Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2013 02
Ran by mato (administrator) on MATO-KOMPUTER on 20-12-2013 17:28:52
Running from C:\Users\mato\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: Polish
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeSvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeSvc2.exe
(Cherished Technololgy LIMITED) C:\ProgramData\WPM\wprotectmanager.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Elex do Brasil Participações Ltda) C:\Program Files (x86)\iSafe\iSafeTray.exe
(Apple Computer, Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Mozilla Corporation) C:\Program Files (x86)\dMozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Mozilla Corporation) C:\Program Files (x86)\dMozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
() C:\Windows\Temp\svchost.exe
(Electronic Arts) C:\Program Files (x86)\Origin\Origin.exe
(Electronic Arts) C:\Program Files (x86)\Origin\OriginClientService.exe
(OldTimer Tools) C:\Users\mato\Downloads\OTL.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [Windows Defender] - [x]
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)
HKCU\...\Run: [Audio HD Driver] - C:\Users\mato\AppData\Local\Temp\HDAudio.exe <===== ATTENTION
HKCU\...\Run: [EADM] - C:\Program Files (x86)\Origin\Origin.exe [3551576 2013-12-05] (Electronic Arts)
HKCU\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKCU\...\Policies\Explorer: [DisableThumbnails] 1
HKCU\...\Policies\Explorer: [TaskbarNoNotification] 1
HKCU\...\Policies\Explorer: [NoStartMenuMorePrograms] 1
MountPoints2: {3f513e44-4300-11e3-8bde-5404a6b0d4c8} - F:\setup.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.aartemis.com/web/?type=ds&ts=1386272332&from=cor&uid=HitachiXHTS547550A9E384_J2170052GZE24DGZE24DX&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.aartemis.com/web/?type=ds&ts=1386272332&from=cor&uid=HitachiXHTS547550A9E384_J2170052GZE24DGZE24DX&q={searchTerms}
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 88.208.105.1 192.168.10.1

FireFox:
========
FF ProfilePath: C:\Users\mato\AppData\Roaming\Mozilla\Firefox\Profiles\esk5atoh.default
FF user.js: detected! => C:\Users\mato\AppData\Roaming\Mozilla\Firefox\Profiles\esk5atoh.default\user.js
FF NewTab: about:blank
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: about:blank
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll No File
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll No File
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll No File
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Extension: Adblock Plus - C:\Users\mato\AppData\Roaming\Mozilla\Firefox\Profiles\esk5atoh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

Chrome: 
=======
CHR HomePage: about:blank
CHR RestoreOnStartup: "about:blank"
CHR DefaultSearchKeyword: Google
CHR DefaultSearchProvider: Google
CHR DefaultSearchURL: http://www.google.com/search?q={searchTerms}
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Google Wallet) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\mato\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx

==================== Services (Whitelisted) =================

R2 iSafeService; C:\Program Files (x86)\iSafe\iSafeSvc.exe [356520 2013-10-24] (Elex do Brasil Participações Ltda)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-18] (NVIDIA Corporation)
R2 Wpm; C:\ProgramData\WPM\wprotectmanager.exe [499856 2013-12-05] (Cherished Technololgy LIMITED)

