Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 02-03-2015
Ran by Administrator (administrator) on SPEED2 on 03-03-2015 17:09:07
Running from C:\Documents and Settings\Administrator\Pulpit
Loaded Profiles: Administrator (Available profiles: UpdatusUser & Administrator)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polski
Internet Explorer Version 8 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\Program Files\CDBurnerXP\NMSAccessU.exe
(NVIDIA Corporation) C:\WINDOWS\system32\nvsvc32.exe
(Seagate Technology LLC) C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe
() C:\Documents and Settings\All Users\Dane aplikacji\Avg_Update_0414b\0414b_AVG-Secure-Search-Update.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
HKLM\...\RunOnce: [WIAWizardMenu] => RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
HKLM\...\Policies\Explorer: [NoDesktopCleanupWizard] 1
HKLM\...\Policies\Explorer: [NoRemoteRecursiveEvents] 1
HKLM\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKLM\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-20\...\Run: [VisualTaskTips] => C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe [36352 2007-09-05] (VisualTaskTips.com)
HKU\S-1-5-20\...\RunOnce: [nltide_3] => rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
HKU\S-1-5-20\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-20\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-20\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Run: [AvgUpdater] => C:\Documents and Settings\All Users\Dane aplikacji\Avg_Update_0414b\0414b_AVG-Secure-Search-Update.exe [2707480 2014-04-09] ()
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\Policies\Explorer: [NoSaveSettings] 0
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\MountPoints2: Q - Q:\autorun.exe
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\MountPoints2: {3b6fe093-c7a3-11e3-85d0-00148586fe97} - Q:\USBNB.exe
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\...\MountPoints2: {8e63a10a-36e3-11e2-877d-00148586fe97} - O:\RunClubSanDisk.exe
HKU\S-1-5-18\...\Run: [VisualTaskTips] => C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe [36352 2007-09-05] (VisualTaskTips.com)
HKU\S-1-5-18\...\Policies\Explorer: [NoSMHelp] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoSMConfigurePrograms] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoRecentDocsMenu] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoRecentDocsHistory] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-18\...\Policies\Explorer: [LinkResolveIgnoreLinkInfo] 1
HKU\S-1-5-18\...\Policies\Explorer: [NoResolveSearch] 1
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE -> logon.scr
Lsa: [Notification Packages]  scecli
BootExecute: autocheck autochk * OODBS

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1177238915-1972579041-2147093213-500\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: EpsonToolBandKicker Class -> {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} -> C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
Toolbar: HKU\S-1-5-21-1177238915-1972579041-2147093213-500 -> EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll (SEIKO EPSON CORPORATION)
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Winsock: Missing Catalog5 entry, broken internet access. <===== ATTENTION.
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{6917DC68-A4A2-4750-8AD5-B902273C4DBA}: [NameServer] 8.8.8.8,8.8.4.4
Tcpip\..\Interfaces\{D8AECC8D-0457-4405-904C-88FBFA661120}: [NameServer] 8.8.8.8,8.8.4.4

FireFox:
========
FF ProfilePath: C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Firefox\Profiles\47mwjvkn.default-1425384955484
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin: @cuminas.jp/DjVuPlugin -> C:\Program Files\Cuminas\Document Express DjVu Plug-in\npdjvu.dll (Cuminas Corporation)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-1177238915-1972579041-2147093213-500: @acestream.net/acestreamplugin,version=3.0.5 -> C:\Documents and Settings\Administrator\Dane aplikacji\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies)
FF Plugin HKU\S-1-5-21-1177238915-1972579041-2147093213-500: @unity3d.com/UnityPlayer,version=1.0 -> C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdjvu.dll (LizardTech)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2015-01-28]

Chrome: 
=======
CHR HomePage: Default -> 
CHR Profile: C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default
CHR Extension: (Adblock Plus) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-03-24]
CHR Extension: (Google Wallet) - C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-15]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

ATTENTION: => Could not perform signature verification. Cryptographic Service is not running.

R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2012-06-03] ()
S2 O&O Defrag; C:\WINDOWS\system32\oodag.exe [1050120 2007-05-11] (O&O Software GmbH)
R2 Seagate Dashboard Services; C:\Program Files\Seagate\Seagate Dashboard 2.0\Seagate.Dashboard.DASWindowsService.exe [16000 2014-04-30] (Seagate Technology LLC)
S2 Seagate MobileBackup Service; C:\Program Files\Seagate\Seagate Dashboard 2.0\MobileService.exe [157264 2014-04-30] (Seagate Technology LLC)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [4127488 2008-01-24] (Realtek Semiconductor Corp.)
R1 avgtp; C:\WINDOWS\system32\drivers\avgtpx86.sys [42784 2014-08-30] (AVG Technologies)
S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [16384 2004-07-09] (Microsoft Corporation)
R1 dtsoftbus01; C:\WINDOWS\System32\DRIVERS\dtsoftbus01.sys [242240 2012-11-27] (DT Soft Ltd)
R0 giveio; C:\WINDOWS\System32\giveio.sys [5248 2013-10-16] ()
S3 hamachi; C:\WINDOWS\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S2 hardlock; C:\WINDOWS\system32\drivers\hardlock.sys [125952 2013-10-01] (Aladdin Knowledge Systems)
S2 Haspnt; C:\WINDOWS\system32\drivers\Haspnt.sys [110592 2013-10-01] (Aladdin Knowledge Systems.)
R1 HWiNFO32; C:\WINDOWS\system32\drivers\HWiNFO32.SYS [23712 2014-09-16] (REALiX(tm))
R3 ManyCam; C:\WINDOWS\System32\DRIVERS\mcvidrv.sys [34432 2012-10-11] (ManyCam LLC)
R3 mcaudrv_simple; C:\WINDOWS\System32\drivers\mcaudrv.sys [22656 2013-01-31] (ManyCam LLC)
S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10112 2004-07-09] (Microsoft Corporation)
R3 NETDLWL; C:\WINDOWS\System32\DRIVERS\NETDLWL.SYS [183680 2007-09-08] (D-Link. All Rights Reserved.)
R2 npf; C:\WINDOWS\System32\drivers\npf.sys [50704 2010-01-27] (CACE Technologies, Inc.)
R0 speedfan; C:\WINDOWS\System32\speedfan.sys [24184 2012-12-29] (Almico Software)
R2 StarOpen; C:\WINDOWS\system32\Drivers\StarOpen.sys [5504 2012-06-03] ()
S3 tap0901; C:\WINDOWS\System32\DRIVERS\tap0901.sys [25216 2010-02-25] (The OpenVPN Project)
S1 vcdrom; C:\Program Files\System\CPL Bonus\Vcdrom.sys [8576 2001-12-19] (Microsoft Corporation)
R0 VIAMRAID; C:\WINDOWS\System32\DRIVERS\viamraid.sys [117248 2008-01-22] (VIA Technologies inc,.ltd)
S3 vmfilter303; C:\WINDOWS\System32\drivers\vmfilter303.sys [428160 2006-04-25] (Vimicro Corporation)
S1 wceusbsh; C:\WINDOWS\System32\DRIVERS\wceusbsh.sys [31872 2008-07-22] (Microsoft Corporation)
R3 yukonwxp; C:\WINDOWS\System32\DRIVERS\yk51x86.sys [299424 2012-03-27] (Marvell)
S3 ZSMC0303; C:\WINDOWS\System32\Drivers\usbVM303.sys [392058 2006-08-31] (Vimicro Corporation)
S3 ZSMC303; C:\WINDOWS\System32\Drivers\usbVM303.sys [392058 2006-08-31] (Vimicro Corporation)
U4 ClipSrv; No ImagePath
S4 IntelIde; No ImagePath
U4 NetDDE; No ImagePath
U4 NetDDEdsdm; No ImagePath
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [4096 2008-05-02] ()

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 17:07 - 2015-03-03 17:09 - 00013729 _____ () C:\Documents and Settings\Administrator\Pulpit\FRST.txt
2015-03-03 16:52 - 2015-03-03 16:49 - 00005492 _____ () C:\Documents and Settings\Administrator\Pulpit\fixlist.txt
2015-03-03 16:52 - 2015-03-03 14:25 - 01132032 _____ (Farbar) C:\Documents and Settings\Administrator\Pulpit\FRST.exe
2015-03-03 14:34 - 2015-03-03 14:34 - 00001111 _____ () C:\Documents and Settings\Administrator\Pulpit\checkup.txt
2015-03-03 13:43 - 2015-03-03 13:52 - 00000000 ____D () C:\AdwCleaner
2015-03-03 13:34 - 2015-03-03 13:34 - 00260944 _____ () C:\Documents and Settings\All Users\Dane aplikacji\1425386007.bdinstall.bin
2015-03-03 13:29 - 2015-03-03 13:30 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit\CC Support
2015-03-03 13:16 - 2015-03-03 13:16 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Stare dane programu Firefox
2015-03-03 13:15 - 2015-03-03 13:15 - 00000385 _____ () C:\Documents and Settings\Administrator\Dane aplikacjiuser_gensett.xml
2015-03-03 12:58 - 2015-03-03 12:58 - 00000000 ____D () C:\Documents and Settings\UpdatusUser\Ustawienia lokalne\Dane aplikacji\bdch
2015-03-03 12:53 - 2015-03-03 12:53 - 00000000 ____D () C:\Documents and Settings\UpdatusUser\Dane aplikacji\QuickScan
2015-03-03 12:53 - 2015-03-03 12:53 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\bdch
2015-03-03 11:38 - 2015-03-03 11:39 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Girona
2015-03-03 10:49 - 2015-03-03 10:49 - 00000385 _____ () C:\WINDOWS\system32\user_gensett.xml
2015-03-02 16:09 - 2015-03-02 16:09 - 00000000 ____D () C:\Documents and Settings\LocalService\Dane aplikacji\QuickScan
2015-03-02 16:08 - 2015-03-02 16:08 - 00006184 _____ () C:\WINDOWS\FaxSetup.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00006010 _____ () C:\WINDOWS\ocgen.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00002571 _____ () C:\WINDOWS\tsoc.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00002024 _____ () C:\WINDOWS\comsetup.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00001890 _____ () C:\WINDOWS\msmqinst.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00001229 _____ () C:\WINDOWS\ntdtcsetup.log
2015-03-02 16:08 - 2015-03-02 16:08 - 00000000 __HDC () C:\WINDOWS\$NtUninstallWdf01009$
2015-03-02 16:08 - 2015-03-02 16:08 - 00000000 ____H () C:\WINDOWS\system32\Drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf
2015-03-02 16:08 - 2015-03-02 16:08 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_avchv_01009.Wdf
2015-03-02 16:08 - 2008-11-07 18:55 - 00016928 ____N (Microsoft Corporation) C:\WINDOWS\system32\spmsgXP_2k3.dll
2015-03-02 16:07 - 2015-03-02 16:14 - 00074000 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuiskin.dll
2015-03-02 16:07 - 2015-03-02 16:11 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\BDLogging
2015-03-02 16:07 - 2015-03-02 16:08 - 00199768 _____ () C:\WINDOWS\Wdf01009Inst.log
2015-03-02 16:07 - 2015-03-02 16:08 - 00001721 _____ () C:\WINDOWS\setupact.log
2015-03-02 16:07 - 2015-03-02 16:07 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-03-02 16:07 - 2014-12-02 13:37 - 00026624 _____ (BitDefender SRL) C:\WINDOWS\system32\bdsandboxuh.dll
2015-03-02 16:07 - 2009-07-14 12:27 - 01461992 _____ (Microsoft Corporation) C:\WINDOWS\system32\WdfCoInstaller01009.dll
