OTL logfile created on: 2014-09-21 19:52:44 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\JOB\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
3,00 Gb Total Physical Memory | 1,67 Gb Available Physical Memory | 55,76% Memory free
6,19 Gb Paging File | 4,93 Gb Available in Paging File | 79,57% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,59 Gb Total Space | 57,97 Gb Free Space | 39,01% Space Free | Partition Type: NTFS
Drive D: | 72,29 Gb Total Space | 20,36 Gb Free Space | 28,17% Space Free | Partition Type: NTFS
 
Computer Name: KOMPUTER-PC | User Name: JOB | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2014-09-20 14:39:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\JOB\Desktop\OTL.exe
PRC - [2014-09-04 14:50:02 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2014-02-24 16:27:06 | 001,343,408 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe
PRC - [2014-02-24 16:26:50 | 005,075,104 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET Smart Security\egui.exe
PRC - [2013-06-25 21:48:08 | 000,228,552 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE
PRC - [2012-05-18 12:25:20 | 000,081,920 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe
PRC - [2012-05-18 12:24:54 | 002,785,280 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe
PRC - [2012-05-08 14:05:58 | 001,818,472 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe
PRC - [2010-07-23 11:34:54 | 000,975,360 | ---- | M] (ActMask Co.,Ltd - http://www.all2pdf.com) -- C:\Windows\System32\PrintDisp.exe
PRC - [2009-10-28 19:59:48 | 000,065,536 | ---- | M] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\System32\PrintCtrl.exe
PRC - [2009-04-11 08:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2013-09-05 00:14:10 | 004,300,456 | ---- | M] () -- C:\Program Files\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
MOD - [2007-10-12 00:02:00 | 000,159,744 | ---- | M] () -- C:\Windows\System32\atitmmxx.dll
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV - [2014-09-09 21:19:45 | 000,267,440 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014-09-04 14:50:02 | 000,064,704 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2014-08-15 18:56:01 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014-07-02 11:45:03 | 005,037,888 | ---- | M] (TeamViewer GmbH) [On_Demand | Stopped] -- C:\Program Files\TeamViewer\Version9\TeamViewer_Service.exe -- (TeamViewer9)
SRV - [2014-02-24 16:27:06 | 001,343,408 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe -- (ekrn)
SRV - [2013-12-19 00:41:02 | 030,814,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012-05-18 12:25:20 | 000,081,920 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance)
SRV - [2012-05-18 12:24:54 | 002,785,280 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe -- (FirebirdServerDefaultInstance)
SRV - [2009-10-28 19:59:48 | 000,065,536 | ---- | M] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) [Auto | Running] -- C:\Windows\System32\PrintCtrl.exe -- (Printer Control)
SRV - [2008-01-19 00:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jubusenum.sys -- (huawei_enumerator)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_jucdcacm.sys -- (huawei_cdcacm)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\KOMPUTER\AppData\Local\Temp\esihdrv.sys -- (esihdrv)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2014-07-10 11:28:28 | 000,250,160 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0153.sys -- (RsFx0153)
DRV - [2013-09-17 14:17:38 | 000,188,808 | ---- | M] (ESET) [File_System | System | Running] -- C:\Windows\System32\drivers\eamonm.sys -- (eamonm)
DRV - [2013-09-17 14:17:38 | 000,174,400 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\epfw.sys -- (epfw)
