Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by qvvas (administrator) on QVVAS-PC on 17-03-2015 12:01:27
Running from C:\Users\qvvas\Downloads
Loaded Profiles: qvvas (Available profiles: qvvas)
Platform: Windows 8.1 Pro with Media Center (X64) OS Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DTSRVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
( ) C:\Windows\System32\lxdecoms.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Portrait Displays, Inc.) C:\Program Files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
() C:\Program Files (x86)\X7 Oscar Keyboard Editor\OscarEditor.exe
(Valve Corporation) E:\Steam\Steam.exe
() C:\Program Files (x86)\OSCAR Editor X7\OscarEditor.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) E:\Steam\bin\steamwebhelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\wpCtrl.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Floater.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [lxdemon.exe] => C:\Program Files (x86)\Lexmark 4800 Series\lxdemon.exe [455336 2010-02-15] ()
HKLM\...\Run: [lxdeamon] => C:\Program Files (x86)\Lexmark 4800 Series\lxdeamon.exe [25256 2010-02-15] ()
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5595336 2014-10-01] (ESET)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5256336 2012-07-11] (VIA)
HKLM-x32\...\Run: [PivotSoftware] => C:\Program Files (x86)\Portrait Displays\Pivot Pro Plugin\Pivot_startup.exe [112424 2013-06-18] ()
HKLM-x32\...\Run: [DT BEN] => C:\Program Files (x86)\Common Files\Portrait Displays\Shared\DT_startup.exe [122384 2013-11-12] (Portrait Displays, Inc.)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3978600 2015-02-17] (LogMeIn Inc.)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [msnmsgr] => C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [4272624 2013-02-05] (Microsoft Corporation)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [OscarKeyboard] => C:\Program Files (x86)\X7 Oscar Keyboard Editor\OscarEditor.exe [3543040 2010-12-18] ()
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [Steam] => E:\Steam\steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [EADM] => E:\Origin\Origin.exe [3619160 2015-02-15] (Electronic Arts)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [Spotify] => C:\Users\qvvas\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-12-05] (Spotify Ltd)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [Spotify Web Helper] => C:\Users\qvvas\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-12-05] (Spotify Ltd)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [suchypowiadamiacz] => C:\Users\qvvas\AppData\Roaming\Suchy Powiadamiacz\0.5.5175.39317\SuchyPowiadamiacz.exe [1012736 2014-07-08] ()
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [OscarEditor] => C:\Program Files (x86)\OSCAR Editor X7\OscarEditor.exe [3345408 2012-08-17] ()
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31087200 2015-01-23] (Skype Technologies S.A.)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7394584 2014-12-12] (Piriform Ltd)
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Run: [CMD] => cmd.exe /c start http://zenigameblinger.org && exit <===== ATTENTION
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\MountPoints2: {a2f8fb49-68c8-11e4-bf61-60a44ccd3980} - "G:\Startme.exe" 
HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\MountPoints2: {fa4a9b23-0a6b-11e4-bf23-60a44ccd3980} - "G:\Startme.exe" 
IFEO\bitguard.exe: [Debugger] tasklist.exe
IFEO\bprotect.exe: [Debugger] tasklist.exe
IFEO\bpsvc.exe: [Debugger] tasklist.exe
IFEO\browserdefender.exe: [Debugger] tasklist.exe
IFEO\browserprotect.exe: [Debugger] tasklist.exe
IFEO\browsersafeguard.exe: [Debugger] tasklist.exe
IFEO\dprotectsvc.exe: [Debugger] tasklist.exe
IFEO\jumpflip: [Debugger] tasklist.exe
IFEO\protectedsearch.exe: [Debugger] tasklist.exe
IFEO\searchinstaller.exe: [Debugger] tasklist.exe
IFEO\searchprotection.exe: [Debugger] tasklist.exe
IFEO\searchprotector.exe: [Debugger] tasklist.exe
IFEO\searchsettings.exe: [Debugger] tasklist.exe
IFEO\searchsettings64.exe: [Debugger] tasklist.exe
IFEO\snapdo.exe: [Debugger] tasklist.exe
IFEO\stinst32.exe: [Debugger] tasklist.exe
IFEO\stinst64.exe: [Debugger] tasklist.exe
IFEO\umbrella.exe: [Debugger] tasklist.exe
IFEO\utiljumpflip.exe: [Debugger] tasklist.exe
IFEO\volaro: [Debugger] tasklist.exe
IFEO\vonteera: [Debugger] tasklist.exe
IFEO\websteroids.exe: [Debugger] tasklist.exe
IFEO\websteroidsservice.exe: [Debugger] tasklist.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKLM -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=221&itype=a&ver=12791&tm=386&src=ds&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
SearchScopes: HKLM-x32 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=221&itype=a&ver=12791&tm=386&src=ds&p={searchTerms}
SearchScopes: HKU\S-1-5-21-251673657-1254408106-2500988348-1000 -> {930C3C79-F264-46E5-AE27-EBF001D831C4} URL = http://www.idg.pl?q={searchTerms}
SearchScopes: HKU\S-1-5-21-251673657-1254408106-2500988348-1000 -> {9BB47C17-9C68-4BB3-B188-DD9AF0FD2492} URL = http://www.default-search.net/search?sid=492&aid=221&itype=a&ver=12791&tm=386&src=ds&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-11-06] (DVDVideoSoft Ltd.)
