Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-12-2014
Ran by Erhu (administrator) on ERHU-PC on 13-12-2014 22:47:40
Running from C:\Users\Erhu\Desktop
Loaded Profile: Erhu (Available profiles: Erhu)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Flux Software LLC) C:\Users\Erhu\AppData\Local\FluxSoftware\Flux\flux.exe
(Comfort Software Group) C:\Program Files\FreeAlarmClock\FreeAlarmClock.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
() C:\Program Files\Opera\26.0.1656.32\opera_crashreporter.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe
(Opera Software) C:\Program Files\Opera\26.0.1656.32\opera.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [974432 2014-08-22] (Microsoft Corporation)
HKU\S-1-5-21-2688596455-2242333191-3207443447-1000\...\Run: [f.lux] => C:\Users\Erhu\AppData\Local\FluxSoftware\Flux\flux.exe [1017224 2013-10-23] (Flux Software LLC)
HKU\S-1-5-21-2688596455-2242333191-3207443447-1000\...\Run: [FreeAC] => C:\Program Files\FreeAlarmClock\FreeAlarmClock.exe [1553688 2014-02-20] (Comfort Software Group)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2688596455-2242333191-3207443447-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/pl-pl/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Tcpip\Parameters: [DhcpNameServer] 62.21.99.94 62.21.99.95

FireFox:
========

Chrome: 
=======

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22192 2014-08-22] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [288120 2014-08-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2014-12-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [231800 2014-07-17] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-13 22:47 - 2014-12-13 22:48 - 00005069 _____ () C:\Users\Erhu\Desktop\FRST.txt
2014-12-13 22:41 - 2014-12-13 22:47 - 00000000 ____D () C:\FRST
2014-12-13 22:40 - 2014-12-13 22:40 - 00368705 _____ () C:\Users\Erhu\Desktop\gm.zip
2014-12-13 22:37 - 2014-12-13 22:37 - 01111552 _____ (Farbar) C:\Users\Erhu\Desktop\FRST.exe
2014-12-13 22:37 - 2014-12-13 22:37 - 00602112 _____ (OldTimer Tools) C:\Users\Erhu\Desktop\OTL.com
2014-12-13 21:58 - 2014-12-13 22:22 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-12-13 21:48 - 2014-12-13 21:48 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-12-13 21:48 - 2014-12-13 21:48 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-12-13 21:48 - 2014-12-13 21:48 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-12-13 21:48 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-12-13 21:48 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-12-13 21:48 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-12-13 21:34 - 2014-12-13 21:36 - 00000000 ____D () C:\AdwCleaner
2014-12-10 16:39 - 2014-12-10 16:39 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\WinRAR
2014-12-10 16:39 - 2014-12-10 16:39 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-10 16:39 - 2014-12-10 16:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-12-10 16:39 - 2014-12-10 16:39 - 00000000 ____D () C:\Program Files\WinRAR
2014-12-10 16:39 - 2012-08-06 20:25 - 00000000 ____D () C:\Users\Erhu\Desktop\3906143
2014-12-10 00:53 - 2014-12-10 00:53 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Macromedia
2014-12-10 00:53 - 2014-12-10 00:53 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Adobe
2014-12-10 00:52 - 2014-12-13 22:07 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\IHlpr
2014-12-10 00:52 - 2014-12-10 00:53 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\NapiProjekt
2014-12-10 00:52 - 2014-12-10 00:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NapiProjekt
2014-12-10 00:52 - 2014-12-10 00:52 - 00000000 ____D () C:\Program Files\NapiProjekt
2014-12-08 13:06 - 2014-12-08 13:07 - 00000011 _____ () C:\Users\Erhu\Desktop\Zielinski COO.txt
2014-12-08 00:39 - 2014-12-08 00:39 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\MPC-HC
2014-12-08 00:37 - 2014-12-08 00:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\K-Lite Codec Pack
2014-12-08 00:37 - 2014-12-08 00:37 - 00000000 ____D () C:\Program Files\K-Lite Codec Pack
2014-12-08 00:37 - 2014-11-03 13:39 - 00218712 _____ () C:\Windows\system32\unrar.dll
2014-12-07 21:02 - 2014-12-07 22:31 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\BESTplayer
2014-12-04 00:38 - 2014-12-04 00:38 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf
2014-12-02 02:56 - 2014-12-02 02:56 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\OpenOffice
2014-12-02 02:54 - 2014-12-02 02:54 - 00000000 ___SD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice 4.1.1
2014-12-02 02:53 - 2014-12-02 02:53 - 00000000 ____D () C:\Program Files\OpenOffice 4
2014-12-02 02:02 - 2014-12-02 02:02 - 00001128 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Express Scribe Transcription Software.lnk
2014-12-02 02:02 - 2014-12-02 02:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NCH Software Suite
2014-12-01 19:46 - 2014-12-01 19:57 - 00000000 ____D () C:\Users\Erhu\Downloads\Grizzly Bear - Shields [2012]
2014-12-01 19:46 - 2014-12-01 19:47 - 00000000 ____D () C:\Users\Erhu\Desktop\Shields - 320
2014-12-01 18:49 - 2014-12-11 17:38 - 00001138 _____ () C:\Users\Erhu\Desktop\Things - Shortcut.lnk
2014-12-01 18:44 - 2014-12-01 18:46 - 00000000 ____D () C:\Users\Erhu\Desktop\Grizzly Bear [2009] Veckatimest
2014-12-01 18:43 - 2014-12-01 18:43 - 00000792 _____ () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2014-12-01 18:42 - 2014-12-02 00:59 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\uTorrent
2014-12-01 18:29 - 2014-12-01 18:29 - 00000032 _____ () C:\Users\Erhu\Desktop\wierzbicki lekarz.txt
2014-12-01 14:09 - 2014-12-10 23:46 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Skype
2014-12-01 14:09 - 2014-12-01 14:10 - 00000000 ____D () C:\ProgramData\Skype
2014-12-01 14:09 - 2014-12-01 14:09 - 00000000 ___RD () C:\Program Files\Skype
2014-12-01 14:09 - 2014-12-01 14:09 - 00000000 ____D () C:\Users\Erhu\AppData\Local\Skype
2014-12-01 14:09 - 2014-12-01 14:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-12-01 14:09 - 2014-12-01 14:09 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-12-01 13:54 - 2014-12-01 13:54 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-12-01 13:54 - 2014-12-01 13:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-12-01 13:54 - 2014-12-01 13:54 - 00000000 ____D () C:\Windows\system32\Macromed
2014-12-01 13:51 - 2014-12-01 13:54 - 00000000 ____D () C:\Users\Erhu\AppData\Local\Adobe
2014-12-01 03:39 - 2014-12-01 03:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Free Alarm Clock
2014-12-01 03:38 - 2014-12-01 03:39 - 00000000 ____D () C:\Program Files\FreeAlarmClock
2014-12-01 02:36 - 2014-11-30 17:46 - 00000000 ____D () C:\Windows\Panther
2014-11-30 19:26 - 2012-02-17 06:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2014-11-30 19:26 - 2012-02-17 05:14 - 00183808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-11-30 19:26 - 2012-02-17 05:13 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2014-11-30 19:09 - 2014-12-09 17:25 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\foobar2000
2014-11-30 19:08 - 2014-11-30 19:08 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flux
2014-11-30 19:08 - 2014-11-30 19:08 - 00000000 ____D () C:\Users\Erhu\AppData\Local\FluxSoftware
2014-11-30 19:07 - 2014-11-30 19:07 - 00001075 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\foobar2000.lnk
2014-11-30 19:07 - 2014-11-30 19:07 - 00000000 ____D () C:\Program Files\foobar2000
2014-11-30 19:06 - 2014-05-14 17:23 - 01973728 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-11-30 19:06 - 2014-05-14 17:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-11-30 19:06 - 2014-05-14 17:23 - 00054240 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-11-30 19:06 - 2014-05-14 17:23 - 00045536 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-11-30 19:06 - 2014-05-14 17:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-11-30 19:06 - 2014-05-14 17:17 - 02425856 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-11-30 19:06 - 2014-05-14 17:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-11-30 19:06 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-11-30 19:06 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-11-30 18:55 - 2014-11-30 18:55 - 00002117 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2014-11-30 18:55 - 2014-11-30 18:55 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-11-30 18:55 - 2014-11-30 18:55 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-11-30 18:05 - 2014-11-30 18:05 - 00001036 _____ () C:\Users\Erhu\Desktop\Documents - Shortcut.lnk
2014-11-30 18:05 - 2014-11-30 18:05 - 00000355 _____ () C:\Users\Erhu\Desktop\Computer - Shortcut.lnk
2014-11-30 18:04 - 2014-12-13 22:23 - 00000000 ____D () C:\Users\Erhu\Desktop\Programy
2014-11-30 18:04 - 2014-11-30 18:04 - 00001097 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk
2014-11-30 18:04 - 2014-11-30 18:04 - 00000000 ____D () C:\Users\Erhu\AppData\Roaming\Opera Software
2014-11-30 18:04 - 2014-11-30 18:04 - 00000000 ____D () C:\Users\Erhu\AppData\Local\Opera Software
2014-11-30 18:03 - 2014-12-04 00:02 - 00000000 ____D () C:\Program Files\Opera
2014-11-30 18:03 - 2014-10-30 12:24 - 00229000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-11-30 17:50 - 2014-12-02 13:55 - 00063568 _____ () C:\Users\Erhu\AppData\Local\GDIPFONTCACHEV1.DAT
2014-11-30 17:47 - 2014-11-30 17:47 - 00001417 _____ () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-11-30 17:46 - 2014-12-13 22:23 - 01557687 _____ () C:\Windows\WindowsUpdate.log
2014-11-30 17:46 - 2014-11-30 17:47 - 00000000 ____D () C:\Users\Erhu
2014-11-30 17:46 - 2014-11-30 17:46 - 00000020 ___SH () C:\Users\Erhu\ntuser.ini
2014-11-30 17:46 - 2014-11-30 17:46 - 00000000 __SHD () C:\Recovery
2014-11-30 17:46 - 2014-11-30 17:46 - 00000000 ____D () C:\Users\Erhu\AppData\Local\VirtualStore
2014-11-30 17:46 - 2009-07-14 05:42 - 00000000 ___RD () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-30 17:46 - 2009-07-14 05:37 - 00000000 ___RD () C:\Users\Erhu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-11-30 17:40 - 2014-11-30 17:40 - 00001345 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2014-11-30 17:40 - 2014-11-30 17:40 - 00001326 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2014-11-30 17:38 - 2014-11-30 17:38 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2014-11-30 17:37 - 2014-11-30 17:39 - 00001355 _____ () C:\Windows\TSSysprep.log
2014-11-30 17:13 - 2014-12-04 00:16 - 00000000 ____D () C:\Users\Erhu\Desktop\Etnologia
2014-11-30 17:01 - 2014-11-30 19:27 - 00000000 ____D () C:\Users\Erhu\Documents\Snap Photos
2014-11-30 17:01 - 2014-11-30 19:27 - 00000000 ____D () C:\Users\Erhu\Documents\Phone Backup
2014-11-30 17:01 - 2014-11-30 19:27 - 00000000 ____D () C:\Users\Erhu\Documents\paint
2014-11-30 17:01 - 2014-11-30 19:27 - 00000000 ____D () C:\Users\Erhu\Documents\kopie
2014-11-30 17:01 - 2014-11-25 00:11 - 00000000 _____ () C:\Users\Erhu\Documents\llamar del animo ven angelica ven....txt
2014-11-30 17:01 - 2013-08-09 23:48 - 00056528 _____ () C:\Users\Erhu\Documents\untitled_0.odt
2014-11-30 17:01 - 2013-08-08 22:25 - 00000000 _____ () C:\Users\Erhu\Documents\9923.txt
2014-11-30 17:01 - 2012-10-17 22:39 - 00000039 _____ () C:\Users\Erhu\Documents\net.txt
2014-11-30 17:01 - 2011-10-28 20:52 - 00000266 _____ () C:\Users\Erhu\Documents\polo.txt
2014-11-30 17:01 - 2011-07-25 00:31 - 00020930 _____ () C:\Users\Erhu\Documents\CV_ThomasSerbeniuk.odt
2014-11-30 17:01 - 2011-03-15 19:38 - 00000299 _____ () C:\Users\Erhu\Documents\ciechomski cwiczenia.txt
2014-11-30 17:01 - 2011-01-17 00:34 - 00000024 _____ () C:\Users\Erhu\Documents\nr dow i pes. oj..txt
2014-11-30 17:01 - 2010-11-15 20:34 - 00000126 _____ () C:\Users\Erhu\Documents\rekomendacje.txt
2014-11-30 17:01 - 2010-11-07 13:42 - 00000088 _____ () C:\Users\Erhu\Documents\auten.txt
2014-11-30 17:01 - 2010-07-03 16:44 - 00002685 _____ () C:\Users\Erhu\Documents\untitled.txt
2014-11-30 17:01 - 2010-06-14 08:21 - 00000260 _____ () C:\Users\Erhu\Documents\sny.txt
2014-11-30 17:01 - 2008-11-20 07:46 - 12256966 _____ () C:\Users\Erhu\Documents\MOV00559.AVI
2014-11-30 17:01 - 2008-10-08 10:08 - 14492331 _____ () C:\Users\Erhu\Documents\5 animals.WMV
2014-11-30 16:57 - 2014-11-30 19:25 - 00000000 ____D () C:\Users\Erhu\Documents\Dom
2014-11-30 16:46 - 2014-11-30 19:37 - 00000000 ____D () C:\Users\Erhu\Documents\Ayahuasca
2014-11-30 16:43 - 2014-11-30 19:30 - 00000000 ____D () C:\Users\Erhu\Documents\aiciezd
2014-11-30 16:43 - 2013-06-15 14:04 - 48988876 _____ () C:\Users\Erhu\Documents\Помилуй мя, Боже Пслм.50.mpg.flv
2014-11-22 14:55 - 2014-11-30 19:25 - 00000000 ____D () C:\Users\Erhu\Desktop\Pink Floyd - The Endless River [2014] 320

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-12-13 22:15 - 2009-07-14 05:34 - 00021648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-12-13 22:15 - 2009-07-14 05:34 - 00021648 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-12-13 22:12 - 2010-11-20 22:01 - 00713888 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-12-13 22:08 - 2010-11-20 22:48 - 00010544 _____ () C:\Windows\PFRO.log
2014-12-13 22:08 - 2009-07-14 05:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-12-13 22:08 - 2009-07-14 05:39 - 00027506 _____ () C:\Windows\setupact.log
2014-12-13 22:08 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\TAPI
2014-12-04 00:43 - 2014-07-20 15:29 - 00000000 ____D () C:\Users\Erhu\Desktop\Grizzly Bear - Yellow House (2006)
2014-12-02 13:54 - 2009-07-14 05:33 - 00292808 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-12-02 02:51 - 2009-07-14 03:37 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-12-01 10:43 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\rescache
2014-12-01 10:35 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\LiveKernelReports
2014-12-01 02:36 - 2009-07-14 05:57 - 00025600 ___SH () C:\Windows\system32\config\BCD-Template.LOG
2014-12-01 02:36 - 2009-07-14 05:52 - 00028672 _____ () C:\Windows\system32\config\BCD-Template
2014-11-30 19:23 - 2014-10-14 17:51 - 00000000 ____D () C:\Users\Erhu\Desktop\Marissa Nadler - July [2014] [FLAC]
2014-11-30 19:22 - 2014-05-27 13:06 - 00000000 ____D () C:\Users\Erhu\Desktop\Johnny Cash The Ultimate Best Of 2011 Remastered 320 Kbps
2014-11-30 19:19 - 2014-11-11 16:50 - 00000000 ____D () C:\Users\Erhu\Desktop\Joanna Newsom - Have One On Me [2010-MP3-Cov][Bubanee]
2014-11-30 19:15 - 2014-10-25 17:03 - 00000000 ____D () C:\Users\Erhu\Desktop\Caribou - Swim [2010-MP3-Cov][Bubanee]
2014-11-30 19:15 - 2014-10-25 16:40 - 00000000 ____D () C:\Users\Erhu\Desktop\Caribou - Our Love 2014 [MP3@320kbps]
2014-11-30 19:15 - 2014-09-18 16:57 - 00000000 ____D () C:\Users\Erhu\Desktop\Gregory Porter - Liquid Spirit (2013) NLToppers
2014-11-30 19:13 - 2014-10-25 17:04 - 00000000 ____D () C:\Users\Erhu\Desktop\Carbon Based Lifeforms
2014-11-30 19:11 - 2014-10-25 17:08 - 00000000 ____D () C:\Users\Erhu\Desktop\William Orbit - Pieces In A Modern Style 2 [2CD Deluxe Edition] (2010)
2014-11-30 18:03 - 2009-07-14 05:52 - 00000000 ____D () C:\Windows\system32\restore
2014-11-30 17:46 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\system32\Recovery
2014-11-30 17:44 - 2009-07-14 03:37 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-11-30 17:40 - 2009-07-14 05:52 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-11-30 17:40 - 2009-07-14 03:37 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-11-30 17:37 - 2009-07-14 05:34 - 00002790 _____ () C:\Windows\DtcInstall.log

Some content of TEMP:
====================
C:\Users\Erhu\AppData\Local\Temp\aacdec.exe
C:\Users\Erhu\AppData\Local\Temp\ffmpeg17.exe
C:\Users\Erhu\AppData\Local\Temp\Quarantine.exe
C:\Users\Erhu\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-12-05 20:01

==================== End Of Log ============================