DRV - [2013-09-17 14:17:38 | 000,134,248 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2013-09-17 14:17:38 | 000,049,240 | ---- | M] (ESET) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\epfwwfp.sys -- (epfwwfp)
DRV - [2013-09-17 14:17:38 | 000,037,416 | ---- | M] (ESET) [Kernel | System | Running] -- C:\Windows\System32\drivers\EpfwLWF.sys -- (EpfwLWF)
DRV - [2013-07-12 15:29:12 | 000,065,896 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftdibus.sys -- (FTDIBUS)
DRV - [2013-01-22 15:25:44 | 000,073,576 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ftser2k.sys -- (FTSER2K)
DRV - [2012-10-20 01:14:52 | 000,270,824 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0201.sys -- (RsFx0201)
DRV - [2012-07-25 21:25:34 | 000,034,248 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Program Files\Windows Kits\8.0\Assessment and Deployment Kit\Deployment Tools\x86\DISM\wimmount.sys -- (WIMMount)
DRV - [2010-06-23 10:21:32 | 000,259,176 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2009-04-11 07:06:26 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDScan.sys -- (WSDScan)
DRV - [2009-03-13 14:50:18 | 001,095,808 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\smserial.sys -- (smserial)
DRV - [2008-01-18 23:15:00 | 000,016,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV - [2007-10-12 00:13:16 | 003,155,456 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2007-07-31 18:45:50 | 000,076,800 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ser2pl.sys -- (Ser2pl)
DRV - [2007-07-02 17:37:10 | 000,131,616 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvrd32.sys -- (nvrd32)
DRV - [2007-07-02 17:37:08 | 000,110,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)
DRV - [2007-06-13 23:47:12 | 000,048,256 | ---- | M] (JMicron Technology Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID)
DRV - [2007-04-04 05:57:00 | 000,046,592 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\itecir.sys -- (itecir)
DRV - [2007-02-25 06:14:00 | 002,216,448 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32)
DRV - [2006-11-02 09:30:54 | 001,781,760 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{16D9930C-92FE-42D3-B64D-8838C7468FE4}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\..\SearchScopes,DefaultScope = 
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:30.0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.6.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2014-06-13 21:16:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 24.6.0\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins [2014-09-19 19:27:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird [2014-09-13 13:49:23 | 000,000,000 | ---D | M]
 
[2013-11-13 14:11:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\JOB\AppData\Roaming\mozilla\Extensions
[2014-08-15 18:54:54 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2014-08-15 18:56:08 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
 
[color=#E56717]========== Chrome  ==========[/color]
 
CHR - default_search_provider:  (Enabled)
CHR - default_search_provider: search_url = 
CHR - default_search_provider: suggest_url = 
CHR - plugin: Error reading preferences file
CHR - Extension: No name found = C:\Users\JOB\AppData\Local\Google\Chrome\User Data\Default\Extensions\beobeededemalmllhkmnkinmfembdimh\1.0.12_0\
CHR - Extension: No name found = C:\Users\JOB\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn\4.5.3_0\
CHR - Extension: No name found = C:\Users\JOB\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.7.13_0\
CHR - Extension: No name found = C:\Users\JOB\AppData\Local\Google\Chrome\User Data\Default\Extensions\kppfblhheocdidjdioajnkggcbjelojk\3.77_0\
CHR - Extension: No name found = C:\Users\JOB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_1\
 
