Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2014 01
Ran by Admin (administrator) on KONRAD-KOMPUTER on 22-02-2014 17:18:19
Running from C:\FRST\FRST-OlderVersion
Windows 7 Home Premium (X64) OS Language: Polish
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ASLDRSrv.exe
() C:\Program Files\ATKGFNEX\GFNEXSrv.exe
() C:\Program Files (x86)\blueconnect\BackgroundService\ServiceManager.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\PSIA.exe
(ATK) C:\Program Files\P4G\BatteryLife.exe
(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
() C:\Program Files (x86)\ASUS\ControlDeck\ControlDeckStartUp.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControl.exe
() C:\Program Files (x86)\ASUS\ATK Hotkey\Atouch64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMSrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe
(ASUS) C:\Windows\AsScrPro.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(AlcorMicro Co., Ltd.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Boingo Wireless, Inc.) C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe
() C:\Program Files (x86)\blueconnect\BackgroundService\ModemListener.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Hotkey\WDC.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Dropbox, Inc.) C:\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Serhiy Perevoznyk) C:\Program Files\Krento\Krento.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(GG Network S.A.) C:\Users\Admin\AppData\Local\GG\Application\gghub.exe
(GG Network S.A.) C:\Users\Admin\AppData\Local\GG\Application\ggapp.exe
(GG Network S.A.) C:\Users\Admin\AppData\Local\GG\Application\ggdrive\ggdrive.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Steven Mayall) D:\PROG FILES\musicbee\MusicBee.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.exe
(Apache Software Foundation) C:\Program Files (x86)\OpenOffice 4\program\soffice.bin
(GG Network S.A.) C:\Users\Admin\AppData\Local\GG\Application\xulrunner\gghub.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDWare] - C:\Program Files\Elantech\ETDCtrl.exe [621440 2009-09-30] (ELAN Microelectronic Corp.)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-01] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Boingo Wi-Fi] - C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-08-05] ()
HKLM-x32\...\Run: [HDAudDeck] - C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [2245120 2009-09-17] (VIA)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATKOSD2\ATKOSD2.exe [6859392 2009-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Media\DMedia.exe [170624 2009-08-20] (ASUS)
HKLM-x32\...\Run: [ERA_SEPANG ModemListener] - C:\Program Files (x86)\blueconnect\BackgroundService\ModemListener.exe [102400 2010-12-07] ()
HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2014-01-04] (RealNetworks, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4052432272-283152620-2328754637-1000\...\Run: [R-Updater scheduler] - D:\PROG FILES\R-UPDATER\R-Updater\rupdater.exe -autostart
HKU\S-1-5-21-4052432272-283152620-2328754637-1000\...\MountPoints2: F - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL F:\wpavi.avi
HKU\S-1-5-21-4052432272-283152620-2328754637-1000\...\MountPoints2: {12033c57-7073-11e2-b488-20cf303120c4} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL G:\wpavi.avi
Startup: C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Admin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus.msn.com
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: Idea2 SidebarBrowserMonitor Class - {45AD732C-2CE2-4666-B366-B2214AD57A49} - D:\PROG FILES\DESKOP SIDEBAR\sbhelp.dll (Idea2)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Pomocnik logowania za pomocą identyfikatora Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Homepage Print 2BHO - {EFC91ACA-519F-428D-8472-81E158609D25} - C:\Program Files (x86)\Homepage Print 2\IEBand.dll (CORPUS CORPORATION)
Toolbar: HKLM-x32 - Homepage Print 2 - {C4FB9EEC-5B29-486B-ACD1-D93A4396E567} - C:\Program Files (x86)\Homepage Print 2\IEBand.dll (CORPUS CORPORATION)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
DPF: HKLM {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=ASUT&bmod=ASUT
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.1.377\_platform_specific\win_x86\widevinecdmadapter.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.117\pdf.dll ()
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.510.13) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U51) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (RealPlayer Version Plugin) - C:\Program Files (x86)\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks(tm) RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealNetworks(tm) RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
CHR Plugin: (Unity Player) - C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
CHR Extension: (Pogoda (rozszerzenie)) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\beapnbfmjmjhhfpaoajfhjbbfnnlfpnc [2014-01-02]
CHR Extension: (TrafficLight) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfnpidifppmenkapgihekkeednfoenal [2014-02-09]
CHR Extension: (AdBlock) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-01]
CHR Extension: (avast! Online Security) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-02]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-27]
CHR Extension: (Better History) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\obciceimmggglbmelaidpjlmodcebijb [2014-02-20]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

==================== Services (Whitelisted) =================

R2 ATKGFNEXSrv; C:\Program Files\ATKGFNEX\GFNEXSrv.exe [94208 2007-08-08] ()
R2 Modem Device Helper; C:\Program Files (x86)\blueconnect\BackgroundService\ServiceManager.exe [45056 2010-07-23] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
S4 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S4 TeamViewer9; D:\PROG FILES\TEAM VIEVER9\TeamViewer_Service.exe [5341536 2013-12-17] (TeamViewer GmbH)

==================== Drivers (Whitelisted) ====================

R2 ASMMAP64; C:\Program Files\ATKGFNEX\ASMMAP64.sys [14904 2007-07-24] ()
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [119680 2010-07-23] (TCT International Mobile Ltd)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-12-06] (Secunia)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()
S3 cpuz136; \??\C:\Users\Admin\AppData\Local\Temp\Rar$EX02.607\pcwiz_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-22 15:09 - 2014-02-22 17:18 - 00000000 ____D () C:\FRST
2014-02-22 15:09 - 2014-02-22 15:45 - 00000000 ____D () C:\OTL
2014-02-21 14:59 - 2014-02-21 14:59 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-02-21 14:59 - 2014-02-21 14:59 - 00000000 ____D () C:\Program Files\Java
2014-02-21 14:46 - 2014-02-21 14:46 - 00000865 _____ () C:\Users\Public\Desktop\Action!.lnk
2014-02-12 20:28 - 2014-02-12 20:33 - 00000000 ____D () C:\Users\Admin\AppData\Local\Morphyre
2014-02-12 20:28 - 2014-02-12 20:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Morphyre Visualizer
2014-02-10 19:11 - 2014-02-10 19:11 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Unity
2014-02-10 18:30 - 2014-02-10 18:30 - 00000000 ____D () C:\Users\Admin\AppData\Local\Unity
2014-02-09 11:23 - 2014-02-09 11:23 - 00219581 _____ () C:\Users\Admin\Downloads\DF34.tmp
2014-02-08 21:29 - 2014-02-21 15:10 - 00003188 _____ () C:\Windows\windefendam.log
2014-02-08 21:29 - 2014-02-21 15:10 - 00000020 _____ () C:\Windows\capsys184523.log
2014-02-08 21:29 - 2014-02-16 22:31 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mirillis
2014-02-08 21:29 - 2014-02-15 22:18 - 00000000 ____D () C:\Users\Admin\Documents\Action!
2014-02-08 21:29 - 2014-02-08 21:29 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mirillis
2014-02-08 21:29 - 2014-02-08 21:29 - 00000000 ____D () C:\ProgramData\Mirillis
2014-02-08 21:29 - 2013-05-28 21:23 - 00652288 _____ () C:\Windows\system32\ficvdec_x64.dll
2014-02-08 21:29 - 2013-05-28 21:22 - 00641024 _____ () C:\Windows\SysWOW64\ficvdec_x86.dll
2014-02-08 17:50 - 2014-02-08 17:50 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-02-08 17:50 - 2014-02-08 17:50 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-02-08 17:34 - 2014-02-08 17:34 - 00000000 ____D () C:\Users\Admin\AppData\Local\Secunia PSI
2014-02-08 17:33 - 2014-02-08 17:33 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-02-04 16:48 - 2014-02-04 16:47 - 04179293 _____ (Lavalys, Inc. ) C:\Users\Admin\Downloads\everesthome220.exe
2014-02-01 17:49 - 2014-02-22 16:06 - 00391175 _____ () C:\Windows\WindowsUpdate.log
2014-02-01 17:48 - 2014-02-21 15:07 - 00000392 _____ () C:\Windows\setupact.log
2014-02-01 17:48 - 2014-02-01 17:48 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-01 17:46 - 2014-02-21 15:07 - 00004256 _____ () C:\Windows\PFRO.log
2014-01-31 17:51 - 2014-02-10 17:24 - 00000789 _____ () C:\Users\Public\Desktop\JetClean.lnk
2014-01-29 16:44 - 2014-01-29 16:44 - 00000000 ____D () C:\Windows\system32\SPReview
2014-01-26 15:53 - 2014-01-26 15:53 - 00000697 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-26 15:53 - 2013-10-17 16:32 - 00035112 _____ (TeamViewer GmbH) C:\Windows\system32\Drivers\teamviewervpn.sys
2014-01-26 13:22 - 2014-01-26 13:22 - 00001580 _____ () C:\Users\Admin\Desktop\GG dysk.lnk
2014-01-26 13:22 - 2014-01-26 13:22 - 00000000 ___SD () C:\Users\Admin\GG dysk
2014-01-26 13:13 - 2014-02-22 15:21 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\GG
2014-01-26 13:13 - 2014-01-26 13:22 - 00000000 ____D () C:\Users\Admin\AppData\Local\GG
2014-01-26 13:13 - 2014-01-26 13:13 - 00001109 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GG.lnk
2014-01-23 20:59 - 2014-01-23 20:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screamer Radio
2014-01-23 20:07 - 2014-01-23 20:07 - 00000000 ____D () C:\Users\Admin\Documents\Krento
2014-01-23 20:06 - 2014-01-23 20:07 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Krento
2014-01-23 20:06 - 2014-01-23 20:06 - 00000816 _____ () C:\Users\Public\Desktop\Krento.lnk
2014-01-23 20:06 - 2014-01-23 20:06 - 00000000 ____D () C:\Program Files\Krento
2014-01-23 19:12 - 2014-01-23 19:12 - 00003084 _____ () C:\Windows\System32\Tasks\{60267962-D301-42D0-9EFD-506A2C69D1B1}

==================== One Month Modified Files and Folders =======

2014-02-22 17:18 - 2014-02-22 15:09 - 00000000 ____D () C:\FRST
2014-02-22 16:57 - 2010-08-05 17:27 - 00001062 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-22 16:56 - 2014-01-17 18:19 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Dropbox
2014-02-22 16:06 - 2014-02-01 17:49 - 00391175 _____ () C:\Windows\WindowsUpdate.log
2014-02-22 15:45 - 2014-02-22 15:09 - 00000000 ____D () C:\OTL
2014-02-22 15:21 - 2014-01-26 13:13 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\GG
2014-02-22 15:11 - 2010-08-05 17:27 - 00001058 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-21 15:16 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-21 15:16 - 2009-07-14 05:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-21 15:10 - 2014-02-08 21:29 - 00003188 _____ () C:\Windows\windefendam.log
2014-02-21 15:10 - 2014-02-08 21:29 - 00000020 _____ () C:\Windows\capsys184523.log
2014-02-21 15:08 - 2014-01-04 21:48 - 00003354 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-4052432272-283152620-2328754637-1000
2014-02-21 15:08 - 2014-01-04 21:48 - 00003220 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-4052432272-283152620-2328754637-1000
2014-02-21 15:08 - 2011-10-07 09:52 - 00000000 ___HD () C:\ASUS.DAT
2014-02-21 15:07 - 2014-02-01 17:48 - 00000392 _____ () C:\Windows\setupact.log
2014-02-21 15:07 - 2014-02-01 17:46 - 00004256 _____ () C:\Windows\PFRO.log
2014-02-21 15:07 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-21 14:59 - 2014-02-21 14:59 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-02-21 14:59 - 2014-02-21 14:59 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-02-21 14:59 - 2014-02-21 14:59 - 00000000 ____D () C:\Program Files\Java
2014-02-21 14:56 - 2014-01-04 21:32 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-21 14:46 - 2014-02-21 14:46 - 00000865 _____ () C:\Users\Public\Desktop\Action!.lnk
2014-02-21 14:41 - 2011-10-07 10:41 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-02-21 14:40 - 2014-01-08 21:17 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-21 14:40 - 2014-01-08 21:17 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-20 23:50 - 2010-08-05 17:54 - 00002346 _____ () C:\Windows\system32\AutoRunFilter.ini
2014-02-20 23:49 - 2010-08-05 17:54 - 00001482 _____ () C:\Windows\system32\ServiceFilter.ini
2014-02-18 20:00 - 2012-07-01 21:33 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\MusicBee
2014-02-16 22:31 - 2014-02-08 21:29 - 00000000 ____D () C:\Users\Admin\AppData\Local\Mirillis
2014-02-15 22:18 - 2014-02-08 21:29 - 00000000 ____D () C:\Users\Admin\Documents\Action!
2014-02-15 22:15 - 2012-12-22 19:34 - 00000000 ____D () C:\Users\Admin\Desktop\PRIMES1
2014-02-15 10:52 - 2010-08-05 17:27 - 00004058 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-15 10:52 - 2010-08-05 17:27 - 00003806 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 20:33 - 2014-02-12 20:28 - 00000000 ____D () C:\Users\Admin\AppData\Local\Morphyre
2014-02-12 20:28 - 2014-02-12 20:28 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Morphyre Visualizer
2014-02-10 19:11 - 2014-02-10 19:11 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Unity
2014-02-10 18:30 - 2014-02-10 18:30 - 00000000 ____D () C:\Users\Admin\AppData\Local\Unity
2014-02-10 17:24 - 2014-01-31 17:51 - 00000789 _____ () C:\Users\Public\Desktop\JetClean.lnk
2014-02-09 22:40 - 2009-08-03 20:55 - 00698146 _____ () C:\Windows\system32\perfh015.dat
