Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02
Ran by han (administrator) on KILLOCH on 22-12-2013 17:28:44
Running from C:\Users\Administrator\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Fortinet Inc.) C:\Windows\SysWOW64\FortiSSLVPNdaemon.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(ASUS) C:\Windows\AsScrPro.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(IObit) C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(BitTorrent Inc.) C:\Users\Administrator\AppData\Roaming\uTorrent\uTorrent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\APRP\aprp.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\klwtblfs.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2264168 2011-07-28] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.)
HKLM\...\Run: [CDAServer] - C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [438784 2010-12-17] ()
HKLM\...\Policies\Explorer: [NoRecentDosHistory] 1
HKLM\...\Policies\Explorer: [NoIdtrumentation] 1
HKCU\...\Run: [Advanced SystemCare 5] - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe [574296 2012-03-06] (IObit)
HKCU\...\Run: [DAEMON Tools Lite] - D:\Daemon Tools\DAEMON Tools Lite\DTLite.exe [3477312 2012-01-19] (DT Soft Ltd)
HKCU\...\Run: [uTorrent] - C:\Users\Administrator\AppData\Roaming\uTorrent\uTorrent.exe [900440 2013-12-06] (BitTorrent Inc.)
MountPoints2: {51485a6b-d6bc-11e2-8528-14dae9a5de29} - F:\AutoRun.exe
MountPoints2: {51485a81-d6bc-11e2-8528-14dae9a5de29} - F:\AutoRun.exe
MountPoints2: {74cda504-53df-11e1-9386-001e101faa49} - H:\SETUP.EXE
MountPoints2: {88dd259f-42bd-11e1-8d54-001e101f8aaa} - F:\AutoRun.exe
MountPoints2: {895f53d2-78e4-11e1-811e-001e101f8924} - F:\AutoRun.exe
MountPoints2: {b7c92e31-e89e-11e2-8bfa-14dae9a5de29} - F:\AutoRun.exe
MountPoints2: {ba3d22f7-da6c-11e2-b666-001e101f82a7} - F:\AutoRun.exe
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2255360 2011-06-10] (ASUS)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini [371 2013-12-22] ()
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe /S
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\aprp.exe [2018032 2011-04-01] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-08-31] (Kaspersky Lab ZAO)
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-12-03] (RealNetworks, Inc.)
HKU\CHAN\...\Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\CHAN\...\Run: [DAEMON Tools Lite] - D:\Daemon Tools\DAEMON Tools Lite\DTLite.exe [3477312 2012-01-19] (DT Soft Ltd)
HKU\CHAN\...\Run: [uTorrent] - C:\Users\CHAN\AppData\Roaming\uTorrent\uTorrent.exe [900440 2013-11-16] (BitTorrent Inc.)
HKU\Default\...\Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\Default User\...\Run: [Sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\OBCY\...\Run: [DAEMON Tools Lite] - D:\Daemon Tools\DAEMON Tools Lite\DTLite.exe [3477312 2012-01-19] (DT Soft Ltd)
HKU\OBCY\...\Run: [Steam] - D:\DeadIsland\Steam.exe [1242448 2011-03-16] (Valve Corporation)
HKU\OBCY\...\Run: [Advanced SystemCare 5] - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe [574296 2012-03-06] (IObit)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Tcpip\..\Interfaces\{11D86ABA-700D-4E41-AE1D-30C4B86EFC58}: [NameServer]89.108.195.20 89.108.202.20
Tcpip\..\Interfaces\{2F6F90BE-9DFA-45A7-944E-E2EA7260BBE5}: [NameServer]194.204.152.34,194.204.159.1
Tcpip\..\Interfaces\{3BEFE648-D3E5-4382-874D-B90E3A368BFC}: [NameServer]89.108.202.21 89.108.195.21
Tcpip\..\Interfaces\{94B87AAB-90BF-4434-AA62-2A532FFE44C2}: [NameServer]89.108.195.20 89.108.202.20