O1 HOSTS File: ([2014-09-14 14:51:39 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BCSSync] C:\Program Files\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET Smart Security\egui.exe (ESET)
O4 - HKLM..\Run: [PrintDisp] C:\Windows\System32\PrintDisp.exe (ActMask Co.,Ltd - http://www.all2pdf.com)
O4 - HKCU..\Run: [HP Deskjet 3510 series (NET)] C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - Startup: C:\Users\JOB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk = C:\Program Files\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Notatki połączone programu OneNote - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_17-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0025-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_25-windows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.122.200.3 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7255B34F-26C3-45C1-8BFA-1862BF3C2734}: DhcpNameServer = 212.122.200.3 8.8.8.8
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E9204A0-A106-438C-91BA-7373E8CA9ABA}: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: D:\zdjęcia\motorki\2009-04-10-bikepics-potd.jpg
O24 - Desktop BackupWallPaper: D:\zdjęcia\motorki\2009-04-10-bikepics-potd.jpg
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2014-04-12 12:00:40 | 000,000,000 | ---D | M] - D:\automapa_android -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2014-09-20 14:39:15 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\JOB\Desktop\OTL.exe
[2014-09-20 14:23:57 | 002,347,384 | ---- | C] (ESET) -- C:\Users\JOB\Desktop\esetsmartinstaller_plk.exe
[2014-09-20 14:00:20 | 498,580,680 | ---- | C] (Microsoft Corporation) -- C:\Users\JOB\Desktop\Windows6.0-KB948465-X86.exe
[2014-09-20 11:45:37 | 017,292,760 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\JOB\Desktop\mbam-setup-2.0.2.1012.exe
[2014-09-19 19:27:29 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2014-09-18 08:28:54 | 000,000,000 | ---D | C] -- C:\bab3cddc3688b50ab1dfd5
[2014-09-18 08:19:04 | 000,000,000 | ---D | C] -- C:\fc36e2ef84d1dd4113615e99ec
[2014-09-17 17:49:46 | 000,000,000 | ---D | C] -- C:\Program Files\ophcrack
[2014-09-17 17:39:21 | 000,000,000 | ---D | C] -- C:\Windows\Hewlett-Packard
[2014-09-17 17:37:36 | 000,000,000 | ---D | C] -- C:\Users\JOB\AppData\Roaming\HpUpdate
[2014-09-17 12:14:01 | 000,000,000 | ---D | C] -- C:\feb0a93f8d2e41385d1471dd55beda
[2014-09-16 22:06:25 | 000,000,000 | ---D | C] -- C:\17033dfc137a0927d5504bb85acc76ba
[2014-09-15 23:53:24 | 000,000,000 | ---D | C] -- C:\ProgramData\S4H
[2014-09-15 23:53:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\S4H
[2014-09-15 23:53:00 | 000,000,000 | ---D | C] -- C:\Program Files\S4H
[2014-09-15 21:53:35 | 000,000,000 | ---D | C] -- C:\Users\JOB\Desktop\S4h
[2014-09-15 15:18:03 | 000,000,000 | ---D | C] -- C:\Users\JOB\Desktop\Nowy folder
[2014-09-14 14:59:21 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014-09-14 14:55:32 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014-09-14 14:55:25 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2014-09-14 14:55:25 | 000,000,000 | ---D | C] -- C:\Users\JOB\AppData\Local\temp
[2014-09-13 23:23:19 | 000,000,000 | ---D | C] -- C:\Users\JOB\Desktop\CV
[2014-09-13 13:49:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ESET
[2014-09-13 13:49:19 | 000,000,000 | ---D | C] -- C:\ProgramData\ESET
[2014-09-13 13:49:19 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2014-09-13 12:51:10 | 000,000,000 | ---D | C] -- C:\Program Files\Opera
[2014-09-13 12:47:53 | 000,000,000 | ---D | C] -- C:\Program Files\ClearThink
[2014-09-13 10:42:39 | 000,000,000 | ---D | C] -- C:\Users\JOB\{757ff9dd-0c15-43fb-a53c-f5f6283588af}
[2014-09-13 09:45:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
[2014-09-13 09:45:01 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2014-09-13 00:59:56 | 000,000,000 | ---D | C] -- C:\Users\JOB\{f31d0737-279b-43f5-bd33-0eac26f9720a}
[2014-09-13 00:11:03 | 000,000,000 | ---D | C] -- C:\Users\JOB\AppData\Local\ICSharpCode.net
[2014-09-12 23:49:17 | 000,000,000 | ---D | C] -- C:\Users\JOB\{59560c17-aa94-4549-9869-78276cc19e18}
[2014-09-11 23:23:43 | 000,000,000 | ---D | C] -- C:\found.000
[2014-09-11 17:04:59 | 000,000,000 | ---D | C] -- C:\Users\JOB\{c0da7030-76b4-4655-9fd5-e44cb58c2e21}
[2014-09-11 12:05:24 | 002,382,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2014-09-11 12:05:21 | 000,607,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2014-09-11 12:05:21 | 000,065,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2014-09-11 12:05:21 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2014-09-11 12:05:20 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2014-09-11 12:05:18 | 000,223,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2014-09-11 12:05:17 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2014-09-11 12:05:17 | 000,010,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2014-09-11 12:05:14 | 001,810,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2014-09-11 12:05:13 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2014-09-11 12:05:13 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2014-09-11 12:05:10 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2014-09-11 10:32:57 | 000,000,000 | ---D | C] -- C:\Windows\TempA0672160-2EF2-FCC2-49F0-45F6F9D90862-Signatures
[2014-09-11 10:32:50 | 000,000,000 | ---D | C] -- C:\Windows\Temp814B9DAF-CD20-31B5-69E5-DFD406C05D61-Signatures
[2014-08-28 21:57:53 | 002,054,656 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2014-08-26 16:20:35 | 000,000,000 | ---D | C] -- C:\Users\JOB\AppData\Local\Iceni
[2014-08-26 16:20:03 | 000,897,024 | ---- | C] (ActMask http://www.all2pdf.com) -- C:\Windows\System32\SaveTo.dll
[2014-08-26 16:19:45 | 000,975,360 | ---- | C] (ActMask Co.,Ltd - http://www.all2pdf.com) -- C:\Windows\System32\PrintDisp.exe
[2014-08-26 16:19:44 | 000,065,536 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\System32\PrintCtrl.exe
[2014-08-26 16:19:43 | 002,535,424 | ---- | C] (DynaForms GmbH) -- C:\Windows\System32\CPDF.dll
[2014-08-26 16:19:19 | 000,375,296 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\System32\SetPrinter.exe
[2014-08-26 16:19:18 | 000,740,864 | ---- | C] (ActMask - http://www.all2pdf.com) -- C:\Windows\System32\PrtTools.exe
[2014-08-26 16:19:17 | 001,171,456 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\System32\PrtClient.exe
[2014-08-26 16:19:15 | 001,700,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\gdiplus.dll
[2014-08-26 16:19:15 | 000,827,904 | ---- | C] (ActMask Co.,Ltd - HTTP://WWW.ALL2PDF.COM) -- C:\Windows\System32\SetupDrv.exe
[2014-08-26 16:18:48 | 000,000,000 | ---D | C] -- C:\Users\JOB\AppData\Roaming\Aspell
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2014-09-21 19:51:01 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2014-09-21 19:51:01 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2014-09-21 19:50:54 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014-09-20 22:19:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014-09-20 20:25:54 | 001,021,208 | ---- | M] () -- C:\Windows\System32\perfh015.dat
[2014-09-20 20:25:54 | 000,938,324 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2014-09-20 20:25:54 | 000,271,152 | ---- | M] () -- C:\Windows\System32\perfc015.dat
[2014-09-20 20:25:54 | 000,236,994 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2014-09-20 16:02:04 | 253,488,494 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2014-09-20 14:39:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\JOB\Desktop\OTL.exe
[2014-09-20 14:23:58 | 002,347,384 | ---- | M] (ESET) -- C:\Users\JOB\Desktop\esetsmartinstaller_plk.exe
[2014-09-20 14:13:11 | 498,580,680 | ---- | M] (Microsoft Corporation) -- C:\Users\JOB\Desktop\Windows6.0-KB948465-X86.exe
[2014-09-20 13:23:04 | 000,433,192 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2014-09-20 11:46:29 | 017,292,760 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\JOB\Desktop\mbam-setup-2.0.2.1012.exe
[2014-09-19 17:34:29 | 000,001,099 | ---- | M] () -- C:\Users\JOB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tworzenie wycinków ekranu i uruchamianie programu OneNote 2010.lnk
[2014-09-19 17:34:19 | 000,002,543 | ---- | M] () -- C:\Users\JOB\Desktop\Microsoft OneNote 2010.lnk
[2014-09-16 04:37:51 | 000,002,551 | ---- | M] () -- C:\Users\Public\Desktop\S4H Chef.lnk
[2014-09-16 04:37:51 | 000,002,549 | ---- | M] () -- C:\Users\Public\Desktop\S4H POS.lnk
[2014-09-15 21:51:04 | 000,000,166 | ---- | M] () -- C:\Windows\wcx_ftp.ini
[2014-09-14 23:38:17 | 302,694,400 | ---- | M] () -- C:\Users\JOB\Desktop\kav_rescue_10.iso
[2014-09-14 14:51:39 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2014-09-13 13:37:50 | 000,001,672 | ---- | M] () -- C:\Windows\System32\ASOROSet.bin
[2014-09-12 22:46:53 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2014-09-12 22:19:48 | 000,001,912 | ---- | M] () -- C:\Windows\epplauncher.mif
[2014-09-11 22:36:10 | 000,050,227 | ---- | M] () -- C:\Windows\System32\epfwdata.bin
[2014-09-09 21:19:44 | 000,701,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2014-09-09 21:19:44 | 000,071,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2014-09-08 18:10:45 | 005,499,373 | ---- | M] () -- C:\Users\JOB\Desktop\237.pdf
[2014-08-25 06:53:44 | 000,231,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
[2014-08-23 01:26:28 | 002,054,656 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2014-09-20 16:02:04 | 253,488,494 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2014-09-20 12:42:10 | 000,433,192 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2014-09-15 23:53:19 | 000,002,551 | ---- | C] () -- C:\Users\Public\Desktop\S4H Chef.lnk
[2014-09-15 23:53:19 | 000,002,549 | ---- | C] () -- C:\Users\Public\Desktop\S4H POS.lnk
[2014-09-15 21:41:38 | 000,000,545 | ---- | C] () -- C:\Windows\PKZIP.PIF
[2014-09-15 21:41:38 | 000,000,545 | ---- | C] () -- C:\Windows\PKUNZIP.PIF
[2014-09-14 23:29:56 | 302,694,400 | ---- | C] () -- C:\Users\JOB\Desktop\kav_rescue_10.iso
[2014-09-11 22:36:09 | 000,050,227 | ---- | C] () -- C:\Windows\System32\epfwdata.bin
[2014-09-08 18:10:18 | 005,499,373 | ---- | C] () -- C:\Users\JOB\Desktop\237.pdf
[2014-08-26 16:19:44 | 001,391,616 | ---- | C] () -- C:\Windows\System32\ActPDF.dll
[2014-08-26 16:19:21 | 000,524,288 | ---- | C] () -- C:\Windows\System32\PrtPass.exe
[2014-08-26 16:19:20 | 000,691,200 | ---- | C] () -- C:\Windows\System32\PrintLog.exe
[2014-01-04 16:13:31 | 000,488,448 | ---- | C] () -- C:\Windows\System32\apdfprintmon.dll
[2013-12-16 20:11:02 | 000,000,166 | ---- | C] () -- C:\Windows\wcx_ftp.ini
[2013-12-05 01:23:01 | 000,004,096 | -H-- | C] () -- C:\Users\JOB\AppData\Local\keyfile3.drm
[2013-11-05 01:00:00 | 000,048,128 | ---- | C] () -- C:\Windows\System32\wrkgadm.exe
[2013-10-14 20:20:52 | 000,001,672 | ---- | C] () -- C:\Windows\System32\ASOROSet.bin
[2013-09-26 21:36:16 | 000,012,254 | ---- | C] () -- C:\Windows\Ceres4.ini
[2013-07-29 21:06:45 | 000,000,057 | ---- | C] () -- C:\ProgramData\Ament.ini
[2013-02-18 15:58:41 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2013-02-17 23:07:46 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2013-02-17 23:07:45 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012-11-15 21:27:18 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2012-07-22 21:42:59 | 000,000,266 | RHS- | C] () -- C:\ProgramData\ntuser.pol
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2006-11-02 14:51:16 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2014-03-25 15:26:04 | 011,587,584 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009-04-11 08:28:19 | 000,614,912 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009-04-11 08:28:25 | 000,347,648 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2013-10-05 01:16:40 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ġ䁐Ġ
[2013-10-05 01:16:40 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ġ䁐Ġ
[2013-10-05 00:06:51 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠dž䁐dž
[2013-10-05 00:06:51 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠dž䁐dž
[2013-10-04 23:40:09 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǽ䁐ǽ
[2013-10-04 23:40:09 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǽ䁐ǽ
[2013-10-04 19:31:44 | 000,000,000 | ---D | M](C:\ProgramData\?®?®) -- C:\ProgramData\䌠®䁐®
[2013-10-04 19:31:44 | 000,000,000 | ---D | M](C:\ProgramData\?®?®) -- C:\ProgramData\䌠®䁐®
[2013-10-04 06:37:01 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǡ䁐ǡ
[2013-10-04 06:37:01 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǡ䁐ǡ
[2013-10-03 23:17:29 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǹ䁐ǹ
[2013-10-03 23:17:29 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǹ䁐ǹ
[2013-10-02 20:10:22 | 000,000,000 | ---D | M](C:\ProgramData\?I?I) -- C:\ProgramData\䌠Ǐ䁐Ǐ
[2013-10-02 20:10:22 | 000,000,000 | ---D | M](C:\ProgramData\?I?I) -- C:\ProgramData\䌠Ǐ䁐Ǐ
[2013-10-02 19:46:28 | 000,000,000 | ---D | M](C:\ProgramData\?ą?ą) -- C:\ProgramData\䌠ą䁐ą
[2013-10-02 19:46:28 | 000,000,000 | ---D | M](C:\ProgramData\?ą?ą) -- C:\ProgramData\䌠ą䁐ą
[2013-10-02 07:05:18 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠“䁐“
[2013-10-02 07:05:18 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠“䁐“
[2013-09-29 22:17:00 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠Š䁐Š
[2013-09-29 22:17:00 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠Š䁐Š
[2013-09-29 20:07:27 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ǥ䁐Ǥ
[2013-09-29 20:07:27 | 000,000,000 | ---D | M](C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ǥ䁐Ǥ
[2013-09-29 17:54:28 | 000,000,000 | ---D | M](C:\ProgramData\?U?U) -- C:\ProgramData\䌠Ǚ䁐Ǚ
[2013-09-29 17:54:28 | 000,000,000 | ---D | M](C:\ProgramData\?U?U) -- C:\ProgramData\䌠Ǚ䁐Ǚ
[2013-09-29 17:25:55 | 000,000,000 | ---D | M](C:\ProgramData\?O?O) -- C:\ProgramData\䌠Ǭ䁐Ǭ
[2013-09-29 17:25:55 | 000,000,000 | ---D | M](C:\ProgramData\?O?O) -- C:\ProgramData\䌠Ǭ䁐Ǭ
[2013-09-29 15:06:31 | 000,000,000 | ---D | M](C:\ProgramData\?o?o) -- C:\ProgramData\䌠ǒ䁐ǒ
[2013-09-29 15:06:31 | 000,000,000 | ---D | M](C:\ProgramData\?o?o) -- C:\ProgramData\䌠ǒ䁐ǒ
[2013-09-29 00:06:26 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǝ䁐ǝ
[2013-09-29 00:06:26 | 000,000,000 | ---D | M](C:\ProgramData\????) -- C:\ProgramData\䌠ǝ䁐ǝ
[2013-09-29 00:01:33 | 000,000,000 | ---D | M](C:\ProgramData\?u?u) -- C:\ProgramData\䌠ǜ䁐ǜ
[2013-09-29 00:01:33 | 000,000,000 | ---D | M](C:\ProgramData\?u?u) -- C:\ProgramData\䌠ǜ䁐ǜ
(C:\ProgramData\?U?U) -- C:\ProgramData\䌠Ǚ䁐Ǚ
(C:\ProgramData\?u?u) -- C:\ProgramData\䌠ǜ䁐ǜ
(C:\ProgramData\?O?O) -- C:\ProgramData\䌠Ǭ䁐Ǭ
(C:\ProgramData\?o?o) -- C:\ProgramData\䌠ǒ䁐ǒ
(C:\ProgramData\?I?I) -- C:\ProgramData\䌠Ǐ䁐Ǐ
(C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ǥ䁐Ǥ
(C:\ProgramData\?G?G) -- C:\ProgramData\䌠Ġ䁐Ġ
(C:\ProgramData\?ą?ą) -- C:\ProgramData\䌠ą䁐ą
(C:\ProgramData\?®?®) -- C:\ProgramData\䌠®䁐®
(C:\ProgramData\????) -- C:\ProgramData\䌠ǹ䁐ǹ
(C:\ProgramData\????) -- C:\ProgramData\䌠ǝ䁐ǝ
(C:\ProgramData\????) -- C:\ProgramData\䌠dž䁐dž
(C:\ProgramData\????) -- C:\ProgramData\䌠ǡ䁐ǡ
(C:\ProgramData\????) -- C:\ProgramData\䌠ǽ䁐ǽ
(C:\ProgramData\????) -- C:\ProgramData\䌠“䁐“
(C:\ProgramData\????) -- C:\ProgramData\䌠Š䁐Š

< End of report >