Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-07-2014 Ran by ppp (administrator) on ZACHARY on 29-07-2014 21:12:52 Running from C:\Users\ppp\Desktop\Gry Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Polski (Polska) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgrsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgcsrvx.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Cherished Technololgy LIMITED) C:\ProgramData\IePluginService\PluginService.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgui.exe () C:\Program Files\AVG SafeGuard toolbar\vprot.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgidsagent.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgwdsvc.exe (LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (ShopperPro) C:\Program Files\Common Files\ShopperPro\spbiu.exe (StarWind Software) C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe () C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.7\loggingserver.exe (Akamai Technologies, Inc.) C:\Users\ppp\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.) C:\Users\ppp\AppData\Local\Akamai\netsession_win.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgnsx.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2014\avgemcx.exe () C:\Program Files\screenSHU\screenSHU.exe () D:\Program Files\Rockstar Games\GTA San Andreas\samp.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe () C:\Program Files\Opera\23.0.1522.60\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [93696 2009-07-14] (Microsoft Corporation) HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [93696 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [uTorrent] => C:\Users\ppp\AppData\Roaming\uTorrent\uTorrent.exe [1322832 2014-07-03] (BitTorrent Inc.) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [EADM] => D:\Program Files\Origin Games\Origin.exe [3595608 2014-07-26] (Electronic Arts) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [Raptr] => C:\Program Files\Raptr\raptrstub.exe [55360 2014-07-25] (Raptr, Inc) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21444224 2014-05-08] (Skype Technologies S.A.) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [screenSHU] => C:\Program Files\screenSHU\screenSHU.exe [2112000 2013-09-04] () HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [AVG-Secure-Search-Update_0214c] => C:\Users\ppp\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=93a8 (the data entry has 83 more characters). HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [RocketDock] => "C:\Program Files\RocketDock\RocketDock.exe" HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [ares] => "C:\Program Files\Ares\Ares.exe" -h HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [AlcoholAutomount] => C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [LiveSupport] => "C:\Program Files\LiveSupport\LiveSupport.exe" /noshow /log HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [Akamai NetSession Interface] => C:\Users\ppp\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.) HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [Tiny download manager] => "C:\Users\ppp\AppData\Local\DM\TinyDM.exe" /M HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\Run: [SPDriver] => C:\Program Files\ShopperPro\JSDriver\1.37.0.202\jsdrv.exe [3211776 2014-07-22] () HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\MountPoints2: {0d531b40-c6d9-11e3-861d-806e6f6e6963} - H:\Setup.exe HKU\S-1-5-21-1512337231-836916100-4245332658-1000\...\MountPoints2: {484cff85-9303-11e3-87bb-806e6f6e6963} - E:\cda_menu.exe AppInit_DLLs: c:\progra~1\searchprotect\searchprotect\bin\spvc32loader.dll => c:\Program Files\searchprotect\searchprotect\bin\spvc32loader.dll [1050912 2014-04-08] (Conduit) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe (No File) Startup: C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FIFA 10 Registration.lnk ShortcutTarget: FIFA 10 Registration.lnk -> D:\Program Files\EA Sports\FIFA 10\Support\EAregister.exe (No File) ShellIconOverlayIdentifiers: GGDriveOverlay1 -> {E68D0A50-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll No File ShellIconOverlayIdentifiers: GGDriveOverlay2 -> {E68D0A51-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll No File ShellIconOverlayIdentifiers: GGDriveOverlay3 -> {E68D0A52-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll No File ShellIconOverlayIdentifiers: GGDriveOverlay4 -> {E68D0A53-3C40-4712-B90D-DCFA93FF2534} => C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp1 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1397825835&from=cor&uid=126614527_331762_34882826 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1397825835&from=cor&uid=126614527_331762_34882826&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sweet-page.com/?type=hp&ts=1397825835&from=cor&uid=126614527_331762_34882826 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.wp.pl/?src01=dp1 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1397825835&from=cor&uid=126614527_331762_34882826&q={searchTerms} StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe http://www.sweet-page.com/?type=scpp&ts=1397826152&from=cor&uid=126614527_331762_34882826 SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1397825835&from=cor&uid=126614527_331762_34882826&q={searchTerms} SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1397825835&from=cor&uid=126614527_331762_34882826&q={searchTerms} SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3319766&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPD3E8467F-60A3-4441-BAAD-496AAC665B96&q={searchTerms}&SSPV= SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = http://search.conduit.com/Results.aspx?ctid=CT3319766&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPD3E8467F-60A3-4441-BAAD-496AAC665B96&q={searchTerms}&SSPV= SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.sweet-page.com/web/?type=ds&ts=1397825835&from=cor&uid=126614527_331762_34882826&q={searchTerms} SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://mysearch.avg.com/search?cid={1AC7EA8D-7036-4908-A79B-AC3FC0590FD5}&mid=93a8d8e39d8147d2ba17d15e7712a207-280eebffd4b62125f56ac22c8758693e69e718be&lang=pl&ds=AVG&coid=avgtbavg&cmpid=&pr=fr&d=2014-03-15 18:25:24&v=18.0.5.292&pid=safeguard&sg=&sap=dsp&q={searchTerms} BHO: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll No File BHO: Apps Hat -> {11111111-1111-1111-1111-110411851159} -> C:\Program Files\Apps Hat\Apps Hat-bho.dll (Nero) BHO: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files\SupTab\SupTab.dll (Thinknice Co. Limited) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: AVG SafeGuard toolbar -> {95B7759C-8C7F-4BF1-B163-73684A933233} -> C:\Program Files\AVG SafeGuard toolbar\18.1.7.598\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search) BHO: Shopper Pro -> {A5A51D2A-505A-4D84-AFC6-E0FA87E47B8C} -> C:\ProgramData\ShopperPro\ShopperPro.dll (Goobzo Ltd.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - AVG SafeGuard toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG SafeGuard toolbar\18.1.7.598\AVG SafeGuard toolbar_toolbar.dll (AVG Secure Search) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.7\ViProtocol.dll (AVG Secure Search) Tcpip\..\Interfaces\{9E3219F1-684B-4C8F-949C-A54DB30DA4F3}: [NameServer]194.204.152.34,194.204.159.1 FireFox: ======== FF ProfilePath: C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default FF DefaultSearchEngine: sweet-page FF SelectedSearchEngine: sweet-page FF Homepage: hxxp://www.sweet-page.com/?type=hppp&ts=1406017060&from=cor&uid=126614527_331762_34882826 FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.) FF Plugin: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files\Common Files\AVG Secure Search\SiteSafetyInstaller\18.1.7\\npsitesafety.dll No File FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.) FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll No File FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @ngm.nexoneu.com/NxGame - C:\ProgramData\NexonEU\NGM\npNxGameEU.dll (Nexon) FF Plugin: @staging.google.com/globalUpdate Update;version=10 - C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF Plugin: @staging.google.com/globalUpdate Update;version=4 - C:\Program Files\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF user.js: detected! => C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\user.js FF SearchPlugin: C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\searchplugins\conduit-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\sweet-page.xml FF Extension: Apps Hat - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\Extensions\39ed7c16-185d-4f88-b976-666d4928ba01@fe4550c1-7a4f-4a62-ad1c-45e0afdf81a4.com [2014-07-29] FF Extension: Quick Start - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\Extensions\quick_start@gmail.com [2014-05-21] FF Extension: Music Helper - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\Extensions\vkmhloader_adscfg@music-helper.ru [2014-05-18] FF Extension: Shopper-Pro - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\Extensions\{746505DC-0E21-4667-97F8-72EA6BCF5EEF} [2014-07-29] FF Extension: webget - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\Extensions\{9edd0ea8-2819-47c2-8320-b007d5996f8a}.xpi [2014-05-18] FF HKLM\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.7.598 FF Extension: AVG SafeGuard toolbar - C:\ProgramData\AVG SafeGuard toolbar\FireFoxExt\18.1.7.598 [2014-06-09] FF HKLM\...\Firefox\Extensions: [quick_start@gmail.com] - C:\Users\ppp\AppData\Roaming\Mozilla\Firefox\Profiles\yc9ocxqk.default\extensions\quick_start@gmail.com Chrome: ======= CHR HomePage: hxxp://www.sweet-page.com/?type=hppp&ts=1406652653&from=cor&uid=126614527_331762_34882826 CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hppp&ts=1406652653&from=cor&uid=126614527_331762_34882826" CHR DefaultSearchKeyword: sweet-page CHR DefaultSearchProvider: sweet-page CHR DefaultSearchURL: http://www.sweet-page.com/web/?type=dspp&ts=1406652653&from=cor&uid=126614527_331762_34882826&q={searchTerms} CHR DefaultNewTabURL: CHR Extension: (Battlefield 4 - Assault) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahnllbhakmnbcloknbhkhabcnbnhgaim [2014-02-11] CHR Extension: (Dokumenty Google) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-11] CHR Extension: (Dysk Google) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-11] CHR Extension: (YouTube) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-11] CHR Extension: (Adblock Plus) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-02-11] CHR Extension: (Szukaj w Google) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-11] CHR Extension: (Heroes & Generals) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\gbophcdhblbipoaacgchllkobdaolpge [2014-07-25] CHR Extension: (AdBlock) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-11] CHR Extension: (Google Wallet) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-02-11] CHR Extension: (Gmail) - C:\Users\ppp\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-11] CHR Extension: (Extutil) - C:\Users\ppp\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-02-20] CHR Extension: (Managera) - C:\Users\ppp\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-02-20] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-04-30] (Advanced Micro Devices, Inc.) [File not signed] R2 AVGIDSAgent; C:\Program Files\AVG\AVG2014\avgidsagent.exe [3241488 2014-06-27] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2014\avgwdsvc.exe [289328 2014-06-17] (AVG Technologies CZ, s.r.o.) S2 AxAutoMntSrv; C:\Program Files\Alcohol Soft\Alcohol 120\AxAutoMntSrv.exe [75624 2012-01-05] (Alcohol Soft Development Team) S2 globalUpdate; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-29] (globalUpdate) [File not