVERS\NETw5x32.sys [4203392 2009-05-28] (Intel Corporation)
S3 s1039mdm; C:\WINDOWS\System32\DRIVERS\s1039mdm.sys [124016 2009-11-19] (MCCI Corporation)
R3 STHDA; C:\WINDOWS\System32\drivers\sthda.sys [1222840 2007-05-10] (SigmaTel, Inc.)
S1 aqfyvszx; \??\C:\WINDOWS\system32\drivers\aqfyvszx.sys [X]
S1 atpofphs; \??\C:\WINDOWS\system32\drivers\atpofphs.sys [X]
S1 elwanrlf; \??\C:\WINDOWS\system32\drivers\elwanrlf.sys [X]
S4 IntelIde; No ImagePath
S1 jzfimovn; \??\C:\WINDOWS\system32\drivers\jzfimovn.sys [X]
S1 kalrgrad; \??\C:\WINDOWS\system32\drivers\kalrgrad.sys [X]
S1 kdaskjfk; \??\C:\WINDOWS\system32\drivers\kdaskjfk.sys [X]
S1 kdicitfx; \??\C:\WINDOWS\system32\drivers\kdicitfx.sys [X]
S1 minmloiz; \??\C:\WINDOWS\system32\drivers\minmloiz.sys [X]
S1 mvrujavj; \??\C:\WINDOWS\system32\drivers\mvrujavj.sys [X]
S1 nbssngoj; \??\C:\WINDOWS\system32\drivers\nbssngoj.sys [X]
S1 nkwjghrc; \??\C:\WINDOWS\system32\drivers\nkwjghrc.sys [X]
S1 nmsgbirz; \??\C:\WINDOWS\system32\drivers\nmsgbirz.sys [X]
S1 orsiynoz; \??\C:\WINDOWS\system32\drivers\orsiynoz.sys [X]
S1 rvdiabjt; \??\C:\WINDOWS\system32\drivers\rvdiabjt.sys [X]
U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)
S1 vfrgxfvc; \??\C:\WINDOWS\system32\drivers\vfrgxfvc.sys [X]
U1 WS2IFSL; 
S1 wweoiusj; \??\C:\WINDOWS\system32\drivers\wweoiusj.sys [X]
S1 xcmplsfp; \??\C:\WINDOWS\system32\drivers\xcmplsfp.sys [X]
S1 xwhzvdxt; \??\C:\WINDOWS\system32\drivers\xwhzvdxt.sys [X]
U3 kwndraow; \??\C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\kwndraow.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-22 16:19 - 2014-04-22 16:21 - 00000000 ____D () C:\FRST
2014-04-22 13:04 - 2014-04-22 16:21 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\OTL
2014-04-18 11:14 - 2014-04-18 11:14 - 00002075 _____ () C:\WINDOWS\setupapi.log
2014-04-18 11:12 - 2014-04-18 11:12 - 00020774 _____ () C:\WINDOWS\DPINST.LOG
2014-04-18 11:00 - 2014-04-22 12:01 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-04-18 11:00 - 2014-04-22 12:01 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-04-18 11:00 - 2014-04-18 11:00 - 00000000 _____ () C:\WINDOWS\Sti_Trace.log
2014-04-18 10:59 - 2014-04-18 11:36 - 00011466 _____ () C:\WINDOWS\SchedLgU.Txt
2014-04-18 10:50 - 2014-04-22 13:07 - 00108341 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-18 10:50 - 2014-04-18 10:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Advanced SystemCare 7
2014-04-18 10:42 - 2014-04-18 10:42 - 01700352 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdiplus.dll
2014-04-17 13:43 - 2014-04-17 13:43 - 00000000 ____D () C:\WINDOWS\Tasks\ImCleanDisabled
2014-04-17 10:46 - 2014-04-17 10:46 - 34516992 _____ () C:\WINDOWS\system32\config\software.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00286720 _____ () C:\WINDOWS\system32\config\default.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00057344 _____ () C:\WINDOWS\system32\config\SECURITY.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.iodefrag.bak
2014-04-17 10:34 - 2014-02-17 13:41 - 00023872 _____ (IObit) C:\WINDOWS\system32\RegistryDefragBootTime.exe
2014-04-17 10:33 - 2014-04-22 12:15 - 34516992 _____ () C:\WINDOWS\system32\config\software.iobit
2014-04-17 10:33 - 2014-04-22 12:15 - 00286720 _____ () C:\WINDOWS\system32\config\default.iobit
2014-04-17 10:33 - 2014-04-22 12:15 - 00057344 _____ () C:\WINDOWS\system32\config\SECURITY.iobit
2014-04-17 10:33 - 2014-04-22 12:15 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.iobit
2014-04-16 17:02 - 2014-04-16 17:02 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Sun
2014-04-16 16:55 - 2014-04-16 16:55 - 00000000 ____D () C:\Documents and Settings\LocalService\Dane aplikacji\IObit
2014-04-16 16:30 - 2014-04-18 11:14 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-04-16 16:27 - 2014-04-16 16:27 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Adtrustmedia
2014-04-16 16:25 - 2014-04-18 11:19 - 00000000 ____D () C:\Program Files\Comodo
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 ____D () C:\WINDOWS\Tasks\TaskDisabled
2014-04-16 16:12 - 2014-04-18 11:19 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Comodo
2014-04-16 16:09 - 2014-04-16 16:09 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00145408 _____ (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl
2014-04-16 16:09 - 2014-04-16 16:09 - 00094632 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Program Files\Java
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Java
2014-04-16 15:56 - 2014-04-16 16:10 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\ProductData
2014-04-16 15:55 - 2014-04-17 10:28 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-04-16 15:54 - 2014-04-18 10:49 - 00000000 ____D () C:\Program Files\IObit
2014-04-16 15:54 - 2014-04-17 10:19 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\IObit
2014-04-16 15:52 - 2014-04-18 10:50 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\IObit
2014-04-16 15:52 - 2014-04-18 10:49 - 00000446 _____ () C:\ASCInit.log
2014-04-16 15:06 - 2014-04-16 15:06 - 00000000 __SHD () C:\WINDOWS\CSC
2014-04-16 12:52 - 2014-04-16 12:54 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\edek
2014-04-15 16:46 - 2014-04-15 16:46 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\taja
2014-04-15 16:45 - 2014-04-15 16:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\patyczek
2014-04-02 08:14 - 2014-04-16 15:20 - 00000406 ____H () C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
2014-03-31 11:16 - 2014-03-31 11:18 - 00000435 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\topinambur.txt
2014-03-29 13:47 - 2014-03-29 13:52 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\corsa 2004-5 1,2
2014-03-29 11:59 - 2014-04-16 16:16 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-03-27 13:37 - 2014-03-27 14:51 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\druki krs

