Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:12-07-2015
Ran by User (administrator) on USER-PC on 14-07-2015 10:26:46
Running from C:\Users\User\Desktop
Loaded Profiles: User (Available Profiles: User)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polski (Polska)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgcsrva.exe
() C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgui.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgemca.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2015\avgmfapx.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2015\avgui.exe [3730344 2015-06-30] (AVG Technologies CZ, s.r.o.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-4152501255-3088967859-2860816570-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://mysearch.avg.com/?cid={1A536B21-8846-4F64-8663-4985413DC799}&mid=bbe8d91ebbf747cd84dab9ea82a7ab5d-441b921d197766e914ab16bfdf0778cf67af8b02&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0215av&pr=fr&d=2015-02-27 08:46:20&v=4.1.0.411&pid=wtu&sg=&sap=hp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2013-02-26] (Skype Technologies)
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2010-11-21] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2010-11-21] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{3F8D1F86-F894-4F38-B51E-B1C1B6B8E80E}: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{E4A0C783-3870-4654-91A9-10546632C5DC}: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\sgxc14h4.default
FF Homepage: https://mysearch.avg.com/?cid={1A536B21-8846-4F64-8663-4985413DC799}&mid=bbe8d91ebbf747cd84dab9ea82a7ab5d-441b921d197766e914ab16bfdf0778cf67af8b02&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0215av&pr=fr&d=2015-02-27 08:46:20&v=4.1.0.411&pid=wtu&sg=&sap=hp
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll [2014-10-21] ()
FF Plugin: @unity3d.com/UnityPlayer64,version=1.0 -> C:\Program Files\Unity\WebPlayer64\loader-x64\npUnity3D64.dll [2015-01-26] (Unity Technologies ApS)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll [2014-10-21] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-09-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2013-09-05] (Adobe Systems Inc.)

Chrome: 
=======
CHR StartupUrls: Default -> "hxxp://www.google.pl/"
CHR Profile: C:\Users\User\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-02]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-02]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-02]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-02]
CHR Extension: (IP Geolocator) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\fmbfdhofmobljpilbacpbdpjhonpklng [2015-02-16]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-02]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-02]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2014-07-02] (Advanced Micro Devices, Inc.) [File not signed]
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2015\avgidsagent.exe [3518376 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2015\avgwdsvc.exe [314304 2015-06-30] (AVG Technologies CZ, s.r.o.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-07-06] (Electronic Arts)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
R2 WtuSystemSupport; C:\Program Files (x86)\AVG Web TuneUp\WtuSystemSupport.exe [1195920 2015-07-13] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R3 AR5416; C:\Windows\System32\DRIVERS\athwx.sys [2716768 2010-11-05] (Atheros Communications, Inc.)
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [162784 2015-03-11] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [293296 2015-06-26] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [253408 2015-05-12] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [259040 2015-06-16] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [378336 2015-05-07] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [226784 2015-06-10] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [40928 2015-03-20] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [281568 2015-05-12] (AVG Technologies CZ, s.r.o.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-14] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-06-18] (Malwarebytes Corporation)
S2 tandpl; C:\Windows\SysWOW64\drivers\tandpl.sys [4736 2003-04-19] () [File not signed]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-14 10:26 - 2015-07-14 10:37 - 00009417 _____ C:\Users\User\Desktop\FRST.txt
2015-07-14 10:26 - 2015-07-14 10:26 - 00000000 ____D C:\FRST
2015-07-14 10:26 - 2015-07-14 10:16 - 02133504 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2015-07-14 00:18 - 2015-07-14 10:20 - 00000168 _____ C:\Windows\setupact.log
2015-07-14 00:18 - 2015-07-14 00:26 - 00001990 _____ C:\Windows\PFRO.log
2015-07-14 00:18 - 2015-07-14 00:18 - 00000000 _____ C:\Windows\setuperr.log
2015-07-14 00:11 - 2015-07-14 00:15 - 00000000 ____D C:\AdwCleaner
2015-07-13 23:31 - 2015-07-14 10:41 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-07-13 23:31 - 2015-07-13 23:31 - 00001106 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-07-13 23:31 - 2015-07-13 23:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-07-13 23:31 - 2015-07-13 23:31 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-07-13 23:31 - 2015-07-13 23:31 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-07-13 23:31 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-07-13 23:31 - 2015-06-18 08:41 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-07-13 23:31 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-07-13 23:28 - 2015-07-14 00:21 - 00002788 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-07-13 23:28 - 2015-07-13 23:28 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-07-13 23:28 - 2015-07-13 23:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2015-07-13 23:28 - 2015-07-13 23:28 - 00000000 ____D C:\Program Files\CCleaner
2015-07-13 23:06 - 2015-07-13 23:09 - 11313360 _____ (Microsoft Corporation) C:\Users\User\Downloads\WindowsUpdateAgent-7.6-x64.exe
2015-07-13 23:00 - 2015-07-13 23:29 - 00731746 _____ C:\Windows\system32\perfh015.dat
2015-07-13 23:00 - 2015-07-13 23:29 - 00155324 _____ C:\Windows\system32\perfc015.dat
2015-07-13 23:00 - 2015-07-13 22:56 - 00337158 _____ C:\Windows\system32\perfi015.dat
2015-07-13 23:00 - 2015-07-13 22:56 - 00038710 _____ C:\Windows\system32\perfd015.dat
2015-07-13 22:58 - 2015-07-13 22:58 - 00000000 ____D C:\Windows\SysWOW64\0409
2015-07-13 22:57 - 2015-07-13 22:57 - 00000000 ____D C:\Windows\SysWOW64\pl
2015-07-13 22:57 - 2015-07-13 22:57 - 00000000 ____D C:\Windows\system32\0409
2015-07-13 22:56 - 2015-07-13 22:56 - 00000000 ____D C:\Windows\system32\pl
2015-07-13 22:22 - 2015-07-13 22:20 - 56569702 _____ C:\lp.cab
2015-07-13 21:22 - 2015-07-13 21:22 - 00000000 ____D C:\da72fffdd00e7579f876b4
2015-07-13 21:18 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2015-07-13 21:18 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2015-07-13 21:18 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2015-07-13 21:18 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2015-07-13 21:18 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2015-07-13 21:18 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2015-07-13 21:18 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2015-07-13 21:18 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2015-07-13 16:26 - 2015-07-13 16:26 - 00000000 ____D C:\Program Files (x86)\Origin Games
2015-07-13 11:14 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-13 11:14 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-13 11:14 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-13 11:14 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-13 11:14 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-13 11:14 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-13 11:14 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-13 11:14 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-13 11:14 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-13 11:14 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-13 11:13 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-13 11:13 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-13 11:13 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-13 11:13 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-13 11:12 - 2015-07-13 11:12 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-13 11:04 - 2015-07-13 11:04 - 00000000 ____D C:\Users\User\AppData\Local\Avg
2015-07-12 20:26 - 2015-07-12 20:55 - 00000000 ____D C:\Users\User\AppData\Local\Microsoft Games
2015-07-06 16:25 - 2015-07-13 16:27 - 00000000 ____D C:\Users\User\AppData\Roaming\Origin
2015-07-06 16:25 - 2015-07-13 16:26 - 00000000 ____D C:\Users\User\AppData\Local\Origin
2015-06-26 09:49 - 2015-06-26 09:49 - 00293296 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys
2015-06-16 15:55 - 2015-06-16 15:55 - 00259040 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-07-14 10:26 - 2014-12-17 14:58 - 00000000 ____D C:\ProgramData\MFAData
2015-07-14 10:20 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-07-14 00:25 - 2009-07-14 06:45 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-07-14 00:25 - 2009-07-14 06:45 - 00021264 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-07-14 00:24 - 2014-10-21 12:25 - 01270209 _____ C:\Windows\WindowsUpdate.log
2015-07-14 00:24 - 2014-10-20 16:04 - 00000000 ____D C:\ProgramData\Origin
2015-07-14 00:17 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\security
2015-07-14 00:15 - 2015-02-27 09:47 - 02835516 _____ C:\Windows\SysWOW64\debug.log
2015-07-13 23:29 - 2014-10-21 13:21 - 00000000 ____D C:\Windows\Panther
2015-07-13 23:29 - 2010-11-21 08:19 - 00745290 _____ C:\Windows\system32\perfh00C.dat
2015-07-13 23:29 - 2010-11-21 08:19 - 00149182 _____ C:\Windows\system32\perfc00C.dat
2015-07-13 23:29 - 2009-07-14 07:13 - 02554220 _____ C:\Windows\system32\PerfStringBackup.INI
2015-07-13 22:58 - 2010-11-21 08:29 - 00000000 ____D C:\Program Files\Windows Journal
2015-07-13 22:58 - 2010-11-21 08:19 - 00000000 ____D C:\Windows\SysWOW64\winrm
2015-07-13 22:58 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2015-07-13 22:58 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\SysWOW64\WCN
2015-07-13 22:58 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2015-07-13 22:58 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2015-07-13 22:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\servicing
2015-07-13 22:58 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\System
2015-07-13 22:57 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2015-07-13 22:57 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\system32\winrm
2015-07-13 22:57 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\system32\WCN
2015-07-13 22:57 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\system32\slmgr
2015-07-13 22:57 - 2010-11-21 08:18 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\com
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\sysprep
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Setup
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\MUI
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\migwiz
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\Dism
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-13 22:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\IME
2015-07-13 22:56 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\com
2015-07-13 21:26 - 2014-10-21 14:43 - 01642544 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-07-13 20:00 - 2015-02-27 09:46 - 00000000 ____D C:\Users\User\AppData\Local\AVG Web TuneUp
2015-07-13 20:00 - 2015-02-27 09:45 - 00000000 ____D C:\ProgramData\AVG Web TuneUp
2015-07-13 20:00 - 2015-02-27 09:45 - 00000000 ____D C:\Program Files (x86)\AVG Web TuneUp
2015-07-13 19:56 - 2009-07-14 07:08 - 00032482 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-07-13 11:12 - 2014-12-19 20:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2015-07-13 11:12 - 2014-12-17 15:07 - 00000995 _____ C:\Users\Public\Desktop\AVG 2015.lnk
2015-07-12 18:30 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-07-12 18:17 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2015-07-06 16:36 - 2014-10-21 13:33 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2015-07-06 16:25 - 2014-10-20 16:04 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Origin
2015-07-06 16:25 - 2014-10-20 16:03 - 00000000 ____D C:\Program Files (x86)\Origin

Some files in TEMP:
====================
C:\Users\User\AppData\Local\Temp\Quarantine.exe
C:\Users\User\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-12 19:00

==================== End of log ============================