OTL logfile created on: 2014-04-27 08:29:41 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = D:\Downloads\OTL
64bit-Windows Vista Ultimate Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
3,98 Gb Total Physical Memory | 2,09 Gb Available Physical Memory | 52,48% Memory free
8,18 Gb Paging File | 6,00 Gb Available in Paging File | 73,33% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,66 Gb Total Space | 21,63 Gb Free Space | 22,15% Space Free | Partition Type: NTFS
Drive D: | 368,10 Gb Total Space | 215,68 Gb Free Space | 58,59% Space Free | Partition Type: NTFS
 
Computer Name: SZEF | User Name: Aleksandra | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2014-04-27 08:26:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Downloads\OTL\OTL.exe
PRC - [2014-04-15 18:34:02 | 000,180,304 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
PRC - [2014-04-15 18:34:02 | 000,122,448 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
PRC - [2014-04-03 09:49:12 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
PRC - [2014-04-03 09:49:12 | 000,857,912 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
PRC - [2014-04-03 09:49:06 | 006,963,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
PRC - [2014-03-29 12:42:31 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2014-02-14 12:00:50 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2014-02-14 12:00:46 | 000,689,744 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2014-02-14 12:00:46 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2013-12-21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012-01-31 10:46:56 | 000,019,232 | ---- | M] (Autodesk, Inc.) -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe
PRC - [2011-11-25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011-03-03 12:39:10 | 003,278,232 | ---- | M] (Tonec Inc.) -- C:\Program Files (x86)\Internet Download Manager\IDMan.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2014-04-15 18:34:00 | 000,138,320 | ---- | M] () -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
MOD - [2014-04-15 18:33:56 | 000,049,744 | ---- | M] () -- C:\Users\ALEKSA~1\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
MOD - [2014-03-29 12:42:30 | 003,642,480 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2014-02-27 08:16:39 | 000,260,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\1ab52f8951c2ab97592ec25830dd5165\WindowsFormsIntegration.ni.dll
MOD - [2014-02-27 08:14:31 | 002,997,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\1e5e19d119e04b93da3d45153abd60fd\System.IdentityModel.ni.dll
MOD - [2014-02-27 08:14:23 | 019,693,056 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\24bf0c88c0465485f4b842df043b3f45\System.ServiceModel.ni.dll
MOD - [2014-02-27 08:12:04 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\47e7fc401facd4a5d3f2237f16948f36\PresentationFramework-SystemXml.ni.dll
MOD - [2014-02-27 08:12:03 | 000,016,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\af02d03484578dbc357d1df8d1b6fd01\PresentationFramework-SystemData.ni.dll
MOD - [2014-02-27 06:56:05 | 000,223,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\f4354d6580fbb745c0c8acba382a7b84\System.ServiceProcess.ni.dll
MOD - [2014-02-27 06:55:39 | 001,889,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\3fe705796c6a41d4889d9001d1c56af8\System.Xaml.ni.dll
MOD - [2014-02-27 06:55:13 | 002,542,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\7e73e63cf4b8efdf41900b9576489e61\System.Data.Linq.ni.dll
MOD - [2014-02-27 06:55:09 | 018,813,440 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\a4b45c44490c75bc2fb22780e7ef087d\PresentationFramework.ni.dll
MOD - [2014-02-27 06:55:06 | 007,409,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\6bbed231aec6fd82547e09474da0b2f9\System.Data.ni.dll
MOD - [2014-02-27 06:54:43 | 012,894,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f4f6ee0df2aa4189bf36e6335cb92761\System.Windows.Forms.ni.dll
MOD - [2014-02-27 06:54:24 | 011,025,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74542efbeb46445949a39026c501132\PresentationCore.ni.dll
MOD - [2014-02-27 06:54:17 | 001,644,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\5cd2aee5e7c07227c694d89219688ab3\System.Drawing.ni.dll
MOD - [2014-02-27 06:54:13 | 000,806,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\34b53ecafa1d7ccc7ca961d722b5d983\System.ServiceModel.Internals.ni.dll
MOD - [2014-02-27 06:54:13 | 000,122,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\78652b7fa68ee058bff6a118c657f565\SMDiagnostics.ni.dll