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: google.pl
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultNewTabURL: {google:baseURL}_/chrome/newtab?{google:RLZ}{google:instantExtendedEnabledParameter}{google:ntpIsThemedParameter}ie={inputEncoding}
CHR Plugin: (Shockwave Flash) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\PepperFlash\11.9.900.117\pepflashplayer.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.63\pdf.dll ()
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\plugin/npUrlAdvisor.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\plugin/online_banking_npapi.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0\plugin/content_blocker_npapi.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\plugin/npABPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (Kaspersky Anti-Virus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0\plugin/npVKPlugin.dll (Kaspersky Lab ZAO)
CHR Plugin: (FortiClient SSLVPN CacheCleaner Firefox Plugin) - C:\Program Files (x86)\Fortinet\SslvpnClient\npccplugin.dll (Fortinet Inc.)
CHR Plugin: (FortiClient SSLVPN Tunnel Service FireFox Plugin) - C:\Program Files (x86)\Fortinet\SslvpnClient\nptcplugin.dll (Fortinet Inc.)
CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Zeon Plus) - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Kaspersky URL Advisor) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0
CHR Extension: (Safe Money) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0
CHR Extension: (Content Blocker) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0
CHR Extension: (Virtual Keyboard) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0
CHR Extension: (Google Wallet) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR Extension: (Anti-Banner) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0
CHR HKLM-x32\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Administrator\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx
CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\urladvisor.crx
CHR HKLM-x32\...\Chrome\Extension: [hakdifolhalapjijoafobooafbilfakh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\online_banking_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [hghkgaeecgjhjkannahfamoehjmkjail] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\content_blocker_chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx
CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\virtkbd.crx
CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ChromeExt\ab.crx

==================== Services (Whitelisted) =================

R2 AdvancedSystemCareService5; C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe [913752 2012-03-14] (IObit)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [365568 2011-06-29] (Advanced Micro Devices, Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-08-31] (Kaspersky Lab ZAO)
R2 FortiSslvpnDaemon; C:\Windows\SysWOW64\FortiSSLVPNdaemon.exe [954080 2013-07-26] (Fortinet Inc.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2013-06-16] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
S4 GDFwSvc; "C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe" [x]

