Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-09-2014
Ran by Admin (administrator) on ADMIN-KOMPUTER on 07-09-2014 19:25:03
Running from C:\Users\Admin\Downloads
Platform: Windows 7 Enterprise Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Microsoft Corp.) C:\MSDCSC\msdcsc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\MKJogo\MKLOL\Bin\MKIM.exe
(Skype Technologies S.A.) D:\skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(TektonIT) C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
(TektonIT) C:\Program Files (x86)\Remote Manipulator System - Host\rfusclient.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() D:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe
() D:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.218\deploy\LoLLauncher.exe
() D:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.2\deploy\LoLPatcher.exe
() C:\Users\Admin\AppData\Roaming\wserver.exe
() D:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.105\deploy\LolClient.exe
(AdFender, Inc.) C:\Program Files (x86)\AdFender\AdFender.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3802448 2014-09-04] (LogMeIn Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Users\Admin\AppData\Local\Temp\MSDCSC\msdcsc.exe,C:\Windows\system32\Client Server Runtime Process,C:\Users\Admin\Documents\MSDCSC\msdcsc.exe,C:\Windows\system32\WindowsDefender32\UPDATED32.exe,\MSDCSC\msdcsc.exe,C:\Windows\system32\config\systemprofile\AppData\Local\Temp\MSDCSC\msdcsc.exe,C:\Users\Admin\Documents\MSDCSC\msdcsc.exe
HKU\.DEFAULT\...\Run: [MicroUpdate] => \MSDCSC\msdcsc.exe [257536 2014-08-27] (Microsoft Corp.)
HKU\.DEFAULT\...\Policies\system: [DisableTaskMgr] 1
HKU\.DEFAULT\...\Policies\system: [DisableRegistryTools] 1
HKU\.DEFAULT\...\Policies\system: [EnableLUA] 0
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [MKLOL] => C:\Program Files (x86)\MKJogo\MKLOL\Bin\MKIM.exe [1089736 2014-08-25] ()
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [Skype] => D:\skype\Phone\Skype.exe [21415008 2014-07-25] (Skype Technologies S.A.)
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [screenSHU] => C:\Program Files (x86)\screenSHU\screenSHU.exe [2112000 2013-09-04] ()
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [uTorrent] => C:\Users\Admin\AppData\Roaming\uTorrent\uTorrent.exe [1322832 2014-07-27] (BitTorrent Inc.)
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [MicroUpdate] => C:\Users\Admin\Documents\MSDCSC\msdcsc.exe [257536 2014-08-27] (Microsoft Corp.)
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Run: [Default Key] => C:\Users\Admin\AppData\Roaming\Default Folder\Default File.exe [284192 2014-08-17] (Microsoft)
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Policies\system: [EnableLUA] 0
HKU\S-1-5-21-2752573723-1407471058-2751402729-1000\...\Winlogon: [Shell] C:\Users\Admin\AppData\Roaming\wserver.exe [291328 2014-08-24] () <==== ATTENTION 
AppInit_DLLs: C:\PROGRA~3\WinSpeed\WINSPE~1.DLL => C:\ProgramData\WinSpeed\WinSpeed_x64.dll [4304896 2014-08-23] ()
AppInit_DLLs-x32:  c:\progra~3\winspeed\winspeed.dll => c:\ProgramData\WinSpeed\WinSpeed.dll [4127232 2014-08-23] ()
IFEO\AvastSvc.exe: [Debugger] nqij.exe
IFEO\AvastUI.exe: [Debugger] nqij.exe
IFEO\avcenter.exe: [Debugger] nqij.exe
IFEO\avconfig.exe: [Debugger] nqij.exe
IFEO\avgcsrvx.exe: [Debugger] nqij.exe
IFEO\avgidsagent.exe: [Debugger] nqij.exe
IFEO\avgnt.exe: [Debugger] nqij.exe
IFEO\avgrsx.exe: [Debugger] nqij.exe
IFEO\avguard.exe: [Debugger] nqij.exe
IFEO\avgui.exe: [Debugger] nqij.exe
IFEO\avgwdsvc.exe: [Debugger] nqij.exe
IFEO\avp.exe: [Debugger] nqij.exe
IFEO\avscan.exe: [Debugger] nqij.exe
IFEO\bdagent.exe: [Debugger] nqij.exe
IFEO\blindman.exe: [Debugger] nqij.exe
IFEO\ccuac.exe: [Debugger] nqij.exe
IFEO\ComboFix.exe: [Debugger] nqij.exe
IFEO\egui.exe: [Debugger] nqij.exe
IFEO\hijackthis.exe: [Debugger] nqij.exe
IFEO\instup.exe: [Debugger] nqij.exe
IFEO\keyscrambler.exe: [Debugger] nqij.exe
IFEO\mbam.exe: [Debugger] nqij.exe
IFEO\mbamgui.exe: [Debugger] nqij.exe
IFEO\mbampt.exe: [Debugger] nqij.exe
IFEO\mbamscheduler.exe: [Debugger] nqij.exe
IFEO\mbamservice.exe: [Debugger] nqij.exe
IFEO\MpCmdRun.exe: [Debugger] nqij.exe
IFEO\MSASCui.exe: [Debugger] nqij.exe
IFEO\MsMpEng.exe: [Debugger] nqij.exe
IFEO\msseces.exe: [Debugger] nqij.exe
IFEO\rstrui.exe: [Debugger] nqij.exe
IFEO\SDFiles.exe: [Debugger] nqij.exe
IFEO\SDMain.exe: [Debugger] nqij.exe
IFEO\SDWinSec.exe: [Debugger] nqij.exe
IFEO\spybotsd.exe: [Debugger] nqij.exe
IFEO\wireshark.exe: [Debugger] nqij.exe
IFEO\zlclient.exe: [Debugger] nqij.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AdFender.lnk
ShortcutTarget: AdFender.lnk -> C:\Program Files (x86)\AdFender\AdFender.exe (AdFender, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.trovi.com/?gd=&ctid=CT3326582&octid=EB_ORIGINAL_CTID&ISID=MA804117C-9E04-40D4-B5DF-625593C253C1&SearchSource=55&CUI=&UM=6&UP=SP4FC40864-787D-4805-8240-5CAFB50A99C4&SSPV=
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1406473711&from=irs&uid=395049983_266035_8C8E1A1B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1406473711&from=irs&uid=395049983_266035_8C8E1A1B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://istart.webssearches.com/web/?type=ds&ts=1406473711&from=irs&uid=395049983_266035_8C8E1A1B&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://istart.webssearches.com/web/?type=ds&ts=1406473711&from=irs&uid=395049983_266035_8C8E1A1B&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe http://istart.webssearches.com/?type=sc&ts=1406473711&from=irs&uid=395049983_266035_8C8E1A1B
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3326582&octid=EB_ORIGINAL_CTID&ISID=MA804117C-9E04-40D4-B5DF-625593C253C1&SearchSource=58&CUI=&UM=6&UP=SPCD622F3E-54B8-4741-93E5-CA505417B4C6&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://www.trovi.com/Results.aspx?gd=&ctid=CT3326582&octid=EB_ORIGINAL_CTID&ISID=MA804117C-9E04-40D4-B5DF-625593C253C1&SearchSource=58&CUI=&UM=6&UP=SPCD622F3E-54B8-4741-93E5-CA505417B4C6&q={searchTerms}&SSPV=
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2} URL = http://dts.search.ask.com/sr?src=ieb&gct=ds&appid=&systemid=&v=-&apn_uid=&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
BHO: weubsaveere -> {3319CBFF-0B7E-F6DF-061A-2A17A2FBF004} -> C:\ProgramData\weubsaveere\gZ.x64.dll ()
BHO: No Name -> {FFCB3198-32F3-4E8B-9539-4324694ED663} ->  No File
BHO-x32: weubsaveere -> {3319CBFF-0B7E-F6DF-061A-2A17A2FBF004} -> C:\ProgramData\weubsaveere\gZ.dll ()
BHO-x32: No Name -> {FFCB3198-32F3-4E8B-9539-4324694ED663} ->  No File
Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 194.204.159.1 89.228.8.18

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673
FF SelectedSearchEngine: Google
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Admin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\user.js
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\searchplugins\trovi-search.xml
FF Extension: websaver - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\Extensions\ugbqzrhoeu@iogacf.org [2014-09-06]
FF Extension: YouTube Center - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\Extensions\jid1-cwbvBTE216jjpg@jetpack.xpi [2014-06-15]
FF Extension: Adblock Plus - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-06-24]
FF Extension: Greasemonkey - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\g3dqkmx3.default-1402504025673\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-07-15]

Chrome: 
=======
CHR HomePage: Default -> 
CHR DefaultSearchKeyword: Default -> ask.com
CHR DefaultSearchProvider: Default -> Ask.com
CHR DefaultSearchURL: Default -> http://dts.search.ask.com/sr?src=crb&gct=ds&appid=&systemid=&v=-&apn_uid=&apn_dtid=TCH001&o=APN11459&apn_ptnrs=AG1&q={searchTerms}
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (CostMin) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agpakfdakkefjmocnffenanhoffcphhd [2014-06-27]
CHR Extension: (LazyTruth) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cldfekpopdobkddjkgbmbfhahllhagif [2014-08-23]
CHR Extension: (YouTube Center) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gabnjlibfmlilpljjkkbkebfaopgpjmk [2014-04-11]
CHR Extension: (Hide My Ass) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmjonpeiaiacbgfgemlchebljmfgjnmh [2014-09-06]
CHR Extension: (Google Wallet) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-10]
CHR Extension: (CostMin) - C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agpakfdakkefjmocnffenanhoffcphhd\2.2 [2014-06-27]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 f1f78e38; c:\ProgramData\WinSpeed\WinSpeedSvc.dll [186192 2014-08-23] () [File not signed]
S4 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [702344 2014-07-27] (Cherished Technololgy LIMITED)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-08-08] (LogMeIn, Inc.)