MOD - [2014-02-27 06:54:11 | 002,825,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f6d7bb59f318c130d68816a89335d05e\System.Runtime.Serialization.ni.dll
MOD - [2014-02-27 06:53:57 | 003,950,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\acf97bfe2a931d4a47253b26b7218991\WindowsBase.ni.dll
MOD - [2014-02-27 06:53:54 | 000,470,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\75f8bc4cf08030c4a53b6d5e0ae20046\PresentationFramework.Aero.ni.dll
MOD - [2014-02-27 06:53:40 | 007,662,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\bada32953bb6b16a53d653eae23d78dc\System.Xml.ni.dll
MOD - [2014-02-27 06:53:39 | 006,990,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\dce99d8de14d8a015313db98c72552ee\System.Core.ni.dll
MOD - [2014-02-27 06:53:23 | 000,976,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\bbc48ec4245e502ae19b0601d3799c9e\System.Configuration.ni.dll
MOD - [2014-02-27 06:53:20 | 010,060,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ff26cc03e6d57d8abd13b990332e67c6\System.ni.dll
MOD - [2014-02-27 06:53:01 | 000,147,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\4c8a153aa66fcd62db6fff269a2ef2b4\System.Numerics.ni.dll
MOD - [2014-02-27 06:52:59 | 016,953,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\ce5f61c5754789df97be8dc991c47d07\mscorlib.ni.dll
MOD - [2013-09-05 01:14:10 | 004,300,456 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - [2013-04-24 18:53:13 | 001,432,400 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe -- (FLEXnet Licensing Service 64)
SRV:[b]64bit:[/b] - [2008-10-16 18:05:00 | 001,449,984 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:[b]64bit:[/b] - [2008-10-16 17:27:20 | 000,826,368 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:[b]64bit:[/b] - [2008-01-19 00:06:52 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2008-01-19 00:00:54 | 000,195,584 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2014-04-15 18:34:02 | 000,122,448 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe -- (Avira.OE.ServiceHost)
SRV - [2014-04-09 10:29:29 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014-04-03 09:49:12 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014-04-03 09:49:12 | 000,857,912 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2014-03-29 12:42:30 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014-02-14 12:00:50 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2014-02-14 12:00:47 | 001,017,424 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService)
SRV - [2014-02-14 12:00:46 | 000,440,400 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2013-12-21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013-10-23 09:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013-09-11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012-01-31 10:46:56 | 000,019,232 | ---- | M] (Autodesk, Inc.) [Auto | Running] -- C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe -- (Autodesk Content Service)
SRV - [2011-11-25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2010-02-19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009-03-30 06:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV:[b]64bit:[/b] - [2014-04-27 06:54:55 | 000,119,512 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV:[b]64bit:[/b] - [2014-04-03 09:51:12 | 000,063,192 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)
DRV:[b]64bit:[/b] - [2014-04-03 09:50:58 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2014-02-14 12:00:47 | 000,131,576 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avipbb.sys -- (avipbb)
DRV:[b]64bit:[/b] - [2014-02-14 12:00:47 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\avkmgr.sys -- (avkmgr)
DRV:[b]64bit:[/b] - [2014-02-14 12:00:46 | 000,108,440 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\DRIVERS\avgntflt.sys -- (avgntflt)
DRV:[b]64bit:[/b] - [2013-04-23 19:19:37 | 000,503,352 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:[b]64bit:[/b] - [2013-02-06 08:25:24 | 000,030,304 | ---- | M] (Applian Technologies Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\appliand.sys -- (appliand)
DRV:[b]64bit:[/b] - [2012-02-29 15:52:46 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2011-12-01 11:42:44 | 000,072,240 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\NBVol.sys -- (NBVol)
DRV:[b]64bit:[/b] - [2011-12-01 11:42:44 | 000,015,920 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\NBVolUp.sys -- (NBVolUp)
DRV:[b]64bit:[/b] - [2011-01-25 12:40:06 | 000,142,936 | ---- | M] (Tonec Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\DRIVERS\idmwfp.sys -- (IDMWFP)
