Wirus polizja

[Vincent48]

Witam,
mam ten sam problem z Polizją. Próbowałem usunąć Combofixem i CCleanerem w trybie awaryjnym, ale nie pomaga, cały czas znowu się wyświetla. Próbowałem też "na chama", otwierając masę programów przed włączeniem się wirusa, żeby go zawiesić, ale też nie pomogło. To chyba inna mutacja tego wirusa, bo działa to tak, że po włączeniu komputera wyświetla się powiadomienie dotyczące Rundll32. Jeśli kliknę "nie", powiadomienie będzie się wyświetlało w nieskończoność, jeśli kliknę "tak", włącza się Polizja, więc muszę resetować i tak w kółko. Jestem niestety laikiem komputerowym i nie rozumiem, co należy zrobić z OLT itd.

Czy ktoś byłby tak miły, żeby wytłumaczyć mi jak komuś głupiemu, jak się tego cholerstwa pozbyć?
Z góry dziękuję.

[NieWiem]

Jaki masz tam system operacyjny?

[Vincent48]

Windows 7.

[NieWiem]

32- czy 64-bitowy?

[Vincent48]

Cholera, przepraszam, źle napisałem, bo się nie chciał otworzyć nawet w awaryjnym - 64-bitowy, na 100%.

[NieWiem]

Wejdź do trybu awaryjnego - wciskaj F8 podczas uruchamiania komputera.
- Spróbuj najpierw tryb awaryjny z obsługą sieci
- jeśli to nie da rady - po prostu tryb awaryjny
- jeśli to nie da rady - tryb awaryjny z wierszem polecenia

Działa którykolwiek?

[Vincent48]

Tak tak, tryb awaryjny z obsługą sieci działa, właśnie dzięki temu mogłem próbować Combofixem i CCleanerem. Problem w tym, że jak potem włączam zwykły (po przeczyszczeniu), to znowu to samo się wyświetla. Spybot S&D też nie pomógł.

[NieWiem]

CF to jak strzał z armaty w komara, a CCleaner w ogóle nie służy do takich rzeczy. Trza przyjść na forum i się zapytać.

Pobierz FRST w wersji zgodnej z Twoim systemem - 32bit.
Zapisz na pulpicie, uruchom, kliknij scan.
Wygeneruje dwa logi. Obydwa proszę załączyć na forum.

[Vincent48]

Ok, wielkie dzięki . System jest 64-bitowy, ściągam już tę wersję i przenoszę na zainfekowanego kompa. Zaraz wrzucę logi.

Dodano Dzisiaj, 22:31:
Zamieszczam wygenerowane logi:

FRST

Spoiler:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01
Ran by USER (administrator) on USER-KOMPUTER on 11-05-2014 22:25:39
Running from C:\Users\USER\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 11
Boot Mode: Safe Mode (with Networking)

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [7464448 2011-08-28] (Dell Inc.)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [OrderReminder] => C:\Program Files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe [98304 2006-07-30] (Hewlett-Packard)
HKLM-x32\...\Run: [ModemListener] => C:\Program Files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe [98304 2010-05-15] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hnjgzg.lnk
ShortcutTarget: hnjgzg.lnk -> C:\ProgramData\2992199F9A\gzgjnh.cpp ()
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ilfgzjfr.lnk
ShortcutTarget: ilfgzjfr.lnk -> C:\PROGRA~3\rfjzgfli.dss (No File)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4&q={searchTerms}
SearchScopes: HKCU - {885BC2FA-93B7-4736-BAB8-6303660799BF} URL = http://www.search.ask.com/web?tpid=ORJ&o=100000027&pf=V7&p2=&gct=&itbv=12.10.3.24&apn_uid=39EC5D89-0E1C-43F3-B5E7-29A73A45657F&apn_ptnrs=U3&apn_dtid=OSJ000YYPL&apn_dbr=ie_9.0.8112.16421&doi=2014-02-01&trgb=IE,FF&q={searchTerms}&psv=
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 62.179.1.61 62.179.1.63

FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default
FF user.js: detected! => C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\user.js
FF SearchEngineOrder.1: Ask.com
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_37 - C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdjvu.dll (LizardTech)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll (StartSearch )
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcomsearch.xml
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\startsear.xml
FF Extension: Easy Deals - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\Extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com [2014-05-11]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-11-11]

==================== Services (Whitelisted) =================

S2 DeviceManager; C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe [40960 2009-11-17] ()
S3 PCProtect; C:\Program Files (x86)\Web Protect\PCProtect.exe [1265608 2014-01-08] (Objectify Media Inc)
S2 ProtectMonitor; C:\monitorsvc.exe [34244 2014-02-13] ()
S2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6146560 2011-08-28] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [119680 2010-04-07] (Olivetti)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-11 22:25 - 2014-05-11 22:26 - 00009207 _____ () C:\Users\USER\Desktop\FRST.txt
2014-05-11 22:25 - 2014-05-11 22:25 - 00000000 ____D () C:\FRST
2014-05-11 22:25 - 2014-05-11 22:23 - 02066944 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe
2014-05-11 20:57 - 2014-05-11 20:57 - 00020134 _____ () C:\ComboFix.txt
2014-05-11 20:21 - 2014-05-11 20:21 - 00006576 ____N () C:\bootsqm.dat
2014-05-11 05:06 - 2014-05-11 00:29 - 00000027 _____ () C:\windows\system32\Drivers\etc\hosts.20140511-050655.backup
2014-05-11 03:52 - 2014-05-11 05:14 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2014-05-11 02:17 - 2014-05-11 02:18 - 00000000 ____D () C:\SpybotSDPortable
2014-05-11 01:51 - 2014-05-11 01:51 - 00000000 _____ () C:\Users\USER\Documents\cc_20140511_015148.reg
2014-05-11 01:01 - 2014-05-11 01:01 - 02195256 _____ (Reason Software Company Inc.) C:\Users\USER\Downloads\ShouldIRemoveIt_Setup.exe
2014-05-11 00:56 - 2014-05-11 00:57 - 00242890 _____ () C:\Users\USER\Documents\cc_20140511_005628.reg
2014-05-10 22:36 - 2014-05-10 22:36 - 00002770 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-05-10 22:35 - 2014-05-10 22:35 - 04745984 _____ (Piriform Ltd) C:\Users\USER\Downloads\ccsetup413.exe
2014-05-10 22:35 - 2014-05-10 22:35 - 00702752 _____ () C:\Users\USER\Downloads\CCleaner(13061).exe
2014-05-09 23:05 - 2014-05-11 21:07 - 00000000 ____D () C:\ProgramData\2992199F9A
2014-05-07 23:29 - 2014-05-07 23:29 - 00014945 _____ () C:\Users\USER\Desktop\hs_err_pid4612.log
2014-05-07 02:10 - 2014-05-09 14:46 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Loobnoqy
2014-05-05 19:57 - 2014-05-09 19:49 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Amewla
2014-05-03 21:09 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-03 21:08 - 2014-05-03 21:08 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-03 21:08 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-03 21:08 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-03 21:08 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-02 20:52 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-02 20:52 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-04-29 02:13 - 2014-05-02 21:14 - 17931952 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-29 00:20 - 2014-04-29 00:20 - 07220749 _____ () C:\Users\USER\Desktop\Kfjaty.zip
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-26 00:25 - 2014-04-26 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Podatnik.info
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-23 01:40 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-04-23 01:40 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-04-23 01:40 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-04-23 01:40 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-04-23 01:40 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-04-23 01:40 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-04-23 01:40 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-04-23 01:40 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-04-23 01:40 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-04-23 01:40 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-04-23 01:40 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-04-23 01:40 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-04-23 01:40 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-04-23 01:40 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-04-23 01:40 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-04-23 01:40 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-04-23 01:40 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-04-23 01:40 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-04-23 01:40 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 01:40 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-04-23 01:40 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-04-23 01:40 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-04-23 01:40 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-04-23 01:40 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-04-23 01:40 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-04-23 01:40 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-04-23 01:40 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-04-23 01:40 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-04-23 01:40 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-04-23 01:40 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-04-23 01:40 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 01:40 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-04-23 01:40 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-04-23 01:40 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-04-23 01:40 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-04-23 01:40 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-04-23 01:40 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-04-23 01:40 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-04-23 01:40 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-04-23 01:40 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-04-23 01:40 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-04-23 01:40 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-04-23 01:40 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-04-23 01:40 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

==================== One Month Modified Files and Folders =======

2014-05-11 22:26 - 2014-05-11 22:25 - 00009207 _____ () C:\Users\USER\Desktop\FRST.txt
2014-05-11 22:25 - 2014-05-11 22:25 - 00000000 ____D () C:\FRST
2014-05-11 22:24 - 2014-03-29 23:37 - 00000000 ____D () C:\Users\USER\Desktop\Kaz Włochy
2014-05-11 22:23 - 2014-05-11 22:25 - 02066944 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe
2014-05-11 22:10 - 2014-02-27 01:44 - 00001506 _____ () C:\windows\Tasks\Easy Deals-updater.job
2014-05-11 22:10 - 2014-02-27 01:44 - 00001340 _____ () C:\windows\Tasks\Easy Deals-enabler.job
2014-05-11 22:10 - 2014-02-27 01:43 - 00002336 _____ () C:\windows\Tasks\Easy Deals-firefoxinstaller.job
2014-05-11 22:09 - 2011-10-30 14:58 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-05-11 22:09 - 2011-10-30 14:58 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-05-11 22:09 - 2011-08-28 03:43 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-05-11 22:08 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-05-11 22:08 - 2009-07-14 06:51 - 00132871 _____ () C:\windows\setupact.log
2014-05-11 21:07 - 2014-05-09 23:05 - 00000000 ____D () C:\ProgramData\2992199F9A
2014-05-11 21:04 - 2010-11-21 05:47 - 00309890 _____ () C:\windows\PFRO.log
2014-05-11 20:57 - 2014-05-11 20:57 - 00020134 _____ () C:\ComboFix.txt
2014-05-11 20:57 - 2013-11-12 01:25 - 00000000 ____D () C:\Qoobox
2014-05-11 20:51 - 2009-07-14 04:34 - 00000215 _____ () C:\windows\system.ini
2014-05-11 20:29 - 2011-08-28 02:51 - 01350824 _____ () C:\windows\WindowsUpdate.log
2014-05-11 20:29 - 2009-07-14 06:45 - 00020928 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-11 20:29 - 2009-07-14 06:45 - 00020928 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-11 20:21 - 2014-05-11 20:21 - 00006576 ____N () C:\bootsqm.dat
2014-05-11 11:14 - 2014-01-07 23:46 - 00000930 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-05-11 11:03 - 2013-05-23 01:34 - 00003440 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2014-05-11 05:14 - 2014-05-11 03:52 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2014-05-11 02:18 - 2014-05-11 02:17 - 00000000 ____D () C:\SpybotSDPortable
2014-05-11 02:12 - 2011-10-30 15:26 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-05-11 01:51 - 2014-05-11 01:51 - 00000000 _____ () C:\Users\USER\Documents\cc_20140511_015148.reg
2014-05-11 01:31 - 2011-08-28 05:44 - 00740672 _____ () C:\windows\system32\perfh015.dat
2014-05-11 01:31 - 2011-08-28 05:44 - 00156214 _____ () C:\windows\system32\perfc015.dat
2014-05-11 01:31 - 2009-07-14 07:13 - 01670518 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-11 01:06 - 2011-10-30 15:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 01:01 - 2014-05-11 01:01 - 02195256 _____ (Reason Software Company Inc.) C:\Users\USER\Downloads\ShouldIRemoveIt_Setup.exe
2014-05-11 00:57 - 2014-05-11 00:56 - 00242890 _____ () C:\Users\USER\Documents\cc_20140511_005628.reg
2014-05-11 00:29 - 2014-05-11 05:06 - 00000027 _____ () C:\windows\system32\Drivers\etc\hosts.20140511-050655.backup
2014-05-10 22:44 - 2011-08-28 03:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-05-10 22:36 - 2014-05-10 22:36 - 00002770 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-05-10 22:36 - 2011-10-30 15:27 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 22:35 - 2014-05-10 22:35 - 04745984 _____ (Piriform Ltd) C:\Users\USER\Downloads\ccsetup413.exe
2014-05-10 22:35 - 2014-05-10 22:35 - 00702752 _____ () C:\Users\USER\Downloads\CCleaner(13061).exe
2014-05-10 22:24 - 2013-11-12 01:24 - 00000000 ____D () C:\windows\erdnt
2014-05-10 22:22 - 2014-02-27 01:43 - 00000000 ____D () C:\Program Files (x86)\Easy Deals
2014-05-09 23:05 - 2011-10-30 15:00 - 00000000 ___RD () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-09 19:49 - 2014-05-05 19:57 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Amewla
2014-05-09 14:46 - 2014-05-07 02:10 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Loobnoqy
2014-05-08 00:00 - 2013-01-02 23:22 - 00000000 ____D () C:\Users\USER\Desktop\DT 2013
2014-05-07 23:46 - 2012-02-05 18:18 - 00000000 ____D () C:\Users\USER\Desktop\DT 2012
2014-05-07 23:44 - 2014-02-17 04:04 - 00000000 ____D () C:\Users\USER\Desktop\DT2014
2014-05-07 23:29 - 2014-05-07 23:29 - 00014945 _____ () C:\Users\USER\Desktop\hs_err_pid4612.log
2014-05-07 20:03 - 2012-07-01 11:35 - 00000000 ____D () C:\Users\USER\Desktop\DT 2012 (2)
2014-05-07 19:23 - 2013-07-06 22:55 - 00000000 ____D () C:\Users\USER\Desktop\DT 2013 (2)
2014-05-03 21:08 - 2014-05-03 21:08 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-02 21:14 - 2014-04-29 02:13 - 17931952 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-02 21:14 - 2014-01-07 23:46 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-02 21:14 - 2014-01-07 23:46 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-02 21:14 - 2014-01-07 23:46 - 00003868 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 16:01 - 2014-05-03 21:09 - 23547904 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 21:08 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 21:08 - 17384448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 21:08 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-04-29 00:23 - 2011-12-20 20:57 - 00000000 ____D () C:\Users\USER\Desktop\30 dni materiały
2014-04-29 00:20 - 2014-04-29 00:20 - 07220749 _____ () C:\Users\USER\Desktop\Kfjaty.zip
2014-04-29 00:14 - 2012-05-11 01:40 - 00000000 ____D () C:\Users\USER\Desktop\30 dni zapasy
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-26 00:25 - 2014-04-26 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Podatnik.info
2014-04-26 00:25 - 2012-04-28 00:12 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Podatnik.info
2014-04-26 00:25 - 2012-04-28 00:02 - 00000000 ____D () C:\Program Files (x86)\Podatnik.info
2014-04-23 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-23 20:00 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-04-14 04:24 - 2014-05-02 20:52 - 00465408 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-02 20:52 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

Files to move or delete:
====================
C:\ProgramData\ilfgzjfr.bxx
C:\ProgramData\ilfgzjfr.fvv
C:\ProgramData\ilfgzjfr.reg


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 00:41

==================== End Of Log ============================

Addition

Spoiler:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-05-2014 01
Ran by USER at 2014-05-11 22:27:15
Running from C:\Users\USER\Desktop
Boot Mode: Safe Mode (with Networking)
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Browsers Protector (HKLM-x32\...\Browsers Protector) (Version: 1.0.0.0 - Publisher Name) <==== ATTENTION
CCleaner (HKLM\...\CCleaner) (Version: 4.13 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.3.8.2631 - CDBurnerXP)
Chiavetta Internet Olicard 145 (HKLM-x32\...\Chiavetta Internet Olicard 145 ALCATEL_is1) (Version: - Olivetti)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.) Hidden
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.) Hidden
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5971CA1F-6BDE-498F-952C-9F2BF94070A4}) (Version: - Microsoft)
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.60 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.60 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{91AF2672-F5BC-42CF-8037-A9D2F92BBCC0}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.0.6 - Dell Inc.)
Dell Stage (HKLM-x32\...\{E2EBA7C0-8072-447F-856D-FFEE8D15B23B}) (Version: 1.5.201.0 - Fingertapps)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.225 - ALPS ELECTRIC CO., LTD.)
Dell VideoStage (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
DW WLAN Card Utility (HKLM\...\DW WLAN Card Utility) (Version: 5.100.82.96 - Dell Inc.)
Easy Deals (HKLM-x32\...\Easy Deals) (Version: 1.34.2.13 - Adassist) <==== ATTENTION
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM-x32\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
HiDef Media Player 1.1.12 (HKLM-x32\...\HiDef Media Player) (Version: 1.1.12 - HiDefMedia)
HP OrderReminder (HKLM-x32\...\HP OrderReminder) (Version: 2.1 - )
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6341.0 - IDT)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.6.0 - LIGHTNING UK!)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
Intel(R) Turbo Boost Technology Monitor 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Java Auto Updater (x32 Version: 2.0.7.2 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 24 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416024FF}) (Version: 6.0.240 - Oracle)
Java(TM) 6 Update 37 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216037FF}) (Version: 6.0.370 - Oracle)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LaserJet 1018 (HKLM-x32\...\HP-LaserJet 1018) (Version: - )
Lizardtech DjVu Control (HKLM-x32\...\{105CFC7C-6992-11D5-BD9D-000102C10FD8}) (Version: - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (Polish) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (Polish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (HKLM-x32\...\{a0fe116e-9a8a-466f-aee0-625cb7c207e3}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 12.0 (x86 pl) (HKLM-x32\...\Mozilla Firefox 12.0 (x86 pl)) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.2.3 - Frank Heindörfer, Philip Chinery)
PIT pro 2012 (HKLM-x32\...\{19D55039-D7E5-4266-99CA-40DA78EEA193}) (Version: 1.3.21 - Podatnik.info Sp z o.o.)
PIT Projekt 2012 (HKLM-x32\...\{C3515B09-1162-43E2-A9CC-0B52A8D9460D}}_is1) (Version: 1.2.3 - GP SOFT)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podatnik.info PIT pro 2013 wersja 2.0.19.29343 (HKLM-x32\...\{B239B43B-3E99-40B0-80BF-1B1BCA868D4E}_is1) (Version: 2.0.19.29343 - Podatnik.info Sp. z o.o.)
Podstawowe programy Windows Live (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.45.516.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2837594) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{D3C85176-ACCC-4AF0-817D-1BC803303B74}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2494150) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{3FCFD88F-4D13-4F38-8625-ABABEA7F61EA}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{C70D2038-A2C4-4A99-87DE-5272BB44F0CE}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2863818) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{83B1B530-7D9E-4C6A-907F-E979CEE9C295}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0415-0000-0000000FF1CE}_Office14.SingleImage_{70D90D6A-7373-40DD-BF09-9F0B9C55FA36}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0415-0000-0000000FF1CE}_Office14.SingleImage_{1B21CC3B-3FE0-4386-B29E-6EF68C45FD9E}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2553444) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{799005D3-9B70-4219-AFE0-BC479614CC4D}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{8C55AA83-54C2-4236-A622-78440A411DC5}) (Version: - Microsoft)
VLC media player 1.1.11 (HKLM-x32\...\VLC media player) (Version: 1.1.11 - VideoLAN)
Web Protect for Windows (HKLM-x32\...\wp-cb) (Version: 10.0.0 - Web Protect)
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7900 - Broadcom Corporation)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points =========================


==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-05-11 20:51 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0C0F3825-C410-4C9A-932F-EB47367AB147} - System32\Tasks\Easy Deals-firefoxinstaller => C:\Program Files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: {16B83EB9-FF1E-4A07-9FD3-55DF39F37158} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {20320A92-800F-4B13-AE2F-90648D6D7FA0} - System32\Tasks\Easy Deals-updater => C:\Program Files (x86)\Easy Deals\Easy Deals-updater.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: {2D868E3E-6286-4B67-86C5-39CF034E65DB} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-04-17] (Piriform Ltd)
Task: {8D496086-48DD-48F1-87A7-310687CAE4EE} - System32\Tasks\Easy Deals-enabler => C:\Program Files (x86)\Easy Deals\Easy Deals-enabler.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: {8E2F08CB-5576-4F71-B240-92C0C7FEA754} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {964B7817-7589-40C7-8B5B-B2732B20CBD1} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-02] (Adobe Systems Incorporated)
Task: {A1598DBE-3D33-44D2-BB8B-196070F189E1} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\Easy Deals-enabler.job => C:\Program Files (x86)\Easy Deals\Easy Deals-enabler.exe <==== ATTENTION
Task: C:\windows\Tasks\Easy Deals-firefoxinstaller.job => C:\Program Files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe
Task: C:\windows\Tasks\Easy Deals-updater.job => C:\Program Files (x86)\Easy Deals\Easy Deals-updater.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCProtect => ""="service" <==== ATTENTION
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Dell Registration => C:\Program Files (x86)\System Registration\prodreg.exe /boot
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/11/2014 10:12:35 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 09:12:00 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 09:06:01 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 11:06:31 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: Nazwa aplikacji powodującej błąd: pcdrcui.exe, wersja: 6.0.6426.22, sygnatura czasowa: 0x52cfadb3
Nazwa modułu powodującego błąd: KERNELBASE.dll, wersja: 6.1.7601.18229, sygnatura czasowa: 0x51fb1677
Kod wyjątku: 0xe0434352
Przesunięcie błędu: 0x000000000000940d
Identyfikator procesu powodującego błąd: 0x133c
Godzina uruchomienia aplikacji powodującej błąd: 0xpcdrcui.exe0
Ścieżka aplikacji powodującej błąd: pcdrcui.exe1
Ścieżka modułu powodującego błąd: pcdrcui.exe2
Identyfikator raportu: pcdrcui.exe3

Error: (05/11/2014 11:06:29 AM) (Source: .NET Runtime) (User: ) (EventID: 1026)
Description: Application: pcdrcui.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Reflection.TargetInvocationException
Stack:
at wpfview.Program.StartController_HandelAsapiAuthenticationErrors(System.String[])
at wpfview.Program.Main(System.String[])

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 7042)
Description: Usługa Windows Search jest zatrzymywana, ponieważ wystąpił problem z indeksatorem: The catalog is corrupt.

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 7010)
Description: Nie można zainicjować indeksu.

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3058)
Description: Nie można zainicjować aplikacji.

Kontekst: aplikacja Windows

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3028)
Description: Nie można zainicjować obiektu programu zbierającego.

Kontekst: aplikacja Windows, wykaz SystemIndex

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3029)
Description: Nie można zainicjować dodatku typu plug-in w <Search.TripoliIndexer>.

Kontekst: aplikacja Windows, wykaz SystemIndex

Szczegóły:
Nie można odnaleźć elementu. (HRESULT : 0x80070490) (0x80070490)


System errors:
=============
Error: (05/11/2014 10:27:02 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:27:02 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:27:02 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:04 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:04 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:25:04 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068

Error: (05/11/2014 10:20:48 PM) (Source: Service Control Manager) (User: ) (EventID: 7001)
Description: Usługa Przeglądarka komputera zależy od usługi Serwer, której nie można uruchomić z powodu następującego błędu:
%%1068


Microsoft Office Sessions:
=========================
Error: (05/11/2014 10:12:35 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 09:12:00 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 09:06:01 PM) (Source: WinMgmt) (User: ) (EventID: 10)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/11/2014 11:06:31 AM) (Source: Application Error) (User: ) (EventID: 1000)
Description: pcdrcui.exe6.0.6426.2252cfadb3KERNELBASE.dll6.1.7601.1822951fb1677e0434352000000000000940d133c01cf6cf74a6d846dC:\Program Files\My Dell\pcdrcui.exeC:\windows\system32\KERNELBASE.dll8ab9d152-d8eb-11e3-8ea6-ccaf789af8f4

Error: (05/11/2014 11:06:29 AM) (Source: .NET Runtime) (User: ) (EventID: 1026)
Description: Application: pcdrcui.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Reflection.TargetInvocationException
Stack:
at wpfview.Program.StartController_HandelAsapiAuthenticationErrors(System.String[])
at wpfview.Program.Main(System.String[])

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 7042)
Description: Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 7010)
Description: Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3058)
Description: Kontekst: aplikacja Windows

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3028)
Description: Kontekst: aplikacja Windows, wykaz SystemIndex

Szczegóły:
Wykaz indeksów zawartości jest uszkodzony. (HRESULT : 0xc0041801) (0xc0041801)

Error: (05/11/2014 03:54:27 AM) (Source: Windows Search Service) (User: ) (EventID: 3029)
Description: Kontekst: aplikacja Windows, wykaz SystemIndex

Szczegóły:
Nie można odnaleźć elementu. (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer


CodeIntegrity Errors:
===================================
Date: 2014-05-11 20:50:57.336
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 20:50:57.102
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 20:50:56.837
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 20:50:56.619
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 00:28:05.199
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 00:28:04.981
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 00:28:04.747
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-11 00:28:04.528
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-10 22:22:52.369
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-05-10 22:22:52.120
Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Percentage of memory in use: 16%
Total physical RAM: 4004.27 MB
Available physical RAM: 3337.88 MB
Total Pagefile: 8006.73 MB
Available Pagefile: 7356.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:399.16 GB) NTFS
Drive e: () (Removable) (Total:1.95 GB) (Free:0.8 GB) FAT

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or (Size: 466 GB) (Disk ID: FCEC56D2)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=451 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 6F20736B)
No partition Table on disk 1.
Disk 1 is a removable device.

==================== End Of Log ============================

[NieWiem]

Odnajdź ten raport:
C:\ComboFix.txt

i przeklej mi go także.

[Vincent48]

Przeklejam:

Spoiler:

ComboFix 14-05-10.01 - USER 2014-05-11 20:41:05.5.4 - x64 NETWORK
Uruchomiony z: E:\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6426\AddOnDownloaded\0bb0beb6-da93-477d-980d-15bb6e2df09c.dll
c:\programdata\PCDr\6426\AddOnDownloaded\434373b7-17f4-4a5e-9e8f-2c1bb65cd9e5.dll
c:\programdata\PCDr\6426\AddOnDownloaded\59be3af2-87f2-4d3a-b380-7509f3d47c40.dll
c:\programdata\PCDr\6426\AddOnDownloaded\8745715d-dc8a-4b32-b6a6-89cd3d0cc3c5.dll
c:\programdata\PCDr\6426\AddOnDownloaded\9c07cc30-4011-4e36-a63d-e59077a22429.dll
c:\programdata\PCDr\6426\AddOnDownloaded\ad817bdc-639c-43e8-b06b-897bcb5b8f23.dll
c:\programdata\PCDr\6426\AddOnDownloaded\aeffdb78-a789-4b6a-b2c2-f85f9b4863e6.dll
c:\programdata\PCDr\6426\AddOnDownloaded\bc1b45ef-7c18-4b8a-95cd-f77c43d4f7df.dll
c:\programdata\PCDr\6426\AddOnDownloaded\c6bf01ba-05a7-4930-b8dd-7c5fd03e97ac.dll
c:\programdata\PCDr\6426\AddOnDownloaded\d114d5a6-2ec4-4056-a365-d6281d97c6b6.dll
c:\programdata\PCDr\6426\AddOnDownloaded\d48ca7e0-0e31-445b-a98c-56b7318daa06.dll
c:\programdata\PCDr\6426\AddOnDownloaded\e0db530c-27fc-4e55-af38-073796a09e9d.dll
c:\programdata\PCDr\6426\AddOnDownloaded\e5847967-7dc8-4833-8ca6-09af078c1bcb.dll
.
.
((((((((((((((((((((((((( Pliki utworzone od 2014-04-11 do 2014-05-11 )))))))))))))))))))))))))))))))
.
.
2014-05-11 18:51 . 2014-05-11 18:51 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-11 18:51 . 2014-05-11 18:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-11 01:52 . 2014-05-11 03:14 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-05-11 00:19 . 2014-05-11 00:19 -------- d-----w- c:\program files (x86)\TeaTimer (Spybot - Search & Destroy)
2014-05-11 00:19 . 2014-05-11 00:19 -------- d-----w- c:\program files (x86)\SDHelper (Spybot - Search & Destroy)
2014-05-11 00:19 . 2014-05-11 00:19 -------- d-----w- c:\program files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2014-05-11 00:19 . 2014-05-11 00:19 -------- d-----w- c:\program files (x86)\File Scanner Library (Spybot - Search & Destroy)
2014-05-11 00:17 . 2014-05-11 00:18 -------- d-----w- C:\SpybotSDPortable
2014-05-09 21:05 . 2014-05-11 18:23 -------- d-----w- c:\programdata\2992199F9A
2014-05-09 20:51 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EBEC1CF9-956F-4BD5-BBE4-B2C569573E2A}\mpengine.dll
2014-05-07 00:10 . 2014-05-09 12:46 -------- d-----w- c:\users\USER\AppData\Roaming\Loobnoqy
2014-05-05 17:57 . 2014-05-09 17:49 -------- d-----w- c:\users\USER\AppData\Roaming\Amewla
2014-05-03 19:09 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-03 19:08 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-03 19:08 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-03 19:08 . 2014-05-03 19:08 -------- d-s---w- c:\windows\system32\CompatTel
2014-05-02 18:52 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-02 18:52 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-04-29 00:13 . 2014-05-02 19:14 17931952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-27 23:13 . 2014-04-27 23:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-04-27 23:13 . 2014-04-27 23:13 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2014-04-27 23:13 . 2014-04-27 23:13 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2014-04-27 23:13 . 2014-04-27 23:13 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2014-04-27 23:13 . 2014-04-27 23:13 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2014-04-27 23:13 . 2014-04-27 23:13 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2014-04-27 23:13 . 2014-04-27 23:13 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2014-04-27 23:13 . 2014-04-27 23:13 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieUserList
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieSiteList
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-02 19:14 . 2014-01-07 21:46 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-02 19:14 . 2014-01-07 21:46 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:44 . 2014-04-08 19:11 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-08 19:11 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-08 19:11 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-08 19:11 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-08 19:11 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-08 19:11 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-08 19:11 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-08 19:11 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-08 19:11 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-08 19:11 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-08 19:11 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-02-26 17:45 . 2014-03-05 23:26 20312 ----a-w- c:\windows\system32\roboot64.exe
2014-02-13 14:12 . 2014-02-13 14:12 487517 ----a-w- C:\monitor.exe
2014-02-13 13:43 . 2014-02-13 13:43 34244 ----a-w- C:\monitorsvc.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"OrderReminder"="c:\program files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]
"ModemListener"="c:\program files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-05-15 98304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hnjgzg.lnk - c:\windows\System32\rundll32.exe c:\progra~3\299219~1\gzgjnh.cpp,work [2009-7-14 45568]
ilfgzjfr.lnk - c:\windows\System32\rundll32.exe c:\progra~3\rfjzgfli.dss,XL200 [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DeviceManager;DeviceManager;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 ProtectMonitor;Protect Monitor;c:\monitorsvc.exe;c:\monitorsvc.exe [x]
R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Audio dla ekranów;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys;c:\windows\SYSNATIVE\DRIVERS\jrdusbser.sys [x]
R3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0;PCDSRVC{D3412D80-CF3B4A27-06020200}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\my dell\pcdsrvc_x64.pkms;c:\program files\my dell\pcdsrvc_x64.pkms [x]
R3 PCProtect;PCProtect;c:\program files (x86)\Web Protect\PCProtect.exe;c:\program files (x86)\Web Protect\PCProtect.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Zawartość folderu 'Zaplanowane zadania'
.
2014-05-11 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-07 19:14]
.
2014-05-11 c:\windows\Tasks\Easy Deals-enabler.job
- c:\program files (x86)\Easy Deals\Easy Deals-enabler.exe [2014-02-26 23:44]
.
2014-05-11 c:\windows\Tasks\Easy Deals-firefoxinstaller.job
- c:\program files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe [2014-02-26 23:43]
.
2014-05-11 c:\windows\Tasks\Easy Deals-updater.job
- c:\program files (x86)\Easy Deals\Easy Deals-updater.exe [2014-02-26 23:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-08-28 7464448]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Wyślij &do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Wyślij obraz do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Wyślij stronę do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 62.179.1.61 62.179.1.63
FF - ProfilePath - c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);user_pref('extensions.blocklist.enabled', false);user_pref('security.mixed_content.block_active_content', false);
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
Wow6432Node-HKLM-RunOnce-<NO NAME> - (no file)
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{D3412D80-CF3B4A27-06020200}_0]
"ImagePath"="\??\c:\program files\my dell\pcdsrvc_x64.pkms"
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukończenia: 2014-05-11 20:57:20
ComboFix-quarantined-files.txt 2014-05-11 18:57
ComboFix2.txt 2014-05-10 23:26
ComboFix3.txt 2014-05-10 22:33
ComboFix4.txt 2014-05-10 20:32
ComboFix5.txt 2014-05-11 18:37
.
Przed: 429 412 470 784 bajtów wolnych
Po: 428 602 966 016 bajtów wolnych
.
- - End Of File - - FC96EE29F587ACCEC9C1304AD070FCD3

[NieWiem]

Ileś Ty razy tego ComboFixa odpalał? dobrze się czujesz? To nie jest bezpieczne narzędzie, tego się nie używa ot tak.