signed] S3 globalUpdatem; C:\Program Files\globalUpdate\Update\GoogleUpdate.exe [68608 2014-07-29] (globalUpdate) [File not signed] S2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1905488 2014-07-21] (LogMeIn Inc.) S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 IePluginService; C:\ProgramData\IePluginService\PluginService.exe [705136 2014-04-11] (Cherished Technololgy LIMITED) R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2014-07-16] (LogMeIn, Inc.) R2 SPBIUpd; C:\Program Files\Common Files\ShopperPro\spbiu.exe [1812992 2014-07-22] (ShopperPro) [File not signed] R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [370688 2009-12-23] (StarWind Software) [File not signed] S2 vToolbarUpdater18.1.7; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.7\ToolbarUpdater.exe [1808408 2014-06-09] (AVG Secure Search) S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [279712 2014-04-22] () R1 Avgdiskx; C:\Windows\System32\DRIVERS\avgdiskx.sys [121624 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [199960 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [98584 2014-06-17] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.) R1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [42784 2014-06-09] (AVG Technologies) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-04-18] (Disc Soft Ltd) S3 gdrv; C:\Windows\gdrv.sys [15600 2014-06-02] (Windows (R) 2000 DDK provider) R3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2014-04-22] () R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [13216 2009-07-16] () R3 nvmpu401; C:\Windows\System32\drivers\nvmpu401.sys [10240 2006-08-31] (NVIDIA Corporation) [File not signed] S0 sfdrv01; C:\Windows\System32\drivers\sfdrv01.sys [47616 2005-01-14] (Protection Technology) [File not signed] R0 sfhlp02; C:\Windows\System32\drivers\sfhlp02.sys [6656 2004-10-28] (Protection Technology) [File not signed] S0 sfsync02; C:\Windows\System32\drivers\sfsync02.sys [20544 2004-12-03] (Protection Technology) [File not signed] R3 SPBIUpdd; C:\Program Files\Common Files\ShopperPro\spbiw.sys [25600 2014-07-22] () [File not signed] R2 SPDRIVER_1.37.0.202; C:\Program Files\ShopperPro\JSDriver\1.37.0.202\jsdrv.sys [41320 2014-07-22] () R0 sptd; C:\Windows\System32\Drivers\sptd.sys [320120 2014-04-17] (Duplex Secure Ltd.) U3 a7eehfst; C:\Windows\system32\Drivers\a7eehfst.sys [0 ] (Advanced Micro Devices) U3 amne3upc; C:\Windows\system32\Drivers\amne3upc.sys [0 ] (Advanced Micro Devices) S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X] S3 FairplayKD; \??\C:\ProgramData\MTA San Andreas All\Common\temp\FairplayKD.sys [X] S3 VGPU; System32\drivers\rdvgkmd.sys [X] S3 vtany; \??\C:\Windows\vtany.sys [X] S3 XDva409; \??\C:\Windows\system32\XDva409.sys [X] S3 xhunter1; \??\C:\Windows\xhunter1.sys [X] U3 uftdypow; \??\C:\Users\ppp\AppData\Local\Temp\uftdypow.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-07-29 18:52 - 2014-07-29 21:13 - 00000000 ____D () C:\FRST 2014-07-29 12:54 - 2014-07-29 20:55 - 00001470 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-7.job 2014-07-29 12:54 - 2014-07-29 19:29 - 00000892 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job 2014-07-29 12:54 - 2014-07-29 18:55 - 00001434 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-5_user.job 2014-07-29 12:54 - 2014-07-29 18:54 - 00002560 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-4.job 2014-07-29 12:54 - 2014-07-29 18:54 - 00001532 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-6.job 2014-07-29 12:54 - 2014-07-29 18:54 - 00001530 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-1.job 2014-07-29 12:54 - 2014-07-29 18:54 - 00001418 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-5.job 2014-07-29 12:54 - 2014-07-29 18:54 - 00001320 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-2.job 2014-07-29 12:53 - 2014-07-29 18:53 - 00003778 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-11.job 2014-07-29 