2015-03-02 16:07 - 2007-04-11 11:11 - 00511328 _____ (Microsoft Corporation) C:\WINDOWS\capicom.dll
2015-03-02 16:01 - 2015-03-03 13:52 - 00000000 ____D () C:\Program Files\Bitdefender
2015-03-02 16:01 - 2015-03-03 13:34 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2015-03-02 16:01 - 2015-03-02 16:01 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\QuickScan
2015-03-02 15:48 - 2015-03-02 15:48 - 00454656 _____ () C:\Documents and Settings\UpdatusUser\NTUSER.rhk
2015-03-02 15:48 - 2015-03-02 15:48 - 00454656 _____ () C:\Documents and Settings\LocalService\NTUSER.rhk
2015-03-02 15:47 - 2015-03-02 15:48 - 13938688 _____ () C:\Documents and Settings\Administrator\NTUSER.rhk
2015-03-02 15:47 - 2015-03-02 15:47 - 00491520 _____ () C:\WINDOWS\system32\config\default.rhk
2015-03-02 15:47 - 2015-03-02 15:47 - 00454656 _____ () C:\Documents and Settings\NetworkService\NTUSER.rhk
2015-03-02 15:47 - 2015-03-02 15:47 - 00024576 _____ () C:\WINDOWS\system32\config\SAM.rhk
2015-03-02 15:46 - 2015-03-02 15:47 - 39870464 _____ () C:\WINDOWS\system32\config\software.rhk
2015-03-02 15:46 - 2015-03-02 15:46 - 00053248 _____ () C:\WINDOWS\system32\config\SECURITY.rhk
2015-03-01 10:47 - 2015-03-01 10:54 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Nowy folder
2015-02-27 14:13 - 2015-02-27 14:13 - 00005799 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\Anthony Rogie.pxml
2015-02-25 10:51 - 2015-02-25 10:51 - 00005788 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\Craig Comrie.pxml
2015-02-19 19:34 - 2015-02-19 19:34 - 00932223 _____ () C:\Documents and Settings\Administrator\Pulpit\MEDIACJE-RODZINNE.pptx
2015-02-18 09:53 - 2015-02-18 09:53 - 00002887 _____ () C:\Documents and Settings\Administrator\Moje dokumenty\Barry Ashby1.pxml
2015-02-11 15:47 - 2015-02-11 15:47 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\PokeMMO-Client
2015-02-11 14:42 - 2015-02-11 14:42 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\NVIDIA
2015-02-11 14:40 - 2015-02-11 14:49 - 00000069 _____ () C:\Documents and Settings\Administrator\jagex_cl_oldschool_LIVE.dat
2015-02-11 14:39 - 2015-02-11 15:34 - 00000001 _____ () C:\Documents and Settings\Administrator\random.dat
2015-02-11 14:39 - 2015-02-11 14:40 - 00000000 ____D () C:\Documents and Settings\Administrator\jagexcache
2015-02-11 14:39 - 2015-02-11 14:39 - 00000069 _____ () C:\Documents and Settings\Administrator\jagex_cl_runescape_LIVE.dat
2015-02-10 10:30 - 2015-02-10 11:46 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\nokia
2015-02-09 09:44 - 2015-03-03 11:38 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\sund
2015-02-05 17:48 - 2015-02-05 17:48 - 00000000 ____D () C:\Program Files\Hasbro
2015-02-05 17:48 - 2015-02-05 17:48 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty\TikGames
2015-02-05 17:47 - 2015-02-05 17:47 - 00000000 __RHD () C:\Documents and Settings\Administrator\Dane aplikacji\SecuROM
2015-02-05 17:43 - 2015-02-05 17:43 - 00000000 ____D () C:\H
2015-02-04 09:00 - 2015-03-03 16:05 - 00001036 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-04 09:00 - 2015-03-03 13:54 - 00001032 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-02 11:10 - 2015-02-03 18:17 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Grafika