Potrzebuję jeszcze te raporty:
C:\qoobox\ComboFix2.txt
C:\qoobox\ComboFix3.txt
C:\qoobox\ComboFix4.txt
C:\qoobox\ComboFix5.txt

[Vincent48]

Po pierwszym uruchomieniu wirus zniknął na kilkadziesiąt minut, więc uruchomiłem znowu. Potem coś się z CF zwiesiło i uruchomiłem znowu. Nie znam się na tym, nie wiedziałem, że to tak niebezpieczne. Ale w takim razie już go więcej nie odpalę.

ComboFix2

Spoiler:

ComboFix 14-05-10.01 - USER 2014-05-11 1:09.4.4 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.4004.3275 [GMT 2:00]
Uruchomiony z: E:\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Utworzono nowy punkt przywracania
.
.
((((((((((((((((((((((((( Pliki utworzone od 2014-04-10 do 2014-05-10 )))))))))))))))))))))))))))))))
.
.
2014-05-10 23:22 . 2014-05-10 23:22 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-10 23:22 . 2014-05-10 23:22 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-09 21:05 . 2014-05-10 21:43 -------- d-----w- c:\programdata\2992199F9A
2014-05-09 20:51 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EBEC1CF9-956F-4BD5-BBE4-B2C569573E2A}\mpengine.dll
2014-05-07 00:10 . 2014-05-09 12:46 -------- d-----w- c:\users\USER\AppData\Roaming\Loobnoqy
2014-05-05 17:57 . 2014-05-09 17:49 -------- d-----w- c:\users\USER\AppData\Roaming\Amewla
2014-05-03 19:09 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-03 19:08 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-03 19:08 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-03 19:08 . 2014-05-03 19:08 -------- d-s---w- c:\windows\system32\CompatTel
2014-05-02 18:52 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-02 18:52 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-04-29 00:13 . 2014-05-02 19:14 17931952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-27 23:13 . 2014-04-27 23:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-04-27 23:13 . 2014-04-27 23:13 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2014-04-27 23:13 . 2014-04-27 23:13 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2014-04-27 23:13 . 2014-04-27 23:13 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2014-04-27 23:13 . 2014-04-27 23:13 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2014-04-27 23:13 . 2014-04-27 23:13 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2014-04-27 23:13 . 2014-04-27 23:13 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2014-04-27 23:13 . 2014-04-27 23:13 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieUserList
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieSiteList
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-02 19:14 . 2014-01-07 21:46 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-02 19:14 . 2014-01-07 21:46 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:44 . 2014-04-08 19:11 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-08 19:11 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-08 19:11 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-08 19:11 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-08 19:11 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-08 19:11 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-08 19:11 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-08 19:11 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-08 19:11 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-08 19:11 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-08 19:11 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-02-26 17:45 . 2014-03-05 23:26 20312 ----a-w- c:\windows\system32\roboot64.exe
2014-02-13 14:12 . 2014-02-13 14:12 487517 ----a-w- C:\monitor.exe
2014-02-13 13:43 . 2014-02-13 13:43 34244 ----a-w- C:\monitorsvc.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"OrderReminder"="c:\program files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]
"ModemListener"="c:\program files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-05-15 98304]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hnjgzg.lnk - c:\windows\System32\rundll32.exe c:\progra~3\299219~1\gzgjnh.cpp,work [2009-7-14 45568]
ilfgzjfr.lnk - c:\windows\System32\rundll32.exe c:\progra~3\rfjzgfli.dss,XL200 [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DeviceManager;DeviceManager;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 ProtectMonitor;Protect Monitor;c:\monitorsvc.exe;c:\monitorsvc.exe [x]
R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Inte , %    
  
×××mmmy …C?=ćc`]˙b_\˙_\Y˙mkh˙ÂÁż˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ôôň˙ÎËÄ˙Á˝µ˙Äż¸˙ĎĚĆ˙ćäá˙öőó˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ţţţ˙äăŕ˙ÖÔĎ˙âáŢ˙ďďî˙îîď˙ââá˙ÎĚÉ˙¶ł®˙Ąˇ›˙źś—˙źś–˙©§Ą˙°Ż®˙łł˛˙­­­˙žťť˙ŚŚŠ˙ywu˙jhd˙ca]˙][X˙^]Z˙_^]˙^^^˙ccc˙_`a˙ccd˙lll˙eee˙nnn˙iii˙ddd˙```˙YYY˙OOO˙FGG˙<<=˙123˙')*˙$$$˙$#"˙)&#˙3.)˙@91˙UMDýbYO˙mcY˙{rh˙‹ƒz˙ź™˙±«¤˙ľął˙ËĆÂ˙ŃÍÉ˙ĐĚÇ˙Łť—˙]SG˙ic\˙”Ť˙˛¬¦˙»ł¬˙“Ť„˙|v˙Ť‹‡˙“ŹŚ˙“ŹŤ˙“ŹŤ˙“Ť˙“ŹŤ˙’ŽŤ˙’ŹŚ˙’ŹŚ˙’ŽŤ˙‘ŽŽ˙ŹŤ˙ŽŚ˙ŹŤŚ˙ŽŤ‹˙ŽŤ‹˙ŤŤ‹˙ŤŤ‹˙Ś‹‰˙‹‰ˆ˙Š‰‡˙‰‰‡˙ŚŚ‹˙~Ó%          

řřř’’’UZYXłc`^˙ZXV˙^\Y˙^[X˙ZWT˙xus˙˝Ľ»˙řřů˙˙˙˙˙ţýý˙đďí˙ôóň˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙ţţţ˙űűű˙řřř˙őőő˙ńńń˙éčč˙ŰÚŮ˙ĹÄÁ˙­©¤˙ ť—˙™•˙›˜•˙¤˘ ˙Ş©©˙«««˙˘˘˘˙”““˙‚˙omj˙da^˙[YV˙XVS˙ZXV˙XXW˙ZZZ˙]^^˙ZZZ˙ggh˙ccc˙jjj˙kkk˙eee˙bbb˙\\\˙RRR˙IJJ˙@@@˙567˙)+,˙$$%˙$#"˙$$!˙/+&˙=5/˙JC:˙YOE˙j`V˙{rh˙Šx˙›•Ś˙®¨ ˙şµ®˙ĆÂľ˙ŇÎĘ˙ÖÓĎ˙Ú×Ň˙Ű×Ô˙ŐŇÍ˙ĐÍÇ˙ĚČÂ˙şµ®˙|tk˙ZQF˙€}x˙¤ž™˙ą±Ş˙©ˇ˜˙ys˙ˆƒ˙Ť‰˙’Ž‹˙‘Ž‹˙‘ŽŚ˙Ť‹˙‘Ť‹˙‘ŤŚ˙ŹŤŚ˙ŤŚ˙ŽŚ˙ŹŤ‹˙ŽŚŠ˙ŤŤŠ˙ŤŚŠ˙ŤŚ‹˙ŤŚŠ˙‹Šˆ˙ŠŠˆ˙Š‰‡˙‰ˆ‡˙ˆˆ†˙ŠŠ‰˙…„„Î  
    

ÚÚŮ!®¬©íŠˆ„˙edc˙YXU˙\ZX˙XVT˙WUS˙xvt˙Ľ»ş˙ř÷ř˙˙˙˙˙˙˙˙˙˙˙˙˙űűű˙ůůů˙ôôô˙ďďď˙ęęę˙äää˙ŢŢŢ˙××Ř˙µł°˙›—‘˙‘Žˆ˙—”˙ťś™˙¤ŁŁ˙˘˘˘˙˜˜™˙‰ˆ‡˙wus˙gda˙\YV˙URO˙SRP˙RQO˙TSS˙XXX˙UUU˙___˙```˙ccc˙lll˙fff˙ddd˙^^^˙VVV˙LLL˙BDD˙999˙-./˙&'(˙$$#˙$"!˙+($˙61+˙E>5˙RJ@˙cZO˙uka˙ƒzq˙•Śƒ˙§ˇ™˙¶±Ş˙Ăľ¸˙ĐĚĆ˙ÖŇÍ˙ÚÖŇ˙Ú×Ó˙ŐŇÎ˙ĎÎÉ˙ÉĹż˙ÁĽµ˙şµ­˙µ°¨˙ł­¤˙ł­¤˙ą˛Ş˙ś•Ś˙^TJ˙le^˙“ŤŠ˙Ż§ˇ˙¶­Ą˙Źˆ€˙zt˙Śˆ„˙ŹŚ‰˙ŹŚ‰˙Ź‹‰˙Ž‹‰˙ŹŚŠ˙Ź‹Š˙ŹŚ‹˙ŽŚŠ˙Ť‹‰˙Ť‹ˆ˙Ś‹‰˙ŚŚ‰˙ŚŚŠ˙Ť‹‰˙‹‰ˆ˙Š‰ˆ˙‰ˆ†˙ˆˆ†˙‡‡†˙‡†…˙‰‡†˙‹‹ŠĘ
 



