Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:02-08-2015 01
Ran by Alex (administrator) on ALEX-KOMPUTER (04-08-2015 11:18:41)
Running from C:\Users\Alex\Desktop
Loaded Profiles: Alex (Available Profiles: Alex)
Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) Language: Polski (Polska)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCRTP.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\RsMgrSvc.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RAV\ravmond.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(DTools LIMITED) C:\ProgramData\iWinManProi\ProtectWindowsManager.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
Failed to access process -> knsr96FA.tmp
(ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe
Failed to access process -> hnsgA1ED.tmp
(XTab system) C:\Program Files\MiuiTab\ProtectService.exe
(SearchProtect) C:\Program Files\MiuiTab\CmdShell.exe
(XTab system) C:\Program Files\MiuiTab\HPNotify.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCTray.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.28.1\GoogleCrashHandler.exe
(ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe
() C:\Program Files\Winamp\winampa.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RSD\popwndexe.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Beijing Rising Information Technology Co., Ltd.) C:\Program Files\Rising\RAV\rstray.exe
() C:\Program Files\baidu\baidu.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Raptr, Inc) C:\Program Files\Raptr\raptr.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\plugins\QMNetMon\QQPCNetFlow.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCRealTimeSpeedup.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\TAOFrame.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCTray.exe
(Raptr, Inc) C:\Program Files\Raptr\raptr_im.exe
(Tencent) C:\Program Files\Common Files\Tencent\QQDownload\130\Tencentdl.exe
(Tencent) C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QMDL.exe
(iQIYI.COM) C:\IQIYI Video\Common\QyKernel.exe
(爱奇艺) C:\IQIYI Video\Common\QyFragment.exe
() C:\IQIYI Video\Common\Mobile\AndroidService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11680400 2012-10-26] (Realtek Semiconductor)
HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5088456 2014-10-01] (ESET)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [37888 2009-07-01] ()
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [56080 2015-07-27] (Raptr, Inc)
HKLM\...\Run: [StartCCC] => C:\Program Files\AMD\ATI.ACE\Core-Static\x86\CLIStart.exe [748744 2015-06-22] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [ QQPCTray] => C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCTRAY.EXE [355296 2015-08-04] (Tencent)
HKLM\...\Run: [RSDTRAY] => C:\Program Files\Rising\RSD\popwndexe.exe [126808 2012-09-25] (Beijing Rising Information Technology Co., Ltd.)
HKLM\...\Run: [RavTRAY] => C:\Program Files\Rising\RAV\RSTRAY.EXE [111000 2014-05-15] (Beijing Rising Information Technology Co., Ltd.)
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\...\Run: [GoogleChromeAutoLaunch_3281FCF30DCFA21CFEF4D2ECFEF8608D] => "C:\Program Files\Crossbrowse\Crossbrowse\Application\crossbrowse.exe" --no-startup-window
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\...\Run: [GoogleChromeAutoLaunch_AD2529C7DB5B63D28C23362385276129] => C:\Program Files\Google\Chrome\Application\chrome.exe [813896 2015-07-25] (Google Inc.)
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\...\Run: [apphide] => C:\Program Files\baidu\baidu.exe [69632 2015-07-22] ()
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\...\Run: [HCDNClient] => C:\IQIYI Video\Common\QyKernel.exe [576104 2015-05-12] (iQIYI.COM)
ShellIconOverlayIdentifiers: [.QMDeskTopGCIcon] -> {B7667919-3765-4815-A66D-98A09BE662D6} => C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QMGCShellExt.dll [2015-08-04] (Tencent)
BootExecute: autocheck autochk *  bsmain
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=98388105_hao_pg
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.mystartsearch.com/web/?type=ds&ts=1436197717&z=f291ebabb30ea4eb981bdcdgczcccq8gft7mdmebdw&from=cmi&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hao123.com/?tn=98388105_hao_pg
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D
HKU\S-1-5-21-3050552178-2778190213-2786081387-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.mystartsearch.com/web/?type=ds&ts=1436197717&z=f291ebabb30ea4eb981bdcdgczcccq8gft7mdmebdw&from=cmi&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3050552178-2778190213-2786081387-1000 -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
SearchScopes: HKU\S-1-5-21-3050552178-2778190213-2786081387-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1438673568&z=f0fb2a4da6cb3468f42e789g3zfc2b2q8m3caq9o3e&from=face&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D&q={searchTerms}
BHO: Rising Web Helper -> {14A5E567-034B-471A-89D8-598A6A93B24B} -> C:\Program Files\Rising\RAV\rsscrbho.dll [2012-11-13] (Beijing Rising Information Technology Co., Ltd.)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-12-29] (Oracle Corporation)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-12-29] (Oracle Corporation)
BHO: °®ĆćŇŐÖúĘÖ -> {FB4F6285-4C32-49F2-950F-A5998F9CEC6C} -> C:\IQIYI Video\Common\Accelerator\IEHelper.dll [2015-04-29] (爱奇艺)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2015-05-01] (Microsoft Corporation)
Hosts: 127.0.0.1 validation.sls.microsoft.com
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{9F9BC60C-01ED-4CBF-9866-8FC676D45F96}: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{A6E83768-7E24-4211-AD4C-510A96569F01}: [DhcpNameServer] 8.8.8.8 8.8.4.4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.mystartsearch.com/?type=sc&ts=1436197717&z=f291ebabb30ea4eb981bdcdgczcccq8gft7mdmebdw&from=cmi&uid=ST3500320AS_9QM22M3DXXXX9QM22M3D

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1215155.dll [2014-12-02] (Adobe Systems, Inc.)
FF Plugin: @iqiyi.com/npclient -> C:\IQIYI Video\LStyle\npclient.dll [2015-05-12] ()
FF Plugin: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-12-29] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-12-29] (Oracle Corporation)
FF Plugin: @qq.com/QQPCMgr -> C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\npQMExtensionsMozilla.dll [2015-08-04] (Tencent Technology (Shenzhen) Company Limited)
FF Plugin: @rising.com.cn/nprising -> C:\Program Files\Rising\RAV\nprising.dll [2013-06-27] (Beijing Rising Information Technology Co., Ltd.)
FF Plugin: @staging.google.com/globalUpdate Update;version=10 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll No File
FF Plugin: @staging.google.com/globalUpdate Update;version=4 -> C:\Program Files\globalUpdate\Update\1.3.25.0\npglobalupdateUpdate4.dll No File
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin HKU\S-1-5-21-3050552178-2778190213-2786081387-1000: @iqiyi.com/npWebPlayer -> C:\IQIYI Video\LStyle\npWebPlayer.dll [2015-04-29] (爱奇艺公司)
FF Plugin HKU\S-1-5-21-3050552178-2778190213-2786081387-1000: @rising.com.cn/nprising -> C:\Program Files\Rising\RAV\nprising.dll [2013-06-27] (Beijing Rising Information Technology Co., Ltd.)
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2015-05-01]

Chrome: 
=======
CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-12-20]
CHR Extension: (Steam inventory helper) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmeakgjggjdlcpncigglobpjbkabhmjl [2015-05-29]
CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-12-20]
CHR Extension: (Lounge Assistant) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjonnlehciedbcidabdglnnihcncbml [2015-05-29]
CHR Extension: (LoungeDestroyer) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-05-29]
CHR Extension: (AdBlock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-05-29]
CHR Extension: (Chrome Web Store Payments) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-05-29]
CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-12-20]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2015-05-01]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1394816 2015-05-01] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1772672 2015-05-01] (Microsoft Corporation)
R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1349576 2014-10-01] (ESET)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]
R2 IHProtect Service; C:\Program Files\MiuiTab\ProtectService.exe [125112 2015-07-30] (XTab system)
R2 QQPCRTP; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCRTP.exe [297608 2015-08-04] (Tencent)
R2 RsMgrSvc; C:\Program Files\Rising\RSD\RsMgrSvc.exe [179992 2014-09-02] (Beijing Rising Information Technology Co., Ltd.)
R2 RsRavMon; C:\Program Files\Rising\RAV\ravmond.exe [277552 2014-05-15] (Beijing Rising Information Technology Co., Ltd.)
R3 TAOFrame; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\TAOFrame.exe [293728 2015-08-04] (Tencent)
S2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
R2 WindowsMangerProtect; C:\ProgramData\iWinManProi\ProtectWindowsManager.exe [708264 2015-08-01] (DTools LIMITED) <==== ATTENTION
R2 copofute; C:\Program Files\00000000-1433171668-0000-0000-1C6F6547AC60\knsr96FA.tmp [X]
R2 fivyzipo; C:\Users\Alex\AppData\Roaming\00000000-1433171668-0000-0000-1C6F6547AC60\hnsgA1ED.tmp [X]
S2 globalUpdate; C:\Program Files\globalUpdate\Update\globalupdate.exe /svc [X] <==== ATTENTION
S3 globalUpdatem; C:\Program Files\globalUpdate\Update\globalupdate.exe /medsvc [X] <==== ATTENTION
S2 tyvozyno; C:\Users\Alex\AppData\Roaming\00000000-1433171668-0000-0000-1C6F6547AC60\jnsb8CC6.tmp [X]

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [191928 2014-10-10] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [135296 2014-10-10] (ESET)
R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [176448 2014-10-10] (ESET)
R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [37928 2014-10-10] (ESET)
R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [51288 2014-10-10] (ESET)
R3 EuMusDesignVirtualAudioCableWdm; C:\Windows\System32\DRIVERS\vrtaucbl.sys [50728 2014-12-25] (Eugene V. Muzychenko)
R2 giveio; C:\Windows\system32\giveio.sys [5248 1996-04-03] () [File not signed]
S3 GPCIDrv; C:\Program Files\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv.sys [14504 2010-02-04] ()
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
R1 kguard; C:\Windows\System32\DRIVERS\kguard.sys [68376 2014-05-14] (Beijing Rising Information Technology Co., Ltd.)
R1 QMIEProtect; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QMIEProtect.sys [49080 2015-08-04] ()
R1 QMUdisk; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QMUdisk.sys [60600 2015-08-04] (Tencent)
S1 QQPCHelper; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQPCHelper.sys [22360 2015-08-04] (Tencent)
R2 QQSysMon; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\QQSysMon.sys [108344 2015-08-04] (电脑管家)
R2 rsdsys; C:\Windows\system32\drivers\protreg.sys [24120 2014-05-28] (Beijing Rising Information Technology Co., Ltd.)
R1 rsutils; C:\Windows\System32\DRIVERS\rsutils.sys [58664 2014-08-15] (Beijing Rising Information Technology Co., Ltd.)
R2 RtNdPt60; C:\Windows\System32\DRIVERS\RtNdPt60.sys [27648 2011-06-15] (Realtek                                            )
S3 RTTEAMPT; C:\Windows\System32\DRIVERS\RtTeam60.sys [50280 2011-06-15] (Realtek Corporation)
S3 RTVLANPT; C:\Windows\System32\DRIVERS\RtVlan620.sys [27752 2011-09-16] (Realtek Corporation)
R2 speedfan; C:\Windows\system32\speedfan.sys [24184 2012-12-29] (Almico Software)
R0 sysmon; C:\Windows\System32\DRIVERS\sysmon.sys [156144 2014-09-10] (Beijing Rising Information Technology Co., Ltd.)
R2 TAOAccelerator; C:\Windows\system32\Drivers\TAOAccelerator.sys [77016 2015-08-04] (Tencent)
R1 TAOKernelDriver; C:\Windows\System32\Drivers\TAOKernel.sys [138552 2015-08-04] (Tencent Technology(Shenzhen) Company Limited)
R3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [35288 2013-08-22] (The OpenVPN Project)
S3 TEAM; C:\Windows\System32\DRIVERS\RtTeam60.sys [50280 2011-06-15] (Realtek Corporation)
R3 TFsFlt; C:\Windows\System32\Drivers\TFsFlt.sys [149944 2015-08-04] (电脑管家)
R3 TS888; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\TS888.sys [30392 2015-08-04] (Tencent)
R1 TSCPM; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\tscpm.sys [43448 2015-08-04] (电脑管家)
R1 TSDefenseBt; C:\Windows\System32\DRIVERS\TSDefenseBt.sys [14008 2015-08-04] (Tencent)
R0 TsFltMgr; C:\Windows\System32\drivers\TsFltMgr.sys [128120 2015-08-04] (电脑管家)
R1 TSKSP; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\TSKsp.sys [204312 2015-08-04] (电脑管家)
R1 TSSysKit; C:\Program Files\Tencent\QQPCMgr\10.7.16066.216\TSSysKit.sys [101560 2015-08-04] (电脑管家)
S1 innfd_1_10_0_14; system32\drivers\innfd_1_10_0_14.sys [X]
S1 wsafd_1_10_0_19; system32\drivers\wsafd_1_10_0_19.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-04 11:17 - 2015-08-04 11:17 - 00052455 _____ C:\Users\Alex\Desktop\Addition.txt
2015-08-04 11:15 - 2015-08-04 11:18 - 00020121 _____ C:\Users\Alex\Desktop\FRST.txt
2015-08-04 11:14 - 2015-08-04 11:18 - 00000000 ____D C:\FRST
2015-08-04 11:12 - 2015-08-04 11:13 - 01673728 _____ (Farbar) C:\Users\Alex\Desktop\FRST.exe
2015-08-04 11:07 - 2015-08-04 11:07 - 00000000 ____D C:\ProgramData\LocalStorage
2015-08-04 11:04 - 2015-08-04 11:04 - 00000000 ____D C:\Users\Alex\.android
2015-08-04 11:03 - 2015-08-04 11:03 - 00001266 _____ C:\Users\Alex\Desktop\全网影视.lnk
2015-08-04 11:03 - 2015-08-04 11:03 - 00000000 ____D C:\Users\Alex\AppData\Roaming\ppslog
2015-08-04 10:41 - 2015-08-04 10:41 - 00000000 ____D C:\ProgramData\KingSoft
2015-08-04 10:38 - 2015-08-04 10:38 - 00030392 _____ (Tencent) C:\Windows\system32\Drivers\TS888.sys
2015-08-04 10:37 - 2015-08-04 10:37 - 00000000 ____D C:\ProgramData\TXQMPC
2015-08-04 10:09 - 2015-08-04 10:09 - 00000132 __RSH C:\rising.ini
2015-08-04 10:09 - 2015-08-04 10:09 - 00000122 _____ C:\Windows\system32\BsMain.ini
2015-08-04 10:09 - 2015-08-04 10:09 - 00000000 ___RD C:\RavBin
2015-08-04 10:09 - 2014-09-10 08:11 - 00156144 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\sysmon.sys
2015-08-04 10:09 - 2014-08-15 03:22 - 00058664 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsutils.sys
2015-08-04 10:09 - 2014-07-30 04:44 - 00091928 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\vpatch.dll
2015-08-04 10:09 - 2014-05-14 04:02 - 00068376 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\kguard.sys
2015-08-04 10:09 - 2013-12-30 09:33 - 00256280 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\ravext.dll
2015-08-04 10:09 - 2012-09-06 02:30 - 00240472 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\bsmain.exe
2015-08-04 10:09 - 2012-02-29 09:49 - 00010808 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\rsndisp.sys
2015-08-04 10:08 - 2015-08-04 10:09 - 00000000 ____D C:\ProgramData\Rising
2015-08-04 10:08 - 2015-08-04 10:08 - 00000000 ____D C:\Program Files\Rising
2015-08-04 10:08 - 2014-05-28 09:37 - 00024120 ____N (Beijing Rising Information Technology Co., Ltd.) C:\Windows\system32\Drivers\protreg.sys
2015-08-04 10:07 - 2015-08-04 10:06 - 00138552 _____ (Tencent Technology(Shenzhen) Company Limited) C:\Windows\system32\Drivers\TAOKernel.sys
2015-08-04 10:07 - 2015-08-04 10:06 - 00077016 _____ (Tencent) C:\Windows\system32\Drivers\TAOAccelerator.sys
2015-08-04 10:07 - 2015-08-04 10:06 - 00014008 _____ (Tencent) C:\Windows\system32\Drivers\TSDefenseBt.sys
2015-08-04 10:06 - 2015-08-04 10:51 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Tencent
2015-08-04 10:06 - 2015-08-04 10:51 - 00000000 ____D C:\ProgramData\Tencent
2015-08-04 10:06 - 2015-08-04 10:07 - 00000000 ____D C:\Program Files\Common Files\Tencent
2015-08-04 10:06 - 2015-08-04 10:06 - 00149944 _____ (电脑管家) C:\Windows\system32\Drivers\TFsFlt.sys
2015-08-04 10:06 - 2015-08-04 10:06 - 00128120 _____ (电脑管家) C:\Windows\system32\Drivers\TsFltMgr.sys
2015-08-04 10:06 - 2015-08-04 10:06 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件
2015-08-04 10:06 - 2015-08-04 10:06 - 00000000 ____D C:\Program Files\Tencent
2015-08-04 09:35 - 2015-08-04 09:35 - 00000000 ____D C:\Users\Alex\AppData\Local\SysassistByHotWheel
2015-08-04 09:34 - 2015-08-04 11:07 - 00000000 ____D C:\Users\Alex\AppData\Local\Unity
2015-08-04 09:33 - 2015-08-04 11:07 - 00000000 ____D C:\ProgramData\IQIYI Video
2015-08-04 09:33 - 2015-08-04 11:03 - 00000000 ____D C:\Users\Alex\AppData\Roaming\IQIYI Video
2015-08-04 09:33 - 2015-08-04 11:02 - 00000000 ____D C:\IQIYI Video
2015-08-04 09:33 - 2015-08-04 09:33 - 00000000 ____D C:\Users\Public\QiYi
2015-08-04 09:32 - 2015-08-04 09:32 - 00000000 ____D C:\Program Files\baidu
2015-08-04 09:10 - 2015-08-04 09:11 - 00000000 ____D C:\Users\Alex\Desktop\idler
2015-08-04 09:10 - 2015-08-04 09:10 - 03735528 _____ C:\Users\Alex\Desktop\cshacked.pl Nabijanie godzin na Steam.rar
2015-08-04 01:36 - 2015-08-04 01:36 - 00205278 _____ C:\Users\Alex\Desktop\ezfrags_csgo_multi_v5.2.zip
2015-08-04 01:32 - 2015-08-04 01:33 - 01881192 _____ C:\Users\Alex\Desktop\Menton's Hook v1.1 updated by Adi2071.rar
2015-08-03 13:42 - 2015-08-03 13:42 - 00000000 ____D C:\ProgramData\aWinManProa
2015-08-02 09:23 - 2015-08-02 09:24 - 00000000 ____D C:\ProgramData\2WinManPro2
2015-08-02 04:26 - 2015-08-02 04:26 - 00000000 _____ C:\Users\Alex\Documents\ts3_clientui-win32-1407159763-2015-08-02 04_26_53.907816.dmp
2015-08-02 00:51 - 2015-07-28 03:27 - 00000000 ____D C:\Users\Alex\Desktop\S2.Laneris ver.1.0.1
2015-08-02 00:13 - 2015-08-02 00:15 - 1288954891 _____ C:\Users\Alex\Desktop\S2.Laneris ver.1.0.1.rar
2015-08-01 22:17 - 2015-08-01 22:17 - 00215632 _____ C:\Users\Alex\Documents\ts3_clientui-win32-1407159763-2015-08-01 22_17_02.896562.dmp
2015-08-01 22:06 - 2015-08-01 22:06 - 00000000 ____D C:\Users\Alex\AppData\Roaming\FishTrove
2015-08-01 22:05 - 2015-08-01 22:06 - 01847808 _____ C:\Users\Alex\Desktop\FishBot.exe
2015-08-01 15:05 - 2015-08-04 09:36 - 00002211 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-08-01 14:53 - 2015-08-04 09:34 - 00000000 ____D C:\ProgramData\iWinManProi
2015-08-01 09:12 - 2015-08-01 09:12 - 00001006 _____ C:\Windows\Tasks\X82FxyOAlfq82FaPhMv.job
2015-08-01 09:11 - 2015-08-04 10:37 - 00000956 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job
2015-08-01 09:11 - 2015-08-04 09:16 - 00000960 _____ C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job
2015-08-01 09:10 - 2015-08-04 10:37 - 00001042 _____ C:\Windows\Tasks\Crossbrowse.job
2015-08-01 09:10 - 2015-08-01 09:11 - 00000000 ____D C:\ProgramData\lWinManProl
2015-07-31 14:27 - 2015-07-31 16:03 - 00000000 ____D C:\ProgramData\EpicScale
2015-07-30 15:43 - 2015-07-30 15:43 - 00203627 _____ C:\Users\Alex\Desktop\ezfrags_csgo_multi_v5.1.zip
2015-07-30 14:55 - 2015-07-30 14:55 - 00000000 ____D C:\ProgramData\JWinManProJ
2015-07-30 12:01 - 2015-07-30 12:02 - 00000000 ____D C:\ProgramData\6WinManPro6
2015-07-28 17:13 - 2015-07-28 17:28 - 00000000 ____D C:\Users\Alex\AppData\Roaming\TeamViewer
2015-07-28 17:12 - 2015-07-28 17:13 - 08053272 _____ (TeamViewer GmbH) C:\Users\Alex\Desktop\TeamViewer_Setup_pl.exe
2015-07-28 07:36 - 2015-07-25 19:51 - 00015808 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 07:36 - 2015-07-25 19:47 - 00628736 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 07:36 - 2015-07-25 19:47 - 00587264 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 07:36 - 2015-07-25 19:46 - 00924160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 07:36 - 2015-07-25 19:46 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 07:36 - 2015-07-25 19:46 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 07:36 - 2015-07-25 19:46 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 07:36 - 2015-07-25 19:40 - 00932864 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-27 11:07 - 2015-08-04 11:07 - 00001006 _____ C:\Windows\Tasks\vKj2JFxHqfv9WOGtUya.job
2015-07-27 11:06 - 2015-07-27 11:06 - 00000000 ____D C:\Users\Alex\AppData\Local\Crossbrowse
2015-07-27 10:54 - 2015-07-27 10:54 - 00000000 ____D C:\Users\Alex\Desktop\SteamAchievementManager63
2015-07-24 09:39 - 2015-07-24 09:40 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Trove
2015-07-24 02:59 - 2015-07-24 02:59 - 00000216 _____ C:\Users\Alex\Desktop\Trove.url
2015-07-23 20:29 - 2015-07-23 20:29 - 00000216 _____ C:\Users\Alex\Desktop\AdVenture Capitalist.url
2015-07-23 01:15 - 2015-07-23 01:15 - 00051639 _____ C:\Windows\system32\CCCInstall_201507230115310459.log
2015-07-23 01:15 - 2015-07-23 01:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2015-07-23 01:15 - 2015-07-23 01:15 - 00000000 ____D C:\ProgramData\ATI
2015-07-23 01:04 - 2015-07-23 01:06 - 226363176 _____ (AMD Inc.) C:\Users\Alex\Desktop\amd-catalyst-15.7-with-dotnet45-win7-32bit.exe
2015-07-23 00:18 - 2015-07-23 00:18 - 00000213 _____ C:\Users\Alex\Desktop\Counter-Strike Global Offensive.url
2015-07-22 12:12 - 2015-07-22 12:12 - 00000000 ____D C:\Users\Alex\AppData\Local\CEF
2015-07-21 03:09 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-21 03:09 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-21 03:09 - 2015-07-15 04:55 - 00026624 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-21 03:09 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-21 03:09 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-17 15:00 - 2015-07-17 15:00 - 00167936 _____ C:\Windows\system32\lua5.1.dll
2015-07-15 15:02 - 2015-08-04 11:08 - 00000000 ____D C:\Program Files\00000000-1433171668-0000-0000-1C6F6547AC60
2015-07-15 13:19 - 2015-07-01 22:46 - 00137664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 13:19 - 2015-07-01 22:46 - 00067520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 13:19 - 2015-07-01 22:30 - 01061376 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00655360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 13:19 - 2015-07-01 22:30 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 13:19 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 13:19 - 2015-07-01 22:29 - 00022528 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 13:19 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 13:19 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 13:19 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 13:19 - 2015-07-01 21:18 - 00225792 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 13:19 - 2015-07-01 21:18 - 00124416 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 13:19 - 2015-07-01 21:18 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 13:19 - 2015-06-25 10:46 - 02383872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 13:18 - 2015-07-09 19:43 - 02943488 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 02057216 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00073728 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 13:18 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 13:18 - 2015-07-09 19:42 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 13:18 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 13:18 - 2015-07-09 19:42 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 13:18 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 13:18 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 13:18 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 13:18 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 13:18 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 13:18 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 13:18 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 13:18 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 13:18 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 13:18 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-15 13:18 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-15 13:18 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-15 13:18 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-15 13:18 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-15 13:18 - 2015-06-19 20:13 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-15 13:18 - 2015-06-19 20:06 - 00667648 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 13:18 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-15 13:18 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-15 13:18 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 13:18 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 13:18 - 2015-06-19 19:40 - 00685568 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-15 13:18 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 13:18 - 2015-06-17 19:39 - 00305664 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 13:18 - 2015-06-15 23:47 - 00101824 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 13:18 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 13:18 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 13:18 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 13:18 - 2015-06-15 23:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 13:18 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 13:18 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 13:18 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 13:18 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-15 13:18 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-15 13:18 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-15 13:18 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-15 13:17 - 2015-06-19 20:40 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-15 13:17 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 13:17 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-15 13:17 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-15 13:17 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 13:17 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 13:17 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 13:17 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 13:17 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 13:17 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-15 13:17 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-06 18:47 - 2015-07-06 18:47 - 00000000 ____D C:\Users\Alex\AppData\Local\globalUpdate
2015-07-06 17:49 - 2015-08-04 10:37 - 00000000 ____D C:\Program Files\MiuiTab
2015-07-06 17:49 - 2015-07-06 17:49 - 00000000 ____D C:\ProgramData\WindowsMangerProtect
2015-07-06 17:49 - 2015-07-06 17:49 - 00000000 ____D C:\ProgramData\IHProtectUpDate
2015-07-06 09:46 - 2015-07-26 20:55 - 00000258 _____ C:\Users\Alex\Desktop\IP.txt

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-08-04 11:17 - 2014-12-20 20:44 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-04 11:14 - 2015-06-01 17:14 - 00000338 _____ C:\Windows\Tasks\Bidaily Synchronize Task[74c7].job
2015-08-04 11:09 - 2015-06-01 17:14 - 00000000 ____D C:\Users\Alex\AppData\Roaming\00000000-1433171668-0000-0000-1C6F6547AC60
2015-08-04 11:07 - 2014-12-20 18:19 - 00000000 ____D C:\Users\Alex\AppData\Local\VirtualStore
2015-08-04 11:05 - 2014-12-20 18:20 - 01295642 _____ C:\Windows\WindowsUpdate.log
2015-08-04 11:04 - 2014-12-20 18:18 - 00000000 ____D C:\Users\Alex
2015-08-04 10:56 - 2009-07-14 06:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-04 10:56 - 2009-07-14 06:34 - 00021072 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-04 10:50 - 2015-06-22 22:53 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Raptr
2015-08-04 10:46 - 2015-05-29 13:35 - 00001036 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA1d09a038b4810b3.job
2015-08-04 10:44 - 2015-05-29 13:29 - 00001036 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-04 10:37 - 2015-05-29 13:29 - 00001032 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-04 10:36 - 2010-11-20 23:48 - 00049002 _____ C:\Windows\PFRO.log
2015-08-04 10:36 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-04 10:36 - 2009-07-14 06:39 - 00175731 _____ C:\Windows\setupact.log
2015-08-04 10:36 - 2009-07-14 06:33 - 00270352 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-04 10:09 - 2014-12-20 19:40 - 00059184 _____ C:\Users\Alex\AppData\Local\GDIPFONTCACHEV1.DAT
2015-08-04 09:57 - 2015-07-04 09:05 - 00000000 ____D C:\Users\Alex\AppData\Local\SmartWeb
2015-08-04 09:36 - 2014-12-20 18:19 - 00001425 _____ C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-04 09:33 - 2009-07-14 04:37 - 00000000 ___RD C:\Users\Public
2015-08-04 09:16 - 2014-12-28 00:04 - 00000000 ____D C:\Program Files\Steam
2015-08-04 09:03 - 2014-12-20 20:42 - 00000000 ____D C:\Users\Alex\AppData\Roaming\TS3Client
2015-08-04 04:50 - 2014-12-20 19:40 - 00065536 _____ C:\Windows\system32\spu_storage.bin
2015-08-04 02:47 - 2014-12-25 15:27 - 00000000 ____D C:\Users\Alex\AppData\Local\screenSHU
2015-08-04 01:40 - 2015-06-29 13:00 - 00000000 ____D C:\Users\Alex\Desktop\CW
2015-08-04 01:08 - 2015-05-29 13:08 - 00000382 _____ C:\Windows\Tasks\Bidaily Synchronize Task[973b].job
2015-08-02 22:51 - 2014-12-25 20:23 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Winamp
2015-08-02 13:10 - 2015-06-22 22:53 - 00000000 ____D C:\Program Files\Raptr
2015-08-02 11:28 - 2014-12-23 00:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Skype
2015-08-01 15:05 - 2015-05-29 13:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-07-28 10:29 - 2015-04-15 15:39 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-27 12:06 - 2015-06-01 17:15 - 00000004 _____ C:\Windows\system32\029B560A371F4E00AB32838EBC01B9E7
2015-07-25 19:46 - 2015-04-04 09:23 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-25 14:28 - 2014-12-20 20:22 - 00000000 ____D C:\Program Files\Common Files\Steam
2015-07-23 12:17 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2015-07-23 01:15 - 2015-06-22 22:49 - 00000000 ____D C:\Program Files\AMD
2015-07-23 01:06 - 2014-12-20 19:34 - 00000000 ____D C:\AMD
2015-07-23 00:17 - 2015-06-26 14:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-07-18 21:04 - 2014-12-23 00:10 - 00000000 ___RD C:\Program Files\Skype
2015-07-18 21:04 - 2014-12-23 00:10 - 00000000 ____D C:\ProgramData\Skype
2015-07-18 02:03 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2015-07-17 11:59 - 2015-06-01 16:41 - 01708544 _____ (GamingOnSteroids) C:\Users\Alex\Desktop\Loader.exe
2015-07-16 03:21 - 2015-04-15 15:39 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-16 03:21 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\pl-PL
2015-07-16 03:11 - 2014-12-21 04:05 - 00000000 ____D C:\Windows\system32\MRT
2015-07-15 23:08 - 2015-05-29 13:21 - 00000000 ____D C:\Users\Alex\AppData\Local\Deployment
2015-07-15 16:17 - 2014-12-20 20:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-07-15 16:17 - 2014-12-20 20:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-07-07 14:11 - 2015-04-30 08:51 - 00000000 ____D C:\Users\Alex\Desktop\muzaa angeli
2015-07-06 20:21 - 2015-06-22 22:53 - 00000000 ____D C:\Program Files\AMD AVT
2015-07-06 14:25 - 2015-02-25 22:06 - 00000000 ____D C:\Users\Alex\Desktop\XDD
2015-07-06 13:01 - 2015-05-24 13:13 - 00000610 _____ C:\Users\Alex\Desktop\Ustawienia routera.txt

==================== Files in the root of some directories =======

2015-04-19 14:20 - 2015-04-19 14:20 - 0005872 _____ () C:\Users\Alex\AppData\Roaming\X82FxyOAlfq82FaPhMv
2015-04-20 16:05 - 2015-04-20 16:05 - 1579520 _____ () C:\Users\Alex\AppData\Roaming\X82FxyOAlfq82FaPhMv.exe
2015-06-03 22:28 - 2015-06-03 22:28 - 0000839 _____ () C:\Users\Alex\AppData\Local\recently-used.xbel
2015-05-29 13:17 - 2015-05-29 13:17 - 0000000 _____ () C:\Users\Alex\AppData\Local\Temp.dat

Some files in TEMP:
====================
C:\Users\Alex\AppData\Local\Temp\1589.exe
C:\Users\Alex\AppData\Local\Temp\177.exe
C:\Users\Alex\AppData\Local\Temp\18508.exe
C:\Users\Alex\AppData\Local\Temp\2430.exe
C:\Users\Alex\AppData\Local\Temp\253.exe
C:\Users\Alex\AppData\Local\Temp\32834.exe
C:\Users\Alex\AppData\Local\Temp\3947.exe
C:\Users\Alex\AppData\Local\Temp\4014.exe
C:\Users\Alex\AppData\Local\Temp\4362.exe
C:\Users\Alex\AppData\Local\Temp\4528.exe
C:\Users\Alex\AppData\Local\Temp\51280.exe
C:\Users\Alex\AppData\Local\Temp\5367.exe
C:\Users\Alex\AppData\Local\Temp\5709.exe
C:\Users\Alex\AppData\Local\Temp\7087.exe
C:\Users\Alex\AppData\Local\Temp\7801.exe
C:\Users\Alex\AppData\Local\Temp\7898.exe
C:\Users\Alex\AppData\Local\Temp\7910.exe
C:\Users\Alex\AppData\Local\Temp\860.exe
C:\Users\Alex\AppData\Local\Temp\beddbgejdf.exe
C:\Users\Alex\AppData\Local\Temp\beddcegfca.exe
C:\Users\Alex\AppData\Local\Temp\bedgbjejca.exe
C:\Users\Alex\AppData\Local\Temp\BingBarSetup-Partner.exe
C:\Users\Alex\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Alex\AppData\Local\Temp\fsd10E1.exe
C:\Users\Alex\AppData\Local\Temp\fsd1101.exe
C:\Users\Alex\AppData\Local\Temp\fsd18DD.exe
C:\Users\Alex\AppData\Local\Temp\fsd29AF.exe
C:\Users\Alex\AppData\Local\Temp\fsd32B.exe
C:\Users\Alex\AppData\Local\Temp\fsd3939.exe
C:\Users\Alex\AppData\Local\Temp\fsd4597.exe
C:\Users\Alex\AppData\Local\Temp\fsd46DF.exe
C:\Users\Alex\AppData\Local\Temp\fsd4A68.exe
C:\Users\Alex\AppData\Local\Temp\fsd57B1.exe
C:\Users\Alex\AppData\Local\Temp\fsd6B02.exe
C:\Users\Alex\AppData\Local\Temp\fsd6B9E.exe
C:\Users\Alex\AppData\Local\Temp\fsd6E3D.exe
C:\Users\Alex\AppData\Local\Temp\fsd6EC9.exe
C:\Users\Alex\AppData\Local\Temp\fsd6F22.exe
C:\Users\Alex\AppData\Local\Temp\fsd79FF.exe
C:\Users\Alex\AppData\Local\Temp\fsd7ABB.exe
C:\Users\Alex\AppData\Local\Temp\fsd81AD.exe
C:\Users\Alex\AppData\Local\Temp\fsd8249.exe
C:\Users\Alex\AppData\Local\Temp\fsd8E46.exe
C:\Users\Alex\AppData\Local\Temp\fsd8F5.exe
C:\Users\Alex\AppData\Local\Temp\fsd927F.exe
C:\Users\Alex\AppData\Local\Temp\fsd930B.exe
C:\Users\Alex\AppData\Local\Temp\fsd953D.exe
C:\Users\Alex\AppData\Local\Temp\fsd9E03.exe
C:\Users\Alex\AppData\Local\Temp\fsdA5C0.exe
C:\Users\Alex\AppData\Local\Temp\fsdAB7B.exe
C:\Users\Alex\AppData\Local\Temp\fsdABAA.exe
C:\Users\Alex\AppData\Local\Temp\fsdAD30.exe
C:\Users\Alex\AppData\Local\Temp\fsdAF13.exe
C:\Users\Alex\AppData\Local\Temp\fsdB3B5.exe
C:\Users\Alex\AppData\Local\Temp\fsdB4DD.exe
C:\Users\Alex\AppData\Local\Temp\fsdB847.exe
C:\Users\Alex\AppData\Local\Temp\fsdC10D.exe
C:\Users\Alex\AppData\Local\Temp\fsdC14C.exe
C:\Users\Alex\AppData\Local\Temp\fsdCCE0.exe
C:\Users\Alex\AppData\Local\Temp\fsdD2C9.exe
C:\Users\Alex\AppData\Local\Temp\fsdD355.exe
C:\Users\Alex\AppData\Local\Temp\fsdD5B6.exe
C:\Users\Alex\AppData\Local\Temp\fsdDB80.exe
C:\Users\Alex\AppData\Local\Temp\fsdDEDA.exe
C:\Users\Alex\AppData\Local\Temp\fsdEA9C.exe
C:\Users\Alex\AppData\Local\Temp\fsdFC9.exe
C:\Users\Alex\AppData\Local\Temp\install1832160.exe
C:\Users\Alex\AppData\Local\Temp\InstHelper.exe
C:\Users\Alex\AppData\Local\Temp\IQIYIsetup_l_spl004@kb005.exe
C:\Users\Alex\AppData\Local\Temp\masauto_runxx.dl.dll
C:\Users\Alex\AppData\Local\Temp\masblog_runxx.dl.dll
C:\Users\Alex\AppData\Local\Temp\masflag_runxx.dl.dll
C:\Users\Alex\AppData\Local\Temp\offer-A6130160-5BF2-4ECC-A3AB-F2B15949FCA4.exe
C:\Users\Alex\AppData\Local\Temp\oo2.exe
C:\Users\Alex\AppData\Local\Temp\openvpninstall.exe
C:\Users\Alex\AppData\Local\Temp\pb-updater.exe
C:\Users\Alex\AppData\Local\Temp\PCMgr_AndroidServer.exe
C:\Users\Alex\AppData\Local\Temp\ppstreamsetup_unfix.exe
C:\Users\Alex\AppData\Local\Temp\qqpcmgr_v10.7.16066.216_71780_Silence.exe
C:\Users\Alex\AppData\Local\Temp\Quarantine.exe
C:\Users\Alex\AppData\Local\Temp\QYAgent_runxx.dl.dll
C:\Users\Alex\AppData\Local\Temp\raptrpatch.exe
C:\Users\Alex\AppData\Local\Temp\raptr_stub.exe
C:\Users\Alex\AppData\Local\Temp\sdf94FE.exe
C:\Users\Alex\AppData\Local\Temp\sdf9C9C.exe
C:\Users\Alex\AppData\Local\Temp\sdfF70B.exe
C:\Users\Alex\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Alex\AppData\Local\Temp\setup3.exe
C:\Users\Alex\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Alex\AppData\Local\Temp\sfextra.dll
C:\Users\Alex\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Alex\AppData\Local\Temp\sqlite3.dll
C:\Users\Alex\AppData\Local\Temp\supoptsetup.exe
C:\Users\Alex\AppData\Local\Temp\UninstallES.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-07-24 19:18

==================== End of log ============================