BHO-x32: Lexmark Pasek narzędzi -> {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -> C:\Program Files\Lexmark Toolbar\toolband.dll [2007-05-29] ()
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-26] (Oracle Corporation)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-11-07] (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Lexmark Pasek narzędzi - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll [2007-05-29] ()
Toolbar: HKU\S-1-5-21-251673657-1254408106-2500988348-1000 -> No Name - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-15] ()
FF Plugin: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-15] ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll [2011-11-03] (ESN Social Software AB)
FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll [2014-03-24] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-06-06] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-12-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-12-13] (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-04] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-251673657-1254408106-2500988348-1000: pokki.com/PokkiDownloadHelper -> C:\Users\qvvas\AppData\Local\Pokki\Download Helper\npPokkiDownloadHelper.1.2.0.78.dll [2014-03-01] (Pokki)
FF Plugin HKU\S-1-5-21-251673657-1254408106-2500988348-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-26] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppluginrichmediaplayer.dll [2013-03-12] ()
FF HKU\S-1-5-21-251673657-1254408106-2500988348-1000\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-12]

Chrome: 
=======
CHR HomePage: Default -> 
CHR StartupUrls: Default -> "hxxp://www.default-search.net?sid=492&aid=221&itype=n&ver=12565&tm=386&src=hmp", "hxxp://www.default-search.net?sid=492&aid=221&itype=a&ver=12791&tm=386&src=hmp"
CHR Profile: C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-23]
CHR Extension: (YouTube) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-23]
CHR Extension: (Google Search) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-23]
CHR Extension: (AdBlock) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-23]
CHR Extension: (ProxMate) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki [2014-07-16]
CHR Extension: (Google Wallet) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-23]
CHR Extension: (Gmail) - C:\Users\qvvas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-23]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 BITCOMET_HELPER_SERVICE; C:\Program Files\BitComet\tools\BitCometService.exe [1296728 2013-11-29] (www.BitComet.com)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-10-15] (BitRaider, LLC)
S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-05-14] (BitRaider, LLC)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 DTSRVC; C:\Program Files (x86)\Common Files\Portrait Displays\Shared\dtsrvc.exe [138768 2013-11-12] (Portrait Displays, Inc.)
S3 EasyAntiCheat; C:\WINDOWS\SysWOW64\EasyAntiCheat.exe [173848 2015-02-25] (EasyAntiCheat Ltd)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe [1349576 2014-10-01] (ESET)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2015-02-16] (LogMeIn, Inc.)
S2 lxdeCATSCustConnectService; C:\WINDOWS\system32\spool\DRIVERS\x64\3\\lxdeserv.exe [33712 2007-05-29] (Lexmark International, Inc.)
R2 lxde_device; C:\WINDOWS\system32\lxdecoms.exe [1053104 2007-05-29] ( )
R2 lxde_device; C:\WINDOWS\SysWOW64\lxdecoms.exe [598960 2007-05-29] ( )
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 Origin Client Service; E:\Origin\OriginClientService.exe [1910640 2015-03-06] (Electronic Arts)
R2 PnkBstrA; C:\WINDOWS\SysWOW64\PnkBstrA.exe [76888 2014-08-15] ()
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27792 2012-07-06] (VIA Technologies, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310728 2014-11-09] ()
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [243440 2014-10-10] (ESET)
R0 edevmon; C:\Windows\System32\DRIVERS\edevmon.sys [241368 2014-10-10] (ESET)
R1 ehdrv; C:\Windows\system32\DRIVERS\ehdrv.sys [169280 2014-10-10] (ESET)
R2 epfw; C:\Windows\system32\DRIVERS\epfw.sys [222280 2014-10-10] (ESET)
R1 EpfwLWF; C:\Windows\system32\DRIVERS\EpfwLWF.sys [44632 2014-10-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [63160 2014-10-10] (ESET)
S3 ggsomc; C:\Windows\System32\drivers\ggsomc.sys [30424 2014-07-14] (Sony Mobile Communications)
R3 hamachi; C:\Windows\system32\DRIVERS\Hamdrv.sys [44296 2015-02-17] (LogMeIn Inc.)
S3 hidusbf; C:\Windows\system32\DRIVERS\hidusbf.sys [7776 2014-05-01] (SweetLow)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2014-11-09] ()
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1975000 2013-07-31] (Realtek Semiconductor Corporation                           )
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 WUDFWpdComp; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
S3 xusb22; C:\Windows\System32\drivers\xusb22.sys [87040 2014-03-18] (Microsoft Corporation)
S3 BRDriver64; \??\C:\ProgramData\BitRaider\BRDriver64.sys [X]
S3 BRDriver64_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [X]
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
S1 MpKsldda1d3a5; \??\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{25DD5053-3A7E-47C1-A59A-BEC646E38ABC}\MpKsldda1d3a5.sys [X]
S4 sptd; \SystemRoot\System32\Drivers\sptd.sys [X]
U3 kglcipow; \??\C:\Users\qvvas\AppData\Local\Temp\kglcipow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 12:01 - 2015-03-17 12:01 - 00020936 _____ () C:\Users\qvvas\Downloads\FRST.txt
2015-03-17 11:59 - 2015-03-17 12:01 - 00000000 ____D () C:\FRST
2015-03-17 11:57 - 2015-03-17 11:57 - 00380416 _____ () C:\Users\qvvas\Downloads\3pmo4r5n.exe
2015-03-17 11:43 - 2015-03-17 11:43 - 02095616 _____ (Farbar) C:\Users\qvvas\Downloads\FRST64.exe
2015-03-17 11:28 - 2015-03-17 11:28 - 00619688 _____ (Duplex Secure Ltd) C:\Users\qvvas\Downloads\SPTDinst-v187-x64.exe
2015-03-17 11:24 - 2015-03-17 11:38 - 00000693 _____ () C:\WINDOWS\setupact.log
2015-03-17 11:24 - 2015-03-17 11:30 - 00004934 _____ () C:\WINDOWS\PFRO.log
2015-03-17 11:24 - 2015-03-17 11:24 - 00000000 _____ () C:\WINDOWS\setuperr.log
2015-03-17 11:22 - 2015-03-17 11:22 - 00000000 __SHD () C:\Users\qvvas\AppData\Local\EmieUserList
2015-03-17 11:22 - 2015-03-17 11:22 - 00000000 __SHD () C:\Users\qvvas\AppData\Local\EmieSiteList
2015-03-17 11:22 - 2015-03-17 11:22 - 00000000 __SHD () C:\Users\qvvas\AppData\Local\EmieBrowserModeList
2015-03-16 10:10 - 2015-03-16 10:10 - 02171392 _____ () C:\Users\qvvas\Downloads\adwcleaner_4.112_www.INSTALKI.pl.exe
2015-03-15 20:16 - 2015-03-17 11:39 - 00226664 _____ () C:\WINDOWS\WindowsUpdate.log
2015-03-15 18:29 - 2015-03-15 18:32 - 00000000 ____D () C:\Users\qvvas\Desktop\syfy
2015-03-14 19:06 - 2015-03-14 19:06 - 00005227 _____ () C:\Users\qvvas\AppData\Local\recently-used.xbel
2015-03-14 18:46 - 2015-03-14 19:06 - 00000000 ____D () C:\Users\qvvas\AppData\Local\gtk-2.0
2015-03-14 18:44 - 2015-03-14 18:44 - 00000000 ____D () C:\Users\qvvas\.thumbnails
2015-03-14 18:42 - 2015-03-14 19:06 - 00000000 ____D () C:\Users\qvvas\.gimp-2.8
2015-03-14 18:42 - 2015-03-14 18:42 - 00000910 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2015-03-14 18:42 - 2015-03-14 18:42 - 00000898 _____ () C:\Users\Public\Desktop\GIMP 2.lnk
2015-03-14 18:42 - 2015-03-14 18:42 - 00000000 ____D () C:\Users\qvvas\AppData\Local\gegl-0.2
2015-03-14 18:41 - 2015-03-14 18:41 - 00000000 ____D () C:\Program Files\GIMP 2
2015-03-12 19:10 - 2015-03-12 19:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2015-03-12 19:10 - 2015-03-12 19:10 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2015-03-10 19:59 - 2015-03-10 20:14 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\SmartSteamEmu
2015-03-10 19:59 - 2015-03-10 19:59 - 00000000 ____D () C:\Users\qvvas\Documents\Colossal Order
2015-03-10 19:59 - 2015-03-10 19:59 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\Colossal Order
2015-03-10 19:59 - 2015-03-10 19:59 - 00000000 ____D () C:\Users\qvvas\AppData\Local\Colossal Order
2015-03-10 19:59 - 2015-03-10 19:59 - 00000000 ____D () C:\ProgramData\.mono
2015-03-10 19:37 - 2015-03-10 19:43 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\qBittorrent
2015-03-10 19:37 - 2015-03-10 19:37 - 00000000 ____D () C:\Users\qvvas\AppData\Local\qBittorrent
2015-03-06 16:53 - 2015-03-06 16:53 - 00001055 _____ () C:\Users\Public\Desktop\qBittorrent.lnk
2015-03-06 16:52 - 2015-03-06 16:53 - 00000000 ____D () C:\Program Files (x86)\qBittorrent
2015-03-06 16:52 - 2015-03-06 16:52 - 10724302 _____ (The qBittorrent project) C:\Users\qvvas\Downloads\qbittorrent_3.1.12_setup.exe
2015-03-04 14:48 - 2015-03-04 14:48 - 00000071 _____ () C:\Users\qvvas\Downloads\settings.sav
2015-03-04 14:47 - 2015-03-04 14:47 - 00014037 _____ () C:\Users\qvvas\Downloads\laa_2_0_4.zip
2015-03-04 14:47 - 2010-03-21 23:18 - 00041984 _____ (Lee 'FordGT90Concept' Glasser) C:\Users\qvvas\Downloads\Large Address Aware.exe
2015-03-04 14:40 - 2015-03-04 14:40 - 04646635 _____ () C:\Users\qvvas\Downloads\hoi3_tfh.zip
2015-03-04 14:28 - 2015-03-04 14:28 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hearts of iron 3 Their Finest Hour 4.01
2015-03-04 14:17 - 2015-03-04 14:19 - 669302086 _____ (Panzeroo, Inc. ) C:\Users\qvvas\Downloads\BI7_40.exe
2015-02-28 17:21 - 2015-02-28 17:21 - 08154691 _____ () C:\Users\qvvas\Downloads\ets2mp_client.zip
2015-02-26 19:06 - 2015-02-26 19:07 - 00100367 _____ () C:\Users\qvvas\Downloads\config.zip
2015-02-25 19:12 - 2015-02-25 19:07 - 00173848 _____ (EasyAntiCheat Ltd) C:\WINDOWS\SysWOW64\EasyAntiCheat.exe
2015-02-19 19:25 - 2015-02-19 19:25 - 00000000 ____D () C:\Users\qvvas\AppData\Local\Steam
2015-02-18 19:50 - 2015-02-18 19:50 - 00000823 _____ () C:\Users\qvvas\Desktop\Steam.lnk
2015-02-17 18:21 - 2015-02-17 18:21 - 00044296 ____H (LogMeIn Inc.) C:\WINDOWS\system32\Drivers\Hamdrv.sys

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-17 12:00 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-03-17 11:57 - 2014-07-23 18:56 - 00000000 ____D () C:\Users\qvvas\AppData\Local\CrashDumps
2015-03-17 11:44 - 2013-05-25 14:20 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-251673657-1254408106-2500988348-1000
2015-03-17 11:39 - 2014-12-23 08:04 - 00000000 __RDO () C:\Users\qvvas\SkyDrive
2015-03-17 11:39 - 2014-02-23 00:51 - 00001066 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-17 11:38 - 2013-11-05 20:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-03-17 11:38 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-03-17 11:37 - 2013-08-22 14:25 - 01048576 ___SH () C:\WINDOWS\system32\config\BBI
2015-03-17 11:25 - 2014-05-06 21:17 - 00000000 ____D () C:\Users\qvvas\AppData\Local\LogMeIn Hamachi
2015-03-17 11:21 - 2014-02-23 00:51 - 00001070 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-17 11:14 - 2013-05-20 20:55 - 00000930 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2015-03-16 22:58 - 2013-07-04 18:36 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\TS3Client
2015-03-16 10:12 - 2014-02-22 23:23 - 00000000 ____D () C:\AdwCleaner
2015-03-16 10:09 - 2014-07-09 09:36 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-03-15 18:54 - 2013-05-29 19:08 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\DAEMON Tools Lite
2015-03-15 18:40 - 2014-07-21 15:59 - 00000000 ____D () C:\Program Files\SAMSUNG
2015-03-15 18:40 - 2013-09-06 12:23 - 00000000 ____D () C:\ProgramData\Samsung
2015-03-15 18:40 - 2013-09-06 12:23 - 00000000 ____D () C:\Program Files (x86)\Samsung
2015-03-15 18:40 - 2013-05-21 13:18 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2015-03-15 18:38 - 2013-09-06 12:26 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\Samsung
2015-03-15 18:37 - 2014-12-31 09:16 - 00000000 ____D () C:\Program Files (x86)\Mount&Blade
2015-03-15 18:36 - 2013-09-02 14:38 - 00000000 ____D () C:\Program Files (x86)\OBS
2015-03-15 18:15 - 2013-09-28 20:38 - 00007598 _____ () C:\Users\qvvas\AppData\Local\Resmon.ResmonCfg
2015-03-15 11:44 - 2014-10-05 16:30 - 00000000 ____D () C:\Users\qvvas\AppData\Local\Adobe
2015-03-15 11:44 - 2013-05-20 20:55 - 00003818 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater
2015-03-15 00:46 - 2013-05-20 20:52 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\Skype
2015-03-14 18:44 - 2013-11-05 20:59 - 00000000 ____D () C:\Users\qvvas
2015-03-14 17:30 - 2014-10-07 13:17 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-14 17:30 - 2013-05-20 20:52 - 00000000 ____D () C:\ProgramData\Skype
2015-03-14 16:51 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-03-12 19:08 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Performance
2015-03-10 13:08 - 2014-07-11 10:46 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-10 13:08 - 2014-06-06 11:45 - 00000000 ____D () C:\Users\qvvas\AppData\Local\Arma 3
2015-03-06 16:52 - 2014-07-21 21:28 - 00000000 ____D () C:\Users\qvvas\AppData\Roaming\uTorrent
2015-03-06 14:03 - 2013-08-15 18:15 - 00000000 ____D () C:\ProgramData\Origin
2015-03-06 10:38 - 2015-01-16 19:37 - 00000000 ____D () C:\Users\qvvas\Documents\Euro Truck Simulator 2
2015-03-04 14:29 - 2014-01-30 17:40 - 00000000 ____D () C:\Users\qvvas\Documents\Paradox Interactive
2015-03-02 20:42 - 2015-01-16 19:38 - 00000000 ____D () C:\Users\qvvas\Documents\ETS2MP
2015-03-01 21:59 - 2013-12-09 08:54 - 00000000 ____D () C:\WINDOWS\SysWOW64\directx
2015-02-28 17:21 - 2015-01-16 19:36 - 00001201 _____ () C:\Users\Public\Desktop\Play Euro Truck Simulator 2 Multiplayer.lnk
2015-02-28 17:21 - 2015-01-16 19:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 Multiplayer
2015-02-28 17:21 - 2015-01-16 19:36 - 00000000 ____D () C:\Program Files (x86)\Euro Truck Simulator 2 Multiplayer
2015-02-27 20:42 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2015-02-27 12:34 - 2013-09-30 05:15 - 01852216 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-02-27 12:34 - 2013-09-30 04:56 - 00815144 _____ () C:\WINDOWS\system32\perfh015.dat
2015-02-27 12:34 - 2013-09-30 04:56 - 00168428 _____ () C:\WINDOWS\system32\perfc015.dat
2015-02-22 18:39 - 2013-08-29 16:36 - 00000000 ____D () C:\Users\qvvas\AppData\Local\Game Dev Tycoon - Steam

==================== Files in the root of some directories =======

2014-07-11 11:18 - 2014-08-07 20:50 - 0000297 _____ () C:\Users\qvvas\AppData\Roaming\BreakingPoint_Login.ini
2014-08-05 15:41 - 2014-08-07 22:24 - 0001408 _____ () C:\Users\qvvas\AppData\Roaming\BreakingPoint_Options.ini
2013-10-13 14:53 - 2013-10-13 14:53 - 0000244 _____ () C:\Users\qvvas\AppData\Roaming\ex_log.txt
2015-01-26 18:31 - 2015-01-26 18:31 - 0000001 _____ () C:\Users\qvvas\AppData\Roaming\jv.txt
2015-03-14 19:06 - 2015-03-14 19:06 - 0005227 _____ () C:\Users\qvvas\AppData\Local\recently-used.xbel
2013-09-28 20:38 - 2015-03-15 18:15 - 0007598 _____ () C:\Users\qvvas\AppData\Local\Resmon.ResmonCfg
2014-05-03 13:21 - 2014-05-03 13:21 - 0000041 ___SH () C:\ProgramData\.zreglib

Some content of TEMP:
====================
C:\Users\qvvas\AppData\Local\Temp\Quarantine.exe
C:\Users\qvvas\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-16 16:54

==================== End Of Log ============================