ÇĹÁ‚ĚĘÇ˙Ľş¸˙–•’˙nlk˙[ZW˙ZYW˙XVU˙XVT˙vus˙¶µ´˙ččč˙ňóó˙ççç˙ÝÝÝ˙ÖÖÖ˙ÍÍÍ˙ĆĆĆ˙ľľľ˙···˙ŻŻŻ˙¤¤Ł˙›ś›˙ššš˙”••˙ƒƒ„˙lki˙_\Y˙SRO˙NMJ˙MLJ˙KKJ˙PPO˙QQQ˙TVV˙^^^˙\\\˙hhh˙fff˙eee˙aaa˙ZZZ˙OOO˙FGG˙<<<˙/01˙'))˙$$$˙#"!˙)&#˙2.(˙?81˙NE<˙]RI˙oe[˙~uj˙Ť…|˙ š’˙°Ş¤˙Ŕ»µ˙ÍÉÄ˙ÔŃĚ˙ŮÖŇ˙ŰŘÓ˙×ÓĎ˙ŇÎÉ˙ĘĆŔ˙Á˝¶˙»¶®˙µ°¨˙˛¬Ł˙±«Ł˙±¬Ł˙ł­Ł˙´­¤˙¶Ż¦˙µŻĄ˙ą˛¨˙˛«Ł˙xne˙\SJ˙{w˙˘›•˙¶­¦˙Ąť•˙}wp˙…‚|˙‹‰…˙ŤŠˆ˙ŤŠˆ˙ŤŠˆ˙ŤŠˆ˙Ť‹ˆ˙ŤŠ‡˙Ś‰‡˙‹‰‡˙ŠŠ‡˙‹Šˆ˙‹Šˆ˙‹‰‡˙‰‰†˙‰ˆ‡˙‰‡†˙ˆ‡†˙††…˙†…„˙†……˙‡……˙Ž‹‹É
ĹĂÁÄÂŔ÷ČĆĹ˙ĚĚÉ˙ÄÄÁ˙ŁŁ ˙tsq˙VUR˙NML˙MKJ˙JIG˙cb`˙‘‘‘ů¶¶¶ţ»»»˙±±±˙¦¦¦˙žžž˙–––˙ŽŽŽ˙‡‡‡˙˙xxx˙ppp˙hii˙XXX˙IHG˙HHF˙KKK˙KKK˙XXY˙WWW˙bbb˙ggg˙eee˙ddd˙\\\˙RSS˙JJJ˙@@A˙456˙++,˙%%&˙""!˙&#!˙.*&˙;4-˙H@7˙YOE˙g^R˙xnd˙‡v˙š“‹˙©Łś˙ş´®˙ĘĹŔ˙ÓĎĘ˙ŮŐŃ˙ŰŮŐ˙ŘÖŇ˙ÔŃĚ˙ËÇÁ˙Âľ·˙»·®˙µ°¨˙±«˘˙°Şˇ˙°Şˇ˙˛«ˇ˙ł¬Ł˙´­¤˙´®¤˙´®¤˙µ®¤˙µ®Ą˙¶°Ą˙·±Ą˙¸±§˙˝¶¬˙™‘ˆ˙^TI˙mf`˙’Ś†˙®¦ž˙µ­¤˙‹„}˙}xr˙ˆ…˙‹ˆ†˙Ś‰†˙Ś‰†˙‹‡…˙Šˆ…˙Šˆ†˙‰ˆ…˙‰ˆ†˙‰‰‡˙Š‰‡˙Šˆ†˙ˆ‡…˙‡‡…˙‡‡„˙ˆ†…˙‡……˙†„„˙†…„˙……„˙…„„˙Ť‹‹Č ĹÄØĹĹÄ˙ĹĹÄ˙ÉÉČ˙ĐĐÍ˙ĚÍĘ˙ŞŞ¨˙srq˙GFF˙:88˙987˙10/ř>==řhhg˙€€€ý˙vvv˙nnn˙ggg˙^^^˙UUU˙MMM˙III˙DDD˙MMM˙SSS˙YZZ˙cdd˙bbc˙eee˙^^^˙WWW˙LLL˙DDD˙899˙--.˙&&'˙"!!˙!! ˙+($˙5/*˙B<3˙RI?˙bYN˙pg]˙xm˙•Ž„˙¤ž–˙´Ż¨˙ĹÁ»˙ŃÎČ˙ŘÔŃ˙ŰŘÔ˙ÚÖŇ˙ŐŃĚ˙ÍĘĹ˙ĹÁ»˙˝¸°˙·˛¨˙±«Ł˙Ż© ˙Ż©ź˙°©ź˙±«ˇ˙ł¬˘˙ł­Ł˙ł¬Ł˙ł­Ł˙ł­Ł˙´®Ł˙µŻ¤˙¶ŻĄ˙·°¦˙·±¦˙ą˛§˙ął¨˙»´©˙ż·®˙´­Ł˙rj`˙^UL˙ƒ~x˙¤ś”˙¸°§˙§ž–˙{un˙ƒ~z˙Š†‚˙Š‡„˙Š†ƒ˙‰†ƒ˙ˆ†„˙ˆ‡„˙‰‡…˙‰‡…˙‰‡…˙ˆ‡„˙‡†„˙‡†ƒ˙‡†„˙†…„˙…„ƒ˙†„ƒ˙†„„˙†„„˙…ƒƒ˙…„ƒ˙………Č ÇĆĹ!ČÇÇűČÇÇ˙ÉČČ˙ĘÉÉ˙ÍĚË˙ŐÔŇ˙ÖÔÓ˙ł´±˙kjj˙544˙(''˙ůřë<;;˙GGG˙FFF˙AAA˙BBB˙MMM˙OOO˙___˙aaa˙ddd˙bbb˙[[[˙QQQ˙GGH˙;<<˙012˙))*˙###˙ ˙'$"˙0,(˙>70˙LD9˙\SI˙kbV˙zpf˙Ś„{˙ź˜‘˙°ŞŁ˙Ŕ˝·˙ÎĘĆ˙×ÓĐ˙ŰŘŐ˙ÚŘÔ˙ÖÓĎ˙ĐËĆ˙ĆÂĽ˙ľą˛˙¸˛«˙±¬Ł˙Ż© ˙Ż©ź˙®¨ž˙°©ź˙±«ˇ˙˛¬ˇ˙ł¬˘˙´¬˘˙´­˘˙ł¬˘˙´­Ł˙µ®¤˙µŻ¤˙·°Ą˙¸°¦˙¸±¦˙ą˛§˙ş˛¨˙»ł©˙»´©˙ĽµŞ˙˝¶«˙ľ·¬˙ÂĽ±˙–†˙]TG˙qjc˙•Ž‰˙°¨ź˙¸Ż¦˙Ś…}˙zuo˙…}˙‡„˙ˆ…‚˙‡…‚˙‡†ƒ˙‡†ƒ˙‡†ƒ˙‡…ƒ˙†„‚˙…„‚˙……ƒ˙†…‚˙…ƒ‚˙„ƒ‚˙„ƒ‚˙„ƒ‚˙„ƒ‚˙…ƒ‚˙…ƒƒ˙„„ƒ˙„„ƒČ ĘĘÉ›ËËĘ˙ĚËË˙ÍĚÍ˙ÎÍÎ˙ĎÎÎ˙ŇŃĐ˙ŰÚ×˙ÄÄÂ˙€€˙DDC˙(('ţďô! ˙554ţRRR˙^^^˙```˙ccc˙^^^˙UUU˙KKK˙>>@˙445˙+,,˙##%˙ ˙%#!˙,)%˙82,˙F>5˙WMC˙e\Q˙tj`˙…}r˙™’Š˙©Łś˙Ľ·±˙ĚČĂ˙ŐŃÎ˙ŰŮŐ˙ÜŮÖ˙ŮÖŇ˙ŃÍÉ˙ČĂľ˙żş´˙¸ł«˙±«Ł˙Ż¨ ˙®¨ź˙®¨ź˙±Şˇ˙±Ş ˙±Şˇ˙±Ş ˙˛«ˇ˙˛«ˇ˙ł«ˇ˙ł¬˘˙´­˘˙µ­Ł˙µ®¤˙·ŻĄ˙¶°Ą˙·±¦˙ą±¦˙ş˛¨˙ş˛¨˙şł©˙Ľ´Ş˙˝µ«˙˝¶«˙˝·«˙ľ·¬˙ż·­˙żą®˙ÄĽ˛˙¸°§˙sj`˙_WM˙…y˙¤›•˙ą°¨˙§ź–˙wrk˙yt˙…‚˙†ƒ˙†„˙†„˙†ƒ€˙…‚€˙…ƒ€˙„ƒ€˙…ƒ˙…ƒ€˙„‚€˙„€˙„˙„˙ƒ‚˙‚‚˙ƒ‚˙„‚‚˙„ƒƒ˙„ƒƒČ ÍËË"ĎÎÎýĐĎĎ˙ĐĐĐ˙ŃŃŃ˙ŇŇŇ˙ÓÓŇ˙ÔÔŇ˙ÓŇĐ˙żżż˙€€˙a_^˙UUTňVVVýbbb˙bbbţZZZ˙OOO˙CDD˙888˙-..˙%%&˙ ˙#" ˙(%"˙2-(˙@81˙QH>˙_UK˙neY˙wl˙“Š˙˘›”˙·˛«˙ÉĹż˙ÓĎĚ˙ÚŘÓ˙ÝÚ×˙Ú×Ó˙ÓĐĘ˙ËĆÁ˙Á˝¶˙ą´­˙˛¬Ł˙Ż© ˙­§ž˙­¦ť˙Ż§ť˙°© ˙°Ş ˙±Şˇ˙˛«ˇ˙µ¬˘˙µ®˘˙˛«ˇ˙˛«ˇ˙ł¬ˇ˙´®Ł˙µ®Ł˙µŻ¤˙·°Ą˙¸°¦˙¸°¦˙ą˛§˙ą˛§˙»ł¨˙»´©˙ĽµŞ˙Ľ¶Ş˙˝¶«˙ľ¶«˙ľ·¬˙ż¸­˙Ŕą®˙Ŕą®˙ÁşŻ˙Ăş°˙ĆĽ±˙ČŔ¶˙˜‘ˆ˙]TH˙rjd˙”Ś†˙Ż¦ž˙¸Ż¦˙Šƒz˙vrk˙z˙„~˙…~˙„~˙ƒ~˙ƒ€~˙ƒ~˙„‚˙„‚˙‚€~˙‚€˙ƒ˙ƒ˙ƒ€˙ƒ€€˙‚€˙‚‚˙ƒ‚˙ƒ‚˙ƒ‚‚Č ĐĐĐšŇŇŇ˙ÓÓÓ˙ŐÔÔ˙ÔÔÔ˙ŃŃŇ˙ĎĎÍ˙ĚĚÉ˙ĆĆĹ˙–––˙gfg˙fgg˙III˙>>>˙022˙'((˙ !!˙! ˙%#!˙.*&˙93,˙JB8˙ZPF˙g]R˙zpe˙‹„{˙›”‹˙±«¤˙ĹÁĽ˙ĐÍÉ˙Ů×Ó˙ßÜ×˙ÜÚŐ˙ŐŇÎ˙ĚČÄ˙ÄŔą˙»µ®˙ł®¦˙Ż©ˇ˙­¦ž˙¬¦ť˙­¦ś˙Ż¨ť˙Ż¨ź˙°Ş ˙˛Ş ˙´¬˘˙ł«ˇ˙±« ˙´¬˘˙¸°Ą˙¬¦›˙®§ť˙ął¦˙µ®¤˙¶Ż¤˙·°Ą˙¸±¦˙ą˛§˙ą˛§˙ş˛¨˙»ł©˙»´¨˙Ľµ©˙Ľ´Ş˙˝µ«˙ľ¶«˙ż·¬˙ż¸­˙Ŕ¸­˙ÁşŻ˙ÁşŻ˙Ă»Ż˙ĂĽ±˙ÄĽ±˙Ĺ˝˛˙Ĺľł˙Ęø˙»´Ş˙ri`˙_VM˙„~x˙Łš’˙·®¦˙¦ž•˙uqi˙zxr˙~{˙‚|˙‚€|˙‚€}˙‚€}˙‚€}˙‚€}˙‚~}˙}˙}˙~˙~˙€~˙€˙‚€˙‚€˙‚‚€˙€˙‚€Č ĐĐĐŐŐŐöÖÖÖ˙×ŘŘ˙ŃŃŃ˙ÇÇČ˙»şş˙Ż®®˙©©Ş˙‘‘‘˙jkk˙NOO˙&&&˙ ˙*&#˙5/)˙D=3˙SJA˙bWM˙rh^˙…}t˙–Ž…˙«Łť˙Ŕ»µ˙ÍËĹ˙ŮÖŃ˙ßÜŘ˙ÝŰ×˙ÖÔĎ˙ĎËĆ˙ĆÂĽ˙Ľ·±˙¶°§˙°«˘˙­§ž˙¬¦ť˙¬¦ť˙®¨ť˙Ż¨ž˙Ż¨ž˙Ż©ź˙°©ź˙±Şź˙±Şź˙ł¬˘˙·°Ą˙­§ť˙˛« ˙ş˛§˙ą˛§˙„v˙]YS˙nic˙—’‰˙»µ¨˙ą˛§˙şł§˙»´§˙»´©˙»ł©˙Ľµ©˙ĽµŞ˙ż·«˙ľ·¬˙ľ·«˙ÄĽ±˙ÉÁµ˙ĘÁ¶˙ʵ˙Ĺ˝°˙Âą®˙ĹĽ±˙Ä˝˛˙Ĺľł˙Ćľł˙ÇŔ´˙ÇŔ´˙Éö˙ÍĆş˙š“Š˙^SI˙pic˙’Š„˙¬¤ś˙¶¬¤˙‰‚z˙qnh˙}zv˙~{˙~{˙~{˙|˙€}z˙€}{˙~|˙~|˙€}|˙€~|˙€}˙~˙~˙€~˙€~˙˙˙Č ÜŰŰŠÝÜÜ˙ŐÔÔ˙ĆÇÇ˙¸ą¸˙¦¨¨˙‘‘‘˙€˙xus˙faZ˙SKC˙RI@˙YPE˙lbW˙uk˙Ź‡~˙¤ť–˙ą´®˙ÉĹż˙ŐÓĎ˙ßÜŘ˙ŢÝŘ˙ŮÖŇ˙ÓĎĘ˙ÉĹż˙żşł˙¸˛«˙˛­¤˙®¨ź˙¬¦ť˙¬¦ť˙¬¦ť˙®§ž˙®§ž˙Ż©ź˙Ż¨ž˙°©ź˙ł­˘˙µ®Ł˙¶Ż¤˙¶°Ą˙µ®¤˙´®Ł˙ą˛¦˙…€x˙b^X˙xsk˙©˘˜˙ˇ›“˙DCA˙DBA˙<;8˙`]W˙±« ˙ż¸¬˙Ľ´©˙˝µŞ˙˝µ«˙ľ¶«˙ľ·«˙ż·¬˙Ŕ·­˙ĹĽ±˙ĚĹş˙ą˛Ş˙Ą š˙™–Ź˙«§ź˙Äľµ˙Ëĸ˙Ĺľ°˙Ćżł˙ČŔµ˙ČÁµ˙ɶ˙Ëø˙ĚÄą˙ŃĘľ˙ĂĽ˛˙vnd˙]UK˙zu˙ —‘˙´«Ł˙Ą›“˙tng˙wuo˙~|x˙€}z˙|x˙{y˙|y˙|z˙|z˙|z˙}{˙}{˙}|˙~|˙€}˙€}˙€}˙€}˙€~˙~Č ´´´ĎĎĎčŇŇŇ˙ÄÄÄ˙žťš˙phb˙aYQ˙\SH˙aWK˙si_˙„|s˙š”‹˙´®©˙ĹŔ»˙ŇĐË˙ŢŰŘ˙ŕÝÚ˙ŰŘÔ˙ŐŇÍ˙ĚČÂ˙Á˝·˙ş¶®˙´Ż§˙°Şˇ˙®§ź˙­§ž˙­¦ž˙®¨ź˙Ż©ź˙°© ˙Ż¨ź˙°Şź˙±Ş ˙±Ş ˙±Şź˙±Şź˙´­˘˙¬¦ś˙š•Ť˙Ž‰‚˙‘Śƒ˙±Ş ˙Áą¬˙Ś†}˙32/˙DCA˙A@<˙id]˙ťš—˙ČÇÇ˙”’Ź˙ecb˙<:8˙¸°¤˙Âş®˙ż·¬˙ż·¬˙Ŕ¸¬˙Á¸­˙Á¸­˙Âą®˙Çżł˙ą´¬˙~{t˙WQI˙LE:˙OH=˙92(˙}zv˙˙ţü˙ĺâŰ˙ŐÍÂ˙Ěö˙ĚĹą˙ÍĹş˙ĎĆĽ˙ĎÇĽ˙ŇĘż˙ŐÎÂ˙ š˙^TI˙le^˙Ž‡˙Şˇ™˙ł© ˙‹ƒz˙qle˙{ws˙}zw˙~zw˙~{w˙~{x˙~{y˙~{y˙~|y˙~|z˙}{˙}{˙}{˙~}|˙~{˙€~|˙€|˙~|˙€}|Č Š‹‹`âăä˙ś˜“˙ne[˙xne˙Ž†}˙ŞĄź˙ľş´˙ĎËĆ˙ÜÚÖ˙ŕŢÚ˙ÝŮÖ˙×ŐŃ˙ÎĚĆ˙ĹŔ»˙˝·±˙·˛«˙±¬¤˙Ż©ˇ˙®¨ ˙®¨ź˙®¨ź˙Ż© ˙°Şˇ˙±Ş ˙±Ş ˙±Ş ˙±Ş ˙±Şˇ˙µ®¤˙´­˘˙Ż©ť˙Ż§ś˙´­ˇ˙»´¨˙ š˙lf^˙c\S˙b[R˙YTL˙zs˙µ­ˇ˙Ś‰…˙¨¦Ą˙Ś‰†˙YWV˙JGD˙ŽŚˆ˙ĺĺć˙óňň˙ą·¸˙pmi˙Ćľ˛˙Ŕ¸¬˙Áą­˙Âş®˙Âş®˙Ă»Ż˙Ă»°˙ÇŔł˙˝·­˙zrg˙k`P˙‰}k˙™Ť|˙Ąš‰˙‰~l˙ŻŞ¤˙űűű˙yvr˙’Ź‹˙ßŘÎ˙ĐÇ˝˙ĐÉ˝˙ŃÉľ˙ŇĘż˙ÓËŔ˙×ĎÄ˙ĘĂą˙zsi˙\SI˙|tq˙›“Ś˙±§ź˙¤›‘˙rme˙toj˙zwt˙|yw˙}yw˙}zw˙|zw˙|zx˙|zx˙}{y˙~|z˙~|z˙~|z˙~|y˙~|z˙~}{˙|{˙|{˙~}{Č ŇŇÓ8ÎËÇô´Ż©˙ĆÄľ˙ŰŘŐ˙ŕÜŘ˙ÝÚŘ˙Ú×Ó˙ŇÎÉ˙ČĂľ˙ż»´˙ş´­˙ł®¦˙°«Ł˙°Şˇ˙Ż© ˙®¨ ˙°©ź˙°Şˇ˙°Şˇ˙±Şˇ˙˛¬˘˙˛«ˇ˙˛«ˇ˙˛«ˇ˙˛¬ˇ˙ł¬˘˙ł­˘˙ą˛Ą˙˘ś˙ˆƒy˙tnh˙kga˙Š…{˙°©ž˙“‰{˙…s[˙„u]˙„we˙dWH˙aZP˙«¤š˙ŽŠ˙öőö˙éçć˙¸··˙„y˙¶Ż¤˙•’Ź˙ŞŞ©˙ł°¬˙Ľµ©˙Ä˝°˙ÂĽŻ˙ĂĽŻ˙Ä˝°˙Ĺ˝±˙Ĺľ±˙ČÁł˙żąŻ˙°­Ş˙ĚĆľ˙łŞś˙Ą›Ś˙ČÂą˙âßÚ˙ËĹľ˙ňđď˙ĎČÂ˙nbQ˙;5-˙•”Ź˙áŮÎ˙ÓĚż˙ÔĚÁ˙ŐÎÂ˙ÖÎĂ˙×ĎĂ˙ÜŐĘ˙«˘›˙aWM˙g`Y˙‰|˙¤ś•˙±§ž˙‹ƒ{˙mhc˙xto˙{xu˙{xv˙{xu˙|yv˙|zw˙|zw˙|zx˙}zx˙}{x˙}|y˙~{y˙~zx˙}{x˙}|y˙~|z˙}{zČ čćâĄŃÍČ˙ÜŮŐ˙ÔŃË˙ĘĆŔ˙½·˙Ľ·°˙µ°¨˙˛­Ą˙±«Ł˙°©ˇ˙Ż©ˇ˙°Şź˙°Şˇ˙±«ˇ˙±«˘˙˛«˘˙ł¬˘˙ł¬Ł˙ł¬˘˙ł­Ł˙´­Ł˙µ®¤˙µ®¤˙µ®¤˙¶Ż¤˙·°¤˙Ľµ©˙¦ź–˙PLV˙QM`˙YVs˙MJc˙TQV˙‚zm˙ÍƸ˙¬ś…˙ź‘z˙™Šu˙€s]˙thU˙Ĺ˝ł˙Łś”˙——”˙˛˛±˙ą·ł˙˝µ¨˙Çżł˙ľ¶Ş˙ł«ź˙ľ¶Ş˙ÇŔ˛˙Ä˝Ż˙Ĺľ±˙Çľ˛˙Çżł˙ČŔł˙ÉÁµ˙ÎĹ·˙Ł š˙’‘‘˙Ŕľ˝˙ŐŃÍ˙ĘĹŔ˙ÁżŔ˙wxv˙~|{˙±Ż­˙ŃÍĆ˙´«ť˙ƒwf˙?92˙ş¶±˙ß×Ë˙ÖÎĂ˙×ÎÄ˙×ĐĆ˙×ŃĹ˙ÜÔĘ˙ŇÍĂ˙ƒ{r˙ZOF˙uni˙•Ť†˙¬˘š˙§ť“˙upf˙qmg˙xuq˙{wu˙{wu˙{xu˙|yv˙|zv˙|yw˙{yv˙}zw˙}zw˙}yx˙}zx˙}zx˙|zx˙|{y˙}{yČ d: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukończenia: 2014-05-11 01:26:41
ComboFix-quarantined-files.txt 2014-05-10 23:26
ComboFix2.txt 2014-05-10 22:33
ComboFix3.txt 2014-05-10 20:32
ComboFix4.txt 2013-11-11 23:45
.
Przed: 429 458 186 240 bajtów wolnych
Po: 429 153 886 208 bajtów wolnych
.
- - End Of File - - E37DC823A4EBE2E697BE38CC1C3A0B19

