OTL logfile created on: 2016-08-24 19:40:56 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\DB\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000415 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd
 
1,93 Gb Total Physical Memory | 0,67 Gb Available Physical Memory | 34,89% Memory free
3,86 Gb Paging File | 2,12 Gb Available in Paging File | 54,97% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 139,04 Gb Total Space | 7,39 Gb Free Space | 5,32% Space Free | Partition Type: NTFS
Drive E: | 14,66 Gb Total Space | 12,00 Gb Free Space | 81,90% Space Free | Partition Type: FAT32
 
Computer Name: DB-PC | User Name: DB | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2016-08-24 19:40:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DB\Downloads\OTL_www.INSTALKI.pl.exe
PRC - [2016-08-24 18:51:57 | 000,470,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
PRC - [2016-08-24 18:51:45 | 000,831,576 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
PRC - [2016-08-24 18:51:45 | 000,470,600 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
PRC - [2016-08-03 02:20:56 | 000,961,352 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
PRC - [2016-07-25 16:02:36 | 000,153,288 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
PRC - [2016-07-25 16:01:18 | 000,319,648 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
PRC - [2016-06-25 01:45:12 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2016-03-10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
PRC - [2016-03-10 14:07:20 | 009,926,112 | ---- | M] (Malwarebytes) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
PRC - [2015-03-02 11:03:36 | 002,477,056 | ---- | M] (MyHeritage) -- C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe
PRC - [2010-11-16 15:37:30 | 000,230,912 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\ProgramData\DatacardService\DCSHelper.exe
PRC - [2009-07-20 12:51:52 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
PRC - [2009-04-14 22:28:46 | 000,110,592 | R--- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\DB\AppData\Roaming\PLAY ONLINE\ouc.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2016-08-03 02:24:15 | 001,771,336 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libglesv2.dll
MOD - [2016-08-03 02:23:49 | 000,094,024 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\libegl.dll
MOD - [2016-08-03 01:54:39 | 017,602,240 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\52.0.2743.116\PepperFlash\pepflashplayer.dll
MOD - [2015-03-08 21:29:16 | 001,069,056 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\8322baa1cfd162e0e62eb2a426830502\System.IdentityModel.ni.dll
MOD - [2015-03-08 21:29:12 | 017,943,040 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\b632b48f6b8c349e84503a73e367e502\System.ServiceModel.ni.dll
MOD - [2015-03-08 21:26:55 | 000,221,696 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceProce#\89b5a8b57d2724538433052cdb41073a\System.ServiceProcess.ni.dll
MOD - [2015-03-08 21:26:31 | 000,645,632 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Transactions\5934c2cc2690963db93fe3a066bd06e1\System.Transactions.ni.dll
MOD - [2015-03-08 21:26:28 | 001,012,736 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Dura#\d4893f09429f3ff722f1b79dba3c2809\System.Runtime.DurableInstancing.ni.dll
MOD - [2015-03-08 21:26:26 | 000,142,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\37386e49f2c37e963d2c3bdc16efc694\SMDiagnostics.ni.dll
MOD - [2015-03-08 21:26:25 | 002,643,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Seri#\3c4b318b3f449770374cc80681522b94\System.Runtime.Serialization.ni.dll
MOD - [2015-03-08 21:12:10 | 000,391,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml.Linq\f3ffac549fcc3768140728c0382a13be\System.Xml.Linq.ni.dll
MOD - [2015-03-08 21:11:29 | 001,777,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\8ef9040b81564e5fbb3c561f11d16ddb\System.Xaml.ni.dll
MOD - [2015-03-08 17:47:19 | 013,083,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\e5e1bfd5f8a3770d9a49ffbbc13bb6a2\System.Windows.Forms.ni.dll
MOD - [2015-03-08 17:46:58 | 001,651,712 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\e1387d79f6d3b4176d11e2a28ff5c9cb\System.Drawing.ni.dll
MOD - [2015-03-08 17:46:15 | 002,499,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\069860f015b250e9862fef89016c700e\System.Data.Linq.ni.dll
MOD - [2015-03-08 17:46:09 | 006,760,960 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\1dd30a505d7029ebb9ece0d2d9c09390\System.Data.ni.dll
MOD - [2015-03-08 17:46:01 | 000,690,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ComponentMod#\bc81f60c8f3fd207f2caf88a3f9b9c4b\System.ComponentModel.Composition.ni.dll
MOD - [2015-03-08 17:45:54 | 017,637,376 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\e3f794852a19be53d31a152b7b69e162\PresentationFramework.ni.dll
MOD - [2015-03-08 17:45:20 | 011,058,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\d56ae2fe82a427a629eb913b40b07a0b\PresentationCore.ni.dll
MOD - [2015-03-08 17:45:05 | 003,783,680 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\2fb6fabff16d5bfd03ae62fa48552b26\WindowsBase.ni.dll
MOD - [2015-03-08 17:44:42 | 005,577,728 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\f16a20534d28bde97b6df32b65d75df4\System.Xml.ni.dll
MOD - [2015-03-08 17:44:28 | 000,977,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\ff86341453cf0e2ad3aa82b8b051f2be\System.Configuration.ni.dll
MOD - [2015-03-08 17:44:20 | 007,030,272 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\a9b4b0940f609f029fb30dd643fbab44\System.Core.ni.dll
MOD - [2015-03-08 17:44:03 | 009,036,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4323263ffe76f03c27c12b7a32b78e20\System.ni.dll
MOD - [2015-03-07 12:03:05 | 014,415,872 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\4ff1f12a08d455f195ba996fe77497c6\mscorlib.ni.dll
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV:[b]64bit:[/b] - [2016-01-29 18:02:42 | 000,075,720 | ---- | M] () [Unknown (-1) | Unknown] -- C:\Windows\SysNative\drivers\a486044ffee6da9e.sys -- (a486044ffee6da9e)
SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2016-08-24 18:51:57 | 000,470,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2016-08-24 18:51:48 | 001,453,696 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe -- (AntiVirWebService)
SRV - [2016-08-24 18:51:45 | 000,988,184 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe -- (AntiVirMailService)
SRV - [2016-08-24 18:51:45 | 000,470,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2016-07-25 16:01:18 | 000,319,648 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe -- (Avira.ServiceHost)
SRV - [2016-06-25 01:45:12 | 000,082,128 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2016-03-10 14:07:30 | 001,136,608 | ---- | M] (Malwarebytes) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2016-03-10 14:07:28 | 001,514,464 | ---- | M] (Malwarebytes) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2010-11-16 15:38:16 | 000,339,456 | ---- | M] () [Auto | Running] -- C:\ProgramData\DatacardService\HWDeviceService64.exe -- (HWDeviceService64.exe)
SRV - [2010-03-18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009-07-20 12:51:52 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV:[b]64bit:[/b] - [File Corrupted - Detail Data unreadable] [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:[b]64bit:[/b] - [2016-08-24 19:25:16 | 000,192,216 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV:[b]64bit:[/b] - [2016-08-18 22:43:49 | 000,171,752 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:[b]64bit:[/b] - [2016-08-18 22:43:49 | 000,145,984 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:[b]64bit:[/b] - [2016-08-18 22:43:49 | 000,079,696 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\avnetflt.sys -- (avnetflt)
DRV:[b]64bit:[/b] - [2016-03-10 14:09:06 | 000,064,896 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)
DRV:[b]64bit:[/b] - [2016-03-10 14:08:54 | 000,027,008 | ---- | M] (Malwarebytes) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:[b]64bit:[/b] - [2016-01-29 18:02:42 | 000,075,720 | ---- | M] () [Unknown (-1) | Unknown (-1) | Unknown] -- C:\Windows\SysNative\drivers\a486044ffee6da9e.sys -- (a486044ffee6da9e)
DRV:[b]64bit:[/b] - [2015-04-09 15:05:29 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:[b]64bit:[/b] - [2012-03-01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:[b]64bit:[/b] - [2010-11-21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2010-11-21 05:23:47 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010-10-09 15:49:52 | 000,085,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ew_jubusenum.sys -- (huawei_enumerator)