DRV:[b]64bit:[/b] - [2009-12-30 10:21:26 | 000,031,800 | ---- | M] (VS Revo Group) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\revoflt.sys -- (Revoflt)
DRV:[b]64bit:[/b] - [2009-10-01 02:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:[b]64bit:[/b] - [2009-05-19 05:43:32 | 000,026,128 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\AcpiVpc.sys -- (ACPIVPC)
DRV:[b]64bit:[/b] - [2008-11-17 07:50:30 | 004,751,360 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\NETw5v64.sys -- (NETw5v64)
DRV:[b]64bit:[/b] - [2008-10-31 04:49:44 | 000,261,680 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\SynTP.sys -- (SynTP)
DRV:[b]64bit:[/b] - [2008-09-24 23:39:48 | 000,058,912 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2008-04-16 14:49:34 | 000,028,416 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\RimUsb_AMD64.sys -- (RimUsb)
DRV - [2009-02-10 17:23:10 | 000,115,600 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys -- (ISODrive)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=147
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = 
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gazeta.pl/0,0.html?p=147
IE - HKLM\..\SearchScopes,DefaultScope = 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = 
 
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.default-search.net?sid=476&aid=132&itype=n&ver=12349&tm=329&src=hmp
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2476}: "URL" = http://www.default-search.net/search?sid=476&aid=132&itype=n&ver=12349&tm=329&src=ds&p={searchTerms}
IE - HKU\S-1-5-21-628482503-715703045-1814460480-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..browser.search.order.1: "default-search.net"
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "www.onet.pl"
FF - prefs.js..extensions.enabledAddons: newtabgoogle%40graememcc.co.uk:1.0.2
FF - prefs.js..extensions.enabledAddons: youtube-cinemode%40gmail.com:1.13
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:28.0
FF - prefs.js..extensions.unitedinternet.original.browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://www.onet.pl"
FF - user.js - File not found
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_182.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014-03-29 12:42:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014-03-29 12:42:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 [2013-04-24 18:08:44 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2014-03-29 12:42:17 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2014-03-29 12:42:18 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Aleksandra\AppData\Roaming\IDM\idmmzcc3 [2013-04-24 18:08:44 | 000,000,000 | ---D | M]
 
[2013-04-23 11:29:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\Extensions
[2014-04-26 07:45:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\Firefox\Profiles\7xo4fpg5.default\extensions
[2014-04-26 07:31:00 | 000,000,000 | ---D | M] (Settings Manager) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\Firefox\Profiles\7xo4fpg5.default\extensions\{E729C6EC-E9FF-E59F-355C-EC59F2795E4E}
[2013-04-24 20:31:59 | 000,019,225 | ---- | M] () (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\extensions\newtabgoogle@graememcc.co.uk.xpi
[2014-02-13 13:50:01 | 000,062,659 | ---- | M] () (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\extensions\privateTab@infocatcher.xpi
[2013-10-17 15:21:39 | 000,017,767 | ---- | M] () (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\extensions\youtube-cinemode@gmail.com.xpi
[2014-02-27 06:37:00 | 000,957,290 | ---- | M] () (No name found) -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014-04-17 06:30:41 | 000,002,432 | ---- | M] () -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\searchplugins\lastminute.xml
[2014-04-17 06:30:41 | 000,005,637 | ---- | M] () -- C:\Users\Aleksandra\AppData\Roaming\mozilla\firefox\profiles\7xo4fpg5.default\searchplugins\webde-suche.xml
[2014-03-29 12:42:17 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2014-03-29 12:42:31 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
O1 HOSTS File: ([2006-09-18 23:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2:[b]64bit:[/b] - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\Aleksandra\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll (Trend Media Group)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:[b]64bit:[/b] - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4:[b]64bit:[/b] - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:[b]64bit:[/b] - HKLM..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\SkyTel.exe (Realtek Semiconductor Corp.)
