Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-08-2016 01
Ran by DB (administrator) on DB-PC (24-08-2016 19:33:55)
Running from C:\Users\DB\Downloads
Loaded Profiles: DB (Available Profiles: DB)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(MyHeritage) C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Huawei Technologies Co., Ltd.) C:\Users\DB\AppData\Roaming\PLAY ONLINE\ouc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Family Tree Builder Update] => C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe [2477056 2015-03-02] (MyHeritage)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [831576 2016-08-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [66328 2016-07-25] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\Run: [HW_OPENEYE_OUC_PLAY ONLINE] => C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [110592 2009-04-14] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\Run: [syshost32] => C:\Users\DB\AppData\Local\{766A3571-CB80-C66F-2CBD-0EAE0C9DE25B}\syshost.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\CurrentVersion\Windows: [Load] C:\ProgramData\msekou.exe <===== ATTENTION
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {3039a68e-9f5e-11e4-b165-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {3039a6c4-9f5e-11e4-b165-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {588c95c6-a335-11e4-b140-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {f95df7ac-4456-11e6-bdce-001e101f4da1} - G:\Setup.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{2889BFF4-2385-4012-B293-6D9C4929F8D0}: [NameServer] 89.108.195.21 89.108.202.21
Tcpip\..\Interfaces\{67D6819D-962C-4BE4-B694-E9E671ED8F4F}: [NameServer] 89.108.195.21 89.108.202.21
Tcpip\..\Interfaces\{FBB03D04-F02E-40A2-BB71-F155F20C38CD}: [DhcpNameServer] 37.8.214.2 31.11.202.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-304442932-291022296-845227809-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-304442932-291022296-845227809-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.google.com/?trackid=sp-006
URLSearchHook: HKLM-x32 -> Default = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-304442932-291022296-845227809-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-28] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-28] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-01-12] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-05-03] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-05-03] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-06-23] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Chrome Media Router) - C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-20]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

"a486044ffee6da9e" => service could not be unlocked. <===== ATTENTION

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [988184 2016-08-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [470600 2016-08-24] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [470600 2016-08-24] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1453696 2016-08-24] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [319648 2016-07-25] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [339456 2010-11-16] () [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
U2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

U5 a486044ffee6da9e; C:\Windows\System32\Drivers\a486044ffee6da9e.sys [75720 2016-01-29] () <===== ATTENTION Necurs Rootkit?
S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [171752 2016-08-18] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [145984 2016-08-18] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2015-04-09] (Avira Operations GmbH & Co. KG)
S2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [79696 2016-08-18] (Avira Operations GmbH & Co. KG)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-24] (Malwarebytes)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64896 2016-03-10] (Malwarebytes Corporation)
S3 MSPQM; C:\Windows\System32\drivers\MSPQM.sys [6784 2009-07-14] () [File not signed]
S3 MsRPC; C:\Windows\System32\Drivers\MsRPC.sys [366976 2010-11-21] ()
R1 mssmbios; C:\Windows\System32\DRIVERS\mssmbios.sys [32320 2009-07-14] () [File not signed]
S3 MSTEE; C:\Windows\System32\drivers\MSTEE.sys [8064 2009-07-14] () [File not signed]
S3 MTConfig; C:\Windows\system32\drivers\MTConfig.sys [15360 2009-07-14] () [File not signed]
R0 Mup; C:\Windows\System32\Drivers\mup.sys [60496 2009-07-14] () [File not signed]
R3 NativeWifiP; C:\Windows\System32\DRIVERS\nwifi.sys [318976 2009-07-14] () [File not signed]
R0 NDIS; C:\Windows\System32\drivers\ndis.sys [951680 2010-11-21] () [File not signed]
S3 NdisCap; C:\Windows\System32\DRIVERS\ndiscap.sys [35328 2009-07-14] () [File not signed]
R3 NdisTapi; C:\Windows\System32\DRIVERS\ndistapi.sys [24064 2009-07-14] () [File not signed]
R3 Ndisuio; C:\Windows\System32\DRIVERS\ndisuio.sys [56832 2010-11-21] () [File not signed]
R3 NdisWan; C:\Windows\System32\DRIVERS\ndiswan.sys [164352 2010-11-21] () [File not signed]
R3 NDProxy; C:\Windows\System32\Drivers\NDProxy.sys [57856 2010-11-21] ()
R1 NetBIOS; C:\Windows\System32\DRIVERS\netbios.sys [44544 2009-07-14] () [File not signed]
R1 NetBT; C:\Windows\System32\DRIVERS\netbt.sys [261632 2010-11-21] () [File not signed]
S3 nfrd960; C:\Windows\system32\drivers\nfrd960.sys [51264 2009-07-14] () [File not signed]
R1 Npfs; C:\Windows\System32\Drivers\Npfs.sys [44032 2009-07-14] ()
R1 nsiproxy; C:\Windows\System32\drivers\nsiproxy.sys [24576 2009-07-14] () [File not signed]
R3 Ntfs; C:\Windows\System32\Drivers\Ntfs.sys [1659776 2010-11-21] ()
R1 Null; C:\Windows\System32\Drivers\Null.sys [6144 2009-07-14] () [File not signed]
S3 nvraid; C:\Windows\system32\drivers\nvraid.sys [148352 2010-11-21] () [File not signed]
S3 nvstor; C:\Windows\system32\drivers\nvstor.sys [166272 2010-11-21] () [File not signed]
S3 nv_agp; C:\Windows\system32\drivers\nv_agp.sys [122960 2009-07-14] () [File not signed]
S3 ohci1394; C:\Windows\system32\drivers\ohci1394.sys [72832 2009-07-14] () [File not signed]
S3 Parport; C:\Windows\system32\drivers\parport.sys [97280 2009-07-14] () [File not signed]
R0 partmgr; C:\Windows\System32\drivers\partmgr.sys [75120 2012-03-17] () [File not signed]
R0 pci; C:\Windows\System32\drivers\pci.sys [184704 2010-11-21] () [File not signed]
S3 pciide; C:\Windows\system32\drivers\pciide.sys [12352 2009-07-14] () [File not signed]
S3 pcmcia; C:\Windows\system32\drivers\pcmcia.sys [220752 2009-07-14] () [File not signed]
R0 pcw; C:\Windows\System32\drivers\pcw.sys [50768 2009-07-14] () [File not signed]
R2 PEAUTH; C:\Windows\System32\drivers\peauth.sys [651264 2009-07-14] () [File not signed]
R3 PptpMiniport; C:\Windows\System32\DRIVERS\raspptp.sys [111104 2010-11-21] () [File not signed]
S3 Processor; C:\Windows\system32\drivers\processr.sys [60416 2009-07-14] () [File not signed]
R1 Psched; C:\Windows\System32\DRIVERS\pacer.sys [131584 2010-11-21] () [File not signed]
S3 ql2300; C:\Windows\system32\drivers\ql2300.sys [1524816 2009-07-14] () [File not signed]
S3 ql40xx; C:\Windows\system32\drivers\ql40xx.sys [128592 2009-07-14] () [File not signed]
S3 QWAVEdrv; C:\Windows\system32\drivers\qwavedrv.sys [46592 2009-07-14] () [File not signed]
S3 RasAcd; C:\Windows\System32\DRIVERS\rasacd.sys [14848 2009-07-14] () [File not signed]
R3 RasAgileVpn; C:\Windows\System32\DRIVERS\AgileVpn.sys [60416 2009-07-14] () [File not signed]
R3 Rasl2tp; C:\Windows\System32\DRIVERS\rasl2tp.sys [129536 2010-11-21] () [File not signed]
R3 RasPppoe; C:\Windows\System32\DRIVERS\raspppoe.sys [92672 2009-07-14] () [File not signed]
R3 RasSstp; C:\Windows\System32\DRIVERS\rassstp.sys [83968 2009-07-14] () [File not signed]
R1 rdbss; C:\Windows\System32\DRIVERS\rdbss.sys [309248 2010-11-21] () [File not signed]
S3 rdpbus; C:\Windows\system32\drivers\rdpbus.sys [24064 2009-07-14] () [File not signed]
R1 RDPCDD; C:\Windows\System32\DRIVERS\RDPCDD.sys [7680 2009-07-14] () [File not signed]
R1 RDPENCDD; C:\Windows\System32\drivers\rdpencdd.sys [7680 2009-07-14] () [File not signed]
R1 RDPREFMP; C:\Windows\System32\drivers\rdprefmp.sys [8192 2009-07-14] () [File not signed]
S3 RDPWD; C:\Windows\System32\Drivers\RDPWD.sys [212480 2014-07-17] ()
R0 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [213888 2010-11-21] () [File not signed]
R2 rspndr; C:\Windows\System32\DRIVERS\rspndr.sys [76800 2009-07-14] () [File not signed]
S3 sbp2port; C:\Windows\system32\drivers\sbp2port.sys [103808 2010-11-21] () [File not signed]
S3 scfilter; C:\Windows\System32\DRIVERS\scfilter.sys [29696 2010-11-21] () [File not signed]
R2 secdrv; C:\Windows\System32\Drivers\secdrv.sys [23040 2009-06-10] ()
S3 Serenum; C:\Windows\system32\drivers\serenum.sys [23552 2009-07-14] () [File not signed]
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] () [File not signed]
S3 sermouse; C:\Windows\system32\drivers\sermouse.sys [26624 2009-07-14] () [File not signed]
S3 sffdisk; C:\Windows\system32\drivers\sffdisk.sys [14336 2009-07-14] () [File not signed]
S3 sffp_mmc; C:\Windows\system32\drivers\sffp_mmc.sys [13824 2009-07-14] () [File not signed]
S3 sffp_sd; C:\Windows\system32\drivers\sffp_sd.sys [14336 2010-11-21] () [File not signed]
S3 sfloppy; C:\Windows\system32\drivers\sfloppy.sys [16896 2009-07-14] () [File not signed]
S3 SiSRaid2; C:\Windows\system32\drivers\SiSRaid2.sys [43584 2009-07-14] () [File not signed]
S3 SiSRaid4; C:\Windows\system32\drivers\sisraid4.sys [80464 2009-07-14] () [File not signed]
S3 Smb; C:\Windows\System32\DRIVERS\smb.sys [93184 2009-07-14] () [File not signed]
R0 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-14] ()
R3 srv; C:\Windows\System32\DRIVERS\srv.sys [467456 2011-04-29] () [File not signed]
R3 srv2; C:\Windows\System32\DRIVERS\srv2.sys [410112 2011-04-29] () [File not signed]
R3 srvnet; C:\Windows\System32\DRIVERS\srvnet.sys [168448 2011-04-29] () [File not signed]
S3 stexstor; C:\Windows\system32\drivers\stexstor.sys [24656 2009-07-14] () [File not signed]
R3 swenum; C:\Windows\System32\DRIVERS\swenum.sys [12496 2009-07-14] () [File not signed]
R0 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1924480 2010-11-21] () [File not signed]
S3 TCPIP6; C:\Windows\System32\DRIVERS\tcpip.sys [1924480 2010-11-21] () [File not signed]
R2 tcpipreg; C:\Windows\System32\drivers\tcpipreg.sys [45056 2010-11-21] () [File not signed]
S3 TDPIPE; C:\Windows\System32\drivers\tdpipe.sys [15872 2009-07-14] () [File not signed]
S3 TDTCP; C:\Windows\System32\drivers\tdtcp.sys [23552 2012-02-17] () [File not signed]
R1 tdx; C:\Windows\System32\DRIVERS\tdx.sys [119296 2010-11-21] () [File not signed]
R1 TermDD; C:\Windows\System32\DRIVERS\termdd.sys [63360 2010-11-21] () [File not signed]
S3 tssecsrv; C:\Windows\System32\DRIVERS\tssecsrv.sys [39936 2014-07-17] () [File not signed]
S3 TsUsbFlt; C:\Windows\System32\drivers\tsusbflt.sys [59392 2010-11-21] () [File not signed]
S3 TsUsbGD; C:\Windows\system32\drivers\TsUsbGD.sys [31232 2010-11-21] () [File not signed]
S3 tunnel; C:\Windows\System32\DRIVERS\tunnel.sys [125440 2010-11-21] () [File not signed]
S3 uagp35; C:\Windows\system32\drivers\uagp35.sys [64080 2009-07-14] () [File not signed]
S4 udfs; C:\Windows\System32\DRIVERS\udfs.sys [328192 2010-11-21] () [File not signed]
S3 uliagpkx; C:\Windows\system32\drivers\uliagpkx.sys [64592 2009-07-14] () [File not signed]
R3 umbus; C:\Windows\System32\DRIVERS\umbus.sys [48640 2010-11-21] () [File not signed]
S3 UmPass; C:\Windows\system32\drivers\umpass.sys [9728 2009-07-14] () [File not signed]
R3 usbccgp; C:\Windows\System32\DRIVERS\usbccgp.sys [98816 2010-11-21] () [File not signed]
S3 usbcir; C:\Windows\system32\drivers\usbcir.sys [100352 2009-07-14] () [File not signed]
R3 usbehci; C:\Windows\System32\DRIVERS\usbehci.sys [52224 2010-11-21] () [File not signed]
R3 usbhub; C:\Windows\System32\DRIVERS\usbhub.sys [343040 2010-11-21] () [File not signed]
S3 usbohci; C:\Windows\system32\drivers\usbohci.sys [25600 2009-07-14] () [File not signed]
S3 usbprint; C:\Windows\System32\DRIVERS\usbprint.sys [25088 2009-07-14] () [File not signed]
R3 USBSTOR; C:\Windows\System32\DRIVERS\USBSTOR.SYS [91648 2010-11-21] () [File not signed]
R3 usbuhci; C:\Windows\System32\DRIVERS\usbuhci.sys [30720 2009-07-14] () [File not signed]
R3 usbvideo; C:\Windows\System32\Drivers\usbvideo.sys [184960 2010-11-21] () [File not signed]
R0 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-14] () [File not signed]
S3 vga; C:\Windows\System32\DRIVERS\vgapnp.sys [29184 2009-07-14] () [File not signed]
R1 VgaSave; C:\Windows\System32\drivers\vga.sys [29184 2009-07-14] () [File not signed]
S3 vhdmp; C:\Windows\system32\drivers\vhdmp.sys [215936 2010-11-21] () [File not signed]
S3 viaide; C:\Windows\system32\drivers\viaide.sys [17488 2009-07-14] () [File not signed]
R0 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-21] () [File not signed]
R0 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-21] () [File not signed]
R0 volsnap; C:\Windows\System32\drivers\volsnap.sys [295808 2010-11-21] () [File not signed]
S3 vsmraid; C:\Windows\system32\drivers\vsmraid.sys [161872 2009-07-14] () [File not signed]
R3 vwifibus; C:\Windows\System32\DRIVERS\vwifibus.sys [24576 2009-07-14] () [File not signed]
R1 vwififlt; C:\Windows\System32\DRIVERS\vwififlt.sys [59904 2009-07-14] () [File not signed]
R3 vwifimp; C:\Windows\System32\DRIVERS\vwifimp.sys [17920 2009-07-14] () [File not signed]
S3 WacomPen; C:\Windows\system32\drivers\wacompen.sys [27776 2009-07-14] () [File not signed]
S3 WANARP; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
R1 Wanarpv6; C:\Windows\System32\DRIVERS\wanarp.sys [88576 2010-11-21] () [File not signed]
S3 Wd; C:\Windows\system32\drivers\wd.sys [21056 2009-07-14] () [File not signed]
R0 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [654928 2009-07-14] () [File not signed]
R1 WfpLwf; C:\Windows\System32\DRIVERS\wfplwf.sys [12800 2009-07-14] () [File not signed]
S3 WIMMount; C:\Windows\System32\drivers\wimmount.sys [22096 2009-07-14] () [File not signed]
S3 WinUsb; C:\Windows\System32\DRIVERS\WinUsb.sys [41984 2010-11-21] () [File not signed]
R3 WmiAcpi; C:\Windows\System32\DRIVERS\wmiacpi.sys [14336 2009-07-14] () [File not signed]
S4 ws2ifsl; C:\Windows\system32\drivers\ws2ifsl.sys [21504 2009-07-14] () [File not signed]
R3 WudfPf; C:\Windows\System32\drivers\WudfPf.sys [112128 2010-11-21] () [File not signed]
R3 WUDFRd; C:\Windows\System32\DRIVERS\WUDFRd.sys [172544 2010-11-21] () [File not signed]
U5 a486044ffee6da9e;  <===== ATTENTION: Locked Service

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-24 19:22 - 2016-08-24 19:22 - 00000648 _____ C:\Users\DB\Desktop\Total Commander 64 bit.lnk
2016-08-24 19:22 - 2016-08-24 19:22 - 00000634 _____ C:\Users\DB\Desktop\Total Commander.lnk
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Commander
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\Users\DB\AppData\Roaming\GHISLER
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\totalcmd
2016-08-24 19:21 - 2016-08-24 19:21 - 06391912 _____ (Ghisler Software GmbH) C:\Users\DB\Downloads\tcmd852ax32_64.exe
2016-08-23 22:48 - 2016-08-23 22:49 - 00019190 _____ C:\Users\DB\Downloads\Addition.txt
2016-08-23 22:47 - 2016-08-24 19:33 - 00022888 _____ C:\Users\DB\Downloads\FRST.txt
2016-08-23 22:43 - 2016-08-24 19:33 - 00000000 ____D C:\FRST
2016-08-23 22:42 - 2016-08-23 22:42 - 02396672 _____ (Farbar) C:\Users\DB\Downloads\FRST64.exe
2016-08-23 22:23 - 2016-08-23 22:29 - 00000080 _____ C:\Users\DB\Desktop\List_motywacyjny_DariaGuzinska.lnk
2016-08-23 22:23 - 2016-08-23 22:29 - 00000080 _____ C:\Users\DB\Desktop\CV_Daria_Guzinska.lnk
2016-08-23 22:09 - 2016-08-24 19:25 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-23 22:09 - 2016-08-23 22:29 - 00001094 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-08-23 22:09 - 2016-08-23 22:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-08-23 22:09 - 2016-08-23 22:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-23 22:09 - 2016-08-23 22:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-08-23 22:09 - 2016-03-10 14:09 - 00064896 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-08-23 22:09 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-08-23 22:09 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-08-23 22:05 - 2016-08-23 22:06 - 22851472 _____ (Malwarebytes ) C:\Users\DB\Downloads\mbam-setup-2.2.1.1043.exe
2016-08-23 21:41 - 2016-08-23 21:54 - 00000000 ____D C:\Users\DB\Desktop\do ramki
2016-08-23 21:04 - 2016-08-23 21:04 - 00000000 ____D C:\Users\DB\Desktop\inne
2016-08-23 21:03 - 2016-08-23 21:04 - 00000000 ____D C:\Users\DB\Desktop\7.08.2015 Ez7
2016-08-18 22:43 - 2016-08-23 22:29 - 00001130 _____ C:\Users\Public\Desktop\Avira Launcher.lnk
2016-08-18 22:41 - 2016-08-24 18:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2016-08-18 22:40 - 2016-08-18 22:47 - 00000000 ____D C:\Users\DB\AppData\Roaming\Avira
2016-08-18 22:40 - 2016-08-18 22:43 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-18 22:36 - 2016-08-18 22:52 - 00000000 ____D C:\ProgramData\Avira
2016-08-18 22:36 - 2016-08-18 22:43 - 00171752 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2016-08-18 22:36 - 2016-08-18 22:43 - 00145984 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2016-08-18 22:36 - 2016-08-18 22:43 - 00079696 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2016-08-18 22:36 - 2016-08-18 22:43 - 00000000 ____D C:\Program Files (x86)\Avira
2016-08-18 22:36 - 2015-04-09 15:05 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2016-08-18 22:30 - 2016-08-18 22:33 - 167504288 _____ C:\Users\DB\Downloads\avira_free_antivirus_en.exe
2016-08-11 20:33 - 2016-08-11 20:33 - 00803489 _____ C:\Users\DB\Downloads\nabor-recepcjonista-ssm.pdf
2016-08-11 19:13 - 2016-08-11 19:26 - 00000000 ____D C:\Users\DB\Desktop\fb
2016-08-07 11:36 - 2016-08-23 22:29 - 00001011 _____ C:\Users\Public\Desktop\Fotosizer.lnk
2016-08-07 11:36 - 2016-08-07 11:36 - 01830731 _____ C:\Users\DB\Downloads\fsSetup209.exe
2016-08-07 11:36 - 2016-08-07 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fotosizer
2016-08-07 11:36 - 2016-08-07 11:36 - 00000000 ____D C:\Program Files (x86)\Fotosizer
2016-08-07 11:31 - 2016-08-07 11:43 - 00000000 ____D C:\Users\DB\Desktop\wesele wieksza rozdzielczośc
2016-08-06 23:01 - 2016-08-06 23:01 - 00000000 ____D C:\Users\DB\AppData\Roaming\AVG
2016-08-06 23:00 - 2016-08-06 23:00 - 00000000 ____D C:\Users\DB\AppData\Roaming\TuneUp Software
2016-08-06 22:56 - 2016-08-06 23:31 - 00000000 ____D C:\ProgramData\MFAData
2016-08-06 22:56 - 2016-08-06 22:56 - 00000000 ____D C:\Users\DB\AppData\Local\MFAData
2016-08-06 22:53 - 2016-08-06 23:33 - 00000000 ____D C:\Users\DB\AppData\Local\AvgSetupLog
2016-08-06 22:53 - 2016-08-06 23:33 - 00000000 ____D C:\ProgramData\Avg
2016-08-06 22:53 - 2016-08-06 23:31 - 00000000 ____D C:\Users\DB\AppData\Local\Avg
2016-08-06 22:52 - 2016-08-06 22:52 - 02895464 _____ (AVG Technologies) C:\Users\DB\Downloads\AVG_Protection_Free_1144.exe
2016-08-06 22:44 - 2016-08-06 22:44 - 00000000 ____D C:\Users\DB\AppData\Local\CEF
2016-08-06 22:42 - 2016-08-06 23:23 - 00000000 ____D C:\Program Files\Common Files\AV
2016-08-06 22:42 - 2016-08-06 22:42 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2016-08-06 22:41 - 2016-08-06 22:41 - 00992960 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-08-06 22:41 - 2016-08-06 22:41 - 00921280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-08-06 14:30 - 2016-08-06 14:30 - 00000000 ____D C:\Users\DB\Desktop\wesele mateusza
2016-08-04 19:45 - 2016-08-04 20:47 - 00000000 ____D C:\Users\DB\Desktop\do albumu
2016-08-04 19:30 - 2016-08-23 22:29 - 00000621 _____ C:\Users\DB\Desktop\Wzor_oswiadczen.lnk
2016-08-04 19:15 - 2016-08-04 19:29 - 00000844 _____ C:\Users\DB\Desktop\List_motywacyjny_DariaGuzińska.lnk
2016-08-04 19:12 - 2016-08-04 19:30 - 00000754 _____ C:\Users\DB\Desktop\CV_Daria_Guzińska.lnk
2016-08-04 17:32 - 2016-08-07 11:30 - 00000000 ____D C:\Users\DB\Desktop\Ślub_Ellert
2016-07-26 20:58 - 2016-07-26 20:58 - 00000000 ____D C:\Users\DB\Desktop\opony
2016-07-25 10:26 - 2016-07-25 10:27 - 172932293 _____ C:\Users\DB\Desktop\plany nato.rar
2016-07-25 09:57 - 2016-07-25 11:04 - 00000000 ____D C:\Users\DB\Desktop\plany nato

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-24 19:14 - 2009-07-14 07:13 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-24 19:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-08-24 19:10 - 2015-03-07 12:26 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-24 19:10 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-24 19:09 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-24 19:09 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-24 18:51 - 2015-03-07 12:26 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-23 22:29 - 2016-04-29 19:48 - 00001087 _____ C:\Users\DB\Desktop\Video WebCam - Shortcut.lnk
2016-08-23 22:29 - 2016-04-20 20:56 - 00000686 _____ C:\Users\Public\Desktop\PIT Format 2015.lnk
2016-08-23 22:29 - 2016-02-01 19:55 - 00001136 _____ C:\Users\Public\Desktop\OpenOffice 4.1.2.lnk
2016-08-23 22:29 - 2015-11-22 17:41 - 00001119 _____ C:\Users\DB\Desktop\MyHeritage Family Tree Builder.lnk
2016-08-23 22:29 - 2015-07-13 17:03 - 00001146 _____ C:\Users\DB\Desktop\Continue WinRAR installation.lnk
2016-08-23 22:29 - 2015-03-28 12:26 - 00000925 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\e-Deklaracje.lnk
2016-08-23 22:29 - 2015-03-28 12:26 - 00000907 _____ C:\Users\Public\Desktop\e-Deklaracje.lnk
2016-08-23 22:29 - 2015-03-07 12:29 - 00002203 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-23 22:29 - 2015-03-07 12:29 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-23 22:29 - 2015-03-07 12:09 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker 2.6.lnk
2016-08-23 22:29 - 2015-02-15 09:30 - 00002724 _____ C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2016-08-23 22:29 - 2015-02-06 22:14 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2016-08-23 22:29 - 2015-02-06 22:14 - 00002015 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2016-08-23 22:29 - 2015-01-19 00:00 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-08-23 22:29 - 2015-01-19 00:00 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-08-23 22:29 - 2015-01-18 15:46 - 00001035 _____ C:\Users\Public\Desktop\PLAY ONLINE.lnk
2016-08-23 22:29 - 2015-01-18 15:10 - 00001140 _____ C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-23 22:29 - 2015-01-18 15:10 - 00001005 _____ C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-08-23 22:29 - 2009-07-14 07:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001352 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-08-23 22:29 - 2009-07-14 06:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-08-23 22:29 - 2009-07-14 06:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-08-23 22:23 - 2015-10-06 20:52 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-23 22:23 - 2015-10-06 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-23 22:23 - 2015-01-28 15:38 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-08-23 22:22 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2016-08-18 23:02 - 2015-08-16 21:41 - 00000000 ____D C:\Users\DB\AppData\Roaming\System32
2016-08-15 20:03 - 2016-07-20 20:40 - 00000000 ____D C:\Users\DB\Desktop\rozliczenia wypłat
2016-08-06 23:03 - 2015-06-18 20:24 - 00000000 ____D C:\ProgramData\AVAST Software
2016-08-06 22:09 - 2015-01-18 21:29 - 00000000 __RHD C:\Users\DB\Desktop\dane
2016-08-01 20:43 - 2015-03-07 12:26 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-08-01 20:43 - 2015-03-07 12:26 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-28 19:31 - 2016-07-03 10:51 - 00000523 _____ C:\Users\DB\Desktop\konto.txt

==================== Files in the root of some directories =======

2015-03-28 12:22 - 2015-03-28 12:22 - 0003173 _____ () C:\Users\DB\AppData\Local\unins000.dat
2015-03-28 12:22 - 2015-03-28 12:22 - 0011761 _____ () C:\Users\DB\AppData\Local\unins000.msg
2010-11-21 05:24 - 2010-11-21 05:24 - 81635456 ___SH () C:\ProgramData\msekou.exe

Files to move or delete:
====================
C:\ProgramData\msekou.exe


Some files in TEMP:
====================
C:\Users\DB\AppData\Local\Temp\avgnt.exe
C:\Users\DB\AppData\Local\Temp\cdo1001481818.dll
C:\Users\DB\AppData\Local\Temp\cdo1010206394.dll
C:\Users\DB\AppData\Local\Temp\cdo1047534562.dll
C:\Users\DB\AppData\Local\Temp\cdo1078817796.dll
C:\Users\DB\AppData\Local\Temp\cdo1096740462.dll
C:\Users\DB\AppData\Local\Temp\cdo1116959912.dll
C:\Users\DB\AppData\Local\Temp\cdo1119885665.dll
C:\Users\DB\AppData\Local\Temp\cdo1173448703.dll
C:\Users\DB\AppData\Local\Temp\cdo1255340546.dll
C:\Users\DB\AppData\Local\Temp\cdo1373379632.dll
C:\Users\DB\AppData\Local\Temp\cdo148155580.dll
C:\Users\DB\AppData\Local\Temp\cdo1547846313.dll
C:\Users\DB\AppData\Local\Temp\cdo1566170007.dll
C:\Users\DB\AppData\Local\Temp\cdo158060411.dll
C:\Users\DB\AppData\Local\Temp\cdo1712433770.dll
C:\Users\DB\AppData\Local\Temp\cdo174451708.dll
C:\Users\DB\AppData\Local\Temp\cdo1762418010.dll
C:\Users\DB\AppData\Local\Temp\cdo176584984.dll
C:\Users\DB\AppData\Local\Temp\cdo1773476360.dll
C:\Users\DB\AppData\Local\Temp\cdo1791261651.dll
C:\Users\DB\AppData\Local\Temp\cdo1806852259.dll
C:\Users\DB\AppData\Local\Temp\cdo182475311.dll
C:\Users\DB\AppData\Local\Temp\cdo1856374607.dll
C:\Users\DB\AppData\Local\Temp\cdo1868972807.dll
C:\Users\DB\AppData\Local\Temp\cdo1889013740.dll
C:\Users\DB\AppData\Local\Temp\cdo1895818504.dll
C:\Users\DB\AppData\Local\Temp\cdo1906190484.dll
C:\Users\DB\AppData\Local\Temp\cdo2100059350.dll
C:\Users\DB\AppData\Local\Temp\cdo2109306997.dll
C:\Users\DB\AppData\Local\Temp\cdo2122856870.dll
C:\Users\DB\AppData\Local\Temp\cdo2145314215.dll
C:\Users\DB\AppData\Local\Temp\cdo2150726565.dll
C:\Users\DB\AppData\Local\Temp\cdo2199419950.dll
C:\Users\DB\AppData\Local\Temp\cdo2227141440.dll
C:\Users\DB\AppData\Local\Temp\cdo2248590082.dll
C:\Users\DB\AppData\Local\Temp\cdo2278292350.dll
C:\Users\DB\AppData\Local\Temp\cdo2293940864.dll
C:\Users\DB\AppData\Local\Temp\cdo2358648081.dll
C:\Users\DB\AppData\Local\Temp\cdo240289599.dll
C:\Users\DB\AppData\Local\Temp\cdo240974694.dll
C:\Users\DB\AppData\Local\Temp\cdo241041321.dll
C:\Users\DB\AppData\Local\Temp\cdo2438957297.dll
C:\Users\DB\AppData\Local\Temp\cdo244723618.dll
C:\Users\DB\AppData\Local\Temp\cdo250389105.dll
C:\Users\DB\AppData\Local\Temp\cdo2516361301.dll
C:\Users\DB\AppData\Local\Temp\cdo2591293982.dll
C:\Users\DB\AppData\Local\Temp\cdo2598629161.dll
C:\Users\DB\AppData\Local\Temp\cdo2643234154.dll
C:\Users\DB\AppData\Local\Temp\cdo2714327105.dll
C:\Users\DB\AppData\Local\Temp\cdo2726187130.dll
C:\Users\DB\AppData\Local\Temp\cdo2731779601.dll
C:\Users\DB\AppData\Local\Temp\cdo2748823129.dll
C:\Users\DB\AppData\Local\Temp\cdo2765738891.dll
C:\Users\DB\AppData\Local\Temp\cdo2794314028.dll
C:\Users\DB\AppData\Local\Temp\cdo2832551449.dll
C:\Users\DB\AppData\Local\Temp\cdo283763535.dll
C:\Users\DB\AppData\Local\Temp\cdo2846904722.dll
C:\Users\DB\AppData\Local\Temp\cdo2893055673.dll
C:\Users\DB\AppData\Local\Temp\cdo2924877450.dll
C:\Users\DB\AppData\Local\Temp\cdo298417618.dll
C:\Users\DB\AppData\Local\Temp\cdo3012456722.dll
C:\Users\DB\AppData\Local\Temp\cdo3017406704.dll
C:\Users\DB\AppData\Local\Temp\cdo3018118055.dll
C:\Users\DB\AppData\Local\Temp\cdo3042429489.dll
C:\Users\DB\AppData\Local\Temp\cdo3071879492.dll
C:\Users\DB\AppData\Local\Temp\cdo3098951895.dll
C:\Users\DB\AppData\Local\Temp\cdo3110920892.dll
C:\Users\DB\AppData\Local\Temp\cdo3162313492.dll
C:\Users\DB\AppData\Local\Temp\cdo3192895582.dll
C:\Users\DB\AppData\Local\Temp\cdo319494669.dll
C:\Users\DB\AppData\Local\Temp\cdo3228664253.dll
C:\Users\DB\AppData\Local\Temp\cdo3247378287.dll
C:\Users\DB\AppData\Local\Temp\cdo3277840566.dll
C:\Users\DB\AppData\Local\Temp\cdo3360783866.dll
C:\Users\DB\AppData\Local\Temp\cdo3374157000.dll
C:\Users\DB\AppData\Local\Temp\cdo3405629666.dll
C:\Users\DB\AppData\Local\Temp\cdo3473006960.dll
C:\Users\DB\AppData\Local\Temp\cdo3585107226.dll
C:\Users\DB\AppData\Local\Temp\cdo3626807318.dll
C:\Users\DB\AppData\Local\Temp\cdo3665639845.dll
C:\Users\DB\AppData\Local\Temp\cdo3670156315.dll
C:\Users\DB\AppData\Local\Temp\cdo3672104965.dll
C:\Users\DB\AppData\Local\Temp\cdo3717624340.dll
C:\Users\DB\AppData\Local\Temp\cdo3756225155.dll
C:\Users\DB\AppData\Local\Temp\cdo3773697200.dll
C:\Users\DB\AppData\Local\Temp\cdo3784975209.dll
C:\Users\DB\AppData\Local\Temp\cdo381423286.dll
C:\Users\DB\AppData\Local\Temp\cdo384335494.dll
C:\Users\DB\AppData\Local\Temp\cdo385113536.dll
C:\Users\DB\AppData\Local\Temp\cdo3867786731.dll
C:\Users\DB\AppData\Local\Temp\cdo4009086891.dll
C:\Users\DB\AppData\Local\Temp\cdo4015139371.dll
C:\Users\DB\AppData\Local\Temp\cdo4076673918.dll
C:\Users\DB\AppData\Local\Temp\cdo4101033135.dll
C:\Users\DB\AppData\Local\Temp\cdo4123411773.dll
C:\Users\DB\AppData\Local\Temp\cdo4147824508.dll
C:\Users\DB\AppData\Local\Temp\cdo415396196.dll
C:\Users\DB\AppData\Local\Temp\cdo4177621464.dll
C:\Users\DB\AppData\Local\Temp\cdo4198065159.dll
C:\Users\DB\AppData\Local\Temp\cdo4206370592.dll
C:\Users\DB\AppData\Local\Temp\cdo4212328209.dll
C:\Users\DB\AppData\Local\Temp\cdo4248763492.dll
C:\Users\DB\AppData\Local\Temp\cdo4251269634.dll
C:\Users\DB\AppData\Local\Temp\cdo447647799.dll
C:\Users\DB\AppData\Local\Temp\cdo551810919.dll
C:\Users\DB\AppData\Local\Temp\cdo616365180.dll
C:\Users\DB\AppData\Local\Temp\cdo636280018.dll
C:\Users\DB\AppData\Local\Temp\cdo637271969.dll
C:\Users\DB\AppData\Local\Temp\cdo657800327.dll
C:\Users\DB\AppData\Local\Temp\cdo666831844.dll
C:\Users\DB\AppData\Local\Temp\cdo681118209.dll
C:\Users\DB\AppData\Local\Temp\cdo689759874.dll
C:\Users\DB\AppData\Local\Temp\cdo711474529.dll
C:\Users\DB\AppData\Local\Temp\cdo719659906.dll
C:\Users\DB\AppData\Local\Temp\cdo726329267.dll
C:\Users\DB\AppData\Local\Temp\cdo839704822.dll
C:\Users\DB\AppData\Local\Temp\cdo850090587.dll
C:\Users\DB\AppData\Local\Temp\cdo853453590.dll
C:\Users\DB\AppData\Local\Temp\cdo897579601.dll
C:\Users\DB\AppData\Local\Temp\cdo949062024.dll
C:\Users\DB\AppData\Local\Temp\cdo996510038.dll
C:\Users\DB\AppData\Local\Temp\cdo99865362.dll
C:\Users\DB\AppData\Local\Temp\drm_dialogs.dll
C:\Users\DB\AppData\Local\Temp\drm_dyndata_7330004.dll
C:\Users\DB\AppData\Local\Temp\Quarantine.exe
C:\Users\DB\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys
[2010-11-21 05:23] - [2010-11-21 05:23] - 0295808 ____A () D41D8CD98F00B204E9800998ECF8427E

C:\Windows\system32\Drivers\volsnap.sys => no Company Name <===== ATTENTION



testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <===== ATTENTION


LastRegBack: 2016-08-20 10:17

==================== End of FRST.txt ============================