==================== Drivers (Whitelisted) ====================

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-02-10] (DT Soft Ltd)
S3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [58584 2011-11-21] (G Data Software AG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-08-31] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-08-31] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-08-31] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-08-31] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-08-31] (Kaspersky Lab ZAO)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
R3 pppop; C:\Windows\System32\DRIVERS\pppop64.sys [42528 2009-07-21] (Fortinet Inc.)
U5 klflt; C:\Windows\System32\Drivers\klflt.sys [90208 2013-08-31] (Kaspersky Lab ZAO)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-22 17:28 - 2013-12-22 17:30 - 00021019 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-12-22 17:28 - 2013-12-22 17:28 - 00000000 ____D C:\FRST
2013-12-22 17:26 - 2013-12-22 17:27 - 01928024 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-12-22 16:55 - 2013-12-22 16:55 - 00001099 _____ C:\Users\Administrator\Documents\gmerlog.log
2013-12-22 16:09 - 2013-12-22 16:09 - 687825851 _____ C:\Windows\MEMORY.DMP
2013-12-22 16:09 - 2013-12-22 16:09 - 00291648 _____ C:\Windows\Minidump\122213-28470-01.dmp
2013-12-22 13:54 - 2013-12-22 13:54 - 00085758 _____ C:\Users\Administrator\Downloads\Extras.Txt
2013-12-22 13:52 - 2013-12-22 13:55 - 00104716 _____ C:\Users\Administrator\Downloads\OTL.Txt
2013-12-22 13:45 - 2013-04-04 09:55 - 00377856 _____ C:\Users\Administrator\Downloads\gmer.exe
2013-12-22 13:42 - 2013-12-22 13:42 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\WinRAR
2013-12-22 13:37 - 2013-12-22 13:37 - 00368554 _____ C:\Users\Administrator\Downloads\gmer.zip
2013-12-22 13:34 - 2013-12-22 13:34 - 00664472 _____ C:\Users\Administrator\Downloads\Gmer(13252).exe
2013-12-22 13:33 - 2013-12-22 13:33 - 00602112 _____ (OldTimer Tools) C:\Users\Administrator\Downloads\OTL (1).exe
2013-12-22 13:32 - 2013-12-22 13:32 - 00602112 _____ (OldTimer Tools) C:\Users\Administrator\Downloads\OTL.exe
2013-12-16 19:15 - 2013-12-16 19:18 - 02400948 _____ C:\Users\CHAN\Desktop\SCN_0001.pdf.l33o351.partial
2013-12-08 17:04 - 2013-12-08 17:04 - 00033161 _____ C:\Users\Administrator\Desktop\chaniowe.txt
2013-12-07 15:10 - 2013-12-07 15:10 - 00381952 _____ C:\Users\Administrator\Downloads\Podstawowe elementy zestawu komputerowego.ppt
2013-12-07 14:36 - 2013-12-07 14:36 - 00005625 _____ C:\Users\Administrator\Downloads\Ostrza i trzonki.xlsx
2013-12-07 14:06 - 2013-12-07 14:06 - 00062464 ____H C:\Users\Administrator\Downloads\~WRL2042.tmp
2013-12-07 13:54 - 2013-12-07 13:55 - 00162816 ____H C:\Users\Administrator\Downloads\~WRL0003.tmp
2013-12-06 17:21 - 2013-12-06 17:45 - 00000000 ____D C:\Users\Administrator\Downloads\Aftermath (1994-Short Film) [Hiest-1337x] avi
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\WhiteListing
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\NativeMessaging
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\CRE
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\Conduit
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-12-03 11:45 - 2013-12-03 11:45 - 00000000 ____D C:\Users\CHAN\AppData\Roaming\Real
2013-12-03 00:33 - 2013-12-22 17:03 - 00003334 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-433562862-4184324985-3816982460-500
2013-12-03 00:33 - 2013-12-22 17:03 - 00003196 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-433562862-4184324985-3816982460-500
2013-12-03 00:33 - 2013-12-03 00:34 - 00000000 ____D C:\ProgramData\Google
2013-12-03 00:33 - 2013-12-03 00:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks
2013-12-03 00:33 - 2013-12-03 00:33 - 00000000 ____D C:\Users\Administrator\AppData\Local\Real
2013-12-03 00:32 - 2013-12-03 00:32 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-12-03 00:32 - 2013-12-03 00:32 - 00000000 ____D C:\ProgramData\RealNetworks
2013-12-03 00:32 - 2013-12-03 00:32 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-12-03 00:31 - 2013-12-05 22:44 - 00002191 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 00:31 - 2013-12-03 00:37 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Real
2013-12-03 00:31 - 2013-12-03 00:32 - 00000000 ____D C:\Program Files (x86)\Real
2013-12-03 00:31 - 2013-12-03 00:31 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-12-03 00:29 - 2013-12-03 00:33 - 00000000 ____D C:\ProgramData\Real
2013-12-03 00:29 - 2013-12-03 00:29 - 63360496 _____ (Microsoft Corporation) C:\Users\Administrator\Downloads\PowerPointViewer.exe
2013-12-03 00:19 - 2013-12-03 00:21 - 01108480 _____ C:\Users\CHAN\Desktop\szybkosc_i_rzad_reakcji_chemicznej.ppt
2013-12-01 17:57 - 2013-12-01 17:58 - 00000000 ____D C:\Users\CHAN\Desktop\ustawy z bioetyki
2013-11-30 18:55 - 2013-11-30 18:55 - 00000000 ____D C:\Program Files (x86)\Fortinet
2013-11-27 16:42 - 2013-11-27 16:42 - 00000000 ____D C:\Users\CHAN\AppData\Roaming\TP
2013-11-22 14:39 - 2013-11-22 14:40 - 00000000 ____D C:\Users\CHAN\Desktop\Hostel