S4 Nero BackItUp Scheduler 3; C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe [877864 2008-12-02] (Nero AG)
S4 NMIndexingService; C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe [537896 2008-12-12] (Nero AG)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)
S4 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-06-28] ()
S2 RManService; C:\Program Files (x86)\Remote Manipulator System - Host\rutserv.exe [6057728 2014-01-22] (TektonIT)
S4 SkypeUpdate; D:\skype\Updater\Updater.exe [172192 2013-10-23] (Skype Technologies)
S4 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [535936 2014-07-27] (Fuyu LIMITED)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [572416 2006-12-05] (PixArt Imaging Inc.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-04-11] (Duplex Secure Ltd.)
R1 StarPortLite; C:\Windows\System32\DRIVERS\StarPortLite.sys [120704 2013-02-04] (StarWind Software)
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-03-31] ()
R1 {55dce8ba-9dec-4013-937e-adbf9317d990}Gw64; C:\Windows\System32\drivers\{55dce8ba-9dec-4013-937e-adbf9317d990}Gw64.sys [61584 2014-08-01] (StdLib)
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S3 FairplayKD2; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X]
S1 nethfdrv; \??\C:\Windows\system32\drivers\nethfdrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-07 19:25 - 2014-09-07 19:25 - 00018005 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-09-07 19:24 - 2014-09-07 19:25 - 00000000 ____D () C:\FRST
2014-09-07 18:28 - 2014-09-07 18:29 - 00368705 _____ () C:\Users\Admin\Downloads\gm.zip
2014-09-07 18:28 - 2014-09-07 18:28 - 02104832 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-09-07 18:28 - 2014-09-07 18:28 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL.scr
2014-09-07 18:27 - 2014-09-07 18:28 - 00000000 ____D () C:\Users\Admin\AppData\Local\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\ProgramData\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\Program Files (x86)\AdFender
2014-09-07 18:23 - 2014-09-07 18:24 - 00002992 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-09-07 18:23 - 2014-09-07 18:23 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill_www.INSTALKI.pl64.exe
2014-09-07 18:23 - 2014-09-07 18:23 - 00000000 ____D () C:\Users\Admin\Desktop\rkill
2014-09-07 18:17 - 2014-09-07 18:18 - 02735032 _____ (AdFender, Inc.) C:\Users\Admin\Downloads\Setup.exe
2014-09-07 18:16 - 2014-09-07 18:16 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill_www.INSTALKI.pl.exe
2014-09-07 18:08 - 2014-09-07 18:13 - 133009304 _____ () C:\Users\Admin\Downloads\avast_premier_antivirus_setup.exe.part
2014-09-07 17:16 - 2014-09-07 17:16 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_plk.exe
2014-09-07 17:12 - 2014-09-07 18:25 - 04834344 _____ () C:\Users\Admin\Downloads\avast_premier_antivirus_setup_online.exe.part
2014-09-07 17:00 - 2014-09-07 17:00 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-07 12:39 - 2014-09-07 12:39 - 04834344 _____ () C:\Users\Admin\Desktop\avast_premier_antivirus_setup_online.exe
2014-09-07 12:16 - 2014-09-07 12:16 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-09-07 11:59 - 2014-09-07 12:03 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Downloads\tdsskiller.exe
2014-09-07 11:53 - 2014-09-07 19:25 - 00082200 _____ () C:\Users\Admin\AppData\Roaming\msconfig.ini
2014-09-06 22:04 - 2014-09-06 22:04 - 00000000 ____D () C:\Program Files (x86)\wweBesaover
2014-09-06 17:37 - 2014-09-06 17:37 - 00017513 _____ () C:\Windows\DirectX.log
2014-09-06 17:34 - 2014-09-06 17:34 - 00000728 _____ () C:\Users\Public\Desktop\Counter-Strike Global Offensive.lnk
2014-09-06 17:34 - 2014-09-06 17:34 - 00000671 _____ () C:\Users\Public\Desktop\Update Counter-Strike Global Offensive.lnk