DRV:[b]64bit:[/b] - [2010-08-31 19:09:00 | 000,256,000 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbnet.sys -- (ewusbnet)
DRV:[b]64bit:[/b] - [2010-08-25 20:36:04 | 010,611,552 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2010-08-07 18:49:04 | 000,121,600 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)
DRV:[b]64bit:[/b] - [2010-07-27 10:52:16 | 000,117,248 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)
DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:38 | 001,311,232 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BCMWL664.SYS -- (BCM43XX)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:18 | 000,057,344 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{E9410C70-B6AE-41FF-AB71-32F4B279EA5F}: "URL" = https://www.google.com/search?trackid=sp-006&q={searchTerms}
IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = https://www.google.com/search?trackid=sp-006&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E7 12 86 60 25 33 D0 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
[color=#E56717]========== FireFox ==========[/color]
 
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
 
 
[color=#E56717]========== Chrome  ==========[/color]
 
CHR - Extension: No name found = C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.0_0\
CHR - Extension: No name found = C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm\5216.530.0.14_0\
 
O1 HOSTS File: ([2009-06-10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Avira SystrayStartTrigger] C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [Family Tree Builder Update] C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe (MyHeritage)
O4 - HKCU..\Run: [HW_OPENEYE_OUC_PLAY ONLINE] C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKCU..\Run: [syshost32] C:\Users\DB\AppData\Local\{766A3571-CB80-C66F-2CBD-0EAE0C9DE25B}\syshost.exe File not found
F3:[b]64bit:[/b] - HKCU WinNT: Load - (C:\ProgramData\msekou.exe) - C:\ProgramData\msekou.exe ()
F3 - HKCU WinNT: Load - (C:\ProgramData\msekou.exe) - C:\ProgramData\msekou.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 37.8.214.2 31.11.202.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2889BFF4-2385-4012-B293-6D9C4929F8D0}: NameServer = 89.108.195.21 89.108.202.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{67D6819D-962C-4BE4-B694-E9E671ED8F4F}: NameServer = 89.108.195.21 89.108.202.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FBB03D04-F02E-40A2-BB71-F155F20C38CD}: DhcpNameServer = 37.8.214.2 31.11.202.254
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\System32\Userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013-11-24 14:46:20 | 000,000,000 | ---D | M] - C:\Autodesk -- [ NTFS ]
O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3039a68e-9f5e-11e4-b165-00235a86bd94}\Shell - "" = AutoRun
O33 - MountPoints2\{3039a68e-9f5e-11e4-b165-00235a86bd94}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{3039a6c4-9f5e-11e4-b165-00235a86bd94}\Shell - "" = AutoRun
O33 - MountPoints2\{3039a6c4-9f5e-11e4-b165-00235a86bd94}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{588c95c6-a335-11e4-b140-00235a86bd94}\Shell - "" = AutoRun
O33 - MountPoints2\{588c95c6-a335-11e4-b140-00235a86bd94}\Shell\AutoRun\command - "" = E:\AutoRun.exe
O33 - MountPoints2\{f95df7ac-4456-11e6-bdce-001e101f4da1}\Shell - "" = AutoRun
O33 - MountPoints2\{f95df7ac-4456-11e6-bdce-001e101f4da1}\Shell\AutoRun\command - "" = G:\Setup.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2016-08-24 19:22:11 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Commander
[2016-08-24 19:22:09 | 000,000,000 | ---D | C] -- C:\totalcmd
[2016-08-24 19:22:09 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Roaming\GHISLER
[2016-08-23 22:43:09 | 000,000,000 | ---D | C] -- C:\FRST
[2016-08-23 22:09:49 | 000,192,216 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2016-08-23 22:09:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2016-08-23 22:09:05 | 000,140,672 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2016-08-23 22:09:05 | 000,064,896 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2016-08-23 22:09:05 | 000,027,008 | ---- | C] (Malwarebytes) -- C:\Windows\SysNative\drivers\mbam.sys
[2016-08-23 22:09:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2016-08-23 22:09:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2016-08-23 21:41:40 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\do ramki
