Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-04-2015
Ran by operator (administrator) on NN-35F505A9FF00 on 13-04-2015 15:31:45
Running from C:\Documents and Settings\operator\Moje dokumenty
Loaded Profiles: operator (Available profiles: operator & Administrator)
Platform: Microsoft Windows XP Professional Dodatek Service Pack 3 (X86) OS Language: Polski
Internet Explorer Version 8 (Default browser: Opera)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Analog Devices, Inc.) C:\Program Files\Analog Devices\Core\smax4pnp.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe
(Apple Inc.) C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe
(COMARCH S.A.) C:\Program Files\Serwer wydruków graficznych dla Comarch Klasyka\RpWinKla.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe
(BlackBerry Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
() C:\Program Files\Opera\28.0.1750.51\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
(Opera Software) C:\Program Files\Opera\28.0.1750.51\opera.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [SoundMAXPnP] => C:\Program Files\Analog Devices\Core\smax4pnp.exe [1404928 2004-10-14] (Analog Devices, Inc.)
HKLM\...\Run: [igfxhkcmd] => C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
HKLM\...\Run: [igfxpers] => C:\WINDOWS\system32\igfxpers.exe [118784 2006-03-23] (Intel Corporation)
HKU\S-1-5-21-220523388-1606980848-1905892399-1003\...\MountPoints2: {03605b58-fe04-11df-98dc-00188b294c40} - E:\AutoRun.exe
Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Serwer wydruków graficznych dla Comarch Klasyka.lnk
ShortcutTarget: Serwer wydruków graficznych dla Comarch Klasyka.lnk -> C:\Program Files\Serwer wydruków graficznych dla Comarch Klasyka\RpWinKla.exe (COMARCH S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay1] -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\Documents and Settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay2] -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\Documents and Settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay3] -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\Documents and Settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
ShellIconOverlayIdentifiers: [GGDriveOverlay4] -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\Documents and Settings\All Users\Dane aplikacji\GG\ggdrive\ggdrive-overlay.dll (GG Network S.A.)
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-220523388-1606980848-1905892399-1003\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-21-220523388-1606980848-1905892399-1003 -> DefaultScope {6768B389-1EAB-4EFE-8FC6-F2EC1863E9E3} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKU\S-1-5-21-220523388-1606980848-1905892399-1003 -> {6768B389-1EAB-4EFE-8FC6-F2EC1863E9E3} URL = http://www.google.pl/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-10-15] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-10-15] (Oracle Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A41} https://www.pekaobiznes24.pl/components/1,3,0,82/SignActivXPEKAO.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-05] ()
FF Plugin: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-10-15] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-10-15] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-30] (Microsoft Corporation)
FF Plugin: @RIM.com/WebSLLauncher,version=1.0 -> C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll [2014-08-27] ()
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-08-05] (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-12-02]
 
Opera: 
=======
OPR Extension: (AdBlock) - C:\Documents and Settings\operator\Dane aplikacji\Opera Software\Opera Stable\Extensions\aobdicepooefnbaeokijohmhjlleamfj [2014-10-29]
OPR Extension: (Tłumacz) - C:\Documents and Settings\operator\Dane aplikacji\Opera Software\Opera Stable\Extensions\ibnombjmjocaccigcefonnipcnlaeaed [2014-10-16]
 
========================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 6to4; C:\WINDOWS\System32\6to4svc.dll [100864 2010-02-12] (Microsoft Corporation)
R3 BlackBerry Device Manager; C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [588024 2014-09-04] (BlackBerry Limited)
R2 JavaQuickStarterService; C:\Program Files\Java\jre7\bin\jqs.exe [182696 2014-10-15] (Oracle Corporation)
R2 RIM MDNS; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\mDNSResponder.exe [396024 2014-09-15] (Apple Inc.)
R2 RIM Tunnel Service; C:\Program Files\Common Files\Research In Motion\Tunnel Manager\tunmgr.exe [1343224 2014-09-15] (BlackBerry Limited)
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R3 akshasp; C:\WINDOWS\System32\DRIVERS\akshasp.sys [327168 2006-11-22] (Aladdin Knowledge Systems Ltd.)
R3 aksusb; C:\WINDOWS\System32\DRIVERS\aksusb.sys [100096 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 blackberryncm; C:\WINDOWS\System32\DRIVERS\blackberryncm.sys [19456 2014-04-15] (BlackBerry)
R2 Hardlock; C:\WINDOWS\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
R2 Haspnt; C:\WINDOWS\system32\drivers\Haspnt.sys [47616 2011-01-27] (Aladdin Knowledge Systems) [File not signed]
S3 PortTalk; C:\WINDOWS\System32\Drivers\PortTalk.sys [3567 2002-01-12] (Beyond Logic http://www.beyondlogic.org) [File not signed]
S3 RimUsb; C:\WINDOWS\System32\Drivers\RimUsb.sys [68608 2014-05-06] (BlackBerry Limited)
R3 rimvndis; C:\WINDOWS\System32\Drivers\rimvndis.sys [12800 2014-09-15] (Research in Motion Limited)
R1 Tcpip6; C:\WINDOWS\System32\DRIVERS\tcpip6.sys [226880 2010-02-11] (Microsoft Corporation)
R1 UserPort; C:\WINDOWS\System32\Drivers\UserPort.sys [21088 2008-07-09] () [File not signed]
S3 catchme; \??\C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\catchme.sys [X]
S0 cerc6; No ImagePath
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 filtertdidriver; system32\drivers\ewfiltertdidriver.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]
S4 IntelIde; No ImagePath
U1 WS2IFSL; No ImagePath
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-04-13 15:31 - 2015-04-13 15:32 - 00010513 _____ () C:\Documents and Settings\operator\Moje dokumenty\FRST.txt
2015-04-13 15:30 - 2015-04-13 15:31 - 00000000 ____D () C:\FRST
2015-04-13 15:30 - 2015-04-13 15:30 - 01135616 _____ (Farbar) C:\Documents and Settings\operator\Moje dokumenty\FRST.exe
2015-04-09 14:33 - 2015-04-09 14:33 - 00078336 _____ () C:\Documents and Settings\operator\Pulpit\Sanit 2015.01.01 Cennik zakupowy IK.xls
2015-04-01 10:03 - 2015-04-01 10:03 - 00000000 ____D () C:\Documents and Settings\operator\Moje dokumenty\Oh Laura - A Song Inside My Head, A Demon in My Bed (2007)
2015-03-31 10:00 - 2015-03-31 10:00 - 00000513 _____ () C:\Documents and Settings\operator\Pulpit\Andrzej S.lnk
2015-03-19 12:08 - 2015-03-19 12:08 - 00000892 _____ () C:\WINDOWS\Tasks\Adobe Flash Player PPAPI Notifier.job
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2015-04-13 15:32 - 2011-01-27 16:06 - 00000000 ____D () C:\TEMP
2015-04-13 15:31 - 2010-10-21 08:49 - 00000000 ___RD () C:\Documents and Settings\operator\Moje dokumenty
2015-04-13 15:21 - 2010-10-21 08:49 - 00000000 ____D () C:\Documents and Settings\operator\Pulpit
2015-04-13 15:17 - 2010-10-21 08:32 - 01638544 _____ () C:\WINDOWS\WindowsUpdate.log
2015-04-13 15:16 - 2015-01-05 11:53 - 00001378 _____ () C:\WINDOWS\Tasks\FHUE.job
2015-04-13 15:16 - 2015-01-05 11:52 - 00000436 _____ () C:\WINDOWS\Tasks\SMupdate3.job
2015-04-13 15:16 - 2015-01-05 11:52 - 00000436 _____ () C:\WINDOWS\Tasks\SMupdate2.job
2015-04-13 15:16 - 2014-10-16 13:38 - 00000458 _____ () C:\WINDOWS\Tasks\Opera scheduled Autoupdate 1413459512.job
2015-04-13 15:16 - 2014-05-23 14:29 - 00000159 _____ () C:\WINDOWS\wiadebug.log
2015-04-13 15:16 - 2014-05-23 14:29 - 00000050 _____ () C:\WINDOWS\wiaservc.log
2015-04-13 15:16 - 2014-03-28 09:52 - 00000228 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — logowanie.job
2015-04-13 15:16 - 2012-01-03 12:57 - 00000443 _____ () C:\WINDOWS\system32\Drivers\etc\hosts.ics
2015-04-13 15:16 - 2010-12-02 10:37 - 00065536 _____ () C:\WINDOWS\system32\config\Internet.evt
2015-04-13 15:16 - 2010-10-21 08:49 - 00000188 ___SH () C:\Documents and Settings\operator\ntuser.ini
2015-04-13 15:16 - 2010-10-21 08:48 - 00032478 _____ () C:\WINDOWS\SchedLgU.Txt
2015-04-13 15:16 - 2010-10-21 08:48 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-04-13 15:16 - 2008-04-15 14:00 - 00002206 _____ () C:\WINDOWS\system32\wpa.dbl
2015-04-13 15:15 - 2010-10-21 08:49 - 00000000 ____D () C:\Documents and Settings\operator
2015-04-13 15:08 - 2015-01-20 09:02 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-04-13 15:00 - 2010-10-21 08:49 - 00000000 ___RD () C:\Documents and Settings\operator\Menu Start\Programy
2015-04-13 15:00 - 2010-10-21 00:07 - 00000000 ___RD () C:\Documents and Settings\All Users\Menu Start\Programy
2015-04-13 11:07 - 2010-12-02 11:06 - 00000000 ____D () C:\WINDOWS\system32\LogFiles
2015-04-13 10:58 - 2014-01-14 13:51 - 00121344 __SHC () C:\Documents and Settings\operator\Pulpit\Thumbs.db
2015-04-10 09:20 - 2014-10-16 11:55 - 00000000 ____D () C:\Program Files\Opera Mail
2015-04-08 15:00 - 2014-03-28 09:52 - 00000222 _____ () C:\WINDOWS\Tasks\Powiadomienie o zakończeniu obsługi systemu Microsoft Windows XP — co miesiąc.job
2015-04-08 14:06 - 2014-10-16 13:38 - 00000000 ____D () C:\Program Files\Opera
2015-04-07 14:23 - 2015-01-15 13:47 - 00000000 ____D () C:\Documents and Settings\operator\.shoperManager
2015-04-02 08:04 - 2012-02-10 17:29 - 00000000 ____D () C:\WINDOWS\Minidump
2015-03-30 08:03 - 2010-10-21 00:07 - 01286042 ____C () C:\WINDOWS\system32\PerfStringBackup.INI
2015-03-30 08:03 - 2008-04-15 14:00 - 00565768 _____ () C:\WINDOWS\system32\perfh015.dat
2015-03-30 08:03 - 2008-04-15 14:00 - 00110208 _____ () C:\WINDOWS\system32\perfc015.dat
2015-03-27 15:50 - 2012-02-15 15:47 - 00000000 ____D () C:\Documents and Settings\operator\Dane aplikacji\FileZilla
2015-03-27 14:56 - 2010-12-13 12:19 - 00000000 ____D () C:\Documents and Settings\operator\Pulpit\IGS
2015-03-25 09:02 - 2012-07-09 10:38 - 00778928 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2015-03-25 09:02 - 2012-07-09 10:38 - 00142512 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
 
==================== Files in the root of some directories =======
 
2014-09-01 10:18 - 2014-09-01 10:18 - 0001248 _____ () C:\Documents and Settings\operator\Dane aplikacji\FHUE
2014-03-03 15:10 - 2014-03-03 15:15 - 0000813 ____C () C:\Documents and Settings\operator\Dane aplikacji\LiveSupport.exe_log.txt
2014-03-03 15:10 - 2014-03-03 15:16 - 0000082 ____C () C:\Documents and Settings\operator\Dane aplikacji\regsvr32.exe_log.txt
2010-10-21 08:51 - 2015-03-13 12:44 - 0192000 ____C () C:\Documents and Settings\operator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-12-03 09:46 - 2010-12-03 09:46 - 0000133 ____C () C:\Documents and Settings\operator\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2015-01-05 11:42 - 2015-01-05 11:42 - 0301608 _____ (VuuPC Limited) C:\Documents and Settings\operator\Ustawienia lokalne\Dane aplikacji\nsaB6.tmp
2015-01-05 11:56 - 2015-01-05 11:56 - 0613057 _____ (CMI Limited) C:\Documents and Settings\operator\Ustawienia lokalne\Dane aplikacji\nsb165.tmp
 
Files to move or delete:
====================
C:\Documents and Settings\operator\TempWmicBatchFile.bat
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\WINDOWS\explorer.exe => File is digitally signed
C:\WINDOWS\system32\winlogon.exe => File is digitally signed
C:\WINDOWS\system32\svchost.exe => File is digitally signed
C:\WINDOWS\system32\services.exe => File is digitally signed
C:\WINDOWS\system32\User32.dll => File is digitally signed
C:\WINDOWS\system32\userinit.exe => File is digitally signed
C:\WINDOWS\system32\rpcss.dll => File is digitally signed
C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed
 
==================== End Of Log ============================