O4:[b]64bit:[/b] - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [OnekeyDM] C:\Program Files (x86)\Lenovo\OnekeyDM\OnekeyDM.exe ()
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-628482503-715703045-1814460480-1000..\Run: [AdobeBridge]  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\S-1-5-21-628482503-715703045-1814460480-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer:  = 
O8:[b]64bit:[/b] - Extra context menu item: Download all links by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download all videos by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download current video by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Ściągnij przez IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Ściągnij wszystkie linki przez IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download all links by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm ()
O8 - Extra context menu item: Download all videos by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm ()
O8 - Extra context menu item: Download by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm ()
O8 - Extra context menu item: Download current video by FlashGet3 - C:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm ()
O8 - Extra context menu item: Ściągnij przez IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8 - Extra context menu item: Ściągnij wszystkie linki przez IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Ściągnij zawartość wideo FLV przez IDM - C:\Program Files (x86)\Internet Download Manager\IEGetVL.htm ()
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6CE9E9E4-F5AB-40E2-87E9-45519ADCF4CE}: DhcpNameServer = 62.179.1.63 62.179.1.62
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Tapeta pulpitu.bmp
O24 - Desktop BackupWallPaper: C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Tapeta pulpitu.bmp
O27 - HKLM IFEO\jumpflip: Debugger - C:\Windows\SysWow64\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\volaro: Debugger - C:\Windows\SysWow64\tasklist.exe (Microsoft Corporation)
O27 - HKLM IFEO\vonteera: Debugger - C:\Windows\SysWow64\tasklist.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{b37c8a2e-75f4-11e3-8432-00242ce8b8a4}\Shell - "" = AutoRun
O33 - MountPoints2\{b37c8a2e-75f4-11e3-8432-00242ce8b8a4}\Shell\AutoRun\command - "" = J:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O36 - AppCertDlls: x64 - (c:\program files (x86)\settings manager\systemk\x64\sysapcrt.dll) -  File not found
O36 - AppCertDlls: x86 - (c:\program files (x86)\settings manager\systemk\sysapcrt.dll) -  File not found
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2014-04-27 08:17:57 | 000,000,000 | ---D | C] -- C:\FRST
[2014-04-27 06:20:22 | 000,119,512 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014-04-27 06:19:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014-04-27 06:19:50 | 000,088,280 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014-04-27 06:19:50 | 000,063,192 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2014-04-27 06:19:50 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014-04-27 06:19:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2014-04-27 06:19:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014-04-27 06:15:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2014-04-26 19:34:50 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2014-04-26 19:17:02 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\AppData\Local\VS Revo Group
[2014-04-26 19:16:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
[2014-04-26 19:16:53 | 000,000,000 | ---D | C] -- C:\ProgramData\VS Revo Group
[2014-04-26 19:16:52 | 000,031,800 | ---- | C] (VS Revo Group) -- C:\Windows\SysNative\drivers\revoflt.sys
[2014-04-26 19:16:47 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2014-04-26 07:57:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Anvisoft
[2014-04-26 07:57:22 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\AppData\Local\Anvisoft
[2014-04-26 07:57:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Anvisoft
[2014-04-26 07:30:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Settings Manager
[2014-04-26 07:30:44 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sokoban
[2014-04-26 07:30:34 | 000,000,000 | ---D | C] -- C:\Program Files\Sokoban