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-03 17:09 - 2013-08-16 13:22 - 00000000 ____D () C:\FRST
2015-03-03 17:09 - 2012-08-14 10:01 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp
2015-03-03 17:09 - 2012-08-14 10:01 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit
2015-03-03 17:05 - 2014-03-19 16:36 - 00000188 ___SH () C:\Documents and Settings\UpdatusUser\ntuser.ini
2015-03-03 17:05 - 2012-08-14 11:45 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-03-03 17:03 - 2012-08-14 11:45 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2015-03-03 17:02 - 2012-08-14 10:01 - 01896338 _____ () C:\WINDOWS\system32\oodbs.lor
2015-03-03 17:01 - 2014-12-15 15:01 - 00095461 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-03 17:01 - 2012-08-14 10:01 - 00000188 ___SH () C:\Documents and Settings\Administrator\ntuser.ini
2015-03-03 17:01 - 2012-08-14 10:01 - 00000000 ____D () C:\Documents and Settings\Administrator
2015-03-03 16:52 - 2013-08-03 14:31 - 00065536 _____ () C:\WINDOWS\system32\config\Doctor Web.evt
2015-03-03 16:52 - 2012-10-03 13:44 - 00461530 _____ () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat
2015-03-03 16:52 - 2012-08-14 10:02 - 00000188 ___SH () C:\Documents and Settings\LocalService\ntuser.ini
2015-03-03 16:52 - 2012-08-14 10:01 - 00032438 _____ () C:\WINDOWS\SchedLgU.Txt
2015-03-03 16:52 - 2012-08-14 10:01 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-03 16:44 - 2014-08-30 14:45 - 00000000 ____D () C:\Program Files\AVG Web TuneUp
2015-03-03 16:43 - 2012-08-14 10:00 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2015-03-03 16:29 - 2015-01-28 20:33 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-03 14:21 - 2012-08-18 07:45 - 00004612 _____ () C:\m.txt
2015-03-03 14:13 - 2013-08-03 14:31 - 00000000 ____D () C:\Documents and Settings\Administrator\Doctor Web
2015-03-03 13:52 - 2012-08-14 10:01 - 00000000 ___HD () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji
2015-03-03 13:38 - 2012-09-19 11:23 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Programy - inne
2015-03-03 13:34 - 2014-12-25 16:45 - 00038442 _____ () C:\WINDOWS\setupapi.log
2015-03-03 13:34 - 2012-08-14 11:40 - 00000000 __RHD () C:\Documents and Settings\All Users\Dane aplikacji
2015-03-03 13:34 - 2012-08-14 11:40 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2015-03-03 13:34 - 2012-08-14 11:40 - 00000000 ____D () C:\Documents and Settings\All Users\Pulpit
2015-03-03 13:34 - 2012-08-14 10:01 - 00000000 __RHD () C:\Documents and Settings\Administrator\Dane aplikacji
2015-03-03 12:53 - 2012-08-14 11:30 - 00000260 ___SH () C:\boot.ini
2015-03-03 12:53 - 2001-08-23 13:00 - 00001020 _____ () C:\WINDOWS\win.ini
2015-03-03 12:53 - 2001-08-23 13:00 - 00000227 _____ () C:\WINDOWS\system.ini
2015-03-03 12:43 - 2012-10-04 17:39 - 06713132 _____ () C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1177238915-1972579041-2147093213-500-0.dat
2015-03-03 10:52 - 2001-08-23 13:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2015-03-03 10:49 - 2013-08-05 12:26 - 00000000 ____D () C:\Documents and Settings\All Users\Dane aplikacji\MFAData
2015-03-02 22:26 - 2012-08-14 10:01 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent
2015-03-02 21:48 - 2012-10-10 19:23 - 00000000 ____D () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mirillis
2015-03-02 20:16 - 2012-08-20 12:16 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty\Bandicam
2015-03-02 17:08 - 2012-11-25 19:27 - 00000000 ____D () C:\Documents and Settings\Administrator\Moje dokumenty\KONAMI
2015-03-02 16:09 - 2012-08-14 10:02 - 00000000 ____D () C:\Documents and Settings\LocalService\Dane aplikacji
2015-03-02 16:08 - 2013-09-09 16:14 - 00000000 ____D () C:\WINDOWS\LastGood
2015-03-02 15:55 - 2012-11-25 19:18 - 00000000 ____D () C:\Documents and Settings\All Users\Menu Start\Programy\KONAMI
2015-03-02 15:48 - 2012-08-14 10:02 - 00000000 __SHD () C:\Documents and Settings\LocalService
2015-03-02 15:47 - 2012-08-14 10:01 - 00000000 __SHD () C:\Documents and Settings\NetworkService
2015-03-02 14:22 - 2013-10-02 15:57 - 00000000 ____D () C:\Program Files\Pomocnik Farmera
2015-03-02 14:22 - 2012-08-14 10:01 - 00000000 ___RD () C:\Documents and Settings\Administrator\Menu Start\Programy
2015-02-27 14:13 - 2012-08-14 10:01 - 00000000 ___RD () C:\Documents and Settings\Administrator\Moje dokumenty
2015-02-20 10:51 - 2012-09-10 08:20 - 00009662 _____ () C:\WINDOWS\EPISME00.SWB
2015-02-20 09:06 - 2014-03-15 18:17 - 00001821 _____ () C:\Documents and Settings\All Users\Pulpit\Google Chrome.lnk
2015-02-17 14:58 - 2012-08-14 10:07 - 00000000 ____D () C:\Documents and Settings\Administrator\Dane aplikacji\Adobe
2015-02-08 20:33 - 2015-01-31 11:40 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Różności z pulpitu
2015-02-05 20:29 - 2014-12-15 14:59 - 00701616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-02-05 20:29 - 2014-12-15 14:59 - 00071344 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2015-02-05 17:47 - 2012-10-01 16:50 - 00107888 _____ (Sony DADC Austria AG.) C:\WINDOWS\system32\CmdLineExt.dll
2015-02-05 17:43 - 2015-01-31 11:41 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Gry
2015-02-03 10:50 - 2012-08-14 11:31 - 01622824 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-02-02 10:29 - 2012-08-14 10:30 - 00085952 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2015-02-01 10:10 - 2012-09-19 11:22 - 00000000 ____D () C:\Documents and Settings\Administrator\Pulpit\Dokumenty, obrazki - różne

