ShortcutWithArgument: C:\Users\Rudek\Desktop\Mozilla Firefox.lnk
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
hxxp://www.delta-homes.com/?type=sc&ts=1418832662&from=wpm12173&uid=HGSTXHTS545050A7E680_TEA55C4N2NWBBR2NWBBRX
ShortcutWithArgument: C:\Users\Rudek\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk
C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
hxxp://www.delta-homes.com/?type=sc&ts=1418832662&from=wpm12173&uid=HGSTXHTS545050A7E680_TEA55C4N2NWBBR2NWBBRX
Task: {495C3B76-2879-4F1A-BC6F-9DC1FA368E15} - System32\Tasks\psv_mg3acw30 => cmd.exe /c regedit.exe /s "C:\ProgramData\Donity\mongik3v.1ki.reg" & del "C:\ProgramData\Donity\mongik3v.1ki.reg" & SCHTASKS /Delete /TN "psv_mg3acw30" /F <==== UWAGA
Task: {7CFECD2A-B6DE-4DD2-BD47-8B3F70BF9CB4} - System32\Tasks\psv_10wt1p32 => cmd.exe /c regedit.exe /s "C:\ProgramData\Donity\20x0k2sd.zgv.reg" & del "C:\ProgramData\Donity\20x0k2sd.zgv.reg" & SCHTASKS /Delete /TN "psv_10wt1p32" /F <==== UWAGA
Task: {E797E889-F40C-4836-8206-E3B5ED7B5C16} - System32\Tasks\psv_15velixj => cmd.exe /c regedit.exe /s "C:\ProgramData\Donity\4qxovumw.1fn.reg" & del "C:\ProgramData\Donity\4qxovumw.1fn.reg" & SCHTASKS /Delete /TN "psv_15velixj" /F <==== UWAGA
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [597040 2015-10-06] (Oracle Corporation)
HKU\S-1-5-21-1373394183-4139411631-362143874-1002\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [912480 2015-09-02] (Microsoft Corporation)
S3 ASUSProcObsrv; \??\E:\I386\AsPrOb64.sys [X]
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
S3 dump_wmimmc; \??\D:\Gry\Metin\Games\POL_pol\Metin2\GameGuard\dump_wmimmc.sys [X]
2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () C:\Users\Userr\AppData\Roaming\1BYNzsKhdPy
2015-04-14 17:28 - 2015-04-14 17:28 - 0004387 _____ () C:\Users\Userr\AppData\Roaming\1v1bWqAxG7A9M3DizZYL9pg
C:\ProgramData\{262E20B8-6E20-4CEF-B1FD-D022AB1085F5}.dat
EmptyTemp: