OTL logfile created on: 2014-05-31 15:26:28 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\logi\otl Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,25 Gb Total Physical Memory | 0,57 Gb Available Physical Memory | 45,69% Memory free 2,98 Gb Paging File | 2,46 Gb Available in Paging File | 82,61% Paging File free Paging file location(s): C:\pagefile.sys 1920 3840 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 54,71 Gb Total Space | 30,88 Gb Free Space | 56,45% Space Free | Partition Type: NTFS Drive E: | 19,82 Gb Total Space | 5,11 Gb Free Space | 25,79% Space Free | Partition Type: NTFS Computer Name: PIS | User Name: Administrator | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2014-05-30 12:43:49 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Moje dokumenty\Pobieranie\logi\otl\OTL.exe PRC - [2014-05-30 10:40:14 | 000,317,720 | ---- | M] () -- C:\Program Files\webget\bin\utilwebget.exe PRC - [2014-05-30 09:39:43 | 000,317,720 | ---- | M] () -- C:\Program Files\webget\updatewebget.exe PRC - [2014-05-11 14:54:49 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2014-05-11 09:11:33 | 000,276,376 | R--- | M] (Symantec Corporation) -- C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe PRC - [2014-04-28 14:38:56 | 000,070,848 | ---- | M] () -- C:\Program Files\Mobogenie\MgAssist.exe PRC - [2014-04-28 14:38:55 | 000,748,736 | ---- | M] () -- C:\Program Files\Mobogenie\DaemonProcess.exe PRC - [2011-07-01 12:55:20 | 000,220,824 | ---- | M] () -- C:\Program Files\Macrium\Reflect\ReflectService.exe PRC - [2009-01-19 15:07:34 | 000,415,232 | ---- | M] (Contex A/S) -- C:\Program Files\Contex\WIDEsystem\WS.exe PRC - [2008-04-15 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2005-08-11 19:14:36 | 000,065,536 | ---- | M] (CANON INC.) -- C:\Program Files\Canon\GAROStatusMonitor\cnwida.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2014-05-30 10:40:14 | 000,317,720 | ---- | M] () -- C:\Program Files\webget\bin\utilwebget.exe MOD - [2014-05-30 09:39:43 | 000,317,720 | ---- | M] () -- C:\Program Files\webget\updatewebget.exe MOD - [2014-05-15 09:22:50 | 016,361,136 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll MOD - [2014-05-11 14:54:48 | 003,839,088 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2014-04-28 14:38:56 | 000,070,848 | ---- | M] () -- C:\Program Files\Mobogenie\MgAssist.exe MOD - [2014-04-28 14:38:55 | 000,748,736 | ---- | M] () -- C:\Program Files\Mobogenie\DaemonProcess.exe MOD - [2014-04-28 14:38:55 | 000,474,816 | ---- | M] () -- C:\Program Files\Mobogenie\DCR.dll MOD - [2014-04-28 14:38:55 | 000,065,728 | ---- | M] () -- C:\Program Files\Mobogenie\Device.dll MOD - [2014-02-13 10:17:50 | 000,212,992 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8cd995f00848816e3ec49dc326e3d49b\System.ServiceProcess.ni.dll MOD - [2014-02-13 10:17:35 | 000,998,400 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\5c157466d360a10b2c97e94b41ddc588\System.Management.ni.dll MOD - [2014-02-13 10:14:42 | 000,978,944 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b6e70acd99dc22e29b7fc8f9ac340c4\System.Configuration.ni.dll MOD - [2014-02-12 17:57:24 | 000,425,984 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.dll MOD - [2014-02-12 17:57:24 | 000,114,688 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll MOD - [2014-02-12 17:57:21 | 002,052,096 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.Xml.dll MOD - [2014-02-12 17:57:20 | 003,194,880 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll MOD - [2014-02-12 17:57:11 | 000,372,736 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll MOD - [2014-02-12 17:45:22 | 005,462,016 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\7faf645dc46781225cb722edf9e1e738\System.Xml.ni.dll MOD - [2014-02-12 17:45:12 | 012,434,432 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1cdfe1998ad6794db3237006906c6fa2\System.Windows.Forms.ni.dll MOD - [2014-02-12 17:44:53 | 001,593,344 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Drawing\424bff3295c6e7539cc6df62b9425bd0\System.Drawing.ni.dll MOD - [2014-02-12 17:44:00 | 007,977,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\4b0455ae94e3cecca4bb3ba8c96828c9\System.ni.dll MOD - [2014-02-12 17:39:56 | 011,497,984 | ---- | M] () -- C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\dae02331a443fb52216ca83292cb2f21\mscorlib.ni.dll MOD - [2013-05-17 18:45:02 | 000,040,960 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_pl_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll MOD - [2013-05-17 18:44:57 | 000,311,296 | ---- | M] () -- C:\WINDOWS\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll MOD - [2011-07-01 12:55:20 | 000,220,824 | ---- | M] () -- C:\Program Files\Macrium\Reflect\ReflectService.exe MOD - [2009-01-19 15:03:14 | 000,148,480 | ---- | M] () -- C:\Program Files\Contex\WIDEsystem\ctx_ldr.dll MOD - [2002-06-11 20:36:58 | 000,303,104 | ---- | M] () -- C:\Program Files\Canon\GAROStatusMonitor\CNXP.