[2014-04-23 05:58:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2014-04-23 05:58:26 | 000,264,616 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014-04-23 05:57:45 | 000,175,528 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014-04-23 05:57:45 | 000,175,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014-04-23 05:57:45 | 000,096,168 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014-04-23 05:57:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014-04-21 13:16:26 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\AppData\Roaming\Unity
[2014-04-21 12:59:57 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\AppData\Local\Unity
[2014-04-19 12:32:07 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Desktop\Flower
[2014-04-19 09:38:09 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Desktop\Alternative
[2014-04-13 20:15:52 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Desktop\Peruki www
[2014-04-13 18:28:06 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2014-04-13 18:26:21 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2014-04-13 18:20:09 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2014-04-13 10:19:10 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Documents\RRR2
[2014-04-13 10:18:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ubisoft
[2014-04-13 10:17:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2014-04-12 19:46:38 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Desktop\Nowy folder
[2014-04-12 15:56:06 | 000,000,000 | ---D | C] -- C:\Users\Aleksandra\Desktop\Peruki
[2014-04-11 09:30:28 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll
[2014-04-11 09:30:28 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll
[2014-04-11 09:30:23 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll
[2014-04-11 09:30:22 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll
[2014-04-11 09:30:22 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe
[2014-04-11 09:30:22 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe
[2014-04-11 09:30:21 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll
[2014-04-11 09:30:20 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll
[2014-04-11 09:30:17 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl
[2014-04-11 09:30:17 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl
[2014-04-11 09:30:16 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll
[2014-04-11 09:30:15 | 002,334,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll
[2014-04-11 09:30:15 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll
[2014-04-11 09:30:14 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll
[2014-04-11 09:30:14 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll
[2014-04-10 15:21:54 | 001,212,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\kernel32.dll
[2014-03-29 12:42:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013-04-23 08:59:32 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Users\Aleksandra\AppData\Local\mbr_rest.exe
[2013-04-23 08:59:32 | 000,087,552 | ---- | C] (Microsoft Corporation) -- C:\Users\Aleksandra\AppData\Local\mbr_inst.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2014-04-27 08:20:15 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014-04-27 07:55:57 | 000,137,474 | ---- | M] () -- C:\ProgramData\nvModes.001
[2014-04-27 06:54:55 | 000,119,512 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014-04-27 06:51:36 | 000,137,474 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2014-04-27 06:51:29 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014-04-27 06:51:28 | 000,003,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014-04-27 06:50:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014-04-27 06:50:01 | 4279,431,168 | -HS- | M] () -- C:\hiberfil.sys
[2014-04-27 06:48:52 | 000,005,340 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2014-04-27 06:19:59 | 000,000,980 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014-04-26 19:11:17 | 000,002,496 | ---- | M] () -- C:\Users\Aleksandra\Documents\cc_20140426_191109.reg
[2014-04-26 07:30:43 | 000,000,783 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Sokoban.lnk
[2014-04-26 07:30:01 | 000,808,815 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Sokoban.exe
[2014-04-25 13:49:54 | 001,710,520 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014-04-25 13:49:54 | 000,748,008 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2014-04-25 13:49:54 | 000,664,516 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014-04-25 13:49:54 | 000,168,672 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2014-04-25 13:49:54 | 000,132,342 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014-04-23 05:57:27 | 000,096,168 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2014-04-23 05:57:23 | 000,264,616 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2014-04-23 05:57:23 | 000,175,528 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2014-04-23 05:57:23 | 000,175,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2014-04-23 05:55:02 | 000,004,976 | ---- | M] () -- C:\Users\Aleksandra\Documents\cc_20140423_055451.reg
[2014-04-21 22:18:21 | 002,240,512 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Banner.psd
[2014-04-21 21:18:33 | 000,212,658 | ---- | M] () -- C:\Users\Aleksandra\Desktop\banner.png
[2014-04-21 21:18:31 | 000,000,132 | ---- | M] () -- C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu PNG CS6 firmy Adobe
[2014-04-21 19:30:11 | 001,043,445 | ---- | M] () -- C:\Users\Aleksandra\Desktop\vitafon-t_photo_1.jpg
[2014-04-21 19:14:45 | 000,044,790 | ---- | M] () -- C:\Users\Aleksandra\Desktop\poznaj vitafon.psd
[2014-04-21 18:48:29 | 000,005,532 | ---- | M] () -- C:\Users\Aleksandra\Desktop\poznaj vitafon.png
[2014-04-21 18:03:29 | 000,011,529 | ---- | M] () -- C:\Users\Aleksandra\Desktop\nic nie skutkuje.png
[2014-04-21 17:49:43 | 000,163,435 | ---- | M] () -- C:\Users\Aleksandra\Desktop\parents.png
[2014-04-21 17:40:03 | 000,258,942 | ---- | M] () -- C:\Users\Aleksandra\Desktop\stacks_image_262_1.png
[2014-04-21 17:35:14 | 000,013,927 | ---- | M] () -- C:\Users\Aleksandra\Desktop\bol-stawow-biodrowych.jpg
[2014-04-21 17:35:04 | 000,056,887 | ---- | M] () -- C:\Users\Aleksandra\Desktop\bole-miesni-plecow-i-stawow.jpg
[2014-04-21 17:34:19 | 000,028,367 | ---- | M] () -- C:\Users\Aleksandra\Desktop\img.php.jpg
[2014-04-21 17:32:11 | 000,288,346 | ---- | M] () -- C:\Users\Aleksandra\Desktop\devojka42.jpg
[2014-04-21 17:31:29 | 000,324,483 | ---- | M] () -- C:\Users\Aleksandra\Desktop\devojka19.jpg
[2014-04-21 17:29:42 | 000,325,333 | ---- | M] () -- C:\Users\Aleksandra\Desktop\devojka24.jpg
[2014-04-20 20:26:56 | 000,082,362 | ---- | M] () -- C:\Users\Aleksandra\Desktop\atat3.jpg
[2014-04-20 20:15:41 | 000,081,699 | ---- | M] () -- C:\Users\Aleksandra\Desktop\atat2.jpg
[2014-04-20 17:03:59 | 000,212,094 | ---- | M] () -- C:\Users\Aleksandra\Desktop\atat.jpg
[2014-04-20 08:46:54 | 006,486,669 | ---- | M] () -- C:\Users\Aleksandra\Desktop\peruka z opisem.psd
[2014-04-20 07:43:21 | 000,090,514 | ---- | M] () -- C:\Users\Aleksandra\Desktop\lady.png
[2014-04-19 16:43:40 | 002,475,617 | ---- | M] () -- C:\Users\Aleksandra\Desktop\peruka z opisem.zip
[2014-04-19 16:43:38 | 001,504,987 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Flower.zip
[2014-04-19 16:43:36 | 003,996,062 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Alternative.zip
[2014-04-19 05:38:36 | 000,000,680 | ---- | M] () -- C:\Users\Aleksandra\AppData\Local\d3d9caps.dat
[2014-04-18 19:00:54 | 000,002,611 | ---- | M] () -- C:\Users\Aleksandra\Desktop\Word.lnk
[2014-04-17 05:48:51 | 000,001,079 | ---- | M] () -- C:\Users\Public\Desktop\Avira.lnk
[2014-04-17 00:00:05 | 000,216,500 | ---- | M] () -- C:\Users\Aleksandra\Desktop\CIMG0511.JPG
[2014-04-16 23:13:42 | 000,021,515 | ---- | M] () -- C:\Users\Aleksandra\Desktop\dn.jpg
[2014-04-16 22:59:29 | 000,047,365 | ---- | M] () -- C:\Users\Aleksandra\Desktop\sciences_PO.jpg
[2014-04-16 22:24:07 | 000,008,453 | ---- | M] () -- C:\Users\Aleksandra\Desktop\images.jpg
[2014-04-14 21:25:08 | 000,045,446 | ---- | M] () -- C:\Users\Aleksandra\Desktop\genua2.jpg
[2014-04-14 21:22:10 | 000,028,260 | ---- | M] () -- C:\Users\Aleksandra\Desktop\genua1.jpg
[2014-04-14 21:19:22 | 000,030,615 | ---- | M] () -- C:\Users\Aleksandra\Desktop\malmoe2.jpg
[2014-04-14 21:16:15 | 000,031,302 | ---- | M] () -- C:\Users\Aleksandra\Desktop\malmoe1.jpg
[2014-04-14 21:09:16 | 000,205,867 | ---- | M] () -- C:\Users\Aleksandra\Desktop\130_29_redcooper-mix.jpg
[2014-04-14 21:05:14 | 000,061,311 | ---- | M] () -- C:\Users\Aleksandra\Desktop\lima.jpg
[2014-04-14 21:04:40 | 000,060,495 | ---- | M] () -- C:\Users\Aleksandra\Desktop\palermo.jpg
[2014-04-14 18:02:23 | 000,000,132 | ---- | M] () -- C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu GIF CS6 firmy Adobe
[2014-04-14 05:37:16 | 005,072,568 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014-04-12 07:06:07 | 000,045,230 | ---- | M] () -- C:\Users\Aleksandra\Documents\cc_20140412_070543.reg