==================== One Month Modified Files and Folders =======

2014-04-22 16:21 - 2014-04-22 16:19 - 00000000 ____D () C:\FRST
2014-04-22 16:21 - 2014-04-22 13:04 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\OTL
2014-04-22 16:20 - 2012-01-12 23:07 - 00001050 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-22 16:20 - 2012-01-12 23:07 - 00001046 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-22 16:19 - 2011-12-10 12:10 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie
2014-04-22 15:41 - 2012-04-30 23:44 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-04-22 14:30 - 2012-11-16 14:58 - 00000386 _____ () C:\WINDOWS\Tasks\At8.job
2014-04-22 14:30 - 2012-11-02 10:41 - 00000386 _____ () C:\WINDOWS\Tasks\At4.job
2014-04-22 13:58 - 2012-11-16 14:58 - 00000386 _____ () C:\WINDOWS\Tasks\At7.job
2014-04-22 13:07 - 2014-04-18 10:50 - 00108341 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-22 13:04 - 2011-12-09 18:42 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit
2014-04-22 12:15 - 2014-04-17 10:33 - 34516992 _____ () C:\WINDOWS\system32\config\software.iobit
2014-04-22 12:15 - 2014-04-17 10:33 - 00286720 _____ () C:\WINDOWS\system32\config\default.iobit
2014-04-22 12:15 - 2014-04-17 10:33 - 00057344 _____ () C:\WINDOWS\system32\config\SECURITY.iobit
2014-04-22 12:15 - 2014-04-17 10:33 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.iobit
2014-04-22 12:15 - 2011-12-09 18:42 - 00000000 __SHD () C:\Documents and Settings\LocalService
2014-04-22 12:15 - 2011-12-09 18:42 - 00000000 ____D () C:\Documents and Settings\Administrator
2014-04-22 12:15 - 2011-12-09 18:40 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2014-04-22 12:07 - 2011-12-09 19:25 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2014-04-22 12:02 - 2004-08-04 12:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2014-04-22 12:01 - 2014-04-18 11:00 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2014-04-22 12:01 - 2014-04-18 11:00 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2014-04-22 12:01 - 2014-03-12 14:00 - 00000238 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job
2014-04-22 12:01 - 2011-12-09 19:24 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji
2014-04-22 12:01 - 2011-12-09 18:42 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-18 11:36 - 2014-04-18 10:59 - 00011466 _____ () C:\WINDOWS\SchedLgU.Txt
2014-04-18 11:36 - 2011-12-09 18:42 - 00000188 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2014-04-18 11:19 - 2014-04-16 16:25 - 00000000 ____D () C:\Program Files\Comodo
2014-04-18 11:19 - 2014-04-16 16:12 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Comodo
2014-04-18 11:19 - 2011-12-09 18:33 - 00000000 ____D () C:\WINDOWS\system32\Restore
2014-04-18 11:17 - 2011-12-09 19:23 - 00000211 ___SH () C:\boot.ini
2014-04-18 11:17 - 2004-08-04 12:00 - 00000983 _____ () C:\WINDOWS\win.ini
2014-04-18 11:17 - 2004-08-04 12:00 - 00000327 _____ () C:\WINDOWS\system.ini
2014-04-18 11:14 - 2014-04-18 11:14 - 00002075 _____ () C:\WINDOWS\setupapi.log
2014-04-18 11:14 - 2014-04-16 16:30 - 00065536 _____ () C:\WINDOWS\system32\config\COMODO I.evt
2014-04-18 11:13 - 2011-12-09 19:25 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2014-04-18 11:12 - 2014-04-18 11:12 - 00020774 _____ () C:\WINDOWS\DPINST.LOG
2014-04-18 11:00 - 2014-04-18 11:00 - 00000000 _____ () C:\WINDOWS\Sti_Trace.log