==================== Drivers (Whitelisted) ====================

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-11-01] (Disc Soft Ltd)
R3 iSafeKrnl; C:\Program Files (x86)\iSafe\iSafeKrnl.sys [192000 2013-10-24] (Elex do Brasil Participações Ltda)
R1 iSafeNetFilter; C:\Program Files (x86)\iSafe\iSafeNetFilter.sys [44032 2013-10-24] (Elex do Brasil Participações Ltda)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-28] (NVIDIA Corporation)
S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-12-20 17:28 - 2013-12-20 17:29 - 00007567 _____ C:\Users\mato\Downloads\FRST.txt
2013-12-20 17:27 - 2013-12-20 17:27 - 02193141 _____ (Farbar) C:\Users\mato\Downloads\FRST64.exe
2013-12-20 17:26 - 2013-12-20 17:26 - 00602112 _____ (OldTimer Tools) C:\Users\mato\Downloads\OTL.exe
2013-12-20 17:06 - 2013-12-20 17:06 - 02347384 _____ (ESET) C:\Users\mato\Downloads\esetsmartinstaller_plk.exe
2013-12-20 17:06 - 2013-12-20 17:06 - 00000000 ____D C:\Program Files (x86)\ESET
2013-12-20 13:54 - 2013-12-20 13:54 - 00000000 ____D C:\Program Files (x86)\dMozilla Firefox
2013-12-15 20:43 - 2013-12-18 20:27 - 00000000 ____D C:\Users\mato\Desktop\nowe
2013-12-15 19:58 - 2013-12-15 19:58 - 00000000 ____D C:\Users\mato\Desktop\ss
2013-12-14 13:49 - 2013-12-15 12:57 - 00000000 ____D C:\Users\mato\Documents\FIFA 12
2013-12-13 10:46 - 2013-12-13 10:46 - 00003735 _____ C:\Users\mato\Desktop\verte.txt
2013-12-12 20:57 - 2013-12-12 22:04 - 00010018 _____ C:\Users\mato\Desktop\skarga.txt
2013-12-12 11:20 - 2013-12-13 00:02 - 00000000 ____D C:\Users\mato\Desktop\nnnn
2013-12-12 01:02 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 01:02 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 01:02 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 01:02 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-12 01:00 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-12 01:00 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-12 01:00 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-12 01:00 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-12 01:00 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-12 01:00 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-12 01:00 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-12 01:00 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-12 01:00 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-12 01:00 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-12 01:00 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-12 01:00 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-12 01:00 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-12 01:00 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-12 01:00 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-12 01:00 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-12 01:00 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-12 01:00 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-12 01:00 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-12 01:00 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-12 01:00 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-12 01:00 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-12 01:00 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-12 01:00 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-12 01:00 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-12 01:00 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-12 01:00 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-12 01:00 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-12 01:00 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-12 01:00 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-12 01:00 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-11 14:26 - 2013-12-13 01:50 - 405306575 _____ C:\Windows\MEMORY.DMP
2013-12-11 14:13 - 2013-12-11 14:13 - 00046019 _____ C:\Users\mato\Desktop\lae2.ipl
2013-12-11 10:29 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 10:29 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 10:29 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 10:29 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 10:29 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 10:29 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 10:29 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 10:29 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 10:29 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 10:29 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 10:29 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 10:29 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 10:29 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 10:29 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 10:29 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 10:29 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 10:29 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 10:29 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 10:29 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2013-12-09 22:38 - 2013-12-19 19:47 - 00000000 ____D C:\Users\mato\Desktop\ganton ss
2013-12-07 00:37 - 2013-12-07 00:59 - 01851393 _____ C:\Users\mato\Desktop\Nowy Prezentacja programu Microsoft PowerPoint.pptx
2013-12-05 22:04 - 2013-12-08 10:26 - 00005936 _____ C:\Windows\PFRO.log
2013-12-05 21:59 - 2013-12-05 21:59 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-12-05 21:57 - 2013-12-05 21:59 - 00000000 ____D C:\Users\mato\AppData\Local\Origin
2013-12-05 21:52 - 2013-12-20 17:13 - 00000000 ____D C:\ProgramData\Origin
2013-12-05 21:52 - 2013-12-05 21:52 - 00000979 _____ C:\Users\Public\Desktop\Origin.lnk
2013-12-05 21:51 - 2013-12-20 17:12 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-05 21:36 - 2013-12-05 21:52 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-12-05 21:26 - 2013-12-05 21:26 - 00001230 _____ C:\Users\mato\Desktop\fifa14-www.skidrowcrack.com.exe.lnk
2013-12-05 21:22 - 2013-12-20 16:06 - 00006012 _____ C:\Windows\setupact.log
2013-12-05 21:22 - 2013-12-05 21:22 - 00000000 _____ C:\Windows\setuperr.log
2013-12-05 21:13 - 2013-12-20 17:12 - 00000000 ____D C:\Users\mato\AppData\Roaming\Origin
2013-12-05 21:13 - 2013-12-05 21:13 - 00003116 _____ C:\Windows\System32\Tasks\Origin
2013-12-05 20:39 - 2013-12-05 20:40 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\wangzhisong\AppData\Local\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\wangzhisong
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\Documents\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\AppData\Local\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\AppData\Local\cache
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\ProgramData\WPM
2013-12-04 00:58 - 2013-12-17 22:13 - 00000000 ____D C:\Users\mato\AppData\Roaming\TS3Client
2013-12-04 00:56 - 2013-12-04 19:08 - 00001011 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-12-04 00:56 - 2013-12-04 00:56 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-11-24 23:21 - 2013-12-05 21:14 - 00000000 ____D C:\Users\mato\AppData\Roaming\NVIDIA
2013-11-22 15:57 - 2013-11-22 15:57 - 00000000 ____D C:\ProgramData\Steam
2013-11-22 15:56 - 2013-11-22 15:56 - 00000000 ____D C:\ProgramData\Package Cache
2013-11-22 15:54 - 2008-10-15 06:22 - 05631312 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll
2013-11-22 15:54 - 2008-10-15 06:22 - 04379984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_40.dll
2013-11-22 15:54 - 2008-10-15 06:22 - 02605920 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll
2013-11-22 15:54 - 2008-10-15 06:22 - 02036576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_40.dll
2013-11-22 15:54 - 2008-10-15 06:22 - 00519000 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll
2013-11-22 15:54 - 2008-10-15 06:22 - 00452440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_40.dll
2013-11-22 15:51 - 2013-11-22 15:51 - 00000521 _____ C:\Users\Public\Desktop\Call of Duty Ghosts.lnk
2013-11-20 10:46 - 2013-04-17 08:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-11-20 10:46 - 2013-04-17 07:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-11-20 10:46 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-20 10:46 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

==================== One Month Modified Files and Folders =======

2013-12-20 17:29 - 2013-12-20 17:28 - 00007567 _____ C:\Users\mato\Downloads\FRST.txt
2013-12-20 17:27 - 2013-12-20 17:27 - 02193141 _____ (Farbar) C:\Users\mato\Downloads\FRST64.exe
2013-12-20 17:26 - 2013-12-20 17:26 - 00602112 _____ (OldTimer Tools) C:\Users\mato\Downloads\OTL.exe
2013-12-20 17:15 - 2013-11-09 14:08 - 00000930 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-12-20 17:13 - 2013-12-05 21:52 - 00000000 ____D C:\ProgramData\Origin
2013-12-20 17:12 - 2013-12-05 21:51 - 00000000 ____D C:\Program Files (x86)\Origin
2013-12-20 17:12 - 2013-12-05 21:13 - 00000000 ____D C:\Users\mato\AppData\Roaming\Origin
2013-12-20 17:11 - 2013-11-01 15:13 - 01269650 _____ C:\Windows\WindowsUpdate.log
2013-12-20 17:08 - 2013-11-01 16:34 - 00000000 ____D C:\Users\mato\AppData\Roaming\Skype
2013-12-20 17:06 - 2013-12-20 17:06 - 02347384 _____ (ESET) C:\Users\mato\Downloads\esetsmartinstaller_plk.exe
2013-12-20 17:06 - 2013-12-20 17:06 - 00000000 ____D C:\Program Files (x86)\ESET
2013-12-20 17:02 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\LiveKernelReports
2013-12-20 16:34 - 2013-11-10 14:24 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-12-20 16:14 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-12-20 16:14 - 2009-07-14 05:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-12-20 16:10 - 2013-11-01 16:26 - 00000000 ____D C:\Program Files (x86)\iSafe
2013-12-20 16:07 - 2013-11-12 21:26 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 16:07 - 2013-11-10 14:23 - 00001040 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-12-20 16:06 - 2013-12-05 21:22 - 00006012 _____ C:\Windows\setupact.log
2013-12-20 16:06 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-12-20 16:05 - 2013-11-01 16:30 - 00000000 ____D C:\ProgramData\NVIDIA
2013-12-20 13:54 - 2013-12-20 13:54 - 00000000 ____D C:\Program Files (x86)\dMozilla Firefox
2013-12-19 19:47 - 2013-12-09 22:38 - 00000000 ____D C:\Users\mato\Desktop\ganton ss
2013-12-18 20:27 - 2013-12-15 20:43 - 00000000 ____D C:\Users\mato\Desktop\nowe
2013-12-17 22:13 - 2013-12-04 00:58 - 00000000 ____D C:\Users\mato\AppData\Roaming\TS3Client
2013-12-15 19:58 - 2013-12-15 19:58 - 00000000 ____D C:\Users\mato\Desktop\ss
2013-12-15 12:57 - 2013-12-14 13:49 - 00000000 ____D C:\Users\mato\Documents\FIFA 12
2013-12-13 13:58 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-13 10:46 - 2013-12-13 10:46 - 00003735 _____ C:\Users\mato\Desktop\verte.txt
2013-12-13 02:43 - 2013-11-02 13:29 - 00000000 ____D C:\Users\mato\AppData\Roaming\uTorrent
2013-12-13 01:50 - 2013-12-11 14:26 - 405306575 _____ C:\Windows\MEMORY.DMP
2013-12-13 01:50 - 2013-11-03 00:10 - 00000000 ____D C:\Windows\Minidump
2013-12-13 01:39 - 2013-11-01 16:03 - 00000000 ____D C:\Users\mato
2013-12-13 01:31 - 2013-11-12 21:26 - 00001154 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-12-13 01:31 - 2013-11-10 14:24 - 00002189 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-12-13 01:31 - 2013-11-01 16:04 - 00001421 _____ C:\Users\mato\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-13 00:02 - 2013-12-12 11:20 - 00000000 ____D C:\Users\mato\Desktop\nnnn
2013-12-12 22:04 - 2013-12-12 20:57 - 00010018 _____ C:\Users\mato\Desktop\skarga.txt
2013-12-12 10:44 - 2009-07-14 05:45 - 02344992 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 20:48 - 2013-11-12 22:22 - 00010804 _____ C:\Users\mato\Desktop\Nowy dokument tekstowy.txt
2013-12-11 14:13 - 2013-12-11 14:13 - 00046019 _____ C:\Users\mato\Desktop\lae2.ipl
2013-12-10 22:15 - 2013-11-09 14:08 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-10 22:15 - 2013-11-09 14:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-10 22:15 - 2013-11-09 14:08 - 00003868 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-12-09 17:13 - 2013-11-03 16:46 - 00000072 _____ C:\Users\Public\LMDebug.log
2013-12-08 10:29 - 2013-11-01 16:26 - 00000000 ____D C:\Users\mato\AppData\Roaming\iSafe
2013-12-08 10:26 - 2013-12-05 22:04 - 00005936 _____ C:\Windows\PFRO.log
2013-12-07 00:59 - 2013-12-07 00:37 - 01851393 _____ C:\Users\mato\Desktop\Nowy Prezentacja programu Microsoft PowerPoint.pptx
2013-12-06 17:23 - 2011-04-12 14:21 - 00251064 _____ C:\Windows\system32\perfc015.dat
2013-12-06 17:23 - 2011-04-12 14:21 - 00000000 _____ C:\Windows\system32\perfh015.dat
2013-12-06 17:23 - 2009-07-14 06:13 - 00006248 _____ C:\Windows\system32\PerfStringBackup.INI
2013-12-05 21:59 - 2013-12-05 21:59 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-12-05 21:59 - 2013-12-05 21:57 - 00000000 ____D C:\Users\mato\AppData\Local\Origin
2013-12-05 21:52 - 2013-12-05 21:52 - 00000979 _____ C:\Users\Public\Desktop\Origin.lnk
2013-12-05 21:52 - 2013-12-05 21:36 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-12-05 21:28 - 2013-11-03 13:36 - 00000000 ____D C:\ProgramData\Adobe
2013-12-05 21:28 - 2013-11-03 13:32 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-12-05 21:26 - 2013-12-05 21:26 - 00001230 _____ C:\Users\mato\Desktop\fifa14-www.skidrowcrack.com.exe.lnk
2013-12-05 21:22 - 2013-12-05 21:22 - 00000000 _____ C:\Windows\setuperr.log
2013-12-05 21:14 - 2013-11-24 23:21 - 00000000 ____D C:\Users\mato\AppData\Roaming\NVIDIA
2013-12-05 21:13 - 2013-12-05 21:13 - 00003116 _____ C:\Windows\System32\Tasks\Origin
2013-12-05 20:41 - 2013-11-01 16:17 - 00000000 ____D C:\Users\mato\AppData\Roaming\Adobe
2013-12-05 20:41 - 2013-11-01 16:16 - 00000000 ____D C:\Users\mato\AppData\Local\Adobe
2013-12-05 20:40 - 2013-12-05 20:39 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\wangzhisong\AppData\Local\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\wangzhisong
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\Documents\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\AppData\Local\Mobogenie
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\Users\mato\AppData\Local\cache
2013-12-05 20:39 - 2013-12-05 20:39 - 00000000 ____D C:\ProgramData\WPM
2013-12-04 19:08 - 2013-12-04 00:56 - 00001011 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2013-12-04 00:57 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-12-04 00:56 - 2013-12-04 00:56 - 00000000 ____D C:\Program Files\TeamSpeak 3 Client
2013-12-01 17:19 - 2013-11-01 16:34 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-01 17:19 - 2013-11-01 16:34 - 00000000 ____D C:\ProgramData\Skype
2013-11-30 10:29 - 2013-11-10 14:24 - 00004040 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-11-30 10:29 - 2013-11-10 14:23 - 00003788 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-11-26 12:54 - 2013-12-12 01:00 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-26 11:19 - 2013-12-12 01:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-26 11:18 - 2013-12-12 01:00 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-26 11:11 - 2013-12-12 01:00 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-26 10:48 - 2013-12-12 01:00 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-26 10:46 - 2013-12-12 01:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-26 10:41 - 2013-12-12 01:00 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-26 10:29 - 2013-12-12 01:00 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-26 10:27 - 2013-12-12 01:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-26 10:23 - 2013-12-12 01:00 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-26 10:21 - 2013-12-12 01:00 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-26 10:18 - 2013-12-12 01:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-26 10:18 - 2013-12-12 01:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-26 10:16 - 2013-12-12 01:00 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-26 09:57 - 2013-12-12 01:00 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-26 09:38 - 2013-12-12 01:00 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-26 09:38 - 2013-12-12 01:00 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-26 09:35 - 2013-12-12 01:00 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-26 09:32 - 2013-12-12 01:00 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-26 09:28 - 2013-12-12 01:00 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-26 09:16 - 2013-12-12 01:00 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-26 09:02 - 2013-12-12 01:00 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-26 08:48 - 2013-12-12 01:00 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-26 08:32 - 2013-12-12 01:00 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-26 08:26 - 2013-12-12 01:00 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-26 08:07 - 2013-12-12 01:00 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-26 07:40 - 2013-12-12 01:00 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-26 07:34 - 2013-12-12 01:00 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-26 07:34 - 2013-12-12 01:00 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-26 07:33 - 2013-12-12 01:00 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-26 07:27 - 2013-12-12 01:00 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-23 19:26 - 2013-12-11 10:29 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-23 18:47 - 2013-12-11 10:29 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-22 15:57 - 2013-11-22 15:57 - 00000000 ____D C:\ProgramData\Steam
2013-11-22 15:56 - 2013-11-22 15:56 - 00000000 ____D C:\ProgramData\Package Cache
2013-11-22 15:51 - 2013-11-22 15:51 - 00000521 _____ C:\Users\Public\Desktop\Call of Duty Ghosts.lnk
2013-11-20 10:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-11-20 10:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-11-20 10:35 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-20 10:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-11-20 10:34 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR

Files to move or delete:
====================
C:\Users\mato\AppData\Roaming\Origin\update.vbe


Some content of TEMP:
====================
C:\Users\mato\AppData\Local\Temp\libcurl-4.dll
C:\Users\mato\AppData\Local\Temp\libeay32.dll
C:\Users\mato\AppData\Local\Temp\libidn-11.dll
C:\Users\mato\AppData\Local\Temp\librtmp.dll
C:\Users\mato\AppData\Local\Temp\libssh2.dll
C:\Users\mato\AppData\Local\Temp\ssleay32.dll
C:\Users\mato\AppData\Local\Temp\svchost.exe
C:\Users\mato\AppData\Local\Temp\unins000.exe
C:\Users\mato\AppData\Local\Temp\zlib1.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2010-11-21 04:24] - [2013-11-01 16:55] - 2872320 ____A (Microsoft Corporation) BC03306673C6A99FA5C5FF85F6F744B1

C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-20 10:48

==================== End Of Log ============================