ComboFix3

Spoiler:

ComboFix 14-05-10.01 - USER 2014-05-11 0:14.3.4 - x64 NETWORK
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.4004.3379 [GMT 2:00]
Uruchomiony z: E:\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Utworzono nowy punkt przywracania
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome.manifest
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\asyncDB.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\browserAction.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\contextMenu.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dbManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dom_bg.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\fileManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefox.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxNotifications.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxOmnibox.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\message.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\pageAction.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\request.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\tabs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\webRequest.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\windowsMessagingHandler.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\background.html
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\baseObject.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\browser.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\addressBarChangeObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\console.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\consts.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\delegate.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\extensionDataStore.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\folderIOWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\httpObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\IDBWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\installer.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\logFile.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\prefs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\progressListenerObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\registry.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reloadObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reports.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\requestObject.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\searchSettings.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\uninstallObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\updateManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\utils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\xhr.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\dialog.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\ffCoreFilesIndex.txt
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\main.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\platformVersion.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\search_dialog.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\defaults\preferences\prefs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\manifest.xml
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins.json
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\1_base.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\102_dealply_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\103_intext_5_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\104_jollywallet_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\108_icm_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\123_intext_adv_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\17_jQuery.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\177_crossriderDashboard.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\182_openUrl.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\183_tabsWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\191_ciuvo_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\207_dbWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\21_debug.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\217_similar_products_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\22_resources.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\220_icm_base_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\221_icm_downloads_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\223_imonomy_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\226_set_campaign_id_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\230_revizer_ws_dynamic_b2b_2_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\246_setup.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\256_dealply_sidebar_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\28_initializer.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\47_resources_background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\64_appApiMessage.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\7_hooks.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\72_appApiValidation.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\9_search_engine_hook.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\98_omniCommands.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\extension.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\install.rdf
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\locale\en-US\translations.dtd
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button1.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button2.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button3.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button4.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button5.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\crossrider_statusbar.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon128.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon16.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon24.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon48.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\panelarrow-up.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\popup.html
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\skin.css
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\update.css
.
.
((((((((((((((((((((((((( Pliki utworzone od 2014-04-10 do 2014-05-10 )))))))))))))))))))))))))))))))
.
.
2014-05-10 22:29 . 2014-05-10 22:29 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-10 22:29 . 2014-05-10 22:29 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-09 21:05 . 2014-05-10 21:43 -------- d-----w- c:\programdata\2992199F9A
2014-05-09 20:51 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EBEC1CF9-956F-4BD5-BBE4-B2C569573E2A}\mpengine.dll
2014-05-07 00:10 . 2014-05-09 12:46 -------- d-----w- c:\users\USER\AppData\Roaming\Loobnoqy
2014-05-05 17:57 . 2014-05-09 17:49 -------- d-----w- c:\users\USER\AppData\Roaming\Amewla
2014-05-03 19:09 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-03 19:08 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-03 19:08 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-03 19:08 . 2014-05-03 19:08 -------- d-s---w- c:\windows\system32\CompatTel
2014-05-02 18:52 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-02 18:52 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-04-29 00:13 . 2014-05-02 19:14 17931952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-27 23:13 . 2014-04-27 23:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-04-27 23:13 . 2014-04-27 23:13 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2014-04-27 23:13 . 2014-04-27 23:13 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2014-04-27 23:13 . 2014-04-27 23:13 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2014-04-27 23:13 . 2014-04-27 23:13 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2014-04-27 23:13 . 2014-04-27 23:13 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2014-04-27 23:13 . 2014-04-27 23:13 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2014-04-27 23:13 . 2014-04-27 23:13 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieUserList
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieSiteList
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-02 19:14 . 2014-01-07 21:46 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-02 19:14 . 2014-01-07 21:46 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:44 . 2014-04-08 19:11 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-08 19:11 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-08 19:11 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-08 19:11 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-08 19:11 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-08 19:11 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-08 19:11 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-08 19:11 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-08 19:11 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-08 19:11 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-08 19:11 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-02-26 17:45 . 2014-03-05 23:26 20312 ----a-w- c:\windows\system32\roboot64.exe
2014-02-13 14:12 . 2014-02-13 14:12 487517 ----a-w- C:\monitor.exe
2014-02-13 13:43 . 2014-02-13 13:43 34244 ----a-w- C:\monitorsvc.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11111111-1111-1111-1111-110311991194}]
c:\program files (x86)\Easy Deals\Easy Deals-bho.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"OrderReminder"="c:\program files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]
"ModemListener"="c:\program files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-05-15 98304]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hnjgzg.lnk - c:\windows\System32\rundll32.exe c:\progra~3\299219~1\gzgjnh.cpp,work [2009-7-14 45568]
ilfgzjfr.lnk - c:\windows\System32\rundll32.exe c:\progra~3\rfjzgfli.dss,XL200 [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DeviceManager;DeviceManager;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 ProtectMonitor;Protect Monitor;c:\monitorsvc.exe;c:\monitorsvc.exe [x]
R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 IntcDAud;Intel(R) Audio dla ekranów;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys;c:\windows\SYSNATIVE\DRIVERS\jrdusbser.sys [x]
R3 PCProtect;PCProtect;c:\program files (x86)\Web Protect\PCProtect.exe;c:\program files (x86)\Web Protect\PCProtect.exe [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Zawartość folderu 'Zaplanowane zadania'
.
2014-05-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-07 19:14]
.
2014-05-10 c:\windows\Tasks\Easy Deals-enabler.job
- c:\program files (x86)\Easy Deals\Easy Deals-enabler.exe [2014-02-26 23:44]
.
2014-05-10 c:\windows\Tasks\Easy Deals-firefoxinstaller.job
- c:\program files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe [2014-02-26 23:43]
.
2014-05-10 c:\windows\Tasks\Easy Deals-updater.job
- c:\program files (x86)\Easy Deals\Easy Deals-updater.exe [2014-02-26 23:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-08-28 7464448]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Wyślij &do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Wyślij obraz do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Wyślij stronę do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 62.179.1.61 62.179.1.63
FF - ProfilePath - c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);user_pref('extensions.blocklist.enabled', false);user_pref('security.mixed_content.block_active_content', false);
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
AddRemove-DrTaxPL_Lite_2011 - c:\users\USER\Desktop\Dr. Tax Light - PIT 2011\uninstall.exe
AddRemove-StartSearch Toolbar - c:\program files (x86)\StartSearch plugin\uninst.exe
.
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukończenia: 2014-05-11 00:33:32
ComboFix-quarantined-files.txt 2014-05-10 22:33
ComboFix2.txt 2014-05-10 20:32
ComboFix3.txt 2013-11-11 23:45
.
Przed: 428 513 730 560 bajtów wolnych
Po: 428 252 909 568 bajtów wolnych
.
- - End Of File - - 7A6969AB618EEE8447CD85696F667C5A

ComboFix4

Spoiler:

ComboFix 14-05-10.01 - USER 2014-05-10 22:09:37.2.4 - x64 NETWORK
Uruchomiony z: E:\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Easy Deals\EaSY deals-bho.dll
c:\programdata\PCDr\6426\AddOnDownloaded\0bb0beb6-da93-477d-980d-15bb6e2df09c.dll
c:\programdata\PCDr\6426\AddOnDownloaded\434373b7-17f4-4a5e-9e8f-2c1bb65cd9e5.dll
c:\programdata\PCDr\6426\AddOnDownloaded\59be3af2-87f2-4d3a-b380-7509f3d47c40.dll
c:\programdata\PCDr\6426\AddOnDownloaded\8745715d-dc8a-4b32-b6a6-89cd3d0cc3c5.dll
c:\programdata\PCDr\6426\AddOnDownloaded\9c07cc30-4011-4e36-a63d-e59077a22429.dll
c:\programdata\PCDr\6426\AddOnDownloaded\ad817bdc-639c-43e8-b06b-897bcb5b8f23.dll
c:\programdata\PCDr\6426\AddOnDownloaded\aeffdb78-a789-4b6a-b2c2-f85f9b4863e6.dll
c:\programdata\PCDr\6426\AddOnDownloaded\bc1b45ef-7c18-4b8a-95cd-f77c43d4f7df.dll
c:\programdata\PCDr\6426\AddOnDownloaded\c6bf01ba-05a7-4930-b8dd-7c5fd03e97ac.dll
c:\programdata\PCDr\6426\AddOnDownloaded\d114d5a6-2ec4-4056-a365-d6281d97c6b6.dll
c:\programdata\PCDr\6426\AddOnDownloaded\d48ca7e0-0e31-445b-a98c-56b7318daa06.dll
c:\programdata\PCDr\6426\AddOnDownloaded\e0db530c-27fc-4e55-af38-073796a09e9d.dll
c:\programdata\PCDr\6426\AddOnDownloaded\e5847967-7dc8-4833-8ca6-09af078c1bcb.dll
c:\users\USER\AppData\Roaming\Iqytyp
c:\users\USER\AppData\Roaming\Iqytyp\xaelxu.exe
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome.manifest
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\asyncDB.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\browserAction.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\contextMenu.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dbManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dom_bg.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\fileManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefox.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxNotifications.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxOmnibox.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\message.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\pageAction.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\request.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\tabs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\webRequest.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\windowsMessagingHandler.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\background.html
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\baseObject.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\browser.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\addressBarChangeObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\console.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\consts.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\delegate.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\extensionDataStore.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\folderIOWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\httpObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\IDBWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\installer.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\logFile.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\prefs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\progressListenerObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\registry.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reloadObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reports.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\requestObject.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\searchSettings.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\uninstallObserver.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\updateManager.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\utils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\xhr.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\dialog.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\ffCoreFilesIndex.txt
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\main.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\platformVersion.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\search_dialog.xul
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\defaults\preferences\prefs.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\manifest.xml
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins.json
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\1_base.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\102_dealply_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\103_intext_5_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\104_jollywallet_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\108_icm_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\123_intext_adv_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\126_revizer_ws_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\17_jQuery.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\177_crossriderDashboard.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\182_openUrl.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\183_tabsWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\191_ciuvo_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\207_dbWrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\21_debug.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\217_similar_products_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\22_resources.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\220_icm_base_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\221_icm_downloads_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\223_imonomy_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\226_set_campaign_id_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\230_revizer_ws_dynamic_b2b_2_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\246_setup.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\256_dealply_sidebar_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\28_initializer.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\47_resources_background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\64_appApiMessage.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\7_hooks.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\72_appApiValidation.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\87_ginyas_wrapper.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\9_search_engine_hook.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\98_omniCommands.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\background.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\extension.js
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\install.rdf
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\locale\en-US\translations.dtd
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button1.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button2.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button3.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button4.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button5.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\crossrider_statusbar.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon128.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon16.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon24.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon48.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\panelarrow-up.png
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\popup.html
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\skin.css
c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\update.css
c:\users\USER\AppData\Roaming\Orsoka
c:\users\USER\AppData\Roaming\Orsoka\oqyzna.exe
.
.
((((((((((((((((((((((((( Pliki utworzone od 2014-04-10 do 2014-05-10 )))))))))))))))))))))))))))))))
.
.
2014-05-10 20:24 . 2014-05-10 20:24 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-05-10 20:24 . 2014-05-10 20:24 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-05-09 21:05 . 2014-05-10 08:25 -------- d-----w- c:\programdata\2992199F9A
2014-05-09 20:51 . 2014-04-17 03:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{EBEC1CF9-956F-4BD5-BBE4-B2C569573E2A}\mpengine.dll
2014-05-07 00:10 . 2014-05-09 12:46 -------- d-----w- c:\users\USER\AppData\Roaming\Loobnoqy
2014-05-05 17:57 . 2014-05-09 17:49 -------- d-----w- c:\users\USER\AppData\Roaming\Amewla
2014-05-03 19:09 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
2014-05-03 19:08 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-03 19:08 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-03 19:08 . 2014-05-03 19:08 -------- d-s---w- c:\windows\system32\CompatTel
2014-05-02 18:52 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
2014-05-02 18:52 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-04-29 00:13 . 2014-05-02 19:14 17931952 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2014-04-27 23:13 . 2014-04-27 23:13 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
2014-04-27 23:13 . 2014-04-27 23:13 588728 ----a-w- c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2014-04-27 23:13 . 2014-04-27 23:13 43960 ----a-w- c:\program files (x86)\Mozilla Firefox\mozglue.dll
2014-04-27 23:13 . 2014-04-27 23:13 157352 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2014-04-27 23:13 . 2014-04-27 23:13 129976 ----a-w- c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2014-04-27 23:13 . 2014-04-27 23:13 626688 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcr80.dll
2014-04-27 23:13 . 2014-04-27 23:13 548864 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcp80.dll
2014-04-27 23:13 . 2014-04-27 23:13 479232 ----a-w- c:\program files (x86)\Mozilla Firefox\msvcm80.dll
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieUserList
2014-04-23 18:34 . 2014-04-23 18:34 -------- d-sh--w- c:\users\USER\AppData\Local\EmieSiteList
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-02 19:14 . 2014-01-07 21:46 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-02 19:14 . 2014-01-07 21:46 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-31 07:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-04 09:44 . 2014-04-08 19:11 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-08 19:11 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-08 19:11 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-08 19:11 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-08 19:11 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-08 19:11 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-08 19:11 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-08 19:11 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-08 19:11 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-08 19:11 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-08 19:11 2048 ----a-w- c:\windows\SysWow64\user.exe
2014-02-26 17:45 . 2014-03-05 23:26 20312 ----a-w- c:\windows\system32\roboot64.exe
2014-02-13 14:12 . 2014-02-13 14:12 487517 ----a-w- C:\monitor.exe
2014-02-13 13:43 . 2014-02-13 13:43 34244 ----a-w- C:\monitorsvc.exe
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2014-04-11 00:37 12240 ----a-w- c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\AskPartnerNetwork\Toolbar\ORJ\Passport.dll" [2014-04-11 12240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-12-18 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"OrderReminder"="c:\program files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"ModemListener"="c:\program files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-05-15 98304]
"ApnTBMon"="c:\program files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe" [2014-04-11 1801168]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
hnjgzg.lnk - c:\windows\System32\rundll32.exe c:\progra~3\299219~1\gzgjnh.cpp,work [2009-7-14 45568]
ilfgzjfr.lnk - c:\windows\System32\rundll32.exe c:\progra~3\rfjzgfli.dss,XL200 [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ProtectMonitor;Protect Monitor;c:\monitorsvc.exe;c:\monitorsvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys;c:\windows\SYSNATIVE\DRIVERS\jrdusbser.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 APNMCP;Ask Update Service;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe;c:\program files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [x]
S2 DeviceManager;DeviceManager;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
S3 IntcDAud;Intel(R) Audio dla ekranów;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 PCProtect;PCProtect;c:\program files (x86)\Web Protect\PCProtect.exe;c:\program files (x86)\Web Protect\PCProtect.exe [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{2D46B6DC-2207-486B-B523-A557E6D54B47}]
start [BU]
.
Zawartość folderu 'Zaplanowane zadania'
.
2014-05-09 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-01-07 19:14]
.
2014-05-10 c:\windows\Tasks\Easy Deals-enabler.job
- c:\program files (x86)\Easy Deals\Easy Deals-enabler.exe [2014-02-26 23:44]
.
2014-05-10 c:\windows\Tasks\Easy Deals-firefoxinstaller.job
- c:\program files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe [2014-02-26 23:43]
.
2014-05-10 c:\windows\Tasks\Easy Deals-updater.job
- c:\program files (x86)\Easy Deals\Easy Deals-updater.exe [2014-02-26 23:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-03-29 608112]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-27 1128448]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-08-28 7464448]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Wyślij &do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Wyślij obraz do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Wyślij stronę do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 62.179.1.61 62.179.1.63
FF - ProfilePath - c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
user_pref('extensions.autoDisableScopes', 0);user_pref('security.csp.enable', false);user_pref('security.OCSP.enabled', 0);user_pref('extensions.blocklist.enabled', false);user_pref('security.mixed_content.block_active_content', false);
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC} - c:\program files (x86)\Ask.com\GenericAskToolbar.dll
BHO-{11111111-1111-1111-1111-110311991194} - c:\program files (x86)\Easy Deals\Easy Deals-bho.dll
Wow6432Node-HKCU-Run-Ypodfeydzovegyd - c:\users\USER\AppData\Roaming\Iqytyp\xaelxu.exe
SafeBoot-Wdf01000.sys
AddRemove-DrTaxPL_Lite_2011 - c:\users\USER\Desktop\Dr. Tax Light - PIT 2011\uninstall.exe
AddRemove-StartSearch Toolbar - c:\program files (x86)\StartSearch plugin\uninst.exe
.
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
C:\monitor.exe
c:\program files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
c:\program files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
c:\program files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Czas ukończenia: 2014-05-10 22:32:57 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2014-05-10 20:32
ComboFix2.txt 2013-11-11 23:45
.
Przed: 428 570 763 264 bajtów wolnych
Po: 428 916 785 152 bajtów wolnych
.
- - End Of File - - F3F8F4218A10565BE8FA8869FC8EC296