2014-02-09 22:40 - 2009-08-03 20:55 - 00135224 _____ () C:\Windows\system32\perfc015.dat
2014-02-09 22:40 - 2009-07-14 06:13 - 01549932 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-09 11:23 - 2014-02-09 11:23 - 00219581 _____ () C:\Users\Admin\Downloads\DF34.tmp
2014-02-08 21:29 - 2014-02-08 21:29 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Mirillis
2014-02-08 21:29 - 2014-02-08 21:29 - 00000000 ____D () C:\ProgramData\Mirillis
2014-02-08 17:50 - 2014-02-08 17:50 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Macromedia
2014-02-08 17:50 - 2014-02-08 17:50 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Macromedia
2014-02-08 17:50 - 2010-08-05 17:26 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-08 17:50 - 2010-08-05 17:26 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-02-08 17:34 - 2014-02-08 17:34 - 00000000 ____D () C:\Users\Admin\AppData\Local\Secunia PSI
2014-02-08 17:33 - 2014-02-08 17:33 - 00000000 ____D () C:\Program Files (x86)\Secunia
2014-02-04 22:33 - 2011-10-07 10:01 - 00000000 ___RD () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-04 16:47 - 2014-02-04 16:48 - 04179293 _____ (Lavalys, Inc. ) C:\Users\Admin\Downloads\everesthome220.exe
2014-02-01 23:19 - 2014-01-12 12:35 - 00000000 ____D () C:\Users\Admin\www.apowersoft.com
2014-02-01 19:15 - 2010-08-05 17:24 - 00000000 ____D () C:\ProgramData\CyberLink
2014-02-01 17:48 - 2014-02-01 17:48 - 00000000 _____ () C:\Windows\setuperr.log
2014-02-01 17:48 - 2013-01-15 10:03 - 00301656 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-01 17:44 - 2011-10-07 10:58 - 00000000 ____D () C:\Windows\pss
2014-01-29 16:44 - 2014-01-29 16:44 - 00000000 ____D () C:\Windows\system32\SPReview
2014-01-26 16:06 - 2013-01-15 10:05 - 00066768 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-26 15:53 - 2014-01-26 15:53 - 00000697 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-26 13:22 - 2014-01-26 13:22 - 00001580 _____ () C:\Users\Admin\Desktop\GG dysk.lnk
2014-01-26 13:22 - 2014-01-26 13:22 - 00000000 ___SD () C:\Users\Admin\GG dysk
2014-01-26 13:22 - 2014-01-26 13:13 - 00000000 ____D () C:\Users\Admin\AppData\Local\GG
2014-01-26 13:22 - 2011-10-07 09:51 - 00000000 ____D () C:\Users\Admin
2014-01-26 13:13 - 2014-01-26 13:13 - 00001109 _____ () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GG.lnk
2014-01-26 00:05 - 2011-12-04 15:17 - 00000000 ____D () C:\Program Files\Google
2014-01-23 20:59 - 2014-01-23 20:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Screamer Radio
2014-01-23 20:07 - 2014-01-23 20:07 - 00000000 ____D () C:\Users\Admin\Documents\Krento
2014-01-23 20:07 - 2014-01-23 20:06 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Krento
2014-01-23 20:06 - 2014-01-23 20:06 - 00000816 _____ () C:\Users\Public\Desktop\Krento.lnk
2014-01-23 20:06 - 2014-01-23 20:06 - 00000000 ____D () C:\Program Files\Krento
2014-01-23 19:12 - 2014-01-23 19:12 - 00003084 _____ () C:\Windows\System32\Tasks\{60267962-D301-42D0-9EFD-506A2C69D1B1}
2014-01-23 17:42 - 2010-08-05 17:27 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-23 17:38 - 2011-12-04 15:42 - 00000000 ____D () C:\Users\Admin\AppData\Local\Google
2014-01-23 17:38 - 2011-12-04 15:17 - 00000000 ____D () C:\ProgramData\Google

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp3add8y.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-30 17:14

==================== End Of Log ============================