2014-04-18 11:00 - 2011-12-09 19:13 - 00000000 ____D () C:\WINDOWS\system32\spool
2014-04-18 10:59 - 2012-04-23 23:41 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\GG
2014-04-18 10:54 - 2013-08-30 14:37 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\koncówka drazka 4310190 vw audi
2014-04-18 10:50 - 2014-04-18 10:50 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Advanced SystemCare 7
2014-04-18 10:50 - 2014-04-16 15:52 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\IObit
2014-04-18 10:49 - 2014-04-16 15:54 - 00000000 ____D () C:\Program Files\IObit
2014-04-18 10:49 - 2014-04-16 15:52 - 00000446 _____ () C:\ASCInit.log
2014-04-18 10:49 - 2011-12-09 19:13 - 00000000 ____D () C:\WINDOWS\pchealth
2014-04-18 10:42 - 2014-04-18 10:42 - 01700352 _____ (Microsoft Corporation) C:\WINDOWS\system32\gdiplus.dll
2014-04-18 10:42 - 2011-12-09 18:42 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji
2014-04-18 10:33 - 2012-04-23 23:41 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GG
2014-04-18 10:28 - 2011-12-09 19:25 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
2014-04-17 13:43 - 2014-04-17 13:43 - 00000000 ____D () C:\WINDOWS\Tasks\ImCleanDisabled
2014-04-17 12:07 - 2011-12-09 19:25 - 00000000 ___RD () C:\Documents and Settings\All Users\Dokumenty
2014-04-17 11:06 - 2012-11-02 10:36 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\HP
2014-04-17 11:06 - 2012-11-02 10:28 - 00000000 ____D () C:\Program Files\HP
2014-04-17 10:46 - 2014-04-17 10:46 - 34516992 _____ () C:\WINDOWS\system32\config\software.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00286720 _____ () C:\WINDOWS\system32\config\default.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00057344 _____ () C:\WINDOWS\system32\config\SECURITY.iodefrag.bak
2014-04-17 10:46 - 2014-04-17 10:46 - 00028672 _____ () C:\WINDOWS\system32\config\SAM.iodefrag.bak
2014-04-17 10:29 - 2012-11-07 18:57 - 00000000 ____D () C:\WINDOWS\pss
2014-04-17 10:28 - 2014-04-16 15:55 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-04-17 10:19 - 2014-04-16 15:54 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\IObit
2014-04-17 10:15 - 2012-11-16 14:58 - 00000386 _____ () C:\WINDOWS\Tasks\At5.job
2014-04-16 17:02 - 2014-04-16 17:02 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Sun
2014-04-16 16:55 - 2014-04-16 16:55 - 00000000 ____D () C:\Documents and Settings\LocalService\Dane aplikacji\IObit
2014-04-16 16:27 - 2014-04-16 16:27 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Adtrustmedia
2014-04-16 16:20 - 2012-01-12 23:06 - 00000000 ____D () C:\Program Files\Google
2014-04-16 16:16 - 2014-04-16 16:16 - 00000000 ____D () C:\WINDOWS\Tasks\TaskDisabled
2014-04-16 16:16 - 2014-03-29 11:59 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-04-16 16:16 - 2013-03-10 17:47 - 00000000 ____D () C:\Program Files\PokerStars.EU
2014-04-16 16:16 - 2012-01-19 13:17 - 00000000 ____D () C:\Program Files\Canon
2014-04-16 16:16 - 2012-01-12 23:12 - 00000000 ____D () C:\Program Files\PokerStars
2014-04-16 16:16 - 2011-12-09 19:25 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-04-16 16:10 - 2014-04-16 15:56 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\ProductData
2014-04-16 16:09 - 2014-04-16 16:09 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe
2014-04-16 16:09 - 2014-04-16 16:09 - 00145408 _____ (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl
2014-04-16 16:09 - 2014-04-16 16:09 - 00094632 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Program Files\Java
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-04-16 16:09 - 2014-04-16 16:09 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\Java
2014-04-16 16:08 - 2013-10-05 12:34 - 00000000 ____D () C:\Documents and Settings\Administrator\Menu Start\Programy\BitGuard
2014-04-16 16:08 - 2011-12-09 18:42 - 00000000 __RHD () C:\Documents and Settings\Administrator\Dane aplikacji
2014-04-16 15:56 - 2013-05-31 14:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Apple Computer
2014-04-16 15:54 - 2011-12-09 18:42 - 00000000 ___RD () C:\Documents and Settings\Administrator\Ulubione
2014-04-16 15:38 - 2012-12-26 20:21 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-04-16 15:36 - 2012-01-12 11:36 - 00001912 _____ () C:\WINDOWS\epplauncher.mif
2014-04-16 15:20 - 2014-04-02 08:14 - 00000406 ____H () C:\WINDOWS\Tasks\Microsoft Antimalware Scheduled Scan.job
2014-04-16 15:19 - 2014-02-10 22:14 - 00000000 ____D () C:\Program Files\YoutubeAdblocker
2014-04-16 15:19 - 2014-02-10 22:13 - 00000000 ____D () C:\Program Files\websaave
2014-04-16 15:19 - 2012-01-12 23:07 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google
2014-04-16 15:19 - 2012-01-12 23:06 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Google
2014-04-16 15:17 - 2012-05-25 13:02 - 00000000 ____D () C:\WINDOWS\system32\LogFiles
2014-04-16 15:17 - 2012-03-11 12:17 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic
2014-04-16 15:06 - 2014-04-16 15:06 - 00000000 __SHD () C:\WINDOWS\CSC
2014-04-16 13:16 - 2012-11-04 11:50 - 00000099 _____ () C:\WINDOWS\WirelessFTP.INI
2014-04-16 12:54 - 2014-04-16 12:52 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\edek
2014-04-16 12:44 - 2011-12-09 18:42 - 00000000 ___RD () C:\Documents and Settings\Administrator\Moje dokumenty
2014-04-15 16:48 - 2014-04-15 16:45 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\patyczek
2014-04-15 16:46 - 2014-04-15 16:46 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\taja
2014-04-15 10:03 - 2013-09-06 17:37 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\firebird
2014-04-12 12:47 - 2012-09-19 18:17 - 00000664 _____ () C:\WINDOWS\system32\d3d9caps.dat
2014-04-10 17:25 - 2012-12-26 20:20 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\Norton
2014-04-10 08:15 - 2013-07-14 00:11 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-04-10 08:11 - 2012-01-12 13:02 - 88028728 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-04-08 15:10 - 2014-03-12 14:00 - 00000232 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job
2014-04-01 15:11 - 2013-09-30 13:34 - 00020072 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\OLEJ ANDRZEJ.xlsx
2014-03-31 11:18 - 2014-03-31 11:16 - 00000435 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\topinambur.txt
2014-03-31 08:28 - 2013-08-30 12:40 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\zrobione
2014-03-29 20:22 - 2012-10-06 21:12 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-03-29 13:52 - 2014-03-29 13:47 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\corsa 2004-5 1,2
2014-03-28 21:45 - 2012-11-16 14:58 - 00000386 _____ () C:\WINDOWS\Tasks\At6.job
2014-03-28 21:20 - 2013-10-05 12:33 - 00000288 _____ () C:\WINDOWS\Tasks\EPUpdater.job
2014-03-27 14:51 - 2014-03-27 13:37 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\druki krs

