Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2015 01 Ran by Jarek (administrator) on JAREK-VAIO on 05-02-2015 13:31:04 Running from C:\Users\Jarek\Downloads Loaded Profiles: Jarek (Available profiles: Jarek) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe () C:\ProgramData\MobileBrServ\mbbService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Users\Jarek\Downloads\5rz2glmf.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2870032 2012-03-15] (Synaptics Incorporated) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-18] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Plus Internet] => C:\Program Files (x86)\Plus Internet\PlusInternetChecker.exe [492864 2012-04-20] () HKLM Group Policy restriction on software: syskey.exe <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.com <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.exe <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION HKLM Group Policy restriction on software: lsassvrtdbks.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.com <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.pif <====== ATTENTION HKLM Group Policy restriction on software: %systemdrive%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *:\$Recycle.Bin <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\Appdata\Roaming\Microsoft\Windows\IEUpdate\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.com <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.png*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.exe <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.com <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.scr <====== ATTENTION HKLM Group Policy restriction on software: %programfiles(x86)%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.com <====== ATTENTION HKLM Group Policy restriction on software: lsassw86s.exe <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION HKLM Group Policy restriction on software: ** <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.png*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programfiles%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.pif <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.com <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.7z*.com <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.com <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.scr <====== ATTENTION HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.scr <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.pdf*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.gif*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.png*.scr <====== ATTENTION HKLM Group Policy restriction on software: %allusersprofile%\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.mp3*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xlsx*.pif <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.pptx*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.divx*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.docx*.com <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wav*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.zip*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpeg*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.com <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.png*.com <====== ATTENTION HKLM Group Policy restriction on software: *.pub*.scr <====== ATTENTION HKLM Group Policy restriction on software: cipher.exe <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.txt*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\*.pif <====== ATTENTION HKLM Group Policy restriction on software: *.jpg*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.rtf*.scr <====== ATTENTION HKLM Group Policy restriction on software: %programdata%\*\svchost.exe <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.exe <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.pif <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.ppt*.com <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: *.avi*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.bmp*.com <====== ATTENTION HKLM Group Policy restriction on software: *.wma*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.mp4*.exe <====== ATTENTION HKLM Group Policy restriction on software: *.doc*.pif <====== ATTENTION HKLM Group Policy restriction on software: vssadmin.exe <====== ATTENTION HKLM Group Policy restriction on software: *.wmv*.com <====== ATTENTION HKLM Group Policy restriction on software: *.rar*.scr <====== ATTENTION HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.scr <====== ATTENTION HKLM Group Policy restriction on software: *.xls*.scr <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.com <====== ATTENTION HKLM Group Policy restriction on software: %appdata%\*\*.pif <====== ATTENTION HKLM Group Policy restriction on software: scsvserv.exe <====== ATTENTION Startup: C:\Users\Jarek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKU\S-1-5-21-2876413115-476791588-3789803701-1000\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2876413115-476791588-3789803701-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM -> DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=SNYEDF&pc=MASE&src=IE-SearchBox SearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKLM-x32 -> DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKLM-x32 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE SearchScopes: HKU\S-1-5-21-2876413115-476791588-3789803701-1000 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2876413115-476791588-3789803701-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-2876413115-476791588-3789803701-1000 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 62.179.1.62 62.179.1.63 FireFox: ======== FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) Chrome: ======= CHR Profile: C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Prezentacje Google) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-05] CHR Extension: (Dokumenty Google) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05] CHR Extension: (Dysk Google) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-05] CHR Extension: (YouTube) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-05] CHR Extension: (Szukaj w Google) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-05] CHR Extension: (Arkusze Google) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-05] CHR Extension: (Google Wallet) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-05] CHR Extension: (Gmail) - C:\Users\Jarek\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-05] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S4 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [106144 2012-01-19] (Atheros Commnucations) [File not signed] R2 Huawei E3372; C:\ProgramData\MobileBrServ\mbbservice.exe [240720 2014-03-07] () R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [121344 2012-02-07] () [File not signed] R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-07] (Intel Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) S4 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2012-01-19] (Atheros) [File not signed] S4 GamesAppService; "C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.) R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-08-22] (AVG Technologies) S3 BTATH_VDP; C:\Windows\System32\drivers\btath_vdp.sys [421664 2012-01-19] (Atheros) S3 ewusbmbb; C:\Windows\System32\DRIVERS\ewusbwwan.sys [415744 2012-04-20] (Huawei Technologies Co., Ltd.) [File not signed] U5 ewusbnet; C:\Windows\System32\Drivers\ewusbnet.sys [250368 2010-04-07] (Huawei Technologies Co., Ltd.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) U3 ugtyrpow; \??\C:\Users\Jarek\AppData\Local\Temp\ugtyrpow.