Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 21-08-2016 01
Ran by DB (administrator) on DB-PC (25-08-2016 20:13:02)
Running from C:\Users\DB\Downloads\FRST-OlderVersion
Loaded Profiles: DB (Available Profiles: DB)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Nero AG) C:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Huawei Technologies Co., Ltd.) C:\Users\DB\AppData\Roaming\PLAY ONLINE\ouc.exe
(MyHeritage) C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe
(Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\UsbFix\UsbFix.exe
() C:\UsbFix\UsbFix.exe
() C:\UsbFix\UsbFix.exe
() C:\UsbFix\UsbFix.exe


==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [Family Tree Builder Update] => C:\Program Files (x86)\MyHeritage\Bin\FTBCheckUpdates.exe [2477056 2015-03-02] (MyHeritage)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\Run: [HW_OPENEYE_OUC_PLAY ONLINE] => C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [110592 2009-04-14] (Huawei Technologies Co., Ltd.)
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\Run: [syshost32] => C:\Users\DB\AppData\Local\{766A3571-CB80-C66F-2CBD-0EAE0C9DE25B}\syshost.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\CurrentVersion\Windows: [Load] C:\ProgramData\msekou.exe <===== ATTENTION
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {3039a68e-9f5e-11e4-b165-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {3039a6c4-9f5e-11e4-b165-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {588c95c6-a335-11e4-b140-00235a86bd94} - E:\AutoRun.exe
HKU\S-1-5-21-304442932-291022296-845227809-1000\...\MountPoints2: {f95df7ac-4456-11e6-bdce-001e101f4da1} - G:\Setup.exe
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
GroupPolicy: Restriction - Chrome <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Tcpip\Parameters: [DhcpNameServer] 37.8.214.2 31.11.202.254
Tcpip\..\Interfaces\{2889BFF4-2385-4012-B293-6D9C4929F8D0}: [NameServer] 89.108.195.21 89.108.202.21
Tcpip\..\Interfaces\{67D6819D-962C-4BE4-B694-E9E671ED8F4F}: [NameServer] 89.108.195.21 89.108.202.21
Tcpip\..\Interfaces\{FBB03D04-F02E-40A2-BB71-F155F20C38CD}: [DhcpNameServer] 37.8.214.2 31.11.202.254

Internet Explorer:
==================
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\S-1-5-21-304442932-291022296-845227809-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
HKU\S-1-5-21-304442932-291022296-845227809-1000\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxps://www.google.com/?trackid=sp-006
URLSearchHook: HKLM-x32 -> Default = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = hxxps://www.google.com/search?trackid=sp-006&q={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-304442932-291022296-845227809-1000 -> DefaultScope {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = 
SearchScopes: HKU\S-1-5-21-304442932-291022296-845227809-1000 -> {E9410C70-B6AE-41FF-AB71-32F4B279EA5F} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-28] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-28] (Oracle Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\system32\urlmon.dll [2015-01-12] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2015-01-12] (Microsoft Corporation)

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-05-03] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-05-03] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-28] (Oracle Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2016-06-23] (Adobe Systems Inc.)

Chrome: 
=======
CHR Profile: C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Płatności w sklepie Chrome Web Store) - C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2016-04-02]
CHR Extension: (Chrome Media Router) - C:\Users\DB\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2016-08-20]

==================== Services (Whitelisted) ========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [339456 2010-11-16] () [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)

===================== Drivers (Whitelisted) ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [256000 2010-08-31] (Huawei Technologies Co., Ltd.)
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-25 20:05 - 2016-08-25 20:05 - 00037231 _____ C:\Users\DB\Downloads\Shortcut.txt
2016-08-25 20:03 - 2016-08-25 20:13 - 00000000 ____D C:\Users\DB\Downloads\FRST-OlderVersion
2016-08-25 19:56 - 2016-08-25 19:56 - 00671232 _____ C:\Users\DB\Downloads\MicrosoftFixit50688.msi
2016-08-24 21:45 - 2016-08-24 21:45 - 03124524 _____ (El Desaparecido - SosVirus.net - UsbFix.net) C:\Users\DB\Downloads\UsbFix_2016_8.248_[www.programosy.pl].exe
2016-08-24 21:43 - 2016-08-24 21:43 - 00001450 _____ C:\Users\DB\Desktop\UsbFix.lnk
2016-08-24 21:32 - 2016-08-24 21:43 - 00000000 ____D C:\UsbFix
2016-08-24 21:19 - 2016-08-24 21:20 - 00005112 _____ C:\Users\DB\Desktop\TDSSKiller.3.1.0.11_24.08.2016_21.19.24_log.txt
2016-08-24 21:12 - 2016-08-24 21:12 - 00000000 ____D C:\TDSSKiller_Quarantine
2016-08-24 21:10 - 2016-08-24 21:13 - 00191784 _____ C:\Users\DB\Desktop\TDSSKiller.3.1.0.11_24.08.2016_21.10.50_log.txt
2016-08-24 21:10 - 2016-08-24 21:10 - 04747704 _____ (AO Kaspersky Lab) C:\Users\DB\Downloads\tdsskiller.exe
2016-08-24 20:38 - 2016-08-24 20:38 - 00042433 _____ C:\Users\DB\Desktop\FRST.txt
2016-08-24 20:02 - 2016-08-24 20:02 - 00039648 _____ C:\Users\DB\Desktop\Extras.Txt
2016-08-24 19:52 - 2016-08-24 19:52 - 00075118 _____ C:\Users\DB\Desktop\OTL.Txt
2016-08-24 19:52 - 2016-08-24 19:52 - 00039648 _____ C:\Users\DB\Downloads\Extras.Txt
2016-08-24 19:49 - 2016-08-24 19:49 - 00075118 _____ C:\Users\DB\Downloads\OTL.Txt
2016-08-24 19:40 - 2016-08-24 19:40 - 00602112 _____ (OldTimer Tools) C:\Users\DB\Downloads\OTL_www.INSTALKI.pl.exe
2016-08-24 19:22 - 2016-08-24 19:22 - 00000648 _____ C:\Users\DB\Desktop\Total Commander 64 bit.lnk
2016-08-24 19:22 - 2016-08-24 19:22 - 00000634 _____ C:\Users\DB\Desktop\Total Commander.lnk
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Total Commander
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\Users\DB\AppData\Roaming\GHISLER
2016-08-24 19:22 - 2016-08-24 19:22 - 00000000 ____D C:\totalcmd
2016-08-24 19:21 - 2016-08-24 19:21 - 06391912 _____ (Ghisler Software GmbH) C:\Users\DB\Downloads\tcmd852ax32_64.exe
2016-08-23 22:48 - 2016-08-25 20:05 - 00019087 _____ C:\Users\DB\Downloads\Addition.txt
2016-08-23 22:47 - 2016-08-25 20:05 - 00028743 _____ C:\Users\DB\Downloads\FRST.txt
2016-08-23 22:43 - 2016-08-25 20:13 - 00000000 ____D C:\FRST
2016-08-23 22:42 - 2016-08-25 20:03 - 02396160 _____ (Farbar) C:\Users\DB\Downloads\FRST64.exe
2016-08-23 22:23 - 2016-08-23 22:29 - 00000080 _____ C:\Users\DB\Desktop\List_motywacyjny_DariaGuzinska.lnk
2016-08-23 22:23 - 2016-08-23 22:29 - 00000080 _____ C:\Users\DB\Desktop\CV_Daria_Guzinska.lnk
2016-08-23 22:09 - 2016-08-23 22:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-23 22:05 - 2016-08-23 22:06 - 22851472 _____ (Malwarebytes ) C:\Users\DB\Downloads\mbam-setup-2.2.1.1043.exe
2016-08-23 21:41 - 2016-08-23 21:54 - 00000000 ____D C:\Users\DB\Desktop\do ramki
2016-08-23 21:04 - 2016-08-23 21:04 - 00000000 ____D C:\Users\DB\Desktop\inne
2016-08-23 21:03 - 2016-08-23 21:04 - 00000000 ____D C:\Users\DB\Desktop\7.08.2015 Ez7
2016-08-18 22:40 - 2016-08-24 21:55 - 00000000 ____D C:\Users\DB\AppData\Roaming\Avira
2016-08-18 22:36 - 2016-08-24 22:06 - 00000000 ____D C:\Program Files (x86)\Avira
2016-08-18 22:36 - 2016-08-24 21:56 - 00000000 ____D C:\ProgramData\Avira
2016-08-18 22:30 - 2016-08-18 22:33 - 167504288 _____ C:\Users\DB\Downloads\avira_free_antivirus_en.exe
2016-08-11 20:33 - 2016-08-11 20:33 - 00803489 _____ C:\Users\DB\Downloads\nabor-recepcjonista-ssm.pdf
2016-08-11 19:13 - 2016-08-11 19:26 - 00000000 ____D C:\Users\DB\Desktop\fb
2016-08-07 11:36 - 2016-08-23 22:29 - 00001011 _____ C:\Users\Public\Desktop\Fotosizer.lnk
2016-08-07 11:36 - 2016-08-07 11:36 - 01830731 _____ C:\Users\DB\Downloads\fsSetup209.exe
2016-08-07 11:36 - 2016-08-07 11:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fotosizer
2016-08-07 11:36 - 2016-08-07 11:36 - 00000000 ____D C:\Program Files (x86)\Fotosizer
2016-08-07 11:31 - 2016-08-07 11:43 - 00000000 ____D C:\Users\DB\Desktop\wesele wieksza rozdzielczośc
2016-08-06 23:01 - 2016-08-06 23:01 - 00000000 ____D C:\Users\DB\AppData\Roaming\AVG
2016-08-06 23:00 - 2016-08-06 23:00 - 00000000 ____D C:\Users\DB\AppData\Roaming\TuneUp Software
2016-08-06 22:56 - 2016-08-06 23:31 - 00000000 ____D C:\ProgramData\MFAData
2016-08-06 22:56 - 2016-08-06 22:56 - 00000000 ____D C:\Users\DB\AppData\Local\MFAData
2016-08-06 22:53 - 2016-08-06 23:33 - 00000000 ____D C:\Users\DB\AppData\Local\AvgSetupLog
2016-08-06 22:53 - 2016-08-06 23:33 - 00000000 ____D C:\ProgramData\Avg
2016-08-06 22:53 - 2016-08-06 23:31 - 00000000 ____D C:\Users\DB\AppData\Local\Avg
2016-08-06 22:52 - 2016-08-06 22:52 - 02895464 _____ (AVG Technologies) C:\Users\DB\Downloads\AVG_Protection_Free_1144.exe
2016-08-06 22:44 - 2016-08-06 22:44 - 00000000 ____D C:\Users\DB\AppData\Local\CEF
2016-08-06 22:42 - 2016-08-06 23:23 - 00000000 ____D C:\Program Files\Common Files\AV
2016-08-06 22:42 - 2016-08-06 22:42 - 00000000 ____D C:\Windows\System32\Tasks\AVAST Software
2016-08-06 22:41 - 2016-08-06 22:41 - 00992960 _____ (Microsoft Corporation) C:\Windows\system32\ucrtbase.dll
2016-08-06 22:41 - 2016-08-06 22:41 - 00921280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ucrtbase.dll
2016-08-06 14:30 - 2016-08-06 14:30 - 00000000 ____D C:\Users\DB\Desktop\wesele mateusza
2016-08-04 19:45 - 2016-08-04 20:47 - 00000000 ____D C:\Users\DB\Desktop\do albumu
2016-08-04 19:30 - 2016-08-23 22:29 - 00000621 _____ C:\Users\DB\Desktop\Wzor_oswiadczen.lnk
2016-08-04 19:15 - 2016-08-04 19:29 - 00000844 _____ C:\Users\DB\Desktop\List_motywacyjny_DariaGuzińska.lnk
2016-08-04 19:12 - 2016-08-04 19:30 - 00000754 _____ C:\Users\DB\Desktop\CV_Daria_Guzińska.lnk
2016-08-04 17:32 - 2016-08-07 11:30 - 00000000 ____D C:\Users\DB\Desktop\Ślub_Ellert
2016-07-26 20:58 - 2016-07-26 20:58 - 00000000 ____D C:\Users\DB\Desktop\opony

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2016-08-25 20:11 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-08-25 20:11 - 2009-07-14 06:45 - 00016640 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-08-25 20:07 - 2009-07-14 07:13 - 00778834 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-25 20:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\inf
2016-08-25 19:50 - 2015-03-07 12:26 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-08-25 14:59 - 2015-03-07 12:26 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-08-25 14:59 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-24 21:15 - 2015-03-14 20:08 - 00000258 __RSH C:\ProgramData\ntuser.pol
2016-08-23 22:29 - 2016-04-29 19:48 - 00001087 _____ C:\Users\DB\Desktop\Video WebCam - Shortcut.lnk
2016-08-23 22:29 - 2016-04-20 20:56 - 00000686 _____ C:\Users\Public\Desktop\PIT Format 2015.lnk
2016-08-23 22:29 - 2016-02-01 19:55 - 00001136 _____ C:\Users\Public\Desktop\OpenOffice 4.1.2.lnk
2016-08-23 22:29 - 2015-11-22 17:41 - 00001119 _____ C:\Users\DB\Desktop\MyHeritage Family Tree Builder.lnk
2016-08-23 22:29 - 2015-07-13 17:03 - 00001146 _____ C:\Users\DB\Desktop\Continue WinRAR installation.lnk
2016-08-23 22:29 - 2015-03-28 12:26 - 00000925 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\e-Deklaracje.lnk
2016-08-23 22:29 - 2015-03-28 12:26 - 00000907 _____ C:\Users\Public\Desktop\e-Deklaracje.lnk
2016-08-23 22:29 - 2015-03-07 12:29 - 00002203 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2016-08-23 22:29 - 2015-03-07 12:29 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2016-08-23 22:29 - 2015-03-07 12:09 - 00002507 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Movie Maker 2.6.lnk
2016-08-23 22:29 - 2015-02-15 09:30 - 00002724 _____ C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2016-08-23 22:29 - 2015-02-06 22:14 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2016-08-23 22:29 - 2015-02-06 22:14 - 00002015 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2016-08-23 22:29 - 2015-01-19 00:00 - 00001345 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Media Center.lnk
2016-08-23 22:29 - 2015-01-19 00:00 - 00001326 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows DVD Maker.lnk
2016-08-23 22:29 - 2015-01-18 15:46 - 00001035 _____ C:\Users\Public\Desktop\PLAY ONLINE.lnk
2016-08-23 22:29 - 2015-01-18 15:10 - 00001140 _____ C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2016-08-23 22:29 - 2015-01-18 15:10 - 00001005 _____ C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2016-08-23 22:29 - 2009-07-14 07:01 - 00001282 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Default Programs.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001352 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Anytime Upgrade.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001330 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sidebar.lnk
2016-08-23 22:29 - 2009-07-14 06:57 - 00001246 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XPS Viewer.lnk
2016-08-23 22:29 - 2009-07-14 06:54 - 00001210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Fax and Scan.lnk
2016-08-23 22:29 - 2009-07-14 06:49 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Windows Update.lnk
2016-08-23 22:23 - 2015-10-06 20:52 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-23 22:23 - 2015-10-06 20:52 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2016-08-23 22:23 - 2015-01-28 15:38 - 00000000 ____D C:\Users\DB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2016-08-23 22:22 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\oobe
2016-08-18 23:02 - 2015-08-16 21:41 - 00000000 ____D C:\Users\DB\AppData\Roaming\System32
2016-08-15 20:03 - 2016-07-20 20:40 - 00000000 ____D C:\Users\DB\Desktop\rozliczenia wypłat
2016-08-06 23:03 - 2015-06-18 20:24 - 00000000 ____D C:\ProgramData\AVAST Software
2016-08-06 22:09 - 2015-01-18 21:29 - 00000000 __RHD C:\Users\DB\Desktop\dane
2016-08-01 20:43 - 2015-03-07 12:26 - 00003894 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2016-08-01 20:43 - 2015-03-07 12:26 - 00003642 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2016-07-28 19:31 - 2016-07-03 10:51 - 00000523 _____ C:\Users\DB\Desktop\konto.txt

==================== Files in the root of some directories =======

2015-03-28 12:22 - 2015-03-28 12:22 - 0003173 _____ () C:\Users\DB\AppData\Local\unins000.dat
2015-03-28 12:22 - 2015-03-28 12:22 - 0011761 _____ () C:\Users\DB\AppData\Local\unins000.msg
2010-11-21 05:24 - 2010-11-21 05:24 - 81635456 ___SH () C:\ProgramData\msekou.exe

Files to move or delete:
====================
C:\ProgramData\msekou.exe


Some files in TEMP:
====================
C:\Users\DB\AppData\Local\Temp\avgnt.exe
C:\Users\DB\AppData\Local\Temp\cdo1001481818.dll
C:\Users\DB\AppData\Local\Temp\cdo1010206394.dll
C:\Users\DB\AppData\Local\Temp\cdo1047534562.dll
C:\Users\DB\AppData\Local\Temp\cdo1078817796.dll
C:\Users\DB\AppData\Local\Temp\cdo1096740462.dll
C:\Users\DB\AppData\Local\Temp\cdo1116959912.dll
C:\Users\DB\AppData\Local\Temp\cdo1119885665.dll
C:\Users\DB\AppData\Local\Temp\cdo1173448703.dll
C:\Users\DB\AppData\Local\Temp\cdo1255340546.dll
C:\Users\DB\AppData\Local\Temp\cdo1373379632.dll
C:\Users\DB\AppData\Local\Temp\cdo148155580.dll
C:\Users\DB\AppData\Local\Temp\cdo1547846313.dll
C:\Users\DB\AppData\Local\Temp\cdo1566170007.dll
C:\Users\DB\AppData\Local\Temp\cdo158060411.dll
C:\Users\DB\AppData\Local\Temp\cdo1712433770.dll
C:\Users\DB\AppData\Local\Temp\cdo174451708.dll
C:\Users\DB\AppData\Local\Temp\cdo1762418010.dll
C:\Users\DB\AppData\Local\Temp\cdo176584984.dll
C:\Users\DB\AppData\Local\Temp\cdo1773476360.dll
C:\Users\DB\AppData\Local\Temp\cdo1791261651.dll
C:\Users\DB\AppData\Local\Temp\cdo1806852259.dll
C:\Users\DB\AppData\Local\Temp\cdo182475311.dll
C:\Users\DB\AppData\Local\Temp\cdo1856374607.dll
C:\Users\DB\AppData\Local\Temp\cdo1868972807.dll
C:\Users\DB\AppData\Local\Temp\cdo1889013740.dll
C:\Users\DB\AppData\Local\Temp\cdo1895818504.dll
C:\Users\DB\AppData\Local\Temp\cdo1906190484.dll
C:\Users\DB\AppData\Local\Temp\cdo2100059350.dll
C:\Users\DB\AppData\Local\Temp\cdo2109306997.dll
C:\Users\DB\AppData\Local\Temp\cdo2122856870.dll
C:\Users\DB\AppData\Local\Temp\cdo2145314215.dll
C:\Users\DB\AppData\Local\Temp\cdo2150726565.dll
C:\Users\DB\AppData\Local\Temp\cdo2199419950.dll
C:\Users\DB\AppData\Local\Temp\cdo2227141440.dll
C:\Users\DB\AppData\Local\Temp\cdo2248590082.dll
C:\Users\DB\AppData\Local\Temp\cdo2278292350.dll
C:\Users\DB\AppData\Local\Temp\cdo2293940864.dll
C:\Users\DB\AppData\Local\Temp\cdo2358648081.dll
C:\Users\DB\AppData\Local\Temp\cdo240289599.dll
C:\Users\DB\AppData\Local\Temp\cdo240974694.dll
C:\Users\DB\AppData\Local\Temp\cdo241041321.dll
C:\Users\DB\AppData\Local\Temp\cdo2438957297.dll
C:\Users\DB\AppData\Local\Temp\cdo244723618.dll
C:\Users\DB\AppData\Local\Temp\cdo250389105.dll
C:\Users\DB\AppData\Local\Temp\cdo2516361301.dll
C:\Users\DB\AppData\Local\Temp\cdo2591293982.dll
C:\Users\DB\AppData\Local\Temp\cdo2598629161.dll
C:\Users\DB\AppData\Local\Temp\cdo2643234154.dll
C:\Users\DB\AppData\Local\Temp\cdo2714327105.dll
C:\Users\DB\AppData\Local\Temp\cdo2726187130.dll
C:\Users\DB\AppData\Local\Temp\cdo2731779601.dll
C:\Users\DB\AppData\Local\Temp\cdo2748823129.dll
C:\Users\DB\AppData\Local\Temp\cdo2765738891.dll
C:\Users\DB\AppData\Local\Temp\cdo2794314028.dll
C:\Users\DB\AppData\Local\Temp\cdo2832551449.dll
C:\Users\DB\AppData\Local\Temp\cdo283763535.dll
C:\Users\DB\AppData\Local\Temp\cdo2846904722.dll
C:\Users\DB\AppData\Local\Temp\cdo2893055673.dll
C:\Users\DB\AppData\Local\Temp\cdo2924877450.dll
C:\Users\DB\AppData\Local\Temp\cdo298417618.dll
C:\Users\DB\AppData\Local\Temp\cdo3012456722.dll
C:\Users\DB\AppData\Local\Temp\cdo3017406704.dll
C:\Users\DB\AppData\Local\Temp\cdo3018118055.dll
C:\Users\DB\AppData\Local\Temp\cdo3042429489.dll
C:\Users\DB\AppData\Local\Temp\cdo3071879492.dll
C:\Users\DB\AppData\Local\Temp\cdo3098951895.dll
C:\Users\DB\AppData\Local\Temp\cdo3110920892.dll
C:\Users\DB\AppData\Local\Temp\cdo3162313492.dll
C:\Users\DB\AppData\Local\Temp\cdo3192895582.dll
C:\Users\DB\AppData\Local\Temp\cdo319494669.dll
C:\Users\DB\AppData\Local\Temp\cdo3228664253.dll
C:\Users\DB\AppData\Local\Temp\cdo3247378287.dll
C:\Users\DB\AppData\Local\Temp\cdo3277840566.dll
C:\Users\DB\AppData\Local\Temp\cdo3360783866.dll
C:\Users\DB\AppData\Local\Temp\cdo3374157000.dll
C:\Users\DB\AppData\Local\Temp\cdo3405629666.dll
C:\Users\DB\AppData\Local\Temp\cdo3473006960.dll
C:\Users\DB\AppData\Local\Temp\cdo3585107226.dll
C:\Users\DB\AppData\Local\Temp\cdo3626807318.dll
C:\Users\DB\AppData\Local\Temp\cdo3665639845.dll
C:\Users\DB\AppData\Local\Temp\cdo3670156315.dll
C:\Users\DB\AppData\Local\Temp\cdo3672104965.dll
C:\Users\DB\AppData\Local\Temp\cdo3717624340.dll
C:\Users\DB\AppData\Local\Temp\cdo3756225155.dll
C:\Users\DB\AppData\Local\Temp\cdo3773697200.dll
C:\Users\DB\AppData\Local\Temp\cdo3784975209.dll
C:\Users\DB\AppData\Local\Temp\cdo381423286.dll
C:\Users\DB\AppData\Local\Temp\cdo384335494.dll
C:\Users\DB\AppData\Local\Temp\cdo385113536.dll
C:\Users\DB\AppData\Local\Temp\cdo3867786731.dll
C:\Users\DB\AppData\Local\Temp\cdo4009086891.dll
C:\Users\DB\AppData\Local\Temp\cdo4015139371.dll
C:\Users\DB\AppData\Local\Temp\cdo4076673918.dll
C:\Users\DB\AppData\Local\Temp\cdo4101033135.dll
C:\Users\DB\AppData\Local\Temp\cdo4123411773.dll
C:\Users\DB\AppData\Local\Temp\cdo4147824508.dll
C:\Users\DB\AppData\Local\Temp\cdo415396196.dll
C:\Users\DB\AppData\Local\Temp\cdo4177621464.dll
C:\Users\DB\AppData\Local\Temp\cdo4198065159.dll
C:\Users\DB\AppData\Local\Temp\cdo4206370592.dll
C:\Users\DB\AppData\Local\Temp\cdo4212328209.dll
C:\Users\DB\AppData\Local\Temp\cdo4248763492.dll
C:\Users\DB\AppData\Local\Temp\cdo4251269634.dll
C:\Users\DB\AppData\Local\Temp\cdo447647799.dll
C:\Users\DB\AppData\Local\Temp\cdo551810919.dll
C:\Users\DB\AppData\Local\Temp\cdo616365180.dll
C:\Users\DB\AppData\Local\Temp\cdo636280018.dll
C:\Users\DB\AppData\Local\Temp\cdo637271969.dll
C:\Users\DB\AppData\Local\Temp\cdo657800327.dll
C:\Users\DB\AppData\Local\Temp\cdo666831844.dll
C:\Users\DB\AppData\Local\Temp\cdo681118209.dll
C:\Users\DB\AppData\Local\Temp\cdo689759874.dll
C:\Users\DB\AppData\Local\Temp\cdo711474529.dll
C:\Users\DB\AppData\Local\Temp\cdo719659906.dll
C:\Users\DB\AppData\Local\Temp\cdo726329267.dll
C:\Users\DB\AppData\Local\Temp\cdo839704822.dll
C:\Users\DB\AppData\Local\Temp\cdo850090587.dll
C:\Users\DB\AppData\Local\Temp\cdo853453590.dll
C:\Users\DB\AppData\Local\Temp\cdo897579601.dll
C:\Users\DB\AppData\Local\Temp\cdo949062024.dll
C:\Users\DB\AppData\Local\Temp\cdo996510038.dll
C:\Users\DB\AppData\Local\Temp\cdo99865362.dll
C:\Users\DB\AppData\Local\Temp\drm_dialogs.dll
C:\Users\DB\AppData\Local\Temp\drm_dyndata_7330004.dll
C:\Users\DB\AppData\Local\Temp\Quarantine.exe
C:\Users\DB\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


testsigning: ==> 'testsigning' is set. Check for possible unsigned driver <===== ATTENTION


LastRegBack: 2016-08-20 10:17

==================== End of FRST.txt ============================