Files to move or delete:
====================
C:\Windows\Tasks\At4.job
C:\Windows\Tasks\At5.job
C:\Windows\Tasks\At6.job
C:\Windows\Tasks\At7.job
C:\Windows\Tasks\At8.job


Some content of TEMP:
====================
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\rrujhvyr.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\x6xcr_lu.dll


==================== Bamital & volsnap Check =================

C:\WINDOWS\explorer.exe
[2004-08-04 12:00] - [2008-04-14 23:51] - 1035264 ____A (Microsoft Corporation) c791ed9eac5e76d9525e157b1d7a599a 

C:\WINDOWS\system32\winlogon.exe
[2004-08-04 12:00] - [2008-04-14 23:51] - 0510464 ____A (Microsoft Corporation) 51fd2e13d723857b9ca239ae77150f48 

C:\WINDOWS\system32\svchost.exe
[2004-08-04 12:00] - [2008-04-14 23:51] - 0014336 ____A (Microsoft Corporation) 8607d35d92528e2df386f19a960d23ce 

C:\WINDOWS\system32\services.exe
[2004-08-04 12:00] - [2009-02-09 13:25] - 0111104 ____A (Microsoft Corporation) 02a467e27af55f7064c5b251e587315f 

C:\WINDOWS\system32\User32.dll
[2004-08-04 12:00] - [2008-04-14 23:50] - 0580096 ____A (Microsoft Corporation) a435c5c069afd901751ac323ad238793 

C:\WINDOWS\system32\userinit.exe
[2004-08-04 12:00] - [2008-04-14 23:51] - 0026624 ____A (Microsoft Corporation) 2a5b37d520508be6570a3ea79695f5b5 

C:\WINDOWS\system32\rpcss.dll
[2004-08-04 12:00] - [2009-02-09 12:53] - 0401408 ____A (Microsoft Corporation) a37311d9d628c1042a2836731787f0f3 

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2004-08-04 12:00] - [2008-04-14 22:31] - 0052864 ____A (Microsoft Corporation) 56b191ac5fc0df219949c95a6c87afe7 


==================== End Of Log ============================