Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014 Ran by asus (administrator) on ASUS-KOMPUTER on 29-12-2014 21:42:05 Running from F:\ Loaded Profile: asus (Available profiles: asus) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (4G Systems GmbH & Co. KG) C:\Windows\service4g.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (4G Systems GmbH & Co. KG) C:\Windows\starter4g.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (Telefónica I+D) C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe (ASUS) C:\Windows\AsScrPro.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM-x32\...\Run: [fst_de_6] => [X] HKLM-x32\...\Run: [YTDownloader] => "C:\Program Files (x86)\YTDownloader\YTDownloader.exe" /boot HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\Run: [SPDriver] => C:\Program Files (x86)\ShopperPro\JSDriver\1.38.0.1425\jsdrv.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: G - G:\Autorun.exe PnS Data@PnS.lnk HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {10ba4f73-3a7a-11e4-88f8-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {10ba4f95-3a7a-11e4-88f8-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {1161e457-39d9-11e4-8ffd-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {25676b30-6826-11e2-a060-5404a6725ab1} - F:\autorun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {8cf71f32-376a-11e4-9756-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {8cf71f37-376a-11e4-9756-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {8cf71f74-376a-11e4-9756-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {8cf71f78-376a-11e4-9756-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {8cf71f96-376a-11e4-9756-742f68f9ae2b} - F:\.\Setup.exe AUTORUN=1 HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {c299cfa1-5fe1-11e2-8d68-5404a6725ab1} - F:\.\Setup.exe AUTORUN=1 HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {d11e5fcf-4e6d-11e1-9c2a-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {d11e5fde-4e6d-11e1-9c2a-742f68f9ae2b} - F:\AutoRun.exe HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {f111100e-5ba5-11e4-adb5-742f68f9ae2b} - F:\.\Setup.exe AUTORUN=1 HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {f1111020-5ba5-11e4-adb5-742f68f9ae2b} - F:\.\Setup.exe AUTORUN=1 HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {f3042939-0916-11e4-88e3-742f68f9ae2b} - G:\Autorun.exe PnS Data@PnS.lnk HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\MountPoints2: {f7b2ee95-9a52-11e1-95c7-5404a6725ab1} - G:\.\Autorun.exe AUTORUN=1 ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION ProxyServer: [S-1-5-21-3538497797-2065877681-1779425805-1001] => http=127.0.0.1:49174;https=127.0.0.1:49174 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 -> Backup.Old.DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3538497797-2065877681-1779425805-1001 -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms} SearchScopes: HKU\S-1-5-21-3538497797-2065877681-1779425805-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms} BHO: No Name -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> No File BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: IplexToALLPlayer -> {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} -> C:\Program Files (x86)\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices) Tcpip\Parameters: [DhcpNameServer] 192.168.4.1 FireFox: ======== FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF HKU\S-1-5-21-3538497797-2065877681-1779425805-1001\...\Firefox\Extensions: [{0A51D001-288A-8757-82EA-88D072F82825}] - C:\Program Files (x86)\ver8BlockAndSurf\184.xpi Chrome: ======= CHR HomePage: Default -> https://www.google.pl/?gws_rd=ssl#q=forum+dobre+programy CHR StartupUrls: Default -> "hxxp://www.sweet-page.com/?type=hp&ts=1417978154&from=cor&uid=ST9500325AS_S2W6HB45XXXXS2W6HB45" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Profile: C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Dokumenty Google) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-27] CHR Extension: (Dysk Google) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-27] CHR Extension: (YouTube) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-27] CHR Extension: (Szukaj w Google) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-27] CHR Extension: (Google Wallet) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-02] CHR Extension: (oalbpfagfhfkcmklpdanadjpbfdedndn) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\oalbpfagfhfkcmklpdanadjpbfdedndn [2014-12-06] CHR Extension: (Gmail) - C:\Users\asus\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-27] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 4G USB-Plug Service; C:\Windows\service4g.exe [120080 2008-08-19] (4G Systems GmbH & Co. KG) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-01-20] (Advanced Micro Devices, Inc.) [File not signed] R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-03-13] (Atheros) [File not signed] R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [74912 2011-03-13] (Atheros Commnucations) [File not signed] R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 TGCM_ImportWiFiSvc; C:\Program Files (x86)\o2\Mobile Connection Manager\ImpWiFiSvc.exe [199600 2010-11-11] (Telefónica I+D) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 cm_ser; C:\Windows\System32\DRIVERS\cm_ser.sys [118272 2013-01-27] (C-motech Co.,Ltd.) S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [138752 2014-09-08] (Huawei Technologies Co., Ltd.) [File not signed] S3 ew_hwusbdev; C:\Windows\System32\DRIVERS\ew_hwusbdev.sys [117248 2014-09-08] (Huawei Technologies Co., Ltd.) [File not signed] S3 Huawei; C:\Windows\System32\DRIVERS\ewdcsc.sys [29696 2013-02-02] (Huawei Tech. Co., Ltd.) [File not signed] S3 hwdatacard; C:\Windows\System32\DRIVERS\ewusbmdm.sys [121600 2014-09-08] (Huawei Technologies Co., Ltd.) [File not signed] S3 hwusbfake; C:\Windows\System32\DRIVERS\ewusbfake.sys [116224 2013-02-02] (Huawei Technologies Co., Ltd.) [File not signed] R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) S3 massfilter_hs; C:\Windows\System32\drivers\massfilter_hs.sys [12800 2009-02-03] (ZTE Incorporated) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) U5 RTSPER; C:\Windows\System32\Drivers\RTSPER.sys [465624 2014-01-03] (Realsil Semiconductor Corporation) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [867064 2012-03-23] (Duplex Secure Ltd.) S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X] S2 SPDRIVER_1.38.0.1425; \??\C:\Program Files (x86)\ShopperPro\JSDriver\1.38.0.1425\jsdrv.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-29 20:20 - 2014-12-29 20:21 - 00000000 ____D () C:\Users\asus\AppData\Roaming\driveridentifier 2014-12-29 20:20 - 2014-12-29 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Identifier 2014-12-29 20:20 - 2014-12-29 20:20 - 00000000 ____D () C:\Program Files (x86)\Driver Identifier 2014-12-29 19:39 - 2014-12-29 19:39 - 00029051 _____ () C:\Users\asus\Desktop\AdwCleaner[S1].txt 2014-12-29 17:48 - 2014-12-29 21:42 - 00000000 ____D () C:\FRST 2014-12-18 18:26 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-18 18:25 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-14 22:07 - 2014-12-14 22:07 - 01377760 _____ (Cinema HDV14.12) C:\Users\asus\AppData\Roaming\JTTP.exe 2014-12-14 22:07 - 2014-12-14 22:07 - 00000000 ____D () C:\Program Files (x86)\ebcf6afa-c637-4509-821d-de1050232782 2014-12-14 22:06 - 2014-12-29 20:37 - 00001682 _____ () C:\Windows\Tasks\NLSFHPES.job 2014-12-14 22:06 - 2014-12-14 22:06 - 01866208 _____ (Cinema HDV14.12) C:\Users\asus\AppData\Roaming\NLSFHPES.exe 2014-12-14 22:06 - 2014-12-14 22:06 - 00004716 _____ () C:\Windows\System32\Tasks\NLSFHPES 2014-12-11 21:33 - 2014-12-11 21:33 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-11 16:52 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-11 16:52 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-10 17:08 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 17:08 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 17:08 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 17:08 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 17:08 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-10 17:08 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 17:08 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-10 17:08 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 17:08 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-10 17:08 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 17:08 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 17:08 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-10 17:08 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 17:08 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-10 17:08 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 17:08 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-10 17:08 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-10 17:08 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 17:08 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 17:08 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-10 17:08 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-10 17:08 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-10 17:08 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 17:08 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 17:08 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-10 17:08 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-10 17:08 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 17:08 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 17:08 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 17:08 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-10 17:08 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-10 17:08 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-10 17:08 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-10 17:08 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 17:08 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 17:08 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-10 17:08 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 17:08 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-10 17:08 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 17:08 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-10 17:08 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-10 17:08 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 17:08 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 17:08 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 17:08 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 17:08 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 17:08 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 17:08 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-10 17:08 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 17:08 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 17:08 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 17:08 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 17:08 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 17:08 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 17:05 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 17:05 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 17:05 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-10 17:04 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 17:04 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 17:04 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-10 17:00 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 17:00 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-10 17:00 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-10 17:00 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-10 17:00 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-10 17:00 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-10 17:00 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-10 17:00 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-10 17:00 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-10 17:00 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-10 17:00 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-10 17:00 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-10 17:00 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-10 17:00 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-07 19:55 - 2014-12-07 19:55 - 00613057 _____ (CMI Limited) C:\Users\asus\AppData\Local\nswE851.tmp 2014-12-07 19:51 - 2014-12-14 12:30 - 00001971 _____ () C:\Windows\patsearch.bin 2014-12-07 19:51 - 2014-12-07 19:51 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_webinstrNewH_01009.Wdf 2014-12-07 17:05 - 2014-12-07 17:05 - 00000470 _____ () C:\Windows\Tasks\SPBIW_UpdateTask_Time_313634393935323433332d372d55324157505a57454a2a.job 2014-12-04 19:07 - 2014-12-16 19:02 - 00004240 _____ () C:\Windows\System32\Tasks\SPBIW_UpdateTask_Time_313634393935323433332d7855236c575a4a5741415034 2014-12-04 19:07 - 2014-12-16 19:02 - 00000000 ____D () C:\Program Files\Common Files\ShopperPro 2014-12-01 22:08 - 2014-12-01 22:08 - 00628496 _____ (CMI Limited) C:\Users\asus\AppData\Local\nsuA584.tmp 2014-12-01 20:59 - 2014-12-01 20:59 - 01519576 _____ (Object Browser) C:\Users\asus\AppData\Roaming\YL.exe 2014-12-01 20:58 - 2014-12-01 20:58 - 01847256 _____ (Object Browser) C:\Users\asus\AppData\Roaming\LHLBMVCF.exe 2014-12-01 20:58 - 2014-12-01 20:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Liveistream 2014-12-01 20:57 - 2014-12-01 20:57 - 00003580 _____ () C:\Windows\System32\Tasks\YTDownloaderUpd ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-29 21:35 - 2013-11-02 22:28 - 00001048 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-29 21:35 - 2011-11-09 04:40 - 01838884 _____ () C:\Windows\WindowsUpdate.log 2014-12-29 21:25 - 2014-11-23 20:42 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-29 20:45 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-29 20:45 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-29 20:37 - 2014-11-16 00:55 - 00008562 _____ () C:\Windows\PFRO.log 2014-12-29 20:37 - 2014-11-16 00:55 - 00004237 _____ () C:\Windows\setupact.log 2014-12-29 20:37 - 2013-11-02 22:28 - 00001044 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-29 20:37 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-29 20:35 - 2014-09-10 19:47 - 00000000 ____D () C:\AdwCleaner 2014-12-29 19:57 - 2012-04-12 09:42 - 00268800 ___SH () C:\Users\asus\Desktop\Thumbs.db 2014-12-29 19:51 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-12-29 19:44 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-29 17:32 - 2011-02-19 06:31 - 00752302 _____ () C:\Windows\system32\perfh015.dat 2014-12-29 17:32 - 2011-02-19 06:31 - 00159902 _____ () C:\Windows\system32\perfc015.dat 2014-12-29 17:32 - 2009-07-14 06:13 - 01701862 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-12-18 20:57 - 2012-02-10 06:48 - 00000000 ____D () C:\Users\asus\AppData\Roaming\Skype 2014-12-18 18:13 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini 2014-12-17 21:19 - 2012-02-03 15:18 - 00000000 ____D () C:\Users\asus\AppData\Local\CrashDumps 2014-12-14 22:07 - 2013-11-02 22:28 - 00002209 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-14 22:07 - 2013-08-31 16:04 - 00000000 ____D () C:\Program Files (x86)\ALLConverter PRO 2014-12-13 14:56 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-12-12 21:14 - 2013-07-07 22:24 - 00000000 ____D () C:\Users\asus\AppData\Roaming\Media Player Classic 2014-12-12 19:25 - 2014-11-23 20:42 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-12 19:25 - 2014-11-23 20:42 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-12 19:25 - 2014-11-23 20:42 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-11 21:33 - 2014-05-07 17:40 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-11 21:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-11 21:33 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 16:59 - 2013-08-18 12:03 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 16:54 - 2012-03-23 16:07 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-08 20:52 - 2012-07-04 23:00 - 00001788 _____ () C:\Windows\system32\ServiceFilter.ini 2014-12-07 20:03 - 2012-07-04 23:00 - 00002292 _____ () C:\Windows\system32\AutoRunFilter.ini 2014-12-01 20:57 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\System Some content of TEMP: ==================== C:\Users\asus\AppData\Local\Temp\2C3C2643-2670-16A1-8136-C762FF1E4F60.dll C:\Users\asus\AppData\Local\Temp\2C3C2643-2670-16A1-8136-C762FF1E4F60.exe C:\Users\asus\AppData\Local\Temp\F85982EF-49D0-C3A0-4954-D4100AA92476.exe C:\Users\asus\AppData\Local\Temp\LiveiStream.exe C:\Users\asus\AppData\Local\Temp\nsvFD1B.exe C:\Users\asus\AppData\Local\Temp\PlayerStub.exe C:\Users\asus\AppData\Local\Temp\Quarantine.exe C:\Users\asus\AppData\Local\Temp\ShopperProJSINJFull.exe C:\Users\asus\AppData\Local\Temp\SkypeSetup.exe C:\Users\asus\AppData\Local\Temp\sqlite3.dll C:\Users\asus\AppData\Local\Temp\System.Data.SQLite.dll C:\Users\asus\AppData\Local\Temp\System.Data.SQLite6a1c394d-f915-40ad-a7d4-3d4e13cd6aaf.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-12-05 00:41 ==================== End Of Log ============================