[2016-08-23 21:04:01 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\inne
[2016-08-23 21:03:56 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\7.08.2015 Ez7
[2016-08-18 22:41:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
[2016-08-18 22:40:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache
[2016-08-18 22:40:38 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Roaming\Avira
[2016-08-18 22:36:43 | 000,171,752 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2016-08-18 22:36:43 | 000,145,984 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2016-08-18 22:36:43 | 000,079,696 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2016-08-18 22:36:43 | 000,028,600 | ---- | C] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avkmgr.sys
[2016-08-18 22:36:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira
[2016-08-18 22:36:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avira
[2016-08-11 19:13:26 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\fb
[2016-08-07 11:36:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fotosizer
[2016-08-07 11:36:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Fotosizer
[2016-08-07 11:31:11 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\wesele wieksza rozdzielczośc
[2016-08-06 23:01:06 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Roaming\AVG
[2016-08-06 23:00:24 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Roaming\TuneUp Software
[2016-08-06 22:56:24 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Local\MFAData
[2016-08-06 22:56:24 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2016-08-06 22:53:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Avg
[2016-08-06 22:53:43 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2016-08-06 22:53:03 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Local\AvgSetupLog
[2016-08-06 22:53:03 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Local\Avg
[2016-08-06 22:44:12 | 000,000,000 | ---D | C] -- C:\Users\DB\AppData\Local\CEF
[2016-08-06 22:42:12 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\AV
[2016-08-06 22:42:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\AV
[2016-08-06 22:41:30 | 000,992,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ucrtbase.dll
[2016-08-06 22:41:30 | 000,921,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ucrtbase.dll
[2016-08-06 14:30:30 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\wesele mateusza
[2016-08-04 19:45:48 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\do albumu
[2016-08-04 17:32:15 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\Ślub_Ellert
[2016-07-26 20:58:19 | 000,000,000 | ---D | C] -- C:\Users\DB\Desktop\opony
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2016-08-24 19:25:16 | 000,192,216 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2016-08-24 19:22:13 | 000,000,648 | ---- | M] () -- C:\Users\DB\Desktop\Total Commander 64 bit.lnk
[2016-08-24 19:22:13 | 000,000,634 | ---- | M] () -- C:\Users\DB\Desktop\Total Commander.lnk
[2016-08-24 19:14:44 | 000,778,834 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2016-08-24 19:14:44 | 000,660,318 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2016-08-24 19:14:44 | 000,121,214 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2016-08-24 19:10:04 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2016-08-24 19:09:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2016-08-24 19:09:49 | 1555,542,016 | -HS- | M] () -- C:\hiberfil.sys
[2016-08-24 19:09:07 | 000,016,640 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2016-08-24 19:09:07 | 000,016,640 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2016-08-24 18:51:16 | 000,000,898 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2016-08-23 22:29:31 | 000,002,724 | ---- | M] () -- C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
[2016-08-23 22:29:31 | 000,002,185 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2016-08-23 22:29:31 | 000,002,015 | ---- | M] () -- C:\Users\Public\Desktop\Adobe Reader XI.lnk
[2016-08-23 22:29:31 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice 4.1.2.lnk
[2016-08-23 22:29:31 | 000,001,130 | ---- | M] () -- C:\Users\Public\Desktop\Avira Launcher.lnk
[2016-08-23 22:29:31 | 000,001,094 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2016-08-23 22:29:31 | 000,001,035 | ---- | M] () -- C:\Users\Public\Desktop\PLAY ONLINE.lnk