==================== Files in the root of some directories =======

2014-03-15 18:15 - 2014-03-15 18:18 - 49940480 _____ () C:\Program Files\GUT5E.tmp
2013-03-05 11:28 - 2013-03-05 16:25 - 0006144 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-02-19 12:26 - 2013-02-19 12:26 - 0000138 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2013-09-09 08:50 - 2013-09-09 08:50 - 0013938 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\recently-used.xbel
2014-04-23 08:26 - 2014-04-23 08:26 - 0005917 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\unins000.dat
2014-04-23 08:26 - 2014-04-23 08:26 - 0707504 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\unins000.exe
2014-04-23 08:26 - 2014-04-23 08:26 - 0011761 _____ () C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\unins000.msg
ZeroAccess:
C:\Program Files\Google\Desktop\Install

Files to move or delete:
====================
C:\Documents and Settings\Administrator\jagex_cl_oldschool_LIVE.dat
C:\Documents and Settings\Administrator\jagex_cl_runescape_LIVE.dat
C:\Documents and Settings\Administrator\random.dat


Some content of TEMP:
====================
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\CmdLineExtInstallerExe.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\drm_dialogs.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\drm_dyndata_7330014.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\Quarantine.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\sqlite3.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\SRLDetectionLibrary251920678590363984.dll
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\UNINSTALL.exe
C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\wtw-update.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\WINDOWS\explorer.exe
[2008-07-22 14:25] - [2008-07-22 14:25] - 1528832 ____A (Microsoft Corporation) b49a80a502fd86b2f05bc7bbd723ddab  

C:\WINDOWS\system32\winlogon.exe
[2008-04-14 21:51] - [2008-04-14 21:51] - 0510464 ____A (Microsoft Corporation) 51fd2e13d723857b9ca239ae77150f48  

C:\WINDOWS\system32\svchost.exe
[2008-04-14 21:51] - [2008-04-14 21:51] - 0014336 ____A (Microsoft Corporation) 8607d35d92528e2df386f19a960d23ce  

C:\WINDOWS\system32\services.exe
[2008-04-14 21:51] - [2008-04-14 21:51] - 0109056 ____A (Microsoft Corporation) 3e3ae424e27c4cefe4cab368c7b570ea  

C:\WINDOWS\system32\User32.dll
[2008-07-22 14:34] - [2008-07-22 14:34] - 0487424 ____A (Microsoft Corporation) 5f1ccdf37f28a88d0473b0c9ea1e0d58  

C:\WINDOWS\system32\userinit.exe
[2008-04-14 21:51] - [2008-04-14 21:51] - 0026624 ____A (Microsoft Corporation) 2a5b37d520508be6570a3ea79695f5b5  

C:\WINDOWS\system32\rpcss.dll
[2008-04-14 21:50] - [2008-04-14 21:50] - 0399360 ____A (Microsoft Corporation) 02396dab9dd407b06539981f477f3fec  

 ATTENTION ======> If the system is having audio adware rpcss.dll is patched. Google the MD5, if the MD5 is unique the file is infected.
C:\WINDOWS\system32\Drivers\volsnap.sys
[2008-04-14 20:31] - [2008-04-14 20:31] - 0052864 ____A (Microsoft Corporation) 56b191ac5fc0df219949c95a6c87afe7  


==================== End Of Log ============================