Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27-07-2016
Ran by mentol (administrator) on MENTOL-PC (10-08-2016 19:39:52)
Running from C:\Users\mentol\Desktop\skan
Loaded Profiles: mentol (Available Profiles: mentol)
Platform: Windows 7 Ultimate Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\mentol\Desktop\skan\ysrj2zsy.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [5565960 2016-07-20] (LogMeIn Inc.)
HKU\S-1-5-21-3502765815-1476509878-803485157-1000\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8810200 2016-06-10] (Piriform Ltd)
HKU\S-1-5-21-3502765815-1476509878-803485157-1000\...\Run: [mentol] => explorer.exe hxxp://kb-ribaki.org <===== ATTENTION
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{DE089B59-893F-4E74-90AF-64AEB12B229E}: [DhcpNameServer] 192.168.1.1 192.168.1.1

Internet Explorer:
==================
HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\S-1-5-21-3502765815-1476509878-803485157-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3502765815-1476509878-803485157-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3502765815-1476509878-803485157-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxps://mysearch.avg.com/?cid={1707ADCF-42A9-4ACD-9C05-7B80B920D146}&mid=3015cc824ed947cc88e46d16b21eab62-ad1491be2ce6c122f6b66faa90e70c2decf7d34c&lang=pl&ds=AVG&coid=avgtbavg&cmpid=0516pi&pr=fr&d=2016-08-02%2018:29:24&v=4.3.2.18&pid=wtu&sg=&sap=hp
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2010-01-21] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2010-01-16] (Microsoft Corporation)

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.oursurfing.com/?type=sy&ts=1435597077&z=8afcf42752125a84e138084g5zac3w0w7t7m1e5m1w&from=smt&uid=ST500DM002-1BD142_Z6E4GE59XXXXZ6E4GE59
CHR StartupUrls: Default -> "hxxp://search.conduit.com/?gd=&ctid=CT3321459&octid=EB_ORIGINAL_CTID&ISID=M486E8DD3-338A-4D2F-8481-5A54586888CF&SearchSource=55&CUI=&UM=5&UP=SP5B546ED7-912D-4C4B-9B30-ED04FEBB673E&SSPV=","hxxp://www.oursurfing.com/?type=hp&ts=1435597040&z=af967304df28f82b50eaf49gbz7c5wcwbtbmaeaccb&from=smt&uid=ST500DM002-1BD142_Z6E4GE59XXXXZ6E4GE59","hxxp://www.oursurfing.com/?type=hppp&ts=1435597077&z=8afcf42752125a84e138084g5zac3w0w7t7m1e5m1w&from=smt&uid=ST500DM002-1BD142_Z6E4GE59XXXXZ6E4GE59"
CHR Profile: C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2016-08-10]
CHR Extension: (Adblock Plus) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2016-08-10]
CHR Extension: (Lounge Assistant) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\enjonnlehciedbcidabdglnnihcncbml [2016-08-10]
CHR Extension: (Momentum) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\laookkfknpbbblfpciffpaejjkokdgca [2016-08-10]
CHR Extension: (Morpheon Dark) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\mafbdhjdkjnoafhfelkjpchpaepjknad [2016-08-10]
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-08-10]
CHR Extension: (Gmail) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2016-08-10]
CHR Extension: (Chrome Media Router) - C:\Users\mentol\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-10]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 Hamachi2Svc; C:\Program Files (x86)\LogMeIn Hamachi\x64\hamachi-2.exe [2554376 2016-07-20] (LogMeIn Inc.)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\x64\LMIGuardianSvc.exe [419248 2016-07-20] (LogMeIn, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2016-06-12] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 nita2m2audio; C:\Windows\System32\Drivers\nita2m2audio.sys [372616 2015-09-10] (Native Instruments GmbH)
R3 nita2m2usb; C:\Windows\System32\DRIVERS\nita2m2usb.sys [91456 2015-09-10] (Native Instruments GmbH)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]
U3 uwdiypow; \??\C:\Users\mentol\AppData\Local\Temp\uwdiypow.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-10 19:26 - 2016-08-10 19:26 - 00053212 _____ C:\Users\mentol\Documents\cc_20160810_192615.reg
2016-08-10 18:52 - 2016-08-10 19:28 - 00024963 _____ C:\Windows\SysWOW64\servers.def.lkg
2016-08-10 18:52 - 2016-08-10 19:28 - 00024963 _____ C:\Windows\SysWOW64\servers.def
2016-08-10 18:51 - 2016-08-10 19:28 - 00002869 _____ C:\Windows\SysWOW64\servers.def.vpx
2016-08-10 18:51 - 2016-08-10 19:28 - 00000446 _____ C:\Windows\SysWOW64\prod-pgm.vpx
2016-08-10 18:51 - 2016-08-10 18:51 - 464833484 _____ C:\Windows\MEMORY.DMP
2016-08-10 18:51 - 2016-08-10 18:51 - 00398904 _____ C:\Windows\Minidump\081016-20576-01.dmp
2016-08-10 18:51 - 2016-08-10 18:51 - 00000000 ____D C:\Windows\Minidump
2016-08-10 18:50 - 2016-08-10 18:50 - 00003922 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2016-08-10 18:50 - 2016-08-10 18:50 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2016-08-10 18:50 - 2016-08-10 18:50 - 00000000 ____D C:\Program Files\Common Files\AV
2016-08-10 18:49 - 2016-08-10 18:57 - 00000000 ____D C:\Users\mentol\Desktop\vst instalki
2016-08-10 18:49 - 2016-08-10 18:49 - 00992960 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-08-10 18:49 - 2016-08-10 18:49 - 00921280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-08-10 18:43 - 2016-08-10 19:30 - 00000000 ____D C:\Users\mentol\Desktop\skan
2016-08-10 17:53 - 2016-08-10 17:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-10 17:52 - 2016-08-10 18:07 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-08-10 17:52 - 2016-08-10 17:52 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-10 17:52 - 2016-08-10 17:52 - 00109272 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-08-10 17:47 - 2016-08-10 17:52 - 00000000 ____D C:\ProgramData\HitmanPro
2016-08-10 16:52 - 2016-08-10 17:03 - 00000000 ____D C:\AdwCleaner
2016-08-10 16:31 - 2016-08-10 16:31 - 00000000 ____D C:\SUPERDelete
2016-08-10 16:04 - 2016-08-10 16:04 - 00000000 _____ C:\autoexec.bat
2016-08-10 15:30 - 2016-08-10 15:30 - 00000000 ____D C:\Users\mentol\AppData\Roaming\PowerISO
2016-08-10 15:24 - 2016-08-10 18:12 - 00000008 __RSH C:\ProgramData\ntuser.pol
2016-08-09 17:52 - 2016-08-10 17:07 - 00000000 ____D C:\Users\mentol\AppData\LocalLow\uTorrent
2016-08-07 22:27 - 2016-08-07 22:27 - 00000000 ____D C:\Users\mentol\Downloads\crazycrissy video virtual cgaturbate live free 2016-06-25 14-31-02
2016-08-06 14:28 - 2016-08-06 14:28 - 00000000 ____D C:\Users\mentol\AppData\Roaming\Valhalla DSP, LLC
2016-08-06 14:25 - 2016-08-06 22:11 - 00000000 ____D C:\ProgramData\ValhallaRoom
2016-08-06 14:25 - 2016-08-06 14:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\ValhallaRoom
2016-08-06 14:24 - 2016-08-06 14:24 - 00000000 ____D C:\VSTPlugIns
2016-08-06 14:24 - 2016-08-06 14:24 - 00000000 ____D C:\ProgramData\Valhalla DSP, LLC
2016-08-06 14:08 - 2016-08-06 14:08 - 00000000 ____D C:\Users\mentol\AppData\Roaming\NVIDIA
2016-08-06 14:05 - 2016-08-06 14:05 - 00000000 ____D C:\Users\mentol\Documents\FabFilter
2016-08-06 14:05 - 2016-08-06 14:05 - 00000000 ____D C:\Users\mentol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FabFilter
2016-08-06 14:05 - 2016-08-06 14:05 - 00000000 ____D C:\Users\mentol\AppData\Roaming\FabFilter
2016-08-06 14:05 - 2016-08-06 14:05 - 00000000 ____D C:\Program Files (x86)\FabFilter
2016-08-06 14:04 - 2016-08-06 14:04 - 01700352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdiplus.dll
2016-08-06 14:04 - 2016-08-06 14:04 - 01060864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc71.dll
2016-08-06 14:03 - 2016-08-07 01:45 - 00000000 ___RD C:\Users\mentol\Desktop\nnn Project
2016-08-03 23:44 - 2016-08-03 23:44 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2016-08-03 23:44 - 2016-08-03 23:44 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2016-08-02 19:14 - 2016-08-02 19:19 - 00000000 ____D C:\Users\mentol\Desktop\trapnshit
2016-08-02 18:25 - 2016-08-02 18:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\TuneUp Software
2016-08-02 18:25 - 2016-08-02 18:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\AVG
2016-08-02 18:24 - 2016-08-07 10:51 - 00000000 ____D C:\ProgramData\MFAData
2016-08-02 18:24 - 2016-08-06 14:31 - 00000000 ___HD C:\$AVG
2016-08-02 18:24 - 2016-08-02 18:24 - 00000000 ____D C:\Users\mentol\AppData\Local\MFAData
2016-08-02 18:05 - 2016-08-07 10:51 - 00000000 ____D C:\Users\mentol\AppData\Local\Avg
2016-08-02 18:05 - 2016-08-06 14:31 - 00000000 ____D C:\Users\mentol\AppData\Local\AvgSetupLog
2016-08-02 18:05 - 2016-08-06 14:31 - 00000000 ____D C:\ProgramData\Avg
2016-08-01 23:17 - 2016-08-01 23:17 - 00000000 ____D C:\adb
2016-08-01 23:05 - 2016-08-01 23:07 - 00000000 ____D C:\Users\mentol\AppData\Local\Sony
2016-08-01 23:05 - 2016-08-01 23:06 - 00005798 _____ C:\Windows\system32\--traceoff
2016-08-01 23:05 - 2016-08-01 23:05 - 00000000 ____D C:\ProgramData\Sony
2016-08-01 23:05 - 2016-08-01 23:05 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2016-08-01 23:05 - 2016-08-01 23:05 - 00000000 ____D C:\Program Files (x86)\Sony
2016-08-01 23:05 - 2016-08-01 23:05 - 00000000 _____ C:\Windows\system32\--debugoff
2016-08-01 23:04 - 2016-08-01 23:07 - 00000000 ____D C:\Users\mentol\AppData\Roaming\Sony
2016-08-01 21:38 - 2016-08-08 20:50 - 00002201 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-01 21:37 - 2016-08-10 19:37 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-01 21:37 - 2016-08-10 18:48 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-01 21:37 - 2016-08-01 21:43 - 00004044 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-08-01 21:37 - 2016-08-01 21:43 - 00003792 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-08-01 21:16 - 2016-08-01 21:16 - 00000000 ____D C:\Program Files (x86)\Etron Technology
2016-08-01 21:06 - 2016-08-01 21:06 - 00000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_WinUsb_01009.Wdf
2016-08-01 21:04 - 2014-09-15 13:08 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\WdfCoInstaller01009.dll
2016-08-01 21:04 - 2014-09-15 13:08 - 01002728 _____ (Microsoft Corporation) C:\Windows\system32\WinUSBCoInstaller2.dll
2016-08-01 21:00 - 2016-08-01 21:02 - 00000000 ____D C:\Program Files (x86)\PdaNet for Android
2016-08-01 21:00 - 2011-11-25 00:25 - 00015360 _____ (June Fabrics Technology Inc.) C:\Windows\system32\Drivers\pneteth.sys
2016-08-01 19:03 - 2016-08-01 19:03 - 00000000 ____D C:\KVRT_Data
2016-08-01 18:55 - 2016-08-10 19:39 - 00000000 ____D C:\FRST
2016-08-01 18:49 - 2016-08-01 18:49 - 00021059 _____ C:\ComboFix.txt
2016-08-01 18:35 - 2016-08-01 18:49 - 00000000 ____D C:\Qoobox
2016-08-01 18:35 - 2016-08-01 18:48 - 00000000 ____D C:\Windows\erdnt
2016-08-01 18:35 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2016-08-01 18:35 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2016-08-01 18:35 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2016-08-01 18:35 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2016-08-01 18:35 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2016-08-01 18:35 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2016-08-01 18:35 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2016-08-01 18:35 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2016-08-01 18:26 - 2016-08-08 15:22 - 00000000 ____D C:\Program Files (x86)\Windows Loader
2016-08-01 18:25 - 2016-08-01 18:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\WinRAR
2016-08-01 18:25 - 2016-08-01 18:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-01 18:25 - 2016-08-01 18:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-01 18:25 - 2016-08-01 18:25 - 00000000 ____D C:\Program Files (x86)\WinRAR
2016-07-20 19:44 - 2016-07-20 19:44 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi
2016-07-20 19:44 - 2016-07-20 19:44 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi
2016-07-19 23:51 - 2016-07-19 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerISO
2016-07-19 23:51 - 2016-07-19 23:51 - 00000000 ____D C:\Program Files\PowerISO
2016-07-19 23:51 - 2016-05-25 01:06 - 00137280 _____ (Power Software Ltd) C:\Windows\system32\Drivers\scdemu.sys
2016-07-19 13:59 - 2016-07-19 13:59 - 00000000 ____D C:\Users\mentol\AppData\Roaming\SmartSteamEmu
2016-07-19 11:14 - 2016-07-21 01:10 - 00000000 ____D C:\Users\Default\AppData\Local\LogMeIn Hamachi
2016-07-19 11:14 - 2016-07-21 01:10 - 00000000 ____D C:\Users\Default User\AppData\Local\LogMeIn Hamachi
2016-07-19 11:14 - 2016-07-20 12:08 - 00034720 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys
2016-07-17 22:16 - 2016-07-17 22:16 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stronghold Crusader 2 Special Edition
2016-07-17 00:05 - 2016-07-17 00:06 - 00000000 ____D C:\Users\mentol\Documents\Stronghold Crusader 2
2016-07-17 00:05 - 2016-07-17 00:05 - 00000000 ____D C:\Users\mentol\AppData\Roaming\Steam
2016-07-16 23:59 - 2016-08-10 19:37 - 00000000 ____D C:\Users\mentol\AppData\Local\LogMeIn Hamachi
2016-07-16 23:59 - 2016-07-16 23:59 - 00000000 ____D C:\Users\mentol\AppData\Local\LogMeIn
2016-07-16 23:59 - 2016-07-16 23:59 - 00000000 ____D C:\ProgramData\LogMeIn
2016-07-13 00:06 - 2016-07-13 00:06 - 00000000 ____D C:\Users\mentol\AppData\Roaming\EurekaLog
2016-07-12 19:11 - 2016-07-22 00:58 - 00000000 ____D C:\Users\mentol\Documents\TrackMania
2016-07-12 19:11 - 2016-07-12 19:18 - 00000000 ____D C:\ProgramData\TrackMania

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-10 19:35 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-10 19:31 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-10 19:31 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-10 18:58 - 2009-07-14 07:13 - 00781298 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-10 18:58 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-08-10 18:49 - 2016-06-27 13:53 - 00000000 ____D C:\Users\mentol\AppData\Roaming\vlc
2016-08-10 18:11 - 2009-07-14 05:20 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2016-08-10 18:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\SysWOW64\GroupPolicy
2016-08-10 17:31 - 2016-06-26 16:25 - 00000000 ____D C:\Users\mentol\AppData\Roaming\uTorrent
2016-08-10 16:46 - 2016-06-13 03:45 - 00000000 ____D C:\Windows\Panther
2016-08-10 13:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2016-08-04 18:40 - 2016-06-27 17:57 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2016-08-01 21:38 - 2016-06-26 15:41 - 00000000 ____D C:\Program Files (x86)\Google
2016-08-01 21:37 - 2016-06-26 15:41 - 00000000 ____D C:\Users\mentol\AppData\Local\Deployment
2016-08-01 21:37 - 2016-06-26 15:41 - 00000000 ____D C:\Users\mentol\AppData\Local\Apps\2.0
2016-08-01 21:16 - 2016-06-26 15:27 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-08-01 18:48 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2016-08-01 18:32 - 2016-06-12 13:44 - 01008640 _____ (Microsoft Corporation) C:\Windows\system32\user32.dll
2016-08-01 18:32 - 2016-06-12 13:44 - 00833024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user32.dll
2016-08-01 18:32 - 2010-11-21 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\systemcpl.dll
2016-08-01 18:32 - 2010-11-21 05:24 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\slwga.dll
2016-08-01 18:32 - 2010-11-21 05:23 - 00013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\slwga.dll
2016-07-22 02:59 - 2016-06-29 13:18 - 00000000 ____D C:\Users\mentol\AppData\Roaming\TS3Client
2016-07-20 16:37 - 2016-06-26 16:20 - 00000000 ____D C:\Users\mentol\AppData\Local\paint.net
2016-07-19 23:48 - 2016-06-26 15:52 - 00000000 ____D C:\Users\mentol\AppData\Local\WinZip
2016-07-17 22:35 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2016-07-17 21:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\LiveKernelReports
2016-07-13 02:00 - 2016-06-27 17:58 - 00004476 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2016-07-12 19:18 - 2016-06-26 15:23 - 00000000 ____D C:\Users\mentol\AppData\Local\VirtualStore

==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll
[2016-06-12 13:44] - [2016-08-01 18:32] - 1008640 ____A (Microsoft Corporation) 2C353B6CE0C8D03225CAA2AF33B68D79

C:\Windows\SysWOW64\User32.dll
[2016-06-12 13:44] - [2016-08-01 18:32] - 0833024 ____A (Microsoft Corporation) 861C4346F9281DC0380DE72C8D55D6BE

C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2016-08-06 12:15

==================== End of FRST.txt ============================