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-05 13:29 - 2015-02-05 13:30 - 00000129 _____ () C:\Users\Jarek\Downloads\fixlist.txt 2015-02-05 13:24 - 2015-02-05 13:31 - 00024708 _____ () C:\Users\Jarek\Downloads\FRST.txt 2015-02-05 13:22 - 2015-02-05 13:22 - 00053248 _____ () C:\Windows\SysWOW64\zlib.dll 2015-02-05 13:22 - 2015-02-05 13:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Foolish IT 2015-02-05 13:22 - 2015-02-05 13:22 - 00000000 ____D () C:\ProgramData\Foolish IT 2015-02-05 13:22 - 2015-02-05 13:22 - 00000000 ____D () C:\Program Files (x86)\Foolish IT 2015-02-05 13:18 - 2015-02-05 13:19 - 00971528 _____ (Foolish IT LLC ) C:\Users\Jarek\Downloads\CryptoPreventSetup.exe 2015-02-05 12:09 - 2015-02-05 12:09 - 00380416 _____ () C:\Users\Jarek\Downloads\5rz2glmf.exe 2015-02-05 11:57 - 2015-02-05 11:57 - 00002221 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-05 11:57 - 2015-02-05 11:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-02-05 11:56 - 2015-02-05 13:01 - 00001046 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-05 11:56 - 2015-02-05 12:01 - 00001042 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-05 11:56 - 2015-02-05 11:56 - 00003790 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-05 11:55 - 2015-02-05 11:56 - 00000000 ____D () C:\Users\Jarek\AppData\Local\Deployment 2015-02-05 11:55 - 2015-02-05 11:55 - 00000000 ____D () C:\Users\Jarek\AppData\Local\Apps\2.0 2015-02-05 11:46 - 2015-02-05 11:46 - 00001576 _____ () C:\Windows\PFRO.log 2015-02-05 11:42 - 2015-02-05 11:42 - 00000000 ____D () C:\ProgramData\c406ba16000042c6 2015-02-05 11:23 - 2015-02-05 11:23 - 00000000 ____D () C:\ProgramData\Mini - Adblocker 2015-02-05 11:22 - 2015-02-05 13:28 - 00052272 _____ () C:\Users\Jarek\Downloads\Shortcut.txt 2015-02-05 11:19 - 2015-02-05 13:28 - 00037531 _____ () C:\Users\Jarek\Downloads\Addition.txt 2015-02-05 11:17 - 2015-02-05 13:31 - 00000000 ____D () C:\FRST 2015-02-05 11:16 - 2015-02-05 11:16 - 02131968 _____ (Farbar) C:\Users\Jarek\Downloads\FRST64.exe 2015-02-05 11:15 - 2015-02-05 11:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2015-02-05 11:11 - 2015-02-05 11:11 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works 2015-02-05 11:04 - 2015-02-05 11:04 - 00461202 _____ () C:\Users\Jarek\Documents\cc_20150205_110430.reg 2015-02-05 11:02 - 2015-02-05 11:02 - 00000000 ____D () C:\ProgramData\3872871776 2015-02-05 03:30 - 2015-02-05 03:30 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{DF051DBE-D726-4020-97B0-B9B13562CD79} 2015-02-04 15:53 - 2015-02-05 11:47 - 00000956 _____ () C:\Windows\setupact.log 2015-02-04 15:53 - 2015-02-04 15:53 - 00000000 _____ () C:\Windows\setuperr.log 2015-02-04 15:30 - 2015-02-04 16:05 - 02359350 _____ () C:\Users\Jarek\Downloads\!Decrypt-All-Files-ipeqgvm.bmp 2015-02-04 15:30 - 2015-02-04 16:05 - 00001266 _____ () C:\Users\Jarek\Downloads\!Decrypt-All-Files-ipeqgvm.txt 2015-02-04 12:15 - 2015-02-04 12:15 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{23B198BA-5810-46B5-B531-56E95C5EE429} 2015-02-04 01:34 - 2015-02-05 11:08 - 00002774 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC 2015-02-04 01:34 - 2015-02-04 01:34 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk 2015-02-04 01:34 - 2015-02-04 01:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner 2015-02-04 01:33 - 2015-02-04 01:34 - 00000000 ____D () C:\Program Files\CCleaner 2015-02-04 01:25 - 2015-02-04 01:25 - 00003866 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1423009507 2015-02-04 01:25 - 2015-02-04 01:25 - 00001095 _____ () C:\Users\Public\Desktop\Opera.lnk 2015-02-04 01:25 - 2015-02-04 01:25 - 00001095 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk 2015-02-04 01:25 - 2015-02-04 01:25 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\Opera Software 2015-02-04 01:25 - 2015-02-04 01:25 - 00000000 ____D () C:\Users\Jarek\AppData\Local\Opera Software 2015-02-04 01:24 - 2015-02-04 16:11 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-02-04 01:23 - 2015-02-04 01:23 - 05325208 _____ (Piriform Ltd) C:\Users\Jarek\Downloads\CCleaner 5.02.5101 [1].exe 2015-02-04 01:21 - 2015-02-04 01:22 - 00700904 _____ (komputerswiat.pl) C:\Users\Jarek\Downloads\CCleaner 5.02.5101.exe 2015-02-04 00:50 - 2015-02-04 00:50 - 00000020 _____ () C:\Users\Jarek\AppData\Roaming\appdataFr3.bin 2015-02-04 00:50 - 2015-02-04 00:50 - 00000000 ____D () C:\ProgramData\The AdBlocker 2015-02-04 00:13 - 2015-02-04 00:13 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{A557DFFB-47F3-42EF-8B0A-571B91BDBE60} 2015-02-04 00:12 - 2015-02-04 00:12 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{5CF2146B-08A3-488F-BF00-187015198133} 2015-02-03 23:38 - 2015-02-03 23:38 - 00000000 ____D () C:\Users\Jarek\Desktop\graal single 2015-02-03 23:20 - 2015-02-03 23:20 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{C80ABDB0-3AFE-4071-9208-87E2AEB306BE} 2015-02-03 07:51 - 2015-02-03 07:51 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{82F33FC8-0D8A-492B-8A44-8655F628FCAC} 2015-02-02 20:29 - 2015-02-02 20:29 - 00000000 ____D () C:\Users\Jarek\Desktop\graal radiowy 2015-02-02 19:50 - 2015-02-02 19:50 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{CF85AEBD-7E63-4A21-ADEB-FABDDB8D0941} 2015-02-02 07:08 - 2015-02-02 07:09 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{21F09AC5-9746-4D7A-B5CC-018EF1534324} 2015-02-01 19:06 - 2015-02-01 19:06 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{E436A8DF-EDA1-4499-89D1-152DF52AF302} 2015-02-01 02:51 - 2015-02-01 02:51 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{D4A6E46F-2CCA-4F84-B2AC-C572903AB186} 2015-01-31 13:18 - 2015-01-31 13:19 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{32433E29-6F53-4C1F-990E-D068B772D356} 2015-01-30 12:25 - 2015-01-30 12:25 - 00000767 _____ () C:\Users\Jarek\Downloads\historia_2015-01-30_4682 (2).csv 2015-01-30 12:07 - 2015-01-30 12:07 - 00001077 _____ () C:\Users\Jarek\Downloads\historia_2015-01-30_4682 (1).csv 2015-01-30 12:02 - 2015-01-30 12:03 - 00001115 _____ () C:\Users\Jarek\Downloads\historia_2015-01-30_4682.csv 2015-01-30 09:55 - 2015-01-30 09:56 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{7757EB3C-1E1A-42AA-8DFE-1AF2980B84EE} 2015-01-29 21:26 - 2015-01-29 21:26 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{6829EBC3-6557-44C8-A35D-8695FDA2CE45} 2015-01-29 09:25 - 2015-01-29 21:02 - 00000000 ____D () C:\Program Files (x86)\IsaVeer 2015-01-29 09:25 - 2015-01-29 09:26 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{D1D95BC8-3D20-4087-A27C-FC66E4303038} 2015-01-29 01:45 - 2015-01-29 01:45 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{AA6A701A-46F8-46A9-9D27-A15AD82BFDA0} 2015-01-28 10:09 - 2015-01-28 10:09 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{7A597A50-DC31-4988-822B-98321524EA66} 2015-01-27 22:08 - 2015-01-27 22:08 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{C1FAD733-26FB-44FE-8F4F-9BFDA85E302D} 2015-01-27 10:01 - 2015-01-27 10:02 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{1974D296-6D92-424B-BC50-19E38CD57C23} 2015-01-26 22:01 - 2015-01-26 22:01 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{1C04494A-67F5-4A1D-9CA8-20B402565120} 2015-01-26 18:20 - 2015-01-26 18:20 - 00000467 _____ () C:\Users\Jarek\Documents\jasnachmura@jasnachmura.art.pl.vcf 2015-01-26 10:00 - 2015-01-26 10:00 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{4C4222DD-5639-4627-9A73-B85B29074D33} 2015-01-25 21:36 - 2015-01-25 21:37 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{5EABDCEB-7B2F-4E16-8CCD-0E08AE7CD0E0} 2015-01-25 09:36 - 2015-01-25 09:36 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{C72969C4-771E-4C68-BBED-3FF732E03DB6} 2015-01-24 21:35 - 2015-01-24 21:35 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{CF737049-981A-49DB-A9D7-E1BFDFE0A44B} 2015-01-24 09:31 - 2015-01-24 09:31 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{3C436FC4-8B07-4EEC-9B67-2F342E1F9BB1} 2015-01-24 01:33 - 2015-01-24 01:33 - 00587216 _____ () C:\Users\Jarek\Downloads\Java (2).exe 2015-01-23 21:30 - 2015-01-23 21:31 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{B25F8815-FFDB-4CB0-8D2D-47AE2DF020B6} 2015-01-23 09:29 - 2015-01-23 09:29 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{EFF7C64F-1E26-4690-A9B0-7F8DF6820C2C} 2015-01-22 12:48 - 2015-01-22 12:49 - 00000000 ____D () C:\Users\Jarek\Desktop\Jarek Polit 21.01.2015 2015-01-22 12:31 - 2015-01-22 12:31 