2014-09-06 17:34 - 2014-09-06 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Strogino CS Portal
2014-09-06 14:41 - 2014-09-06 14:42 - 00013314 _____ () C:\Users\Admin\Desktop\eRanking.sk
2014-09-06 14:20 - 2014-09-06 14:42 - 305122912 _____ () C:\Users\Admin\Downloads\Symulator_Jazdy_2_PL_(www_dodane_pl).rar
2014-09-06 13:56 - 2014-09-06 13:56 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-09-06 13:34 - 2014-09-06 13:42 - 174866560 _____ (Kaspersky Lab) C:\Users\Admin\Downloads\kis15.0.0.463pl-pl.exe
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Windows\SysWOW64\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Users\Default\AppData\Local\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\MSDCSC
2014-09-06 13:00 - 2014-09-06 13:00 - 00000000 __SHD () C:\Windows\SysWOW64\WindowsDefender32
2014-09-06 12:48 - 2014-09-07 11:51 - 00000000 ____D () C:\ProgramData\wweBesaover
2014-09-04 21:46 - 2014-09-04 21:48 - 19722284 _____ () C:\Users\Admin\Desktop\Audio 2014-09-04 21-46-46.wav
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-09-03 15:39 - 2014-09-03 15:39 - 00921632 _____ () C:\PA207.DAT
2014-09-02 07:19 - 2014-09-07 11:51 - 00005882 _____ () C:\Windows\PFRO.log
2014-08-31 18:22 - 2014-08-31 18:27 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Audacity
2014-08-31 15:27 - 2014-09-04 21:46 - 00000020 _____ () C:\Windows\capsys184523.log
2014-08-28 19:28 - 2014-09-03 15:29 - 00026258 _____ () C:\Users\Admin\Desktop\warzywa.txt
2014-08-28 12:03 - 2014-08-28 12:04 - 00000000 ____D () C:\Program Files (x86)\AnMing
2014-08-28 12:03 - 2014-08-28 12:03 - 00000928 _____ () C:\Users\Admin\Desktop\MP3 To Ringtone Gold.lnk
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\Temp
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3 To Ringtone Gold
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\AnMingringtone
2014-08-28 12:03 - 2007-09-14 10:40 - 00336896 _____ () C:\Windows\SysWOW64\ammppg.dll
2014-08-28 12:03 - 2007-03-25 20:46 - 00212992 _____ () C:\Windows\SysWOW64\amrdec.dll
2014-08-28 12:03 - 2006-12-24 07:36 - 00073728 _____ () C:\Windows\SysWOW64\a1.dll
2014-08-28 12:03 - 2006-12-21 15:47 - 00081920 _____ () C:\Windows\SysWOW64\qcpsdk.dll
2014-08-28 12:03 - 2005-10-18 11:14 - 00144896 _____ () C:\Windows\SysWOW64\lame_dshow.ax
2014-08-28 12:03 - 2005-04-15 13:22 - 00303104 _____ () C:\Windows\SysWOW64\qscl.dll
2014-08-28 12:03 - 2002-12-02 11:11 - 00290816 _____ (NCT Company) C:\Windows\SysWOW64\NCTWMAFile.dll
2014-08-28 12:03 - 2002-12-02 11:09 - 00282624 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioVisualization.dll
2014-08-28 12:03 - 2002-12-02 11:08 - 00339968 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioTransform.dll
2014-08-28 12:03 - 2002-12-02 11:07 - 00274432 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioRecord.dll
2014-08-28 12:03 - 2002-12-02 11:07 - 00274432 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioPlayer.dll
2014-08-28 12:03 - 2002-12-02 11:05 - 00892928 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioInformation.dll
2014-08-28 12:03 - 2002-12-02 11:03 - 00327680 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioGrabber.dll
2014-08-28 12:03 - 2002-12-02 11:02 - 01703936 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioFile.dll
2014-08-28 12:03 - 2002-09-06 11:36 - 00233472 _____ () C:\Windows\SysWOW64\lame_enc.dll
2014-08-28 12:03 - 2002-09-04 15:17 - 00503808 _____ (NCT Company) C:\Windows\SysWOW64\NCTAudioEditor.dll
2014-08-27 22:21 - 2014-08-27 22:29 - 00000000 ____D () C:\Users\Admin\Desktop\bremu
2014-08-27 20:04 - 2014-08-27 20:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-08-27 12:45 - 2014-08-27 12:45 - 00000000 ____D () C:\Users\Admin\Documents\My Cheat Tables
2014-08-27 12:44 - 2014-09-06 22:05 - 00000000 ____D () C:\Program Files (x86)\Cheat Engine 6.4
2014-08-27 12:44 - 2014-08-27 12:44 - 09052192 _____ (Cheat Engine ) C:\Users\Admin\Desktop\CheatEngine64.exe
2014-08-27 12:42 - 2014-09-07 16:48 - 00000000 ____D () C:\Users\Admin\Documents\MSDCSC
2014-08-27 12:42 - 2014-08-27 12:42 - 00258048 ___SH (Microsoft Corp.) C:\Windows\SysWOW64\Client Server Runtime Process
2014-08-24 22:12 - 2014-09-04 20:04 - 00000000 __SHD () C:\Windows\SysWOW64\Windows Server
2014-08-24 18:58 - 2014-08-24 22:12 - 00291328 _____ () C:\Users\Admin\AppData\Roaming\wserver.exe
2014-08-24 18:24 - 2014-09-07 11:59 - 00000000 ____D () C:\Users\Admin\Downloads\vol1-m2twg
2014-08-24 10:56 - 2014-08-24 10:57 - 05461521 _____ () C:\Users\Admin\Desktop\Top 10 Spawn by Farbenemo1-.rar
2014-08-23 11:36 - 2014-08-23 11:36 - 00000000 ____D () C:\Users\Admin\AppData\Local\Packages
2014-08-23 11:35 - 2014-08-23 11:36 - 00000000 ____D () C:\ProgramData\weubsaveere
2014-08-23 11:11 - 2014-08-23 11:11 - 00000000 ____D () C:\ProgramData\WinSpeed
2014-08-21 20:37 - 2014-08-21 20:37 - 00001214 _____ () C:\Users\Admin\Desktop\filezilla.exe — skrót.lnk
2014-08-19 14:07 - 2014-09-07 18:20 - 00013724 _____ () C:\Windows\setupact.log
2014-08-19 14:07 - 2014-08-19 14:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-18 10:02 - 2014-08-18 10:02 - 00000014 _____ () C:\Users\Admin\Desktop\kod do media ewxpert.txt
2014-08-17 12:02 - 2014-08-17 15:49 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Imminent
2014-08-17 12:02 - 2014-08-17 12:02 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Default Folder
2014-08-16 22:01 - 2014-08-16 22:01 - 00000008 _____ () C:\Windows\28122008.txt
2014-08-16 22:01 - 2014-08-16 22:01 - 00000000 _RSHD () C:\Program Files (x86)\Remote Manipulator System - Host
2014-08-16 21:51 - 2014-08-18 19:44 - 2570635282 _____ () C:\Users\Admin\Downloads\AUTOMAPA_6.15_1312_FINAL_EUROPA_CRACKED iso.rar
2014-08-16 13:16 - 2014-08-16 13:16 - 00000000 ____D () C:\Users\Admin\Documents\NeroVision
2014-08-16 13:13 - 2014-08-16 13:13 - 00000000 ____D () C:\Users\Admin\Documents\Nero Home
2014-08-16 13:12 - 2014-08-16 13:12 - 00000000 ____D () C:\Users\Admin\AppData\Local\Nero
2014-08-16 13:08 - 2014-08-16 16:04 - 1073741824 _____ () C:\Users\Admin\Downloads\AutoMapa 6.16 (1406) Polska i Europa (Cracked).part1.rar
2014-08-16 11:48 - 2014-08-16 11:48 - 00000000 ____D () C:\Users\Admin\Desktop\ItemShop
2014-08-16 11:45 - 2014-08-16 11:47 - 04650240 _____ () C:\Users\Admin\Desktop\ItemShop.rar
2014-08-15 16:40 - 2014-08-15 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combat Mission - Shock Force

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-07 19:25 - 2014-09-07 19:25 - 00018005 _____ () C:\Users\Admin\Downloads\FRST.txt
2014-09-07 19:25 - 2014-09-07 19:24 - 00000000 ____D () C:\FRST
2014-09-07 19:25 - 2014-09-07 11:53 - 00082200 _____ () C:\Users\Admin\AppData\Roaming\msconfig.ini
2014-09-07 19:22 - 2014-04-01 12:25 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Skype
2014-09-07 18:29 - 2014-09-07 18:28 - 00368705 _____ () C:\Users\Admin\Downloads\gm.zip
2014-09-07 18:28 - 2014-09-07 18:28 - 02104832 _____ (Farbar) C:\Users\Admin\Downloads\FRST64.exe
2014-09-07 18:28 - 2014-09-07 18:28 - 00602112 _____ (OldTimer Tools) C:\Users\Admin\Downloads\OTL.scr
2014-09-07 18:28 - 2014-09-07 18:27 - 00000000 ____D () C:\Users\Admin\AppData\Local\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\ProgramData\AdFender
2014-09-07 18:27 - 2014-09-07 18:27 - 00000000 ____D () C:\Program Files (x86)\AdFender
2014-09-07 18:25 - 2014-09-07 17:12 - 04834344 _____ () C:\Users\Admin\Downloads\avast_premier_antivirus_setup_online.exe.part
2014-09-07 18:25 - 2014-04-23 11:50 - 01292437 _____ () C:\Windows\WindowsUpdate.log
2014-09-07 18:24 - 2014-09-07 18:23 - 00002992 _____ () C:\Users\Admin\Desktop\Rkill.txt
2014-09-07 18:23 - 2014-09-07 18:23 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill_www.INSTALKI.pl64.exe
2014-09-07 18:23 - 2014-09-07 18:23 - 00000000 ____D () C:\Users\Admin\Desktop\rkill
2014-09-07 18:23 - 2014-04-08 21:44 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\uTorrent
2014-09-07 18:22 - 2014-06-15 20:47 - 00000000 ____D () C:\Users\Admin\AppData\Local\LogMeIn Hamachi
2014-09-07 18:21 - 2014-04-05 11:44 - 00000000 ____D () C:\Users\Admin\AppData\Local\screenSHU
2014-09-07 18:20 - 2014-08-19 14:07 - 00013724 _____ () C:\Windows\setupact.log
2014-09-07 18:20 - 2014-03-31 11:00 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-09-07 18:18 - 2014-09-07 18:17 - 02735032 _____ (AdFender, Inc.) C:\Users\Admin\Downloads\Setup.exe
2014-09-07 18:16 - 2014-09-07 18:16 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Admin\Downloads\rkill_www.INSTALKI.pl.exe
2014-09-07 18:13 - 2014-09-07 18:08 - 133009304 _____ () C:\Users\Admin\Downloads\avast_premier_antivirus_setup.exe.part
2014-09-07 17:58 - 2014-04-05 09:54 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\TS3Client
2014-09-07 17:16 - 2014-09-07 17:16 - 02347384 _____ (ESET) C:\Users\Admin\Downloads\esetsmartinstaller_plk.exe
2014-09-07 17:00 - 2014-09-07 17:00 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-09-07 16:55 - 2014-06-07 19:07 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\.minecraft
2014-09-07 16:48 - 2014-08-27 12:42 - 00000000 ____D () C:\Users\Admin\Documents\MSDCSC
2014-09-07 12:39 - 2014-09-07 12:39 - 04834344 _____ () C:\Users\Admin\Desktop\avast_premier_antivirus_setup_online.exe
2014-09-07 12:25 - 2014-06-09 21:33 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\FileZilla
2014-09-07 12:17 - 2014-07-29 15:19 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-09-07 12:16 - 2014-09-07 12:16 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-09-07 12:03 - 2014-09-07 11:59 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Downloads\tdsskiller.exe
2014-09-07 11:59 - 2014-08-24 18:24 - 00000000 ____D () C:\Users\Admin\Downloads\vol1-m2twg
2014-09-07 11:56 - 2014-03-31 10:05 - 00699568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-07 11:56 - 2014-03-31 10:05 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-07 11:56 - 2014-03-31 10:05 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-07 11:51 - 2014-09-06 12:48 - 00000000 ____D () C:\ProgramData\wweBesaover
2014-09-07 11:51 - 2014-09-02 07:19 - 00005882 _____ () C:\Windows\PFRO.log
2014-09-06 22:32 - 2014-04-29 17:39 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-09-06 22:05 - 2014-08-27 12:44 - 00000000 ____D () C:\Program Files (x86)\Cheat Engine 6.4
2014-09-06 22:05 - 2014-08-07 19:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefront
2014-09-06 22:04 - 2014-09-06 22:04 - 00000000 ____D () C:\Program Files (x86)\wweBesaover
2014-09-06 22:04 - 2014-06-27 15:30 - 00000000 ____D () C:\ProgramData\1d268881d9c7e4d5
2014-09-06 21:02 - 2014-08-01 22:41 - 00000000 ____D () C:\Users\Admin\AppData\Local\CrashDumps
2014-09-06 17:38 - 2014-05-18 19:11 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-06 17:37 - 2014-09-06 17:37 - 00017513 _____ () C:\Windows\DirectX.log
2014-09-06 17:34 - 2014-09-06 17:34 - 00000728 _____ () C:\Users\Public\Desktop\Counter-Strike Global Offensive.lnk
2014-09-06 17:34 - 2014-09-06 17:34 - 00000671 _____ () C:\Users\Public\Desktop\Update Counter-Strike Global Offensive.lnk
2014-09-06 17:34 - 2014-09-06 17:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Strogino CS Portal
2014-09-06 14:42 - 2014-09-06 14:41 - 00013314 _____ () C:\Users\Admin\Desktop\eRanking.sk
2014-09-06 14:42 - 2014-09-06 14:20 - 305122912 _____ () C:\Users\Admin\Downloads\Symulator_Jazdy_2_PL_(www_dodane_pl).rar
2014-09-06 13:56 - 2014-09-06 13:56 - 00000000 ____D () C:\ProgramData\Kaspersky Lab Setup Files
2014-09-06 13:42 - 2014-09-06 13:34 - 174866560 _____ (Kaspersky Lab) C:\Users\Admin\Downloads\kis15.0.0.463pl-pl.exe
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Windows\SysWOW64\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Users\Default\AppData\Local\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\Users\Default User\AppData\Local\SearchProtect
2014-09-06 13:04 - 2014-09-06 13:04 - 00000000 ____D () C:\MSDCSC
2014-09-06 13:00 - 2014-09-06 13:00 - 00000000 __SHD () C:\Windows\SysWOW64\WindowsDefender32
2014-09-04 21:48 - 2014-09-04 21:46 - 19722284 _____ () C:\Users\Admin\Desktop\Audio 2014-09-04 21-46-46.wav
2014-09-04 21:46 - 2014-08-31 15:27 - 00000020 _____ () C:\Windows\capsys184523.log
2014-09-04 20:04 - 2014-08-24 22:12 - 00000000 __SHD () C:\Windows\SysWOW64\Windows Server
2014-09-04 18:18 - 2009-07-14 06:45 - 00010112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-09-04 18:18 - 2009-07-14 06:45 - 00010112 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2014-09-04 15:22 - 2014-09-04 15:22 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-09-04 15:22 - 2014-06-15 20:45 - 00000926 _____ () C:\Users\Public\Desktop\LogMeIn Hamachi.lnk
2014-09-03 15:39 - 2014-09-03 15:39 - 00921632 _____ () C:\PA207.DAT
2014-09-03 15:29 - 2014-08-28 19:28 - 00026258 _____ () C:\Users\Admin\Desktop\warzywa.txt
2014-08-31 18:27 - 2014-08-31 18:22 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Audacity
2014-08-31 18:21 - 2014-08-05 22:21 - 00001023 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2014-08-31 18:21 - 2014-08-05 22:21 - 00001011 _____ () C:\Users\Public\Desktop\Audacity.lnk
2014-08-31 18:21 - 2014-08-05 22:20 - 00000000 ____D () C:\Program Files (x86)\Audacity
2014-08-31 11:30 - 2014-04-05 10:32 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Notepad++
2014-08-28 12:04 - 2014-08-28 12:03 - 00000000 ____D () C:\Program Files (x86)\AnMing
2014-08-28 12:03 - 2014-08-28 12:03 - 00000928 _____ () C:\Users\Admin\Desktop\MP3 To Ringtone Gold.lnk
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\Temp
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MP3 To Ringtone Gold
2014-08-28 12:03 - 2014-08-28 12:03 - 00000000 ____D () C:\AnMingringtone
2014-08-27 22:29 - 2014-08-27 22:21 - 00000000 ____D () C:\Users\Admin\Desktop\bremu
2014-08-27 20:04 - 2014-08-27 20:04 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-08-27 12:45 - 2014-08-27 12:45 - 00000000 ____D () C:\Users\Admin\Documents\My Cheat Tables
2014-08-27 12:44 - 2014-08-27 12:44 - 09052192 _____ (Cheat Engine ) C:\Users\Admin\Desktop\CheatEngine64.exe
2014-08-27 12:42 - 2014-08-27 12:42 - 00258048 ___SH (Microsoft Corp.) C:\Windows\SysWOW64\Client Server Runtime Process
2014-08-24 22:12 - 2014-08-24 18:58 - 00291328 _____ () C:\Users\Admin\AppData\Roaming\wserver.exe
2014-08-24 17:07 - 2014-07-28 20:05 - 00070144 _____ () C:\Windows\SysWOW64\tasks.dll
2014-08-24 16:54 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-24 10:57 - 2014-08-24 10:56 - 05461521 _____ () C:\Users\Admin\Desktop\Top 10 Spawn by Farbenemo1-.rar
2014-08-23 11:36 - 2014-08-23 11:36 - 00000000 ____D () C:\Users\Admin\AppData\Local\Packages
2014-08-23 11:36 - 2014-08-23 11:35 - 00000000 ____D () C:\ProgramData\weubsaveere
2014-08-23 11:11 - 2014-08-23 11:11 - 00000000 ____D () C:\ProgramData\WinSpeed
2014-08-23 11:11 - 2014-08-03 10:52 - 00000000 ____D () C:\ProgramData\374311380
2014-08-21 20:37 - 2014-08-21 20:37 - 00001214 _____ () C:\Users\Admin\Desktop\filezilla.exe — skrót.lnk
2014-08-20 10:17 - 2014-04-01 12:25 - 00000000 ____D () C:\ProgramData\Skype
2014-08-19 14:07 - 2014-08-19 14:07 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-19 12:57 - 2014-04-09 17:32 - 00000000 ____D () C:\Windows\Minidump
2014-08-19 12:56 - 2014-04-12 17:50 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-08-19 12:56 - 2014-04-12 17:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-08-18 19:44 - 2014-08-16 21:51 - 2570635282 _____ () C:\Users\Admin\Downloads\AUTOMAPA_6.15_1312_FINAL_EUROPA_CRACKED iso.rar
2014-08-18 10:02 - 2014-08-18 10:02 - 00000014 _____ () C:\Users\Admin\Desktop\kod do media ewxpert.txt
2014-08-17 16:02 - 2009-07-14 07:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-17 15:49 - 2014-08-17 12:02 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Imminent
2014-08-17 12:02 - 2014-08-17 12:02 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Default Folder
2014-08-16 22:01 - 2014-08-16 22:01 - 00000008 _____ () C:\Windows\28122008.txt
2014-08-16 22:01 - 2014-08-16 22:01 - 00000000 _RSHD () C:\Program Files (x86)\Remote Manipulator System - Host
2014-08-16 21:20 - 2009-07-14 14:43 - 00739852 _____ () C:\Windows\system32\perfh015.dat
2014-08-16 21:20 - 2009-07-14 14:43 - 00155426 _____ () C:\Windows\system32\perfc015.dat
2014-08-16 21:20 - 2009-07-14 07:13 - 01668226 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 16:04 - 2014-08-16 13:08 - 1073741824 _____ () C:\Users\Admin\Downloads\AutoMapa 6.16 (1406) Polska i Europa (Cracked).part1.rar
2014-08-16 13:16 - 2014-08-16 13:16 - 00000000 ____D () C:\Users\Admin\Documents\NeroVision
2014-08-16 13:13 - 2014-08-16 13:13 - 00000000 ____D () C:\Users\Admin\Documents\Nero Home
2014-08-16 13:13 - 2014-07-26 16:28 - 00000000 ____D () C:\Users\Admin\AppData\Local\Ahead
2014-08-16 13:12 - 2014-08-16 13:12 - 00000000 ____D () C:\Users\Admin\AppData\Local\Nero
2014-08-16 13:12 - 2014-07-26 16:26 - 00007867 _____ () C:\Windows\Irremote.ini
2014-08-16 13:12 - 2014-07-26 16:25 - 00001024 _____ () C:\Users\Admin\.rnd
2014-08-16 11:54 - 2014-04-04 20:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2014-08-16 11:48 - 2014-08-16 11:48 - 00000000 ____D () C:\Users\Admin\Desktop\ItemShop
2014-08-16 11:47 - 2014-08-16 11:45 - 04650240 _____ () C:\Users\Admin\Desktop\ItemShop.rar
2014-08-15 16:40 - 2014-08-15 16:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Combat Mission - Shock Force

Files to move or delete:
====================
C:\Users\Admin\dgderapi.dll
C:\Users\Admin\DIFxAPI.dll
C:\Users\Admin\Uninstall.exe
C:\Users\Admin\AppData\Roaming\msconfig.ini


Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\DO NOT CLICK.EXE
C:\Users\Admin\AppData\Local\Temp\GPUpd53F23D3F0.exe
C:\Users\Admin\AppData\Local\Temp\GPUpd53F368BD0.exe
C:\Users\Admin\AppData\Local\Temp\GPUpd53F4BA3C0.exe
C:\Users\Admin\AppData\Local\Temp\GPUpd53F60BBC0.exe
C:\Users\Admin\AppData\Local\Temp\GPUpd53F75D3D0.exe
C:\Users\Admin\AppData\Local\Temp\ICReinstall_Recuva(13044).exe
C:\Users\Admin\AppData\Local\Temp\jansi-64-git-Bukkit-1.7.9-R0.2-11-g3fd9db2-b3097jnks.dll
C:\Users\Admin\AppData\Local\Temp\MINECRAFT PACK.EXE
C:\Users\Admin\AppData\Local\Temp\npp.6.6.8.Installer.exe
C:\Users\Admin\AppData\Local\Temp\serverREAL.sfx.exe
C:\Users\Admin\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Admin\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll
C:\Users\Admin\AppData\Local\Temp\TITANIUM.EXE
C:\Users\Admin\AppData\Local\Temp\TITANIUM.EXE.EXE
C:\Users\Admin\AppData\Local\Temp\TUMBLR_LA48V6TKS61QCBO2TO1_50FAT_BLACK_MAN.EXE
C:\Users\Admin\AppData\Local\Temp\xmlUpdater.exe
C:\Users\Admin\AppData\Local\Temp\{6C19BC0B-4710-483A-904E-049C66640BC2}.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 14:38

==================== End Of Log ============================