ComboFix5

Spoiler:

ComboFix 13-11-11.01 - USER 2013-11-12 0:29.1.4 - x64 MINIMAL
Microsoft Windows 7 Home Premium 6.1.7601.1.1250.48.1045.18.4004.3443 [GMT 1:00]
Uruchomiony z: E:\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Utworzono nowy punkt przywracania
.
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\StartSearch plugin
c:\program files (x86)\StartSearch plugin\IEhelperActiveX.dll
c:\program files (x86)\StartSearch plugin\startsplg.crx
c:\program files (x86)\StartSearch plugin\uninst.exe
c:\programdata\ilfgzjfr.fdd
c:\programdata\ilfgzjfr.pss
c:\programdata\PCDr\6308\AddOnDownloaded\073fb38f-0e69-479d-bca1-4f81ec9dcbf6.dll
c:\programdata\PCDr\6308\AddOnDownloaded\2a6b5d0b-a2fc-4bdd-b3fe-6bbefb85b7e4.dll
c:\programdata\PCDr\6308\AddOnDownloaded\2c784c13-702f-431e-a492-e9dddd757b25.dll
c:\programdata\PCDr\6308\AddOnDownloaded\3cb2cbfc-72a8-4ae7-9061-1a58b1505327.dll
c:\programdata\PCDr\6308\AddOnDownloaded\5c103ca5-8249-401b-a699-41d0a39023f4.dll
c:\programdata\PCDr\6308\AddOnDownloaded\66858fdf-b35c-4b24-a074-915d56b3871b.dll
c:\programdata\PCDr\6308\AddOnDownloaded\704dfeb5-9129-4d88-8096-7f3bc80eb1ec.dll
c:\programdata\PCDr\6308\AddOnDownloaded\8d529c31-eeb1-4b4d-ab7e-98a38b1abf60.dll
c:\programdata\PCDr\6308\AddOnDownloaded\8fab1a01-d6b6-4640-ac86-c3ddd583c840.dll
c:\programdata\PCDr\6308\AddOnDownloaded\9d97f346-8efc-4e33-9c3b-3eef6c324e61.dll
c:\programdata\PCDr\6308\AddOnDownloaded\9e7391aa-d9c2-4547-bdb7-737a833083a2.dll
c:\programdata\PCDr\6308\AddOnDownloaded\b96b7bbd-964e-47f1-9323-f48f460042bf.dll
c:\programdata\PCDr\6308\AddOnDownloaded\c4f346c1-09ef-4c0a-846d-8ca41f94690b.dll
c:\programdata\PCDr\6308\AddOnDownloaded\cadaa395-f50b-45c6-81f6-b5aaa3c5efba.dll
c:\programdata\PCDr\6308\AddOnDownloaded\dde43788-ba3c-4b88-bc8a-de8a0eb22c79.dll
c:\programdata\PCDr\6308\AddOnDownloaded\e13c218f-cd37-454b-a187-3381a9945752.dll
c:\programdata\PCDr\6308\AddOnDownloaded\f12de547-df4d-4236-9129-baac054f90ab.dll
c:\programdata\PCDr\6308\AddOnDownloaded\f586fa98-17b8-498c-9c59-24de5750efab.dll
c:\programdata\PCDr\6308\AddOnDownloaded\f73e8868-a1f5-4756-9eae-b4ffc305f35a.dll
c:\programdata\PCDr\6308\AddOnDownloaded\fc470dbb-846d-42d3-bb0a-6363a559f3fb.dll
c:\programdata\rfjzgfli.dss
.
.
((((((((((((((((((((((((( Pliki utworzone od 2013-10-11 do 2013-11-11 )))))))))))))))))))))))))))))))
.
.
2013-11-11 23:40 . 2013-11-11 23:40 -------- d-----w- c:\users\USER\AppData\Local\temp
2013-11-11 23:40 . 2013-11-11 23:40 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-11-11 22:16 . 2013-11-11 22:17 285 ----a-w- c:\programdata\ilfgzjfr.reg
2013-11-11 22:16 . 2013-11-11 23:28 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD799A3B-6131-4684-B62C-3F85C1CED3E6}\offreg.dll
2013-11-09 10:44 . 2013-10-14 07:12 10280728 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{DD799A3B-6131-4684-B62C-3F85C1CED3E6}\mpengine.dll
2013-10-26 18:47 . 2013-11-09 10:48 -------- d-----w- c:\users\USER\AppData\Roaming\Etbamy
2013-10-26 18:47 . 2013-11-09 10:37 -------- d-----w- c:\users\USER\AppData\Roaming\Etsohe
2013-10-26 18:47 . 2013-10-26 18:47 -------- d-----w- c:\users\USER\AppData\Roaming\Seceog
.
.
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-22 23:28 . 2013-10-11 01:12 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-09-22 23:27 . 2013-10-11 01:12 2876928 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-09-22 23:27 . 2013-10-11 01:12 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-09-22 23:27 . 2013-10-11 01:12 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-09-22 22:55 . 2013-10-11 01:12 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-09-22 22:55 . 2013-10-11 01:12 2241024 ----a-w- c:\windows\system32\wininet.dll
2013-09-22 22:55 . 2013-10-11 01:12 1365504 ----a-w- c:\windows\system32\urlmon.dll
2013-09-22 22:54 . 2013-10-11 01:12 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-09-22 22:54 . 2013-10-11 01:12 19252224 ----a-w- c:\windows\system32\mshtml.dll
2013-09-22 22:54 . 2013-10-11 01:12 855552 ----a-w- c:\windows\system32\jscript.dll
2013-09-22 22:54 . 2013-10-11 01:12 3959296 ----a-w- c:\windows\system32\jscript9.dll
2013-09-22 22:54 . 2013-10-11 01:12 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-09-22 22:54 . 2013-10-11 01:12 526336 ----a-w- c:\windows\system32\ieui.dll
2013-09-22 22:54 . 2013-10-11 01:12 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-09-22 22:54 . 2013-10-11 01:12 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-09-22 22:54 . 2013-10-11 01:12 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-09-22 22:54 . 2013-10-11 01:12 2647552 ----a-w- c:\windows\system32\iertutil.dll
2013-09-22 22:54 . 2013-10-11 01:12 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-09-21 03:38 . 2013-10-11 01:12 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-09-21 03:30 . 2013-10-11 01:12 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-09-21 02:48 . 2013-10-11 01:12 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-09-21 02:39 . 2013-10-11 01:12 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-09-14 01:10 . 2013-10-10 22:42 497152 ----a-w- c:\windows\system32\drivers\afd.sys
2013-09-08 02:30 . 2013-10-10 22:42 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-09-08 02:27 . 2013-10-10 22:42 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-09-08 02:03 . 2013-10-10 22:42 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-09-03 12:35 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe
2013-08-29 02:17 . 2013-10-10 22:42 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-08-29 02:16 . 2013-10-10 22:42 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-08-29 02:16 . 2013-10-10 22:42 243712 ----a-w- c:\windows\system32\wow64.dll
2013-08-29 02:16 . 2013-10-10 22:42 859648 ----a-w- c:\windows\system32\tdh.dll
2013-08-29 02:13 . 2013-10-10 22:42 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-08-29 01:51 . 2013-10-10 22:42 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-08-29 01:51 . 2013-10-10 22:42 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-08-29 01:50 . 2013-10-10 22:42 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-08-29 01:50 . 2013-10-10 22:42 76304 ----a-w- c:\users\USER\AppData\Roaming\Other.res
2013-08-29 01:50 . 2013-10-10 22:42 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-08-29 01:50 . 2013-10-10 22:42 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-08-29 01:48 . 2013-10-10 22:42 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-08-29 01:48 . 2013-10-10 22:42 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-08-29 00:49 . 2013-10-10 22:42 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-08-29 00:49 . 2013-10-10 22:42 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-08-29 00:49 . 2013-10-10 22:42 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-08-29 00:49 . 2013-10-10 22:42 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-08-28 01:21 . 2013-10-10 22:42 3155968 ----a-w- c:\windows\system32\win32k.sys
2013-08-28 01:12 . 2013-10-10 22:42 461312 ----a-w- c:\windows\system32\scavengeui.dll
.
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-25 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-04-25 15:36 1520776 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-25 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2011-04-13 503942]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2013-09-03 40312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"OrderReminder"="c:\program files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2006-07-30 98304]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-04-25 1648264]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"ModemListener"="c:\program files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe" [2010-05-15 98304]
.
c:\users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ilfgzjfr.lnk - c:\windows\System32\rundll32.exe c:\progra~3\rfjzgfli.dss,XL200 [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2011-2-8 1136928]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 DeviceManager;DeviceManager;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe;c:\program files (x86)\Common Files\DeviceHelper\DeviceManager.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys;c:\windows\SYSNATIVE\DRIVERS\CtClsFlt.sys [x]
R3 IntcDAud;Intel(R) Audio dla ekranów;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 jrdusbser;Mobile Connector Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\jrdusbser.sys;c:\windows\SYSNATIVE\DRIVERS\jrdusbser.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2011-03-29 608112]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2011-05-27 1128448]
"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2011-08-28 7464448]
.
------- Skan uzupełniający -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&ksportuj do programu Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Wyślij &do programu OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Wyślij obraz do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Wyślij stronę do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 62.179.1.62 62.179.1.63
FF - ProfilePath - c:\users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\
FF - prefs.js: browser.startup.homepage - hxxp://startsear.ch/?aff=1&cf=8fa44f7d-7f5f-11e1-88fa-ccaf789af8f4
FF - prefs.js: keyword.URL - hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=ORJ&o=100000027&locale=en_US&apn_uid=39EC5D89-0E1C-43F3-B5E7-29A73A45657F&apn_ptnrs=U3&apn_sauid=8124417D-4282-43A5-9261-06F42BBEA76B&apn_dtid=OSJ000YYPL&&q=
.
- - - - USUNIĘTO PUSTE WPISY - - - -
.
Wow6432Node-HKCU-Run-Ekzir - c:\users\USER\AppData\Roaming\Etbamy\ismui.exe
Wow6432Node-HKCU-Run-FNModuleUpdater - c:\users\USER\AppData\Roaming\fnmod_32.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-Browsers Protector - c:\program files (x86)\Browsers Protector\regmon32.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-DrTaxPL_Lite_2011 - c:\users\USER\Desktop\Dr. Tax Light - PIT 2011\uninstall.exe
AddRemove-StartSearch Toolbar - c:\program files (x86)\StartSearch plugin\uninst.exe
.
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10u_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10u.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Czas ukończenia: 2013-11-12 00:45:23
ComboFix-quarantined-files.txt 2013-11-11 23:45
.
Przed: 431 913 828 352 bajtów wolnych
Po: 432 663 511 040 bajtów wolnych
.
- - End Of File - - B49C019A552A7F1FC40B13D527EF5EC2

ComboFix-quarantined-files

Spoiler:

2014-05-11 09:05:33 . 2014-05-07 20:23:24 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\434373b7-17f4-4a5e-9e8f-2c1bb65cd9e5.dll.vir
2014-05-11 09:05:33 . 2014-04-28 16:45:11 66,296 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\d114d5a6-2ec4-4056-a365-d6281d97c6b6.dll.vir
2014-05-11 09:05:33 . 2014-04-30 16:22:58 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\ad817bdc-639c-43e8-b06b-897bcb5b8f23.dll.vir
2014-05-11 09:05:33 . 2014-04-28 21:57:22 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\9c07cc30-4011-4e36-a63d-e59077a22429.dll.vir
2014-05-11 09:05:32 . 2014-04-25 22:18:56 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\e5847967-7dc8-4833-8ca6-09af078c1bcb.dll.vir
2014-05-11 09:05:32 . 2014-04-25 20:26:36 82,680 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\c6bf01ba-05a7-4930-b8dd-7c5fd03e97ac.dll.vir
2014-05-11 09:05:32 . 2014-04-18 15:31:43 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\bc1b45ef-7c18-4b8a-95cd-f77c43d4f7df.dll.vir
2014-05-11 09:05:32 . 2014-04-18 15:25:43 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\d48ca7e0-0e31-445b-a98c-56b7318daa06.dll.vir
2014-05-11 09:05:32 . 2014-04-18 17:06:44 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\aeffdb78-a789-4b6a-b2c2-f85f9b4863e6.dll.vir
2014-05-11 09:05:32 . 2014-04-18 17:04:51 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\8745715d-dc8a-4b32-b6a6-89cd3d0cc3c5.dll.vir
2014-05-11 09:05:32 . 2014-04-18 17:02:35 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\59be3af2-87f2-4d3a-b380-7509f3d47c40.dll.vir
2014-05-11 09:05:32 . 2014-04-18 17:00:32 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\e0db530c-27fc-4e55-af38-073796a09e9d.dll.vir
2014-05-11 09:05:32 . 2014-04-18 16:59:13 62,200 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6426\AddOnDownloaded\0bb0beb6-da93-477d-980d-15bb6e2df09c.dll.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 3 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\extension.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 451 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\223_imonomy_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 1,079 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\256_dealply_sidebar_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 795 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\230_revizer_ws_dynamic_b2b_2_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 381 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\221_icm_downloads_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 46,953 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\220_icm_base_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 795 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\193_revizer_p_dynamic_b2b_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 795 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\192_revizer_ws_dynamic_b2b_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 153,182 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\91_monetizationLoader.js.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 1,151 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\191_ciuvo_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 447 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\155_ibario_pops_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 887 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\123_intext_adv_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 1,622 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\126_revizer_ws_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 2,294 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\103_intext_5_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 1,055 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\102_dealply_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 2,807 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\246_setup.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 791 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\93_superfish_no_coupons_m.js.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 17,410 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins.json.vir
2014-05-10 22:09:29 . 2014-05-10 22:09:29 1,733 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\manifest.xml.vir
2014-05-10 21:38:35 . 2014-05-10 21:38:35 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button4.png.vir
2014-05-10 21:38:35 . 2014-05-10 21:38:35 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\crossrider_statusbar.png.vir
2014-05-10 21:38:34 . 2014-05-10 21:38:35 134,775 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon128.png.vir
2014-05-10 21:38:34 . 2014-05-10 21:38:34 917 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\panelarrow-up.png.vir
2014-05-10 21:38:34 . 2014-05-10 21:38:34 1,350 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon16.png.vir
2014-05-10 21:38:33 . 2014-05-10 21:38:33 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button1.png.vir
2014-05-10 21:38:33 . 2014-05-10 21:38:33 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button3.png.vir
2014-05-10 21:38:33 . 2014-05-10 21:38:33 2,765 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon24.png.vir
2014-05-10 21:38:33 . 2014-05-10 21:38:33 990 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\skin.css.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button2.png.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:33 1,361 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\button5.png.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 140 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\update.css.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 349 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\popup.html.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 2,505 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dom_bg.js.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 5,078 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\skin\icon48.png.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 3,628 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\tabs.js.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 8,906 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\browserAction.js.vir
2014-05-10 21:38:32 . 2014-05-10 21:38:32 4,805 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\asyncDB.js.vir
2014-05-10 21:38:31 . 2014-05-10 21:38:31 5,359 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\contextMenu.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 943 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\fileManager.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 353 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefox.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 5,806 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\webRequest.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 1,336 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\background.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 10,097 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\dbManager.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 1,515 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxOmnibox.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 5,210 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\message.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 11,257 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\pageAction.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 960 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\windowsMessagingHandler.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 1,116 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\firefoxNotifications.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 2,314 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api\request.js.vir
2014-05-10 21:38:30 . 2014-05-10 21:38:30 18,554 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\utils.js.vir
2014-05-10 21:38:29 . 2014-05-10 21:38:30 8,607 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\extensionDataStore.js.vir
2014-05-10 21:38:29 . 2014-05-10 21:38:29 130 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\addressBarChangeObserver.js.vir
2014-05-10 21:38:29 . 2014-05-10 21:38:29 2,372 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\uninstallObserver.js.vir
2014-05-10 21:38:28 . 2014-05-10 21:38:28 1,261 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\requestObject.js.vir
2014-05-10 21:38:28 . 2014-05-10 21:38:28 3,526 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\folderIOWrapper.js.vir
2014-05-10 21:38:28 . 2014-05-10 21:38:28 2,561 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\httpObserver.js.vir
2014-05-10 21:38:28 . 2014-05-10 21:38:28 4,191 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\IDBWrapper.js.vir
2014-05-10 21:38:27 . 2014-05-10 21:38:35 1,317 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\installer.js.vir
2014-05-10 21:38:27 . 2014-05-10 21:38:27 2,356 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\consts.js.vir
2014-05-10 21:38:27 . 2014-05-10 21:38:27 2,180 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\delegate.js.vir
2014-05-10 21:38:27 . 2014-05-10 21:38:27 1,368 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\progressListenerObserver.js.vir
2014-05-10 21:38:27 . 2014-05-10 21:38:27 3,869 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reports.js.vir
2014-05-10 21:38:25 . 2014-05-10 21:38:25 1,753 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\console.js.vir
2014-05-10 21:38:25 . 2014-05-10 21:38:25 11,288 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\updateManager.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:25 1,158 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\registry.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 1,562 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\logFile.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 1,649 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\prefs.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 1,527 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\reloadObserver.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 3,426 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\searchSettings.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 2,852 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\core\xhr.js.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 4,813 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\browser.xul.vir
2014-05-10 21:38:23 . 2014-05-10 21:38:23 1,931 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.js.vir
2014-05-10 21:38:22 . 2014-05-10 21:38:22 18,796 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\api.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:21 18,750 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\main.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 19 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\baseObject.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 613 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\platformVersion.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 2,457 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\search_dialog.xul.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 1,052 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\ffCoreFilesIndex.txt.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 2,001 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\background.html.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 1,343 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\dialog.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 1,913 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome\content\options.xul.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 496 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\userCode\background.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 5,007 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\108_icm_m.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 7,056 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\13_CrossriderAppUtils.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 3,676 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\21_debug.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 664 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\28_initializer.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 79,982 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\17_jQuery.js.vir
2014-05-10 21:38:20 . 2014-05-10 21:38:20 26,508 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\217_similar_products_m.js.vir
2014-05-10 21:38:19 . 2014-05-10 21:38:19 20,377 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\87_ginyas_wrapper.js.vir
2014-05-10 21:38:19 . 2014-05-10 21:38:19 569 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\226_set_campaign_id_m.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:19 94,180 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\4_jquery_1_7_1.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 801 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\7_hooks.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 545 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\195_icm_convertmedia_m.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 9,082 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\22_resources.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 2,285 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\9_search_engine_hook.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 30,419 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\177_crossriderDashboard.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 1,450 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\104_jollywallet_m.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 2,555 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\183_tabsWrapper.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 14,301 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\182_openUrl.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 6,908 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\1_base.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 1,661 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\207_dbWrapper.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 7,720 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\47_resources_background.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 1,936 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\98_omniCommands.js.vir
2014-05-10 21:38:18 . 2014-05-10 21:38:18 46,195 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\72_appApiValidation.js.vir
2014-05-10 21:38:17 . 2014-05-10 21:38:17 2,332 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\64_appApiMessage.js.vir
2014-05-10 21:38:17 . 2014-05-10 21:38:17 20,810 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\14_CrossriderUtils.js.vir
2014-05-10 21:38:11 . 2014-05-10 21:38:17 16,158 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\16_FFAppAPIWrapper.js.vir
2014-05-10 21:38:11 . 2014-05-10 21:38:11 3,321 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\extensionData\plugins\78_CrossriderInfo.js.vir
2014-05-10 21:38:09 . 2014-05-10 21:38:09 732 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\chrome.manifest.vir
2014-05-10 21:38:09 . 2014-05-10 21:38:35 3,979 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\defaults\preferences\prefs.js.vir
2014-05-10 21:38:09 . 2014-05-10 21:38:09 425 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\locale\en-US\translations.dtd.vir
2014-05-10 21:38:08 . 2014-05-10 21:38:08 1,374 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com\install.rdf.vir
2014-05-10 20:32:07 . 2014-05-10 20:32:07 558 ----a-w- C:\Qoobox\Quarantine\Registry_backups\SafeBoot-Wdf01000.sys.reg.dat
2014-05-10 20:32:00 . 2014-05-10 20:32:00 154 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKCU-Run-Ypodfeydzovegyd.reg.dat
2014-05-10 20:31:59 . 2014-05-10 23:23:49 224 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-BHO-{11111111-1111-1111-1111-110311991194}.reg.dat
2014-05-10 20:31:58 . 2014-05-10 20:31:59 476 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-URLSearchHooks-{00000000-6E41-4FD3-8538-502F5495E5FC}.reg.dat
2014-02-27 21:48:13 . 2014-02-27 21:48:13 286,387 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Iqytyp\xaelxu.exe.vir
2014-02-26 23:44:03 . 2014-02-26 23:44:03 0 ----a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\Easy Deals\EaSY deals-bho.dll.vir
2013-11-11 23:45:23 . 2013-11-11 23:45:23 0 ----a-w- C:\Qoobox\Quarantine\MBR_HardDisk0.mbr
2013-11-11 23:42:59 . 2013-11-11 23:42:59 377 ----a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47}.reg.dat
2013-11-11 23:42:34 . 2013-11-11 23:42:34 174 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKLM-Run-Browsers Protector.reg.dat
2013-11-11 23:42:31 . 2013-11-11 23:42:31 148 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKCU-Run-FNModuleUpdater.reg.dat
2013-11-11 23:42:31 . 2013-11-11 23:42:31 143 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Wow6432Node-HKCU-Run-Ekzir.reg.dat
2013-11-11 23:37:41 . 2014-05-11 18:48:33 18,473 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg
2013-11-11 23:26:48 . 2014-05-11 18:37:35 255 ----a-w- C:\Qoobox\Quarantine\catchme.log
2013-11-11 20:06:45 . 2013-11-07 01:42:15 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\3cb2cbfc-72a8-4ae7-9061-1a58b1505327.dll.vir
2013-11-11 20:06:45 . 2013-11-07 01:35:51 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\9e7391aa-d9c2-4547-bdb7-737a833083a2.dll.vir
2013-11-11 20:06:44 . 2013-11-07 01:28:36 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\f586fa98-17b8-498c-9c59-24de5750efab.dll.vir
2013-11-11 20:06:44 . 2013-11-07 01:15:22 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\f73e8868-a1f5-4756-9eae-b4ffc305f35a.dll.vir
2013-11-11 20:06:44 . 2013-11-05 18:49:25 58,104 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\073fb38f-0e69-479d-bca1-4f81ec9dcbf6.dll.vir
2013-11-11 20:06:44 . 2013-10-30 18:07:38 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\e13c218f-cd37-454b-a187-3381a9945752.dll.vir
2013-11-11 20:06:44 . 2013-10-30 17:59:52 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\5c103ca5-8249-401b-a699-41d0a39023f4.dll.vir
2013-11-11 20:06:44 . 2013-10-30 17:42:13 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\dde43788-ba3c-4b88-bc8a-de8a0eb22c79.dll.vir
2013-11-11 20:06:43 . 2013-10-28 15:21:33 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\c4f346c1-09ef-4c0a-846d-8ca41f94690b.dll.vir
2013-11-01 14:08:40 . 2013-10-28 16:05:41 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\2a6b5d0b-a2fc-4bdd-b3fe-6bbefb85b7e4.dll.vir
2013-11-01 14:08:40 . 2013-10-28 15:54:29 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\8d529c31-eeb1-4b4d-ab7e-98a38b1abf60.dll.vir
2013-10-31 17:06:26 . 2013-10-28 15:39:41 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\cadaa395-f50b-45c6-81f6-b5aaa3c5efba.dll.vir
2013-10-23 20:52:33 . 2013-10-22 18:49:10 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\704dfeb5-9129-4d88-8096-7f3bc80eb1ec.dll.vir
2013-10-22 08:36:45 . 2013-10-21 21:06:12 54,008 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\8fab1a01-d6b6-4640-ac86-c3ddd583c840.dll.vir
2013-10-19 10:56:05 . 2013-10-14 17:08:37 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\9d97f346-8efc-4e33-9c3b-3eef6c324e61.dll.vir
2013-10-19 10:56:04 . 2013-10-14 16:54:05 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\66858fdf-b35c-4b24-a074-915d56b3871b.dll.vir
2013-10-18 08:24:59 . 2013-10-14 16:23:31 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\fc470dbb-846d-42d3-bb0a-6363a559f3fb.dll.vir
2013-10-18 08:24:59 . 2013-10-14 16:11:15 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\2c784c13-702f-431e-a492-e9dddd757b25.dll.vir
2013-10-15 09:45:56 . 2013-10-11 20:19:29 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\b96b7bbd-964e-47f1-9323-f48f460042bf.dll.vir
2013-10-15 09:45:55 . 2013-10-12 00:32:45 49,912 ----a-w- C:\Qoobox\Quarantine\C\ProgramData\PCDr\6308\AddOnDownloaded\f12de547-df4d-4236-9129-baac054f90ab.dll.vir
2012-08-13 06:48:47 . 2012-08-13 06:48:47 295,108 ----a-w- C:\Qoobox\Quarantine\C\Users\USER\AppData\Roaming\Orsoka\oqyzna.exe.vir
2012-04-05 20:40:44 . 2012-04-05 20:40:44 52,685 ----a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\StartSearch plugin\uninst.exe.vir
2012-02-20 11:00:08 . 2012-02-20 11:00:08 141,184 ----a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\StartSearch plugin\IEhelperActiveX.dll.vir
2012-01-02 10:51:48 . 2012-01-02 10:51:48 42,412 ----a-w- C:\Qoobox\Quarantine\C\Program Files (x86)\StartSearch plugin\startsplg.crx.vir

[NieWiem]

Pobierz załączony plik i umieść go obok FRST.

fixlist.txt

(3.11 KiB) Ściągnięto 84 razy

Uruchom FRST jako administrator i wciśnij tym razem FIX.
Poczekaj aż ukończy zadanie.

Następnie poproszę raport z usuwania (fixlog.txt) i nowy raport z FRST z opcji Scan, ale robiony w miarę możliwości już z trybu normalnego.

[Vincent48]

Zrobiłem dokładnie tak, jak napisałeś, ale byłem zaskoczony, bo po wciśnięciu Fix całe naprawianie trwało zaledwie kilka sekund. Załączam plik fixlog i już próbuję uruchomić tryb normalny.


Fixlog

Spoiler:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 11-05-2014 01
Ran by USER at 2014-05-11 23:46:20 Run:1
Running from C:\Users\USER\Desktop
Boot Mode: Safe Mode (with Networking)
==============================================

Content of fixlist:
*****************
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hnjgzg.lnk
ShortcutTarget: hnjgzg.lnk -> C:\ProgramData\2992199F9A\gzgjnh.cpp ()
Startup: C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ilfgzjfr.lnk
ShortcutTarget: ilfgzjfr.lnk -> C:\PROGRA~3\rfjzgfli.dss (No File)
C:\ProgramData\2992199F9A
C:\PROGRA~3\rfjzgfli.dss
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dl ... r=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1&cf=8fa44f7d- ... af789af8f4
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=8f ... 89af8f4&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://startsear.ch/?aff=1&src=sp&cf=8f ... 89af8f4&q={searchTerms}
SearchScopes: HKCU - {885BC2FA-93B7-4736-BAB8-6303660799BF} URL = http://www.search.ask.com/web?tpid=ORJ& ... b=IE,FF&q={searchTerms}&psv=
FF SearchEngineOrder.1: Ask.com
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll (StartSearch )
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcomsearch.xml
FF SearchPlugin: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\startsear.xml
FF Extension: Easy Deals - C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\Extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com [2014-05-11]
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2014-05-07 02:10 - 2014-05-09 14:46 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Loobnoqy
2014-05-05 19:57 - 2014-05-09 19:49 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Amewla
C:\Program Files (x86)\Easy Deals
C:\ProgramData\ilfgzjfr.bxx
C:\ProgramData\ilfgzjfr.fvv
C:\ProgramData\ilfgzjfr.reg
Task: {0C0F3825-C410-4C9A-932F-EB47367AB147} - System32\Tasks\Easy Deals-firefoxinstaller => C:\Program Files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: {20320A92-800F-4B13-AE2F-90648D6D7FA0} - System32\Tasks\Easy Deals-updater => C:\Program Files (x86)\Easy Deals\Easy Deals-updater.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: {8D496086-48DD-48F1-87A7-310687CAE4EE} - System32\Tasks\Easy Deals-enabler => C:\Program Files (x86)\Easy Deals\Easy Deals-enabler.exe [2014-02-27] (Adassist) <==== ATTENTION
Task: C:\windows\Tasks\Easy Deals-enabler.job => C:\Program Files (x86)\Easy Deals\Easy Deals-enabler.exe <==== ATTENTION
Task: C:\windows\Tasks\Easy Deals-firefoxinstaller.job => C:\Program Files (x86)\Easy Deals\Easy Deals-firefoxinstaller.exe
Task: C:\windows\Tasks\Easy Deals-updater.job => C:\Program Files (x86)\Easy Deals\Easy Deals-updater.exe





*****************

C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hnjgzg.lnk => Moved successfully.
C:\ProgramData\2992199F9A\gzgjnh.cpp => Moved successfully.
C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ilfgzjfr.lnk => Moved successfully.
C:\PROGRA~3\rfjzgfli.dss not found.
C:\ProgramData\2992199F9A => Moved successfully.
"C:\PROGRA~3\rfjzgfli.dss" => File/Directory not found.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{885BC2FA-93B7-4736-BAB8-6303660799BF} => Key deleted successfully.
HKCR\CLSID\{885BC2FA-93B7-4736-BAB8-6303660799BF} => Key not found.
Firefox SearchEngineOrder.1 deleted successfully.
C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcom.xml => Moved successfully.
C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\askcomsearch.xml => Moved successfully.
C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\searchplugins\startsear.xml => Moved successfully.
C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\Extensions\4985d132-15d7-4ae5-9070-bdf2b427ddf5@d93c7dd2-be3e-4e65-ba77-3d67be52663e.com => Moved successfully.
catchme => Service deleted successfully.
C:\Users\USER\AppData\Roaming\Loobnoqy => Moved successfully.
C:\Users\USER\AppData\Roaming\Amewla => Moved successfully.
"C:\Program Files (x86)\Easy Deals" => File/Directory not found.
C:\ProgramData\ilfgzjfr.bxx => Moved successfully.
C:\ProgramData\ilfgzjfr.fvv => Moved successfully.
C:\ProgramData\ilfgzjfr.reg => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0C0F3825-C410-4C9A-932F-EB47367AB147} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C0F3825-C410-4C9A-932F-EB47367AB147} => Key deleted successfully.
C:\Windows\System32\Tasks\Easy Deals-firefoxinstaller not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Easy Deals-firefoxinstaller => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{20320A92-800F-4B13-AE2F-90648D6D7FA0} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{20320A92-800F-4B13-AE2F-90648D6D7FA0} => Key deleted successfully.
C:\Windows\System32\Tasks\Easy Deals-updater not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Easy Deals-updater => Key not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{8D496086-48DD-48F1-87A7-310687CAE4EE} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{8D496086-48DD-48F1-87A7-310687CAE4EE} => Key deleted successfully.
C:\Windows\System32\Tasks\Easy Deals-enabler not found.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Easy Deals-enabler => Key not found.
C:\windows\Tasks\Easy Deals-enabler.job not found.
C:\windows\Tasks\Easy Deals-firefoxinstaller.job not found.
C:\windows\Tasks\Easy Deals-updater.job not found.

