Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 Ran by Maciej (administrator) on MACIEJ-KOMPUTER on 23-03-2014 11:02:13 Running from C:\Users\Maciej\Desktop\Logi Windows 7 Home Premium Service Pack 1 (X64) OS Language: Polish Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (ASUSTeK Computer Inc.) C:\Windows\system32\FBAgent.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (Razer Inc.) C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUS) C:\Windows\AsScrPro.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-10-14] (Realtek Semiconductor) HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2587944 2010-12-31] (ELAN Microelectronics Corp.) HKLM\...\Run: [NUSB3MON] - C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus) HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-22] (ASUS) HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS) HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS) HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKU\S-1-5-21-2475148013-1230956755-3406740402-1001\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1821888 2014-02-25] (Valve Corporation) HKU\S-1-5-21-2475148013-1230956755-3406740402-1001\...\MountPoints2: {01467865-5c07-11e3-a40c-9cb70dc4fa8e} - G:\AutoRun.exe HKU\S-1-5-21-2475148013-1230956755-3406740402-1001\...\MountPoints2: {01467874-5c07-11e3-a40c-9cb70dc4fa8e} - G:\AutoRun.exe HKU\S-1-5-21-2475148013-1230956755-3406740402-1001\...\MountPoints2: {617d1a94-675f-11e3-ac9c-9cb70dc4fa8e} - G:\Startme.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=5.5&ar=msnhome HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x4478A766333DCF01 BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR Extension: (Dokumenty Google) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-15] CHR Extension: (Dysk Google) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-15] CHR Extension: (YouTube) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-15] CHR Extension: (Adblock Plus) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-12-15] CHR Extension: (Szukaj w Google) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-15] CHR Extension: (Strumienie z Ruczaju) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\mfopjimlhbikohbmjagioiomhmfhodam [2014-01-05] CHR Extension: (Norton Identity Protection) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-12-15] CHR Extension: (Google Wallet) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-15] CHR Extension: (Gmail) - C:\Users\Maciej\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-15] CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx [2014-01-31] ==================== Services (Whitelisted) ================= R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-11-01] (Advanced Micro Devices, Inc.) R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation) R2 RzKLService; C:\Program Files (x86)\Razer\Razer Game Booster\RzKLService.exe [105448 2013-11-22] (Razer Inc.) R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [158880 2011-10-01] (Atheros) ==================== Drivers (Whitelisted) ==================== S3 andnetadb; C:\Windows\System32\Drivers\lgandnetadb.sys [31744 2013-04-18] (Google Inc) R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20140214.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation) R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation) R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-12-11] (Symantec Corporation) R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2014-01-18] (Symantec Corporation) R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20140321.001\IDSvia64.sys [524504 2014-03-06] (Symantec Corporation) R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( ) R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20140322.002\ENG64.SYS [126040 2014-01-18] (Symantec Corporation) R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20140322.002\EX64.SYS [2099288 2014-01-18] (Symantec Corporation) R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation) R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation) R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation) R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation) R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-12-11] (Symantec Corporation) R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation) R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-22 23:53 - 2014-03-22 23:53 - 00000000 _____ () C:\Windows\SysWOW64\shoD5E2.tmp 2014-03-21 09:56 - 2014-03-22 19:13 - 00000000 ____D () C:\Users\Maciej\AppData\Local\CrashDumps 2014-03-15 12:10 - 2014-03-23 11:02 - 00000000 ____D () C:\FRST 2014-03-15 11:58 - 2014-03-23 11:02 - 00000000 ____D () C:\Users\Maciej\Desktop\Logi 2014-03-12 19:58 - 2014-03-12 19:58 - 00000000 ____D () C:\Users\Maciej\AppData\Local\Blizzard 2014-03-12 19:56 - 2014-03-12 19:58 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-03-12 19:56 - 2014-03-12 19:56 - 00001149 _____ () C:\Users\Public\Desktop\Hearthstone.lnk 2014-03-12 19:49 - 2014-03-13 11:10 - 00000000 ____D () C:\Users\Maciej\AppData\Local\Battle.net 2014-03-12 19:49 - 2014-03-12 19:56 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\Battle.net 2014-03-12 19:49 - 2014-03-12 19:49 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-03-12 19:49 - 2014-03-12 19:49 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-03-12 19:48 - 2014-03-12 19:48 - 00000000 ____D () C:\ProgramData\Battle.net 2014-03-06 17:26 - 2014-03-06 17:26 - 00000000 ____D () C:\Users\Maciej\Documents\My Games 2014-03-04 21:23 - 2014-03-14 14:26 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\vlc 2014-03-04 