==================== One Month Modified Files and Folders =======

2013-12-22 17:30 - 2013-12-22 17:28 - 00021019 _____ C:\Users\Administrator\Downloads\FRST.txt
2013-12-22 17:28 - 2013-12-22 17:28 - 00000000 ____D C:\FRST
2013-12-22 17:28 - 2013-11-14 21:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\uTorrent
2013-12-22 17:27 - 2013-12-22 17:26 - 01928024 _____ (Farbar) C:\Users\Administrator\Downloads\FRST64.exe
2013-12-22 17:21 - 2013-08-31 12:33 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-12-22 17:21 - 2011-10-11 14:34 - 01631930 _____ C:\Windows\WindowsUpdate.log
2013-12-22 17:06 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-22 17:06 - 2009-07-14 05:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-22 17:03 - 2013-12-03 00:33 - 00003334 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-433562862-4184324985-3816982460-500
2013-12-22 17:03 - 2013-12-03 00:33 - 00003196 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-433562862-4184324985-3816982460-500
2013-12-22 17:02 - 2011-11-20 13:07 - 00000000 ___HD C:\ASUS.DAT
2013-12-22 17:02 - 2011-04-01 09:58 - 00001058 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-22 16:59 - 2013-08-28 12:54 - 00014660 _____ C:\Windows\setupact.log
2013-12-22 16:59 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-22 16:55 - 2013-12-22 16:55 - 00001099 _____ C:\Users\Administrator\Documents\gmerlog.log
2013-12-22 16:09 - 2013-12-22 16:09 - 687825851 _____ C:\Windows\MEMORY.DMP
2013-12-22 16:09 - 2013-12-22 16:09 - 00291648 _____ C:\Windows\Minidump\122213-28470-01.dmp
2013-12-22 16:09 - 2012-02-26 02:22 - 00000000 ____D C:\Windows\Minidump
2013-12-22 14:04 - 2013-11-14 21:52 - 00000000 ____D C:\Users\CHAN\AppData\Roaming\uTorrent
2013-12-22 13:55 - 2013-12-22 13:52 - 00104716 _____ C:\Users\Administrator\Downloads\OTL.Txt
2013-12-22 13:54 - 2013-12-22 13:54 - 00085758 _____ C:\Users\Administrator\Downloads\Extras.Txt
2013-12-22 13:47 - 2011-04-01 09:58 - 00001062 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-22 13:42 - 2013-12-22 13:42 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\WinRAR
2013-12-22 13:37 - 2013-12-22 13:37 - 00368554 _____ C:\Users\Administrator\Downloads\gmer.zip
2013-12-22 13:34 - 2013-12-22 13:34 - 00664472 _____ C:\Users\Administrator\Downloads\Gmer(13252).exe
2013-12-22 13:33 - 2013-12-22 13:33 - 00602112 _____ (OldTimer Tools) C:\Users\Administrator\Downloads\OTL (1).exe
2013-12-22 13:32 - 2013-12-22 13:32 - 00602112 _____ (OldTimer Tools) C:\Users\Administrator\Downloads\OTL.exe
2013-12-22 12:46 - 2011-02-19 06:31 - 00775730 _____ C:\Windows\system32\perfh015.dat
2013-12-22 12:46 - 2011-02-19 06:31 - 00172676 _____ C:\Windows\system32\perfc015.dat
2013-12-22 12:46 - 2009-07-14 06:13 - 01769320 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-17 22:34 - 2012-02-06 14:48 - 00000000 ____D C:\Users\CHAN\AppData\Local\CrashDumps
2013-12-16 19:18 - 2013-12-16 19:15 - 02400948 _____ C:\Users\CHAN\Desktop\SCN_0001.pdf.l33o351.partial
2013-12-12 11:02 - 2012-01-09 20:25 - 00000000 ____D C:\Users\CHAN\AppData\Local\Google
2013-12-11 18:00 - 2011-10-11 15:04 - 00045056 _____ C:\Windows\SysWOW64\acovcnt.exe
2013-12-09 23:42 - 2011-04-01 09:58 - 00004058 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-12-09 23:42 - 2011-04-01 09:58 - 00003806 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-12-08 17:04 - 2013-12-08 17:04 - 00033161 _____ C:\Users\Administrator\Desktop\chaniowe.txt
2013-12-08 00:19 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\NDF
2013-12-07 15:10 - 2013-12-07 15:10 - 00381952 _____ C:\Users\Administrator\Downloads\Podstawowe elementy zestawu komputerowego.ppt
2013-12-07 14:36 - 2013-12-07 14:36 - 00005625 _____ C:\Users\Administrator\Downloads\Ostrza i trzonki.xlsx
2013-12-07 14:06 - 2013-12-07 14:06 - 00062464 ____H C:\Users\Administrator\Downloads\~WRL2042.tmp
2013-12-07 13:55 - 2013-12-07 13:54 - 00162816 ____H C:\Users\Administrator\Downloads\~WRL0003.tmp
2013-12-06 18:14 - 2013-09-25 18:12 - 00000524 _____ C:\m.txt
2013-12-06 17:45 - 2013-12-06 17:21 - 00000000 ____D C:\Users\Administrator\Downloads\Aftermath (1994-Short Film) [Hiest-1337x] avi
2013-12-06 17:44 - 2013-09-25 15:18 - 00000004 _____ C:\napis.zip
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\WhiteListing
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\NativeMessaging
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\CRE
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Users\Administrator\AppData\Local\Conduit
2013-12-06 17:20 - 2013-12-06 17:20 - 00000000 ____D C:\Program Files (x86)\Conduit
2013-12-05 22:44 - 2013-12-03 00:31 - 00002191 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-03 11:45 - 2013-12-03 11:45 - 00000000 ____D C:\Users\CHAN\AppData\Roaming\Real
2013-12-03 11:44 - 2011-10-11 15:03 - 00002420 _____ C:\Windows\system32\AutoRunFilter.ini
2013-12-03 11:44 - 2011-10-11 15:03 - 00001585 _____ C:\Windows\system32\ServiceFilter.ini
2013-12-03 11:42 - 2013-08-31 12:16 - 00001818 _____ C:\Windows\PFRO.log
2013-12-03 01:33 - 2013-11-14 21:54 - 00000000 ____D C:\Users\Administrator\AppData\Local\Google
2013-12-03 00:37 - 2013-12-03 00:31 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Real
2013-12-03 00:34 - 2013-12-03 00:33 - 00000000 ____D C:\ProgramData\Google
2013-12-03 00:34 - 2011-04-01 09:58 - 00000000 ____D C:\Program Files\Google
2013-12-03 00:34 - 2011-04-01 09:58 - 00000000 ____D C:\Program Files (x86)\Google
2013-12-03 00:33 - 2013-12-03 00:33 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks
2013-12-03 00:33 - 2013-12-03 00:33 - 00000000 ____D C:\Users\Administrator\AppData\Local\Real
2013-12-03 00:33 - 2013-12-03 00:29 - 00000000 ____D C:\ProgramData\Real
2013-12-03 00:32 - 2013-12-03 00:32 - 00201872 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll
2013-12-03 00:32 - 2013-12-03 00:32 - 00000000 ____D C:\ProgramData\RealNetworks
2013-12-03 00:32 - 2013-12-03 00:32 - 00000000 ____D C:\Program Files (x86)\RealNetworks
2013-12-03 00:32 - 2013-12-03 00:31 - 00000000 ____D C:\Program Files (x86)\Real
2013-12-03 00:31 - 2013-12-03 00:31 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00272896 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00006656 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5016.dll
2013-12-03 00:31 - 2013-12-03 00:31 - 00005632 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\pndx5032.dll
2013-12-03 00:29 - 2013-12-03 00:29 - 63360496 _____ (Microsoft Corporation) C:\Users\Administrator\Downloads\PowerPointViewer.exe
2013-12-03 00:21 - 2013-12-03 00:19 - 01108480 _____ C:\Users\CHAN\Desktop\szybkosc_i_rzad_reakcji_chemicznej.ppt
2013-12-01 17:58 - 2013-12-01 17:57 - 00000000 ____D C:\Users\CHAN\Desktop\ustawy z bioetyki
2013-11-30 20:35 - 2012-01-08 21:10 - 00000000 ___RD C:\Users\CHAN\Desktop\muzyka
2013-11-30 18:55 - 2013-11-30 18:55 - 00000000 ____D C:\Program Files (x86)\Fortinet
2013-11-27 16:42 - 2013-11-27 16:42 - 00000000 ____D C:\Users\CHAN\AppData\Roaming\TP
2013-11-25 11:37 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-22 16:12 - 2011-02-19 06:30 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\winrm
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\WCN
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\slmgr
2013-11-22 16:12 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-11-22 16:12 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-11-22 16:12 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-11-22 16:12 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-11-22 16:12 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\inetsrv
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\oobe
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\MUI
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\inetsrv
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\com
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-11-22 16:12 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-11-22 16:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\sl-SI
2013-11-22 16:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sl-SI
2013-11-22 16:11 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-11-22 16:10 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\sk-SK
2013-11-22 16:10 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sk-SK
2013-11-22 14:40 - 2013-11-22 14:39 - 00000000 ____D C:\Users\CHAN\Desktop\Hostel
2013-11-22 14:26 - 2012-09-22 11:50 - 00000000 ___RD C:\Users\CHAN\Desktop\zdjęcia
2013-11-22 14:26 - 2012-03-21 23:25 - 00000000 ____D C:\Users\CHAN\Desktop\gówienka

Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\lowproc.exe
C:\Users\Administrator\AppData\Local\Temp\stubhelper.dll
C:\Users\Administrator\AppData\Local\Temp\utt6931.tmp.exe
C:\Users\CHAN\AppData\Local\Temp\install_flashplayer11x32ax_gtba_chra_dy_aaa_aih.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-01 13:58

==================== End Of Log ============================