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{45EBB296-F4BC-4F6D-A6AE-69F7851544A2} 2015-01-22 07:51 - 2015-01-29 21:02 - 00000000 ____D () C:\ProgramData\DeEaalExpress 2015-01-22 00:30 - 2015-01-22 00:31 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{9EEE5ABB-EB9B-4631-84D8-22E4FA0441F5} 2015-01-21 12:29 - 2015-01-21 12:29 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{0F344905-B54B-448B-AF1B-5FFF0C67F92E} 2015-01-20 23:23 - 2015-01-20 23:23 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{7049B71F-2FB4-4FDB-8F88-3A4D0A9A1D7C} 2015-01-20 14:20 - 2015-02-04 16:07 - 00000000 ____D () C:\Users\Jarek\Desktop\quantum threeory 2015-01-20 11:22 - 2015-01-20 11:22 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{8272C6CF-7F57-4DB0-9172-B4DB047289EA} 2015-01-19 22:46 - 2015-01-19 22:47 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{13B67ED0-9FB4-4704-99B3-6F484DAC9746} 2015-01-19 10:45 - 2015-01-19 10:45 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{2D973F85-6A88-4679-987C-67FC6BDD6659} 2015-01-18 15:54 - 2015-01-18 15:54 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{74FEA828-356D-4441-9A93-E4E881519551} 2015-01-18 02:48 - 2015-01-18 02:49 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{98143841-CE86-47E0-BF6C-437448DEC03B} 2015-01-17 13:35 - 2015-01-17 13:35 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{D60FC37D-44CB-49BD-8157-A922E5BD17B4} 2015-01-16 09:10 - 2015-01-29 21:02 - 00000000 ____D () C:\ProgramData\EEnjooYCouppon 2015-01-16 08:40 - 2015-01-16 08:40 - 00596608 _____ () C:\Users\Jarek\Downloads\Java (1).exe 2015-01-16 08:25 - 2015-01-16 08:25 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{C3C1285B-84A4-4A2E-9C3B-59BF9C2D69CD} 2015-01-15 15:53 - 2015-01-29 21:02 - 00000000 ____D () C:\ProgramData\50Cuoupons 2015-01-15 11:38 - 2015-01-15 11:38 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{993EB20A-5709-4F6B-B82D-814F4F3A7645} 2015-01-15 08:20 - 2015-01-22 07:53 - 00000000 ____D () C:\ProgramData\7875723679439a5a 2015-01-14 23:02 - 2015-01-14 23:02 - 00588136 _____ () C:\Users\Jarek\Downloads\Java.exe 2015-01-14 22:28 - 2015-01-14 22:28 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{74620FB1-C1B6-4894-977D-CB983CCE1618} 2015-01-14 09:20 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll 2015-01-14 09:20 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2015-01-14 09:20 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-01-14 09:20 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-01-14 09:20 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-01-14 09:20 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-01-14 09:20 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2015-01-14 09:20 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2015-01-14 09:20 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2015-01-14 09:20 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2015-01-14 09:19 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-01-14 09:19 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-01-14 09:19 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-01-14 09:11 - 2015-01-14 09:11 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{64A37FA5-A115-404A-84E5-4BB3D7488FF1} 2015-01-13 08:51 - 2015-01-13 08:51 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{F6B1BCA1-A078-475E-9937-385A38EC6411} 2015-01-12 17:48 - 2015-01-12 17:48 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{9BC28F67-8F11-4E3F-9680-27A64CA12D00} 2015-01-12 17:43 - 2015-01-12 17:43 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{1E707986-AEBA-4550-AE10-870FCCEE30F1} 2015-01-12 05:42 - 2015-01-12 05:42 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{B0E9A879-BC91-4CB3-8D12-0D454EC67922} 2015-01-11 13:00 - 2015-01-11 13:00 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{982AD240-C855-42D1-B50E-2599ED598EBD} 2015-01-11 00:40 - 2015-01-11 00:41 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{25483D8D-4E53-4223-836C-273B0B61AF56} 2015-01-10 12:40 - 2015-01-10 12:40 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{E85E571B-317F-4A7D-870B-98AD31A4F6B5} 2015-01-10 00:07 - 2015-01-10 00:07 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{CC6ACC42-F714-47A5-BE02-725D21B0AE7D} 2015-01-09 23:16 - 2015-01-09 23:16 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{7B6D7344-DA63-40F3-BE82-DC309CCD25DE} 2015-01-09 23:12 - 2015-01-09 23:12 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{8E681D09-4357-442A-A4CB-9194C7875615} 2015-01-09 08:45 - 2015-01-09 08:45 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{E37C083C-4731-4513-98B2-DD9210691A21} 2015-01-08 13:15 - 2015-01-29 09:26 - 00000000 ____D () C:\ProgramData\8679969435114773082 2015-01-08 13:11 - 2015-01-08 13:11 - 01249280 _____ () C:\Users\Jarek\Downloads\Download (3).exe 2015-01-08 13:09 - 2015-01-08 13:10 - 01249280 _____ () C:\Users\Jarek\Downloads\Renata%20Zar%3Fbska%20-%20Noc%20z%20Renat%3F.mp3.exe 2015-01-08 11:38 - 2015-01-08 11:38 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{5DC4C744-5F48-4193-8310-E4C89B2A85D5} 2015-01-07 22:26 - 2015-01-07 22:26 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{2282C9D8-6E16-437E-A753-4FA092F16C00} 2015-01-07 09:07 - 2015-01-07 09:07 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{294872E8-0BCE-45D3-840F-72AF7967D44F} 2015-01-06 11:34 - 2015-01-06 11:34 - 00000000 ____D () C:\Users\Jarek\AppData\Local\{F0823416-4F59-4BC0-923A-6EED3507AE43} ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-05 13:24 - 2012-06-27 08:31 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-02-05 12:56 - 2012-06-27 07:34 - 02071482 _____ () C:\Windows\WindowsUpdate.log 2015-02-05 12:46 - 2012-08-01 13:31 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\SoftGrid Client 2015-02-05 11:57 - 2012-10-04 10:37 - 00000000 ____D () C:\Users\Jarek\AppData\Local\Google 2015-02-05 11:57 - 2012-10-04 10:37 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-05 11:56 - 2012-10-04 10:37 - 00004042 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-05 11:56 - 2009-07-14 05:45 - 00028848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-05 11:56 - 2009-07-14 05:45 - 00028848 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-05 11:55 - 2012-08-01 12:47 - 00000000 ____D () C:\Users\Jarek\AppData\Local\CrashDumps 2015-02-05 11:51 - 2013-11-09 01:15 - 01426944 ___SH () C:\Users\Jarek\Downloads\Thumbs.db 2015-02-05 11:49 - 2013-10-28 10:59 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\Dropbox 2015-02-05 11:48 - 2013-10-08 20:47 - 05701120 ___SH () C:\Users\Jarek\Desktop\Thumbs.db 2015-02-05 11:48 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-05 11:47 - 2014-08-25 10:10 - 00065536 _____ () C:\Windows\system32\Ikeext.etl 2015-02-05 11:47 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-05 11:47 - 2009-07-14 05:45 - 00330128 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-05 11:15 - 2013-01-14 10:10 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-05 11:15 - 2012-07-24 09:39 - 00076416 _____ () C:\Users\Jarek\AppData\Local\GDIPFONTCACHEV1.DAT 2015-02-05 11:10 - 2012-06-27 08:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-05 11:09 - 2014-03-24 20:37 - 00003084 _____ () C:\Windows\System32\Tasks\{363F7A12-B195-4882-A45E-0177088DD5F1} 2015-02-05 11:09 - 2013-01-13 14:20 - 00003080 _____ () C:\Windows\System32\Tasks\Go for FilesUpdate 2015-02-05 11:09 - 2012-08-01 12:04 - 00003542 _____ () C:\Windows\System32\Tasks\CreateChoiceProcessTask 2015-02-05 11:08 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared 2015-02-05 11:07 - 2012-08-01 13:29 - 00000000 ____D () C:\Program Files\Microsoft Office 2015-02-05 11:07 - 2012-06-27 07:47 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-02-05 11:07 - 2012-02-24 03:38 - 00000000 ____D () C:\Windows\ShellNew 2015-02-05 11:06 - 2012-06-27 07:37 - 00000000 ____D () C:\ProgramData\Sony Corporation 2015-02-05 11:05 - 2012-06-27 08:01 - 00000000 ____D () C:\Windows\System32\Tasks\Sony Corporation 2015-02-05 11:03 - 2011-12-07 03:14 - 00741124 _____ () C:\Windows\system32\perfh015.dat 2015-02-05 11:03 - 2011-12-07 03:14 - 00156408 _____ () C:\Windows\system32\perfc015.dat 2015-02-05 11:03 - 2009-07-14 06:13 - 01672134 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-05 10:59 - 2013-05-28 14:13 - 00003974 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{9A1FA276-835E-43D3-9FF7-E79633469F01} 2015-02-04 23:02 - 2014-04-23 14:28 - 00000000 ____D () C:\Users\Jarek\Desktop\nowa muzyka 2015-02-04 22:53 - 2013-09-18 15:25 - 00000000 ____D () C:\Users\Jarek\Desktop\pliki muzyczne 2015-02-04 21:45 - 2014-05-19 23:03 - 00000000 ____D () C:\Users\Jarek\Desktop\promocja 2015-02-04 16:09 - 2014-12-19 10:15 - 00000000 ____D () C:\Users\Jarek\Desktop\For - Tune - propozycje na okładki 2015-02-04 16:09 - 2014-07-16 13:09 - 00000000 ____D () C:\Users\Jarek\Desktop\okładki kądziela 2015-02-04 16:09 - 2014-05-17 15:12 - 00000000 ____D () C:\Users\Jarek\Desktop\zdjęcia nowe 2015-02-04 16:08 - 2014-10-09 07:43 - 00000000 ____D () C:\Users\Jarek\Desktop\wojtczak foty 2015-02-04 16:07 - 2014-11-13 09:42 - 00000000 ____D () C:\Users\Jarek\Desktop\umowy 2015-02-04 16:07 - 2014-04-29 18:03 - 00000000 ____D () C:\Users\Jarek\Desktop\okładki 2015-02-04 16:07 - 2014-03-19 21:11 - 00000000 ____D () C:\Users\Jarek\Desktop\Nowy folder 2015-02-04 16:02 - 2013-02-17 21:25 - 00000000 ____D () C:\FOR TUNE 2015-02-04 15:54 - 2012-06-27 07:48 - 00000000 ____D () C:\Program Files (x86)\Bluetooth Suite 2015-02-04 15:46 - 2013-01-20 23:30 - 00000000 ____D () C:\Users\Jarek\Documents\Natti 2015-02-04 15:37 - 2013-09-18 15:18 - 00000000 ____D () C:\Users\Jarek\Desktop\najnowsze produkcje 2015-02-04 15:37 - 2012-08-08 12:30 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\Plus Internet 2015-02-04 15:36 - 2014-05-19 23:29 - 00000000 ____D () C:\Users\Jarek\Desktop\umowy gosi 2015-02-04 15:35 - 2014-09-11 11:03 - 00000000 ____D () C:\Users\Jarek\Desktop\wania telewizja 2015-02-04 15:34 - 2014-10-02 13:42 - 00000000 ____D () C:\Users\Jarek\Desktop\kody kreskowe 2015-02-04 15:34 - 2014-05-18 10:40 - 00000000 ____D () C:\Users\Jarek\Desktop\nowości w produkcji 2015-02-04 15:34 - 2014-03-28 18:17 - 00000000 ____D () C:\Users\Jarek\Desktop\karty projektu 2015-02-04 15:32 - 2013-01-15 08:03 - 00000000 ____D () C:\Program Files (x86)\Plus Internet 2015-02-04 15:32 - 2012-06-27 08:16 - 00000000 ____D () C:\Program Files (x86)\MSXML 4.0 2015-02-04 15:30 - 2014-03-24 12:26 - 00000000 ____D () C:\Qoobox 2015-02-04 15:28 - 2013-04-20 21:41 - 00000000 ____D () C:\Program Files (x86)\Media Player Classic - Home Cinema 2015-02-04 15:28 - 2013-04-12 18:44 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-02-04 15:28 - 2012-06-27 08:00 - 00000000 ____D () C:\Program Files (x86)\Qualcomm Atheros WiFi Driver Installation 2015-02-04 15:27 - 2013-09-17 18:30 - 00000000 ____D () C:\AdwCleaner 2015-02-04 15:27 - 2012-12-11 11:43 - 00000000 ____D () C:\Program Files\WinRAR 2015-02-04 15:27 - 2012-06-27 09:57 - 00000000 ____D () C:\ProgramData\iolo 2015-02-04 15:27 - 2012-06-27 07:52 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies 2015-02-04 01:37 - 2013-04-20 21:46 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\Media Player Classic 2015-02-04 01:36 - 2013-01-17 12:37 - 00000000 ____D () C:\Windows\Minidump 2015-02-04 01:36 - 2011-12-07 00:41 - 00000000 ____D () C:\Windows\Panther 2015-02-04 01:28 - 2014-09-06 12:05 - 00000000 ____D () C:\Users\Jarek\AppData\Roaming\Systweak 2015-02-04 01:07 - 2014-03-24 12:13 - 00010608 _____ () C:\Users\Jarek\Documents\Co robimy z.DOCX.ipeqgvm 2015-02-03 23:36 - 2014-03-19 21:14 - 00001282 _____ () C:\Users\Jarek\Desktop\kraków delegacja.lnk 2015-02-03 23:30 - 2014-03-24 12:13 - 00010640 _____ () C:\Users\Jarek\Desktop\zadania luty 2015.DOCX.ipeqgvm 2015-02-02 20:28 - 2012-07-25 17:59 - 122800544 _____ () C:\Users\Jarek\Downloads\graal radiowy.ZIP.ipeqgvm 2015-02-02 11:49 - 2014-03-24 12:13 - 00010784 _____ () C:\Users\Jarek\Desktop\Krzysztof Dys Trio tytuły.DOCX.ipeqgvm 2015-01-31 13:04 - 2012-07-25 17:59 - 00952288 _____ () C:\Users\Jarek\Downloads\W_rozklad_jazdy.PDF.ipeqgvm 2015-01-30 12:27 - 2014-03-24 12:13 - 00039056 _____ () C:\Users\Jarek\Downloads\szablon_historia (1).ODS.ipeqgvm 2015-01-30 12:25 - 2014-03-24 12:13 - 00214320 _____ () C:\Users\Jarek\Downloads\szablon_historia (2).XLS.ipeqgvm 2015-01-30 12:24 - 2014-03-24 12:13 - 00214320 _____ () C:\Users\Jarek\Downloads\szablon_historia (1).XLS.ipeqgvm 2015-01-30 12:04 - 2014-03-24 12:13 - 00214320 _____ () C:\Users\Jarek\Downloads\szablon_historia.XLS.ipeqgvm 2015-01-30 12:04 - 2014-03-24 12:13 - 00039056 _____ () C:\Users\Jarek\Downloads\szablon_historia.ODS.ipeqgvm 2015-01-28 14:56 - 2014-03-24 12:13 - 00067616 _____ () C:\Users\Jarek\Downloads\10955643_1023139411036392_8601085816663695475_n.JPG.ipeqgvm 2015-01-28 14:56 - 2014-03-24 12:13 - 00050096 _____ () C:\Users\Jarek\Downloads\1506033_1023139414369725_8007854140971102366_n.JPG.ipeqgvm 2015-01-27 11:09 - 2014-03-24 12:13 - 00000160 ____H () C:\Users\Jarek\Desktop\~$secki, Mazurki_ok-ang.ODT.ipeqgvm 2015-01-26 18:20 - 2014-03-24 12:13 - 00003104 _____ () C:\Users\Jarek\Documents\Graal_teksty _2015.RTF.ipeqgvm 2015-01-26 18:20 - 2014-03-24 12:13 - 00002432 _____ () C:\Users\Jarek\Documents\Budyn_przedmowa.DOC.ipeqgvm 2015-01-26 18:20 - 2014-03-24 12:13 - 00002336 _____ () C:\Users\Jarek\Documents\Czarne 13 przedmowa.RTF.ipeqgvm 2015-01-26 18:20 - 2014-03-24 12:13 - 00000512 _____ () C:\Users\Jarek\Documents\Graal_kolejnosc _2015.RTF.ipeqgvm 2015-01-26 10:09 - 2012-07-25 17:59 - 05768464 _____ () C:\Users\Jarek\Desktop\kądziela wójciński cover.JPG.ipeqgvm 2015-01-26 09:36 - 2014-03-24 12:13 - 00007600 _____ () C:\Users\Jarek\Desktop\Urban Mazurkas.ODT.ipeqgvm 2015-01-26 09:35 - 2014-03-24 12:13 - 00007888 _____ () C:\Users\Jarek\Desktop\Masecki, Mazurki_ok.ODT.ipeqgvm 2015-01-25 17:32 - 2014-03-24 12:13 - 00030464 _____ () C:\Users\Jarek\Desktop\Masecki, Mazurki_ok-ang.ODT.ipeqgvm 2015-01-23 14:53 - 2014-03-24 12:13 - 00078192 _____ () C:\Users\Jarek\Desktop\gaweda pegapofo.JPG.ipeqgvm 2015-01-23 12:42 - 2012-07-25 17:59 - 58841952 _____ () C:\Users\Jarek\Downloads\choice instrumental.ZIP.ipeqgvm 2015-01-23 11:15 - 2014-03-24 12:13 - 00648528 _____ () C:\Users\Jarek\Downloads\img-123111356-0001.PDF.ipeqgvm 2015-01-23 11:15 - 2014-03-24 12:13 - 00648528 _____ () C:\Users\Jarek\Downloads\img-123111356-0001 (1).PDF.ipeqgvm 2015-01-22 17:57 - 2014-03-24 12:13 - 00016320 _____ () C:\Users\Jarek\Desktop\zdjęcia Jan Bebel 2014.DOC.ipeqgvm 2015-01-22 17:52 - 2014-03-24 12:13 - 00015920 _____ () C:\Users\Jarek\Desktop\zdjecia_machowina.DOC.ipeqgvm 2015-01-19 07:58 - 2012-07-25 17:59 - 07085552 _____ () C:\Users\Jarek\Downloads\jazzpress0115 (1).PDF.ipeqgvm 2015-01-17 18:04 - 2014-03-24 12:13 - 00017728 _____ () C:\Users\Jarek\Desktop\!cid_120F4D70-6066-4B9E-9294-1AAD63940DD3@toya_net.JPG.ipeqgvm 2015-01-17 03:09 - 2011-12-07 03:51 - 01644740 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2015-01-16 17:09 - 2012-07-25 17:59 - 07086928 _____ () C:\Users\Jarek\Downloads\jazzpress0115.PDF.ipeqgvm 2015-01-15 10:24 - 2014-03-24 12:13 - 00010656 _____ () C:\Users\Jarek\Desktop\SAMUEL BLASER.DOCX.ipeqgvm 2015-01-15 03:11 - 2013-09-02 06:35 - 00000000 ____D () C:\Windows\system32\MRT 2015-01-15 03:01 - 2013-09-02 06:35 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-01-12 16:56 - 2014-03-24 12:13 - 00007936 _____ () C:\Users\Jarek\Desktop\obliczanie brutto - netto.XLS.ipeqgvm 2015-01-10 00:11 - 2012-07-25 17:59 - 227342704 _____ () C:\Users\Jarek\Downloads\wetransfer-3aa822.ZIP.ipeqgvm 2015-01-08 13:58 - 2014-03-24 12:13 - 00105600 _____ () C:\Users\Jarek\Desktop\10896451_10205412868663944_3929678278154502598_o.JPG.ipeqgvm ==================== Files in the root of some directories ======= 2015-02-04 00:50 - 2015-02-04 00:50 - 0000020 _____ () C:\Users\Jarek\AppData\Roaming\appdataFr3.bin 2012-10-17 11:40 - 2012-10-17 11:40 - 0001183 _____ () C:\Users\Jarek\AppData\Local\recently-used.xbel ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-03 00:20 ==================== End Of Log ============================