21:21 - 2014-03-04 21:21 - 00000000 ____D () C:\Program Files\VideoLAN 2014-03-03 19:30 - 2014-03-03 19:30 - 00000863 _____ () C:\Users\Maciej\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk 2014-02-27 19:22 - 2014-02-27 19:22 - 00003966 _____ () C:\Users\Maciej\Documents\config.cfg 2014-02-26 11:15 - 2014-02-26 11:15 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\OBS 2014-02-25 08:43 - 2014-02-25 08:43 - 00000000 ____D () C:\Program Files (x86)\Thief 2014-02-24 22:18 - 2014-03-22 23:14 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-02-24 22:18 - 2014-03-12 17:14 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater ==================== One Month Modified Files and Folders ======= 2014-03-23 11:02 - 2014-03-15 12:10 - 00000000 ____D () C:\FRST 2014-03-23 11:02 - 2014-03-15 11:58 - 00000000 ____D () C:\Users\Maciej\Desktop\Logi 2014-03-23 10:53 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-23 10:53 - 2009-07-14 05:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-23 10:50 - 2013-11-07 17:44 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-03-23 10:49 - 2013-11-04 15:50 - 01766827 _____ () C:\Windows\WindowsUpdate.log 2014-03-23 10:46 - 2014-02-08 15:25 - 00007370 _____ () C:\Windows\setupact.log 2014-03-23 10:46 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-22 23:53 - 2014-03-22 23:53 - 00000000 _____ () C:\Windows\SysWOW64\shoD5E2.tmp 2014-03-22 23:48 - 2013-11-04 16:07 - 00003148 _____ () C:\Windows\System32\Tasks\SidebarExecute 2014-03-22 23:14 - 2014-02-24 22:18 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-22 22:33 - 2013-11-10 11:59 - 00000600 _____ () C:\Users\Maciej\AppData\Roaming\winscp.rnd 2014-03-22 19:13 - 2014-03-21 09:56 - 00000000 ____D () C:\Users\Maciej\AppData\Local\CrashDumps 2014-03-18 11:27 - 2013-12-02 13:56 - 00000000 ____D () C:\Windows\System32\Tasks\Games 2014-03-17 21:13 - 2013-11-08 15:52 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\.minecraftzyczu 2014-03-17 15:20 - 2009-07-14 06:08 - 00027116 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-03-17 15:19 - 2014-02-08 16:31 - 00028512 _____ () C:\Windows\PFRO.log 2014-03-17 15:19 - 2013-11-19 04:31 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-17 15:19 - 2013-11-19 04:31 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-14 14:26 - 2014-03-04 21:23 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\vlc 2014-03-13 11:10 - 2014-03-12 19:49 - 00000000 ____D () C:\Users\Maciej\AppData\Local\Battle.net 2014-03-12 19:58 - 2014-03-12 19:58 - 00000000 ____D () C:\Users\Maciej\AppData\Local\Blizzard 2014-03-12 19:58 - 2014-03-12 19:56 - 00000000 ____D () C:\Program Files (x86)\Hearthstone 2014-03-12 19:56 - 2014-03-12 19:56 - 00001149 _____ () C:\Users\Public\Desktop\Hearthstone.lnk 2014-03-12 19:56 - 2014-03-12 19:49 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\Battle.net 2014-03-12 19:49 - 2014-03-12 19:49 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment 2014-03-12 19:49 - 2014-03-12 19:49 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-03-12 19:48 - 2014-03-12 19:48 - 00000000 ____D () C:\ProgramData\Battle.net 2014-03-12 17:14 - 2014-02-24 22:18 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-12 17:14 - 2013-11-09 14:50 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-12 17:14 - 2013-11-09 14:50 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-11 20:27 - 2013-11-30 04:29 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\BitTorrent 2014-03-11 15:32 - 2011-02-19 06:31 - 00752536 _____ () C:\Windows\system32\perfh015.dat 2014-03-11 15:32 - 2011-02-19 06:31 - 00160160 _____ () C:\Windows\system32\perfc015.dat 2014-03-11 15:32 - 2009-07-14 06:13 - 01702830 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-07 11:26 - 2013-11-14 19:06 - 00000024 _____ () C:\Users\Maciej\random.dat 2014-03-07 11:13 - 2014-02-19 08:51 - 00000024 _____ () C:\Users\Maciej\jagexappletviewer.preferences 2014-03-07 11:13 - 2013-11-14 19:06 - 00000045 _____ () C:\Users\Maciej\jagex_cl_runescape_LIVE.dat 2014-03-07 11:12 - 2014-01-07 02:51 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\SoftGrid Client 2014-03-07 11:12 - 2011-10-19 23:32 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2014-03-07 10:01 - 2013-11-04 16:07 - 00002146 _____ () C:\Windows\system32\AutoRunFilter.ini 2014-03-06 17:26 - 2014-03-06 17:26 - 00000000 ____D () C:\Users\Maciej\Documents\My Games 2014-03-04 21:21 - 2014-03-04 21:21 - 00000000 ____D () C:\Program Files\VideoLAN 2014-03-03 19:30 - 2014-03-03 19:30 - 00000863 _____ () C:\Users\Maciej\AppData\Roaming\Microsoft\Windows\Start Menu\BitTorrent.lnk 2014-02-27 19:22 - 2014-02-27 19:22 - 00003966 _____ () C:\Users\Maciej\Documents\config.cfg 2014-02-27 12:42 - 2014-01-02 15:11 - 00063600 _____ () C:\Users\Maciej\AppData\Local\GDIPFONTCACHEV1.DAT 2014-02-26 11:15 - 2014-02-26 11:15 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\OBS 2014-02-25 09:23 - 2013-11-30 04:11 - 00000000 ____D () C:\Games 2014-02-25 08:43 - 2014-02-25 08:43 - 00000000 ____D () C:\Program Files (x86)\Thief 2014-02-21 23:50 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-21 08:22 - 2013-11-30 04:27 - 00000000 ____D () C:\Users\Maciej\AppData\Roaming\uTorrent 2014-02-21 08:17 - 2014-01-05 14:25 - 00289880 _____ () C:\Windows\system32\FNTCACHE.DAT Files to move or delete: ==================== C:\Users\Maciej\jagex_cl_runescape_LIVE.dat C:\Users\Maciej\jagex_cl_runescape_LIVE1.dat C:\Users\Maciej\jagex_cl_speccollect_LIVE.dat C:\Users\Maciej\random.dat ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-20 00:27 ==================== End Of Log ============================