12:53 - 2014-07-29 18:51 - 00000888 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job 2014-07-29 12:53 - 2014-07-29 12:55 - 00000000 ____D () C:\Program Files\Apps Hat 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Users\Public\Documents\YTAHelper 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Users\ppp\AppData\Local\globalUpdate 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Program Files\globalUpdate 2014-07-29 12:52 - 2014-07-29 13:06 - 00000000 ____D () C:\Users\Public\Documents\GOOBZO 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Users\Public\Documents\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\ProgramData\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Program Files\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Program Files\Common Files\ShopperPro 2014-07-27 21:04 - 2014-07-28 10:08 - 00000000 ____D () C:\Users\ppp\Desktop\Paczuszka 2014-07-25 19:27 - 2014-07-25 19:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games 2014-07-25 13:30 - 2014-07-25 13:59 - 1101591724 _____ () C:\Users\ppp\Downloads\Dizz Niccas GTA 6.28.14.zip 2014-07-24 13:31 - 2014-07-24 13:31 - 00000000 ____D () C:\Users\ppp\AppData\Local\FalloutNV 2014-07-24 13:29 - 2014-07-24 13:29 - 00000000 ____D () C:\ProgramData\RELOADED 2014-07-23 16:35 - 2014-07-23 16:35 - 00000000 ____D () C:\Users\ppp\Documents\Need for Speed World 2014-07-23 11:32 - 2009-03-18 18:35 - 00026176 ____H (LogMeIn, Inc.) C:\Windows\system32\hamachi.sys 2014-07-23 11:31 - 2014-07-23 11:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-07-23 11:31 - 2014-07-23 11:31 - 00000000 ____D () C:\Program Files\LogMeIn Hamachi 2014-07-22 15:08 - 2014-07-22 15:08 - 00000000 ____D () C:\Users\ppp\Documents\CLEO_SDK 2014-07-21 10:18 - 2014-07-29 18:50 - 00000000 ____D () C:\Users\ppp\AppData\Local\LogMeIn Hamachi 2014-07-21 10:18 - 2014-07-21 10:18 - 00000000 ____D () C:\Users\ppp\AppData\Local\LogMeIn 2014-07-21 10:18 - 2014-07-21 10:18 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-07-20 01:18 - 2014-07-20 01:18 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer 2014-07-19 22:56 - 2014-07-19 22:56 - 00000000 ____D () C:\ProgramData\Riot Games 2014-07-19 19:29 - 2014-07-19 22:45 - 00000000 _____ () C:\dfu.log 2014-07-18 09:43 - 2014-07-18 09:43 - 00000000 ____D () C:\Nexon 2014-07-13 20:32 - 2005-03-02 15:48 - 940064768 _____ () C:\Users\ppp\Desktop\gta3.img 2014-07-03 00:13 - 2014-07-03 00:14 - 00000000 ____D () C:\Users\ppp\Documents\FIFA 10 2014-07-03 00:04 - 2014-07-03 00:04 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Leadertech 2014-07-01 12:17 - 2014-07-01 12:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-07-29 21:26 - 2014-02-12 13:28 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-07-29 21:13 - 2014-07-29 18:52 - 00000000 ____D () C:\FRST 2014-07-29 21:12 - 2014-02-11 22:43 - 00000000 ___RD () C:\Users\ppp\Desktop\Gry 2014-07-29 21:03 - 2014-02-11 17:29 - 00001030 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-29 20:55 - 2014-07-29 12:54 - 00001470 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-7.job 2014-07-29 20:14 - 2014-02-11 12:03 - 01432476 _____ () C:\Windows\WindowsUpdate.log 2014-07-29 19:29 - 2014-07-29 12:54 - 00000892 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineUA.job 2014-07-29 19:20 - 2014-03-02 13:32 - 00000000 ____D () C:\Users\ppp\AppData\Local\screenSHU 2014-07-29 18:59 - 2009-07-14 06:34 - 00021280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-29 18:59 - 2009-07-14 06:34 - 00021280 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-29 18:55 - 2014-07-29 12:54 - 00001434 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-5_user.job 2014-07-29 18:54 - 2014-07-29 12:54 - 00002560 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-4.job 2014-07-29 18:54 - 2014-07-29 12:54 - 00001532 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-6.job 2014-07-29 18:54 - 2014-07-29 