[2014-04-09 10:29:29 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2014-04-09 10:29:29 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2014-04-03 09:51:12 | 000,063,192 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2014-04-03 09:51:04 | 000,088,280 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014-04-03 09:50:58 | 000,025,816 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2014-04-27 06:19:59 | 000,000,980 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014-04-26 19:11:12 | 000,002,496 | ---- | C] () -- C:\Users\Aleksandra\Documents\cc_20140426_191109.reg
[2014-04-26 07:30:43 | 000,000,783 | ---- | C] () -- C:\Users\Aleksandra\Desktop\Sokoban.lnk
[2014-04-26 07:30:00 | 000,808,815 | ---- | C] () -- C:\Users\Aleksandra\Desktop\Sokoban.exe
[2014-04-23 05:54:57 | 000,004,976 | ---- | C] () -- C:\Users\Aleksandra\Documents\cc_20140423_055451.reg
[2014-04-21 22:18:19 | 002,240,512 | ---- | C] () -- C:\Users\Aleksandra\Desktop\Banner.psd
[2014-04-21 21:18:29 | 000,212,658 | ---- | C] () -- C:\Users\Aleksandra\Desktop\banner.png
[2014-04-21 19:29:42 | 001,043,445 | ---- | C] () -- C:\Users\Aleksandra\Desktop\vitafon-t_photo_1.jpg
[2014-04-21 19:14:43 | 000,044,790 | ---- | C] () -- C:\Users\Aleksandra\Desktop\poznaj vitafon.psd
[2014-04-21 18:45:57 | 000,005,532 | ---- | C] () -- C:\Users\Aleksandra\Desktop\poznaj vitafon.png
[2014-04-21 18:03:26 | 000,011,529 | ---- | C] () -- C:\Users\Aleksandra\Desktop\nic nie skutkuje.png
[2014-04-21 17:49:40 | 000,163,435 | ---- | C] () -- C:\Users\Aleksandra\Desktop\parents.png
[2014-04-21 17:40:03 | 000,258,942 | ---- | C] () -- C:\Users\Aleksandra\Desktop\stacks_image_262_1.png
[2014-04-21 17:35:13 | 000,013,927 | ---- | C] () -- C:\Users\Aleksandra\Desktop\bol-stawow-biodrowych.jpg
[2014-04-21 17:35:04 | 000,056,887 | ---- | C] () -- C:\Users\Aleksandra\Desktop\bole-miesni-plecow-i-stawow.jpg
[2014-04-21 17:34:19 | 000,028,367 | ---- | C] () -- C:\Users\Aleksandra\Desktop\img.php.jpg
[2014-04-21 17:32:10 | 000,288,346 | ---- | C] () -- C:\Users\Aleksandra\Desktop\devojka42.jpg
[2014-04-21 17:31:29 | 000,324,483 | ---- | C] () -- C:\Users\Aleksandra\Desktop\devojka19.jpg
[2014-04-21 17:29:41 | 000,325,333 | ---- | C] () -- C:\Users\Aleksandra\Desktop\devojka24.jpg
[2014-04-20 20:26:51 | 000,082,362 | ---- | C] () -- C:\Users\Aleksandra\Desktop\atat3.jpg
[2014-04-20 20:15:38 | 000,081,699 | ---- | C] () -- C:\Users\Aleksandra\Desktop\atat2.jpg
[2014-04-20 17:03:51 | 000,212,094 | ---- | C] () -- C:\Users\Aleksandra\Desktop\atat.jpg
[2014-04-20 07:43:17 | 000,090,514 | ---- | C] () -- C:\Users\Aleksandra\Desktop\lady.png
[2014-04-19 16:43:40 | 002,475,617 | ---- | C] () -- C:\Users\Aleksandra\Desktop\peruka z opisem.zip
[2014-04-19 16:43:38 | 001,504,987 | ---- | C] () -- C:\Users\Aleksandra\Desktop\Flower.zip
[2014-04-19 16:43:36 | 003,996,062 | ---- | C] () -- C:\Users\Aleksandra\Desktop\Alternative.zip
[2014-04-18 16:47:53 | 006,486,669 | ---- | C] () -- C:\Users\Aleksandra\Desktop\peruka z opisem.psd
[2014-04-17 05:48:51 | 000,001,079 | ---- | C] () -- C:\Users\Public\Desktop\Avira.lnk
[2014-04-17 00:00:05 | 000,216,500 | ---- | C] () -- C:\Users\Aleksandra\Desktop\CIMG0511.JPG
[2014-04-16 22:59:23 | 000,047,365 | ---- | C] () -- C:\Users\Aleksandra\Desktop\sciences_PO.jpg
[2014-04-16 22:24:06 | 000,008,453 | ---- | C] () -- C:\Users\Aleksandra\Desktop\images.jpg
[2014-04-16 19:35:41 | 000,021,515 | ---- | C] () -- C:\Users\Aleksandra\Desktop\dn.jpg
[2014-04-14 21:25:06 | 000,045,446 | ---- | C] () -- C:\Users\Aleksandra\Desktop\genua2.jpg
[2014-04-14 21:22:08 | 000,028,260 | ---- | C] () -- C:\Users\Aleksandra\Desktop\genua1.jpg
[2014-04-14 21:16:11 | 000,031,302 | ---- | C] () -- C:\Users\Aleksandra\Desktop\malmoe1.jpg
[2014-04-14 21:14:31 | 000,030,615 | ---- | C] () -- C:\Users\Aleksandra\Desktop\malmoe2.jpg
[2014-04-14 21:09:16 | 000,205,867 | ---- | C] () -- C:\Users\Aleksandra\Desktop\130_29_redcooper-mix.jpg
[2014-04-14 21:05:14 | 000,061,311 | ---- | C] () -- C:\Users\Aleksandra\Desktop\lima.jpg
[2014-04-14 21:04:40 | 000,060,495 | ---- | C] () -- C:\Users\Aleksandra\Desktop\palermo.jpg
[2014-04-14 18:02:23 | 000,000,132 | ---- | C] () -- C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu GIF CS6 firmy Adobe
[2014-04-13 20:15:08 | 000,000,132 | ---- | C] () -- C:\Users\Aleksandra\AppData\Roaming\Preferencje formatu PNG CS6 firmy Adobe
[2014-04-13 18:27:52 | 000,001,058 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS6 (64 Bit).lnk