==== End of Fixlog ====

[NieWiem]

Czekam na update

Autor postu otrzymał pochwałę

[Vincent48]

Działa normalnie po włączeniu w trybie normalnym. Nie wiem, jak Ci dziękować, naprawdę, nie poradziłbym z tym sobie sam. Przeogromne dzięki . Wklejam niżej plik FRST po nowym skanowaniu.


FRST

Spoiler:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-05-2014 01
Ran by USER (administrator) on USER-KOMPUTER on 11-05-2014 23:54:53
Running from C:\Users\USER\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRYSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\BCMWLTRY.EXE
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
() C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe
() C:\monitor.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
(Objectify Media Inc) C:\Program Files (x86)\Web Protect\PCProtect.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Dell Inc.) C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Creative Technology Ltd) C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe
() C:\Program Files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [7464448 2011-08-28] (Dell Inc.)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-12-18] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [OrderReminder] => C:\Program Files (x86)\Hewlett-Packard\OrderReminder\OrderReminder.exe [98304 2006-07-30] (Hewlett-Packard)
HKLM-x32\...\Run: [ModemListener] => C:\Program Files (x86)\Chiavetta Internet Olicard 145\ModemListener.exe [98304 2010-05-15] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 62.179.1.61 62.179.1.63

FireFox:
========
FF ProfilePath: C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default
FF user.js: detected! => C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\cg9ws57m.default\user.js
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_37 - C:\windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdjvu.dll (LizardTech)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npvsharetvplg.dll (StartSearch )
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2012-11-11]

==================== Services (Whitelisted) =================

R2 DeviceManager; C:\Program Files (x86)\Common Files\DeviceHelper\DeviceManager.exe [40960 2009-11-17] ()
R3 PCProtect; C:\Program Files (x86)\Web Protect\PCProtect.exe [1265608 2014-01-08] (Objectify Media Inc)
S2 ProtectMonitor; C:\monitorsvc.exe [34244 2014-02-13] ()
R2 wltrysvc; C:\Program Files\Dell\DW WLAN Card\bcmwltry.exe [6146560 2011-08-28] (Dell Inc.)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [119680 2010-04-07] (Olivetti)
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-11 22:27 - 2014-05-11 22:27 - 00035710 _____ () C:\Users\USER\Desktop\Addition.txt
2014-05-11 22:25 - 2014-05-11 23:54 - 00009076 _____ () C:\Users\USER\Desktop\FRST.txt
2014-05-11 22:25 - 2014-05-11 23:54 - 00000000 ____D () C:\FRST
2014-05-11 22:25 - 2014-05-11 22:23 - 02066944 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe
2014-05-11 20:57 - 2014-05-11 20:57 - 00020134 _____ () C:\ComboFix.txt
2014-05-11 20:21 - 2014-05-11 20:21 - 00006576 ____N () C:\bootsqm.dat
2014-05-11 05:06 - 2014-05-11 00:29 - 00000027 _____ () C:\windows\system32\Drivers\etc\hosts.20140511-050655.backup
2014-05-11 03:52 - 2014-05-11 05:14 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2014-05-11 02:17 - 2014-05-11 02:18 - 00000000 ____D () C:\SpybotSDPortable
2014-05-11 01:51 - 2014-05-11 01:51 - 00000000 _____ () C:\Users\USER\Documents\cc_20140511_015148.reg
2014-05-11 01:01 - 2014-05-11 01:01 - 02195256 _____ (Reason Software Company Inc.) C:\Users\USER\Downloads\ShouldIRemoveIt_Setup.exe
2014-05-11 00:56 - 2014-05-11 00:57 - 00242890 _____ () C:\Users\USER\Documents\cc_20140511_005628.reg
2014-05-10 22:36 - 2014-05-10 22:36 - 00002770 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-05-10 22:35 - 2014-05-10 22:35 - 04745984 _____ (Piriform Ltd) C:\Users\USER\Downloads\ccsetup413.exe
2014-05-10 22:35 - 2014-05-10 22:35 - 00702752 _____ () C:\Users\USER\Downloads\CCleaner(13061).exe
2014-05-07 23:29 - 2014-05-07 23:29 - 00014945 _____ () C:\Users\USER\Desktop\hs_err_pid4612.log
2014-05-03 21:09 - 2014-04-29 16:01 - 23547904 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-03 21:08 - 2014-05-03 21:08 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-03 21:08 - 2014-04-29 15:40 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-03 21:08 - 2014-04-29 14:48 - 17384448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-03 21:08 - 2014-04-29 14:34 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-02 20:52 - 2014-04-14 04:24 - 00465408 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-02 20:52 - 2014-04-14 04:19 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-04-29 02:13 - 2014-05-02 21:14 - 17931952 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-04-29 00:20 - 2014-04-29 00:20 - 07220749 _____ () C:\Users\USER\Desktop\Kfjaty.zip
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-26 00:25 - 2014-04-26 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Podatnik.info
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-23 01:40 - 2014-03-06 11:31 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-04-23 01:40 - 2014-03-06 10:59 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-04-23 01:40 - 2014-03-06 10:57 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-04-23 01:40 - 2014-03-06 10:57 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-04-23 01:40 - 2014-03-06 10:53 - 02767360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-04-23 01:40 - 2014-03-06 10:40 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-04-23 01:40 - 2014-03-06 10:39 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-04-23 01:40 - 2014-03-06 10:32 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-04-23 01:40 - 2014-03-06 10:29 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-04-23 01:40 - 2014-03-06 10:29 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-04-23 01:40 - 2014-03-06 10:28 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-04-23 01:40 - 2014-03-06 10:15 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-04-23 01:40 - 2014-03-06 10:11 - 05784064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-04-23 01:40 - 2014-03-06 10:09 - 00453120 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-04-23 01:40 - 2014-03-06 10:03 - 00586240 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-04-23 01:40 - 2014-03-06 10:02 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-04-23 01:40 - 2014-03-06 10:02 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-04-23 01:40 - 2014-03-06 10:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-04-23 01:40 - 2014-03-06 09:56 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-04-23 01:40 - 2014-03-06 09:48 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-04-23 01:40 - 2014-03-06 09:47 - 02178048 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-04-23 01:40 - 2014-03-06 09:46 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-04-23 01:40 - 2014-03-06 09:46 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-04-23 01:40 - 2014-03-06 09:45 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-04-23 01:40 - 2014-03-06 09:42 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-04-23 01:40 - 2014-03-06 09:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-04-23 01:40 - 2014-03-06 09:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-04-23 01:40 - 2014-03-06 09:36 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-04-23 01:40 - 2014-03-06 09:22 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-04-23 01:40 - 2014-03-06 09:21 - 00628736 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-04-23 01:40 - 2014-03-06 09:13 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-04-23 01:40 - 2014-03-06 09:11 - 02043904 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-04-23 01:40 - 2014-03-06 09:07 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-04-23 01:40 - 2014-03-06 09:01 - 00244224 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-04-23 01:40 - 2014-03-06 08:53 - 13551104 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-04-23 01:40 - 2014-03-06 08:46 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-04-23 01:40 - 2014-03-06 08:40 - 01967104 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-04-23 01:40 - 2014-03-06 08:36 - 11745792 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-04-23 01:40 - 2014-03-06 08:22 - 02260480 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-04-23 01:40 - 2014-03-06 07:58 - 01400832 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-04-23 01:40 - 2014-03-06 07:50 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-04-23 01:40 - 2014-03-06 07:43 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-04-23 01:40 - 2014-03-06 07:41 - 01789440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-04-23 01:40 - 2014-03-06 07:36 - 01143808 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

==================== One Month Modified Files and Folders =======

2014-05-11 23:55 - 2014-05-11 22:25 - 00009076 _____ () C:\Users\USER\Desktop\FRST.txt
2014-05-11 23:54 - 2014-05-11 22:25 - 00000000 ____D () C:\FRST
2014-05-11 23:53 - 2011-08-28 03:43 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-05-11 23:52 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-05-11 23:52 - 2009-07-14 06:51 - 00132927 _____ () C:\windows\setupact.log
2014-05-11 23:46 - 2011-10-30 15:00 - 00000000 ___RD () C:\Users\USER\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-11 23:45 - 2012-10-08 01:46 - 00000000 ____D () C:\Users\USER\Desktop\Nowy Port
2014-05-11 22:27 - 2014-05-11 22:27 - 00035710 _____ () C:\Users\USER\Desktop\Addition.txt
2014-05-11 22:27 - 2011-08-28 05:44 - 00740422 _____ () C:\windows\system32\perfh015.dat
2014-05-11 22:27 - 2011-08-28 05:44 - 00155996 _____ () C:\windows\system32\perfc015.dat
2014-05-11 22:27 - 2009-07-14 07:13 - 01670518 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-11 22:23 - 2014-05-11 22:25 - 02066944 _____ (Farbar) C:\Users\USER\Desktop\FRST64.exe
2014-05-11 22:10 - 2014-02-27 01:44 - 00001506 _____ () C:\windows\Tasks\Easy Deals-updater.job
2014-05-11 22:10 - 2014-02-27 01:44 - 00001340 _____ () C:\windows\Tasks\Easy Deals-enabler.job
2014-05-11 22:10 - 2014-02-27 01:43 - 00002336 _____ () C:\windows\Tasks\Easy Deals-firefoxinstaller.job
2014-05-11 22:09 - 2011-10-30 14:58 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-05-11 22:09 - 2011-10-30 14:58 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-05-11 21:04 - 2010-11-21 05:47 - 00309890 _____ () C:\windows\PFRO.log
2014-05-11 20:57 - 2014-05-11 20:57 - 00020134 _____ () C:\ComboFix.txt
2014-05-11 20:57 - 2013-11-12 01:25 - 00000000 ____D () C:\Qoobox
2014-05-11 20:51 - 2009-07-14 04:34 - 00000215 _____ () C:\windows\system.ini
2014-05-11 20:29 - 2011-08-28 02:51 - 01350824 _____ () C:\windows\WindowsUpdate.log
2014-05-11 20:29 - 2009-07-14 06:45 - 00020928 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-11 20:29 - 2009-07-14 06:45 - 00020928 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-11 20:21 - 2014-05-11 20:21 - 00006576 ____N () C:\bootsqm.dat
2014-05-11 11:14 - 2014-01-07 23:46 - 00000930 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-05-11 11:03 - 2013-05-23 01:34 - 00003440 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2014-05-11 05:14 - 2014-05-11 03:52 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\TeaTimer (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\SDHelper (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\Misc. Support Library (Spybot - Search & Destroy)
2014-05-11 02:19 - 2014-05-11 02:19 - 00000000 ____D () C:\Program Files (x86)\File Scanner Library (Spybot - Search & Destroy)
2014-05-11 02:18 - 2014-05-11 02:17 - 00000000 ____D () C:\SpybotSDPortable
2014-05-11 02:12 - 2011-10-30 15:26 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-05-11 01:51 - 2014-05-11 01:51 - 00000000 _____ () C:\Users\USER\Documents\cc_20140511_015148.reg
2014-05-11 01:06 - 2011-10-30 15:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-11 01:01 - 2014-05-11 01:01 - 02195256 _____ (Reason Software Company Inc.) C:\Users\USER\Downloads\ShouldIRemoveIt_Setup.exe
2014-05-11 00:57 - 2014-05-11 00:56 - 00242890 _____ () C:\Users\USER\Documents\cc_20140511_005628.reg
2014-05-11 00:29 - 2014-05-11 05:06 - 00000027 _____ () C:\windows\system32\Drivers\etc\hosts.20140511-050655.backup
2014-05-10 22:44 - 2011-08-28 03:37 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-05-10 22:36 - 2014-05-10 22:36 - 00002770 _____ () C:\windows\System32\Tasks\CCleanerSkipUAC
2014-05-10 22:36 - 2011-10-30 15:27 - 00000000 ____D () C:\Program Files\CCleaner
2014-05-10 22:35 - 2014-05-10 22:35 - 04745984 _____ (Piriform Ltd) C:\Users\USER\Downloads\ccsetup413.exe
2014-05-10 22:35 - 2014-05-10 22:35 - 00702752 _____ () C:\Users\USER\Downloads\CCleaner(13061).exe
2014-05-10 22:24 - 2013-11-12 01:24 - 00000000 ____D () C:\windows\erdnt
2014-05-10 22:22 - 2014-02-27 01:43 - 00000000 ____D () C:\Program Files (x86)\Easy Deals
2014-05-08 00:00 - 2013-01-02 23:22 - 00000000 ____D () C:\Users\USER\Desktop\DT 2013
2014-05-07 23:46 - 2012-02-05 18:18 - 00000000 ____D () C:\Users\USER\Desktop\DT 2012
2014-05-07 23:44 - 2014-02-17 04:04 - 00000000 ____D () C:\Users\USER\Desktop\DT2014
2014-05-07 23:29 - 2014-05-07 23:29 - 00014945 _____ () C:\Users\USER\Desktop\hs_err_pid4612.log
2014-05-07 20:03 - 2012-07-01 11:35 - 00000000 ____D () C:\Users\USER\Desktop\DT 2012 (2)
2014-05-07 19:23 - 2013-07-06 22:55 - 00000000 ____D () C:\Users\USER\Desktop\DT 2013 (2)
2014-05-03 21:08 - 2014-05-03 21:08 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-02 21:14 - 2014-04-29 02:13 - 17931952 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-02 21:14 - 2014-01-07 23:46 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-02 21:14 - 2014-01-07 23:46 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-02 21:14 - 2014-01-07 23:46 - 00003868 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-04-29 16:01 - 2014-05-03 21:09 - 23547904 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-04-29 15:40 - 2014-05-03 21:08 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-04-29 14:48 - 2014-05-03 21:08 - 17384448 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-04-29 14:34 - 2014-05-03 21:08 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-04-29 00:23 - 2011-12-20 20:57 - 00000000 ____D () C:\Users\USER\Desktop\30 dni materiały
2014-04-29 00:20 - 2014-04-29 00:20 - 07220749 _____ () C:\Users\USER\Desktop\Kfjaty.zip
2014-04-29 00:14 - 2012-05-11 01:40 - 00000000 ____D () C:\Users\USER\Desktop\30 dni zapasy
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\ProgramData\Mozilla
2014-04-28 01:13 - 2014-04-28 01:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-04-26 00:25 - 2014-04-26 00:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Podatnik.info
2014-04-26 00:25 - 2012-04-28 00:12 - 00000000 ____D () C:\Users\USER\AppData\Roaming\Podatnik.info
2014-04-26 00:25 - 2012-04-28 00:02 - 00000000 ____D () C:\Program Files (x86)\Podatnik.info
2014-04-23 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieUserList
2014-04-23 20:34 - 2014-04-23 20:34 - 00000000 __SHD () C:\Users\USER\AppData\Local\EmieSiteList
2014-04-23 20:00 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-04-14 04:24 - 2014-05-02 20:52 - 00465408 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-04-14 04:19 - 2014-05-02 20:52 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-29 00:41

==================== End Of Log ============================

[NieWiem]

To jeszcze nie jest koniec, tutaj jeszcze trochę mamy roboty.

Musisz wyłączyć program AV na czas trwania tego skanowania.
Pobierz ZOEK.
Uruchom jako administrator.
W oknie programu wklej następujący skrypt:

Kod: Zaznacz wszystko

autoclean;
process;
systemspecs;
startupall;
services-list;
filescrm;
firefoxlook;
chromelook;
skipfix-iedefaults;
installedprogs;
uninstall-list;
installer-list;


Upewnij się, że opcja Scan All Users jest zaznaczona.
Wciśnij Run Script i poczekaj na wynikowy raport. Przeklej go.

[Vincent48]

Ok, już ściągam, powiedz tylko proszę - co to jest AV i jak to wyłączyć?

Dodano Dzisiaj, 00:08:
Ach, Antywirus, ok, żaden nie jest włączony, skanuję

[NieWiem]

Ach, Antywirus, ok, żaden nie jest włączony, skanuję

Kolejny niesamowicie dobry pomysł, żeby nie mieć żadnego programu AV