[2016-08-23 22:29:31 | 000,001,011 | ---- | M] () -- C:\Users\Public\Desktop\Fotosizer.lnk
[2016-08-23 22:29:31 | 000,000,907 | ---- | M] () -- C:\Users\Public\Desktop\e-Deklaracje.lnk
[2016-08-23 22:29:31 | 000,000,686 | ---- | M] () -- C:\Users\Public\Desktop\PIT Format 2015.lnk
[2016-08-23 22:29:15 | 000,002,754 | ---- | M] () -- C:\Users\DB\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart Essentials.lnk
[2016-08-23 22:29:15 | 000,001,314 | ---- | M] () -- C:\Users\DB\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2016-08-23 22:29:15 | 000,001,158 | ---- | M] () -- C:\Users\DB\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2016-08-23 22:29:15 | 000,000,290 | ---- | M] () -- C:\Users\DB\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2016-08-23 22:29:15 | 000,000,272 | ---- | M] () -- C:\Users\DB\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2016-08-23 22:29:14 | 000,000,621 | ---- | M] () -- C:\Users\DB\Desktop\Wzor_oswiadczen.lnk
[2016-08-23 22:29:13 | 000,001,119 | ---- | M] () -- C:\Users\DB\Desktop\MyHeritage Family Tree Builder.lnk
[2016-08-23 22:29:13 | 000,001,087 | ---- | M] () -- C:\Users\DB\Desktop\Video WebCam - Shortcut.lnk
[2016-08-23 22:29:13 | 000,000,080 | ---- | M] () -- C:\Users\DB\Desktop\List_motywacyjny_DariaGuzinska.lnk
[2016-08-23 22:29:13 | 000,000,080 | ---- | M] () -- C:\Users\DB\Desktop\CV_Daria_Guzinska.lnk
[2016-08-23 22:29:12 | 000,001,146 | ---- | M] () -- C:\Users\DB\Desktop\Continue WinRAR installation.lnk
[2016-08-18 22:43:49 | 000,171,752 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avgntflt.sys
[2016-08-18 22:43:49 | 000,145,984 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avipbb.sys
[2016-08-18 22:43:49 | 000,079,696 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Windows\SysNative\drivers\avnetflt.sys
[2016-08-06 22:41:12 | 000,992,960 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ucrtbase.dll
[2016-08-06 22:41:12 | 000,921,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ucrtbase.dll
[2016-08-04 22:17:00 | 000,186,531 | ---- | M] () -- C:\Users\DB\Desktop\zdjecia_do_albumu.jpg
[2016-08-04 19:30:56 | 000,000,754 | ---- | M] () -- C:\Users\DB\Desktop\CV_Daria_Guzińska.lnk
[2016-08-04 19:29:29 | 000,000,844 | ---- | M] () -- C:\Users\DB\Desktop\List_motywacyjny_DariaGuzińska.lnk
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2016-08-24 19:22:13 | 000,000,648 | ---- | C] () -- C:\Users\DB\Desktop\Total Commander 64 bit.lnk
[2016-08-24 19:22:13 | 000,000,634 | ---- | C] () -- C:\Users\DB\Desktop\Total Commander.lnk
[2016-08-23 22:23:10 | 000,000,080 | ---- | C] () -- C:\Users\DB\Desktop\List_motywacyjny_DariaGuzinska.lnk
[2016-08-23 22:23:10 | 000,000,080 | ---- | C] () -- C:\Users\DB\Desktop\CV_Daria_Guzinska.lnk
[2016-08-23 22:09:09 | 000,001,094 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2016-08-18 22:43:48 | 000,001,130 | ---- | C] () -- C:\Users\Public\Desktop\Avira Launcher.lnk
[2016-08-07 11:36:53 | 000,001,011 | ---- | C] () -- C:\Users\Public\Desktop\Fotosizer.lnk
[2016-08-04 22:16:59 | 000,186,531 | ---- | C] () -- C:\Users\DB\Desktop\zdjecia_do_albumu.jpg
[2016-08-04 19:30:06 | 000,000,621 | ---- | C] () -- C:\Users\DB\Desktop\Wzor_oswiadczen.lnk
[2016-08-04 19:15:37 | 000,000,844 | ---- | C] () -- C:\Users\DB\Desktop\List_motywacyjny_DariaGuzińska.lnk
[2016-08-04 19:12:47 | 000,000,754 | ---- | C] () -- C:\Users\DB\Desktop\CV_Daria_Guzińska.lnk
[2015-11-22 17:41:24 | 000,454,656 | ---- | C] () -- C:\Windows\SysWow64\PaintX.dll
[2015-05-25 18:55:56 | 000,000,177 | ---- | C] () -- C:\Windows\SysWow64\SetupComponents.exe
[2015-03-28 12:22:55 | 000,011,761 | ---- | C] () -- C:\Users\DB\AppData\Local\unins000.msg
[2015-03-28 12:22:55 | 000,003,173 | ---- | C] () -- C:\Users\DB\AppData\Local\unins000.dat
[2015-03-14 20:08:39 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2015-03-07 12:06:38 | 000,772,682 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010-11-21 05:24:28 | 081,635,456 | -HS- | C] () -- C:\ProgramData\msekou.exe
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2009-07-14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013-07-26 04:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013-07-26 03:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

< End of report >