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV - [2014-05-30 10:40:14 | 000,317,720 | ---- | M] () [Auto | Running] -- C:\Program Files\webget\bin\utilwebget.exe -- (Util webget) SRV - [2014-05-30 09:39:43 | 000,317,720 | ---- | M] () [Auto | Running] -- C:\Program Files\webget\updatewebget.exe -- (Update webget) SRV - [2014-05-15 09:22:53 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2014-05-11 09:11:33 | 000,276,376 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe -- (NIS) SRV - [2014-04-28 14:38:56 | 000,070,848 | ---- | M] () [Auto | Running] -- C:\Program Files\Mobogenie\MgAssist.exe -- (MgAssistService) SRV - [2013-06-12 13:46:33 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2011-07-01 12:55:20 | 000,220,824 | ---- | M] () [Auto | Running] -- C:\Program Files\Macrium\Reflect\ReflectService.exe -- (ReflectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | Boot | Stopped] -- -- (cerc6) DRV - [2014-05-27 18:04:42 | 001,612,376 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140529.025\NAVEX15.SYS -- (NAVEX15) DRV - [2014-05-27 18:04:42 | 000,093,272 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140529.025\NAVENG.SYS -- (NAVENG) DRV - [2014-05-12 16:40:56 | 000,055,224 | ---- | M] (StdLib) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gt.sys -- ({9edd0ea8-2819-47c2-8320-b007d5996f8a}Gt) DRV - [2014-05-10 03:07:24 | 001,101,616 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140510.001\BHDrvx86.sys -- (BHDrvx86) DRV - [2014-03-26 11:16:26 | 000,383,120 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140529.002\IDSXpx86.sys -- (IDSxpx86) DRV - [2014-03-04 06:18:12 | 000,936,152 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\symefa.sys -- (SymEFA) DRV - [2014-02-18 03:32:41 | 000,423,256 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\symtdi.sys -- (SYMTDI) DRV - [2014-02-13 03:59:49 | 000,664,280 | ---- | M] (Symantec Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\srtsp.sys -- (SRTSP) DRV - [2013-11-21 10:17:05 | 000,376,920 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl) DRV - [2013-11-14 14:02:50 | 000,142,936 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent) DRV - [2013-09-27 04:45:56 | 000,206,936 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\ironx86.sys -- (SymIRON) DRV - [2013-09-26 04:50:25 | 000,127,064 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\ccsetx86.sys -- (ccSet_NIS) DRV - [2013-09-10 04:47:26 | 000,367,704 | R--- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\symds.sys -- (SymDS) DRV - [2013-09-10 03:49:48 | 000,032,344 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NIS\1503000.00C\srtspx.sys -- (SRTSPX) DRV - [2013-08-25 12:30:48 | 000,013,120 | ---- | M] () [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2011-12-26 15:34:30 | 000,010,936 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\ampa.sys -- (ampa) DRV - [2011-07-01 12:55:38 | 000,016,024 | ---- | M] (Macrium Software) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\pssnap.sys -- (pssnap) DRV - [2011-07-01 12:55:28 | 000,045,208 | ---- | M] (Macrium Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\psmounter.sys -- (PSMounter) DRV - [2009-03-25 14:29:52 | 000,130,432 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp) DRV - [2008-09-24 10:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM) DRV - [2008-04-14 01:15:34 | 000,011,520 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scsiscan.sys -- (scsiscan) DRV - [2008-04-14 00:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) DRV - [2005-01-20 08:45:30 | 000,088,960 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\nvatabus.sys -- (nvatabus) DRV - [2004-09-01 07:15:52 | 000,094,276 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENET.sys -- (NVENET) DRV - [2001-08-17 22:46:40 | 000,006,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\enum1394.sys -- (ENUM1394) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com/?ptr=100&crg=3.1010000.10039&barid={94BFF767-BE8C-11E2-A4FB-00000021671D} IE - HKLM\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKLM\..\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}: "URL" = http://search.sweetim.com/search.asp?src=6&ptr=100&q={searchTerms}&crg=3.1010000.10039&barid={94BFF767-BE8C-11E2-A4FB-00000021671D} IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=20.4.0.40 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=20.4.0.40 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=20.4.0.40 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=20.4.0.40 IE - HKU\S-1-5-21-1275210071-651377827-842925246-500\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=NAV&pvid=20.4.0.40 IE - HKU\S-1-5-21-1275210071-651377827-842925246-500\..\SearchScopes,DefaultScope = {EEE6C360-6118-11DC-9C72-001320C79847} IE - HKU\S-1-5-21-1275210071-651377827-842925246-500\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKU\S-1-5-21-1275210071-651377827-842925246-500\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "https://www.google.pl/" FF - prefs.js..extensions.enabledAddons: %7B55685567-4840-4a91-962b-49a412e9485a%7D:1.0.1 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:29.0.1 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@mozilla.zeniko.ch/SumatraPDF_Browser_Plugin: C:\Program Files\SumatraPDF\npPdfViewer.dll (Simon Bünzli) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\Documents and Settings\All Users\Dane aplikacji\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-14 14:04:15 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\Documents and Settings\All Users\Dane aplikacji\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ [2014-05-31 15:14:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 29.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013-09-03 13:21:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2014-05-26 09:32:55 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\6qjs2xp1.default\extensions [2014-05-26 09:32:55 | 000,008,896 | ---- | M] () (No name found) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\6qjs2xp1.default\extensions\{55685567-4840-4a91-962b-49a412e9485a}.xpi [2014-05-11 14:54:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions [2014-05-11 14:54:49 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2008-04-15 14:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coieplg.dll (Symantec Corporation) O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\ips\ipsbho.dll (Symantec Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coieplg.dll (Symantec Corporation) O3 - HKU\S-1-5-21-1275210071-651377827-842925246-500\..\Toolbar\WebBrowser: (no name) - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No CLSID value found. O4 - HKLM..\Run: [CnwiDeviceAgent] C:\Program Files\Canon\GAROStatusMonitor\cnwida.exe (CANON INC.) O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files\Mobogenie\DaemonProcess.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\GARO Status Monitor.lnk = C:\Program Files\Canon\GAROStatusMonitor\cnwism.exe (CANON INC.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\WIDEsystem.lnk = C:\Program Files\Contex\WIDEsystem\WS.exe (Contex A/S) O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1275210071-651377827-842925246-500\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Wyślij &do programu OneNote - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.152.34 194.204.159.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{6F719CC0-593F-4AD9-9FD7-20546FE65E15}: DhcpNameServer = 194.204.152.34 194.204.159.1 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013-05-13 09:02:30 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2014-05-15 16:30:35 | 000,055,224 | ---- | C] (StdLib) -- C:\WINDOWS\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gt.sys [2014-05-15 14:59:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ffdshow [2014-05-15 14:59:27 | 000,000,000 | ---D | C] -- C:\Program Files\ffdshow [2014-05-15 14:59:21 | 000,000,000 | ---D | C] -- C:\Program Files\webget [2014-05-15 14:58:16 | 004,760,957 | ---- | C] (ffdshow ) -- C:\Documents and Settings\Administrator\Moje dokumenty\ffdshow_rev4530_20140209_clsid.exe [2014-05-14 16:55:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2014-05-11 14:54:23 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2014-05-08 15:25:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\GARO Status Monitor [2014-05-08 15:25:16 | 000,106,496 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwiocNT.dll [2014-05-08 15:25:16 | 000,106,496 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwioc95.dll [2014-05-08 15:25:16 | 000,102,400 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwiolt.dll [2014-05-08 15:25:16 | 000,069,632 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwiopp.dll [2014-05-08 15:25:16 | 000,045,056 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwioppt.exe [2014-05-08 15:25:16 | 000,045,056 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwiopnt.exe [2014-05-08 15:25:16 | 000,045,056 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\cnwiop95.exe [2014-05-08 15:22:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Canon Printer Uninstaller [2014-05-08 15:22:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Canon [2014-05-08 15:21:36 | 000,061,551 | ---- | C] (CANON INC.) -- C:\WINDOWS\System32\CNWILMNT.DLL [2014-05-08 15:17:11 | 000,000,000 | ---D | C] -- C:\Program Files\Canon [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2014-05-31 15:22:16 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2014-05-31 15:11:56 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2014-05-31 15:11:33 | 000,000,216 | ---- | M] () -- C:\WINDOWS\tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job [2014-05-31 15:11:11 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2014-05-31 15:11:10 | 1341,710,336 | -HS- | M] () -- C:\hiberfil.sys [2014-05-22 08:57:32 | 000,001,973 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Norton Internet Security.LNK [2014-05-22 08:57:04 | 000,537,913 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1503000.00C\Cat.DB [2014-05-22 08:56:39 | 000,037,423 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1503000.00C\VT20140516.004 [2014-05-21 17:16:36 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\DriverDoc_UPDATES.job [2014-05-15 14:58:14 | 004,760,957 | ---- | M] (ffdshow ) -- C:\Documents and Settings\Administrator\Moje dokumenty\ffdshow_rev4530_20140209_clsid.exe [2014-05-15 09:22:51 | 000,692,400 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2014-05-15 09:22:51 | 000,070,832 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2014-05-12 16:40:56 | 000,055,224 | ---- | M] (StdLib) -- C:\WINDOWS\System32\drivers\{9edd0ea8-2819-47c2-8320-b007d5996f8a}Gt.sys [2014-05-11 09:11:03 | 000,000,172 | ---- | M] () -- C:\WINDOWS\System32\drivers\NIS\1503000.00C\isolate.ini [2014-05-08 15:25:37 | 000,001,727 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\GARO Status Monitor.lnk [2014-05-08 15:00:00 | 000,000,210 | ---- | M] () -- C:\WINDOWS\tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2014-05-15 14:59:30 | 000,112,640 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2014-05-15 14:59:30 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\ff_acm.acm [2014-05-08 15:25:37 | 000,001,727 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\GARO Status Monitor.lnk [2014-04-19 20:57:10 | 000,000,082 | ---- | C] () -- C:\WINDOWS\System32\winsevr.dat [2014-04-19 20:56:38 | 000,129,720 | ---- | C] () -- C:\WINDOWS\System32\ammntdrv.sys [2014-04-19 20:56:38 | 000,026,424 | ---- | C] () -- C:\WINDOWS\System32\ambakdrv.sys [2014-04-19 20:56:38 | 000,014,392 | ---- | C] () -- C:\WINDOWS\System32\amwrtdrv.sys [2014-03-19 12:21:45 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Bench32_2.47(dobreprogramy.pl)(1).INI [2014-03-19 12:08:31 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Bench32_2.47(dobreprogramy.pl).INI [2014-02-26 14:37:23 | 000,002,865 | ---- | C] () -- C:\WINDOWS\ctx_scan_2000.ini [2014-02-24 15:15:28 | 000,000,114 | ---- | C] () -- C:\WINDOWS\wininit.ini [2013-11-25 17:06:59 | 000,415,312 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2013-05-16 20:56:33 | 000,013,120 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2013-05-16 20:43:38 | 001,421,752 | ---- | C] () -- C:\WINDOWS\ampa.exe [2013-05-16 20:43:38 | 000,010,936 | ---- | C] () -- C:\WINDOWS\System32\ampa.sys [2013-05-13 18:34:11 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll [2013-05-13 18:30:12 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2013-05-13 18:29:18 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll [2013-05-13 15:50:58 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll [2013-05-13 11:53:27 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2013-05-13 11:50:10 | 000,381,632 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013-05-13 09:05:48 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2013-05-13 08:58:50 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [color=#E56717]========== ZeroAccess Check ==========[/color] [2013-05-13 17:50:25 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2013-02-21 21:10:13 | 001,510,400 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009-02-09 12:53:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-15 14:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [color=#E56717]========== LOP Check ==========[/color] [2013-12-03 18:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Canneverbe Limited [2014-02-26 14:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Contex [2014-03-03 00:24:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\LibreOffice [2014-02-26 14:36:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\SumatraPDF [2014-04-19 20:57:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AomeiBR [2013-05-17 19:14:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk [2013-05-16 20:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Canneverbe Limited [2014-05-08 15:22:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Canon [2013-05-16 20:58:16 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Common Files [2014-02-26 16:38:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Contex [2014-02-24 15:11:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Fighters [2013-05-17 03:47:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IBUpdaterService [2014-04-26 18:20:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Macrium [2013-05-16 20:59:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TuneUp Software [2013-05-16 20:58:16 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F} [2013-05-17 19:15:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Autodesk [2013-05-16 20:57:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Canneverbe Limited [2014-02-26 17:03:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Contex [2013-05-13 17:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Easeware [2013-05-16 21:29:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\LibreOffice [2014-05-30 09:07:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\newnext.me [2013-05-16 20:56:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\OpenCandy [2013-05-17 04:01:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\PerformerSoft [2013-06-17 15:45:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Philipp Winterberg [2013-05-17 01:31:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\SmartPCFix [2013-05-13 17:04:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\Solvusoft [2013-09-03 11:52:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\SumatraPDF [2013-05-16 20:58:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\PC\Dane aplikacji\TuneUp Software [color=#E56717]========== Purity Check ==========[/color] < End of report >