[2014-04-13 18:26:27 | 000,001,020 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS6 (64bit).lnk
[2014-04-13 18:23:57 | 000,001,227 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS6.lnk
[2014-04-13 18:23:45 | 000,001,389 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS6.lnk
[2014-04-12 07:05:51 | 000,045,230 | ---- | C] () -- C:\Users\Aleksandra\Documents\cc_20140412_070543.reg
[2013-11-13 08:39:19 | 000,000,404 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2013-11-13 08:39:19 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2013-11-13 08:37:28 | 000,000,219 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2013-11-13 08:37:28 | 000,000,094 | ---- | C] () -- C:\Windows\brpcfx.ini
[2013-11-13 08:28:31 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2013-09-25 09:13:34 | 000,000,680 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\d3d9caps.dat
[2013-09-04 07:22:22 | 000,217,176 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll
[2013-04-26 13:09:16 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2013-04-26 13:08:38 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2013-04-26 13:07:49 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2013-04-24 20:45:17 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
[2013-04-23 21:09:44 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini
[2013-04-23 20:04:33 | 000,000,025 | ---- | C] () -- C:\Windows\emcore.INI
[2013-04-23 19:35:09 | 000,000,040 | -HS- | C] () -- C:\ProgramData\.zreglib
[2013-04-23 14:51:30 | 001,685,204 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013-04-23 14:36:08 | 000,016,384 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013-04-23 09:27:36 | 000,137,474 | ---- | C] () -- C:\ProgramData\nvModes.001
[2013-04-23 09:26:53 | 000,137,474 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2013-04-23 08:59:32 | 001,474,560 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\vstaldr.img
[2013-04-23 08:59:32 | 000,166,876 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\vstaldr
[2013-04-23 08:59:32 | 000,002,731 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\asus.XRM-MS
[2013-04-23 08:59:32 | 000,000,219 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\menu.lst
[2013-04-23 08:52:18 | 000,000,732 | ---- | C] () -- C:\Users\Aleksandra\AppData\Local\d3d9caps64.dat
[2013-04-23 08:44:18 | 000,005,340 | ---- | C] () -- C:\Windows\bthservsdp.dat
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2006-11-02 17:29:43 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012-06-08 19:59:03 | 012,899,840 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012-06-08 19:47:00 | 011,586,048 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-04-11 09:11:14 | 000,891,392 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009-04-11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2008-01-19 00:04:28 | 000,513,024 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
[color=#E56717]========== LOP Check ==========[/color]
 
[2013-06-15 16:48:13 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\ACD Systems
[2013-05-01 09:51:41 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Autodesk
[2014-03-09 17:28:50 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\BITS
[2014-04-26 22:23:58 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\DMCache
[2013-04-23 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\FlashGet
[2013-04-23 20:04:09 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\FlashGetBHO
[2013-04-23 20:04:17 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\FlashgetSetup
[2014-02-15 07:13:46 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\GG
[2014-01-30 17:52:52 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Graphisoft
[2013-06-29 21:10:29 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\IDM
[2014-01-30 17:35:19 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Install.GS
[2013-07-25 20:42:51 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Medieval Software
[2013-11-21 20:06:42 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\PetShowCraze
[2013-04-29 11:49:34 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\R-TT
[2013-08-08 06:45:05 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Replay Media Catcher 5
[2014-04-21 13:16:26 | 000,000,000 | ---D | M] -- C:\Users\Aleksandra\AppData\Roaming\Unity
 
[color=#E56717]========== Purity Check ==========[/color]
 
 
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A1EDB939

< End of report >