12:54 - 00001530 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-1.job 2014-07-29 18:54 - 2014-07-29 12:54 - 00001418 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-5.job 2014-07-29 18:54 - 2014-07-29 12:54 - 00001320 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-2.job 2014-07-29 18:53 - 2014-07-29 12:53 - 00003778 _____ () C:\Windows\Tasks\030b3de7-1793-48da-9839-f6ab73d18535-11.job 2014-07-29 18:51 - 2014-07-29 12:53 - 00000888 _____ () C:\Windows\Tasks\globalUpdateUpdateTaskMachineCore.job 2014-07-29 18:51 - 2014-02-11 17:29 - 00001026 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-29 18:50 - 2014-07-21 10:18 - 00000000 ____D () C:\Users\ppp\AppData\Local\LogMeIn Hamachi 2014-07-29 18:50 - 2014-02-13 23:19 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Raptr 2014-07-29 18:49 - 2014-02-11 17:40 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\uTorrent 2014-07-29 18:49 - 2010-11-20 23:48 - 00037816 _____ () C:\Windows\PFRO.log 2014-07-29 18:49 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-07-29 18:49 - 2009-07-14 06:39 - 00053784 _____ () C:\Windows\setupact.log 2014-07-29 18:42 - 2014-03-14 16:09 - 00000000 ____D () C:\ProgramData\MFAData 2014-07-29 16:46 - 2014-02-11 15:48 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2014-07-29 16:41 - 2014-04-17 22:18 - 00000000 ____D () C:\ProgramData\Nero 2014-07-29 16:33 - 2014-02-12 16:06 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\.minecraft 2014-07-29 16:32 - 2014-02-20 22:33 - 00000000 ____D () C:\Program Files\MyPC Backup 2014-07-29 16:31 - 2014-02-15 22:20 - 00000000 ____D () C:\Users\ppp\AppData\Local\GG 2014-07-29 16:31 - 2014-02-12 16:44 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GamersFirst 2014-07-29 16:30 - 2014-02-12 19:44 - 00000000 ____D () C:\Users\ppp\Documents\My Games 2014-07-29 16:27 - 2009-07-14 06:52 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-07-29 16:22 - 2014-02-25 18:41 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Skype 2014-07-29 16:21 - 2014-02-15 22:20 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\GG 2014-07-29 15:53 - 2014-03-25 09:02 - 00000000 ____D () C:\mod 2014-07-29 15:46 - 2014-05-18 10:17 - 00000000 ____D () C:\Program Files\webget 2014-07-29 13:32 - 2014-02-12 22:46 - 00000000 ____D () C:\Windows\system32\directx 2014-07-29 13:06 - 2014-07-29 12:52 - 00000000 ____D () C:\Users\Public\Documents\GOOBZO 2014-07-29 13:06 - 2014-02-11 12:16 - 00000000 ____D () C:\ProgramData\TEMP 2014-07-29 13:04 - 2014-06-09 22:53 - 00000000 ____D () C:\Users\ppp\AppData\Local\DM 2014-07-29 12:55 - 2014-07-29 12:53 - 00000000 ____D () C:\Program Files\Apps Hat 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Users\Public\Documents\YTAHelper 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Users\ppp\AppData\Local\globalUpdate 2014-07-29 12:53 - 2014-07-29 12:53 - 00000000 ____D () C:\Program Files\globalUpdate 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Users\Public\Documents\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\ProgramData\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Program Files\ShopperPro 2014-07-29 12:52 - 2014-07-29 12:52 - 00000000 ____D () C:\Program Files\Common Files\ShopperPro 2014-07-29 08:00 - 2014-02-13 23:17 - 00000000 ____D () C:\Program Files\Raptr 2014-07-28 10:08 - 2014-07-27 21:04 - 00000000 ____D () C:\Users\ppp\Desktop\Paczuszka 2014-07-27 09:56 - 2014-02-12 00:13 - 00000000 ____D () C:\ProgramData\Origin 2014-07-26 11:20 - 2014-05-04 12:20 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\www.gtavicecity.ru 2014-07-25 19:27 - 2014-07-25 19:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games 2014-07-25 16:21 - 2014-02-11 20:53 - 00000000 ____D () C:\Users\ppp\Desktop\zdjęcia mamy 2014-07-25 13:59 - 2014-07-25 13:30 - 1101591724 _____ () C:\Users\ppp\Downloads\Dizz Niccas GTA 6.28.14.zip 2014-07-24 13:31 - 2014-07-24 13:31 - 00000000 ____D () C:\Users\ppp\AppData\Local\FalloutNV 2014-07-24 13:29 - 2014-07-24 13:29 - 00000000 ____D () C:\ProgramData\RELOADED 2014-07-23 16:35 - 2014-07-23 16:35 - 00000000 ____D () C:\Users\ppp\Documents\Need for Speed World 2014-07-23 11:31 - 2014-07-23 11:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-07-23 11:31 - 2014-07-23 11:31 - 00000000 ____D () C:\Program Files\LogMeIn Hamachi 2014-07-22 20:22 - 2014-02-19 23:54 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\TS3Client 2014-07-22 15:08 - 2014-07-22 15:08 - 00000000 ____D () C:\Users\ppp\Documents\CLEO_SDK 2014-07-22 10:27 - 2014-04-14 18:31 - 00000000 ____D () C:\Program Files\Opera 2014-07-21 14:15 - 2014-02-19 23:52 - 00000000 ____D () C:\Program Files\TeamSpeak 3 Client 2014-07-21 10:57 - 2014-04-02 12:38 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam 2014-07-21 10:18 - 2014-07-21 10:18 - 00000000 ____D () C:\Users\ppp\AppData\Local\LogMeIn 2014-07-21 10:18 - 2014-07-21 10:18 - 00000000 ____D () C:\ProgramData\LogMeIn 2014-07-21 10:16 - 2014-06-09 22:54 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\systweak 2014-07-20 21:21 - 2014-02-12 18:56 - 00000000 ____D () C:\Program Files\Common Files\Wise Installation Wizard 2014-07-20 21:21 - 2014-02-11 12:18 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-07-20 21:19 - 2014-02-12 18:59 - 00138056 _____ () C:\Users\ppp\AppData\Roaming\PnkBstrK.sys 2014-07-20 21:19 - 2014-02-12 18:58 - 00189248 _____ () C:\Windows\system32\PnkBstrB.ex0 2014-07-20 01:18 - 2014-07-20 01:18 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\San Andreas Multiplayer 2014-07-19 22:56 - 2014-07-19 22:56 - 00000000 ____D () C:\ProgramData\Riot Games 2014-07-19 22:45 - 2014-07-19 19:29 - 00000000 _____ () C:\dfu.log 2014-07-18 09:48 - 2014-03-11 21:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexon 2014-07-18 09:43 - 2014-07-18 09:43 - 00000000 ____D () C:\Nexon 2014-07-16 17:49 - 2014-06-09 22:54 - 00018280 _____ () C:\Windows\system32\roboot.exe 2014-07-09 16:27 - 2014-02-11 12:17 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2014-07-09 16:27 - 2014-02-11 12:17 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2014-07-04 12:09 - 2014-03-31 13:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2014-07-03 00:14 - 2014-07-03 00:13 - 00000000 ____D () C:\Users\ppp\Documents\FIFA 10 2014-07-03 00:04 - 2014-07-03 00:04 - 00000000 ____D () C:\Users\ppp\AppData\Roaming\Leadertech 2014-07-02 23:52 - 2014-02-16 15:57 - 00421271 _____ () C:\Windows\DirectX.log 2014-07-02 09:09 - 2014-02-11 12:37 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service 2014-07-01 12:18 - 2014-07-01 12:17 - 00000000 ____D () C:\Program Files\Mozilla Firefox Some content of TEMP: ==================== C:\Users\ppp\AppData\Local\Temp\13-9-legacy_vista_win7_32_dd_ccc_whql.exe C:\Users\ppp\AppData\Local\Temp\431fc5c728e2e10a8fd726989c5f4d72.dll C:\Users\ppp\AppData\Local\Temp\appshat_generic.exe C:\Users\ppp\AppData\Local\Temp\AxSFADownloader.exe C:\Users\ppp\AppData\Local\Temp\cabex.dll C:\Users\ppp\AppData\Local\Temp\comver.dll C:\Users\ppp\AppData\Local\Temp\drm_dialogs.dll C:\Users\ppp\AppData\Local\Temp\drm_dyndata_7410004.dll C:\Users\ppp\AppData\Local\Temp\eax.dll C:\Users\ppp\AppData\Local\Temp\ggdrive-menu.exe C:\Users\ppp\AppData\Local\Temp\ggdrive-overlay.exe C:\Users\ppp\AppData\Local\Temp\installstats.exe C:\Users\ppp\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe C:\Users\ppp\AppData\Local\Temp\LiveSupport_setup.exe C:\Users\ppp\AppData\Local\Temp\MD5Hash.dll C:\Users\ppp\AppData\Local\Temp\NGMDll.dll C:\Users\ppp\AppData\Local\Temp\NGMResource.dll C:\Users\ppp\AppData\Local\Temp\nsd550D.exe C:\Users\ppp\AppData\Local\Temp\nsh38B9.exe C:\Users\ppp\AppData\Local\Temp\nsi73A.exe C:\Users\ppp\AppData\Local\Temp\nss12A5.exe C:\Users\ppp\AppData\Local\Temp\nsw43F5.exe C:\Users\ppp\AppData\Local\Temp\nsx1DA3.exe C:\Users\ppp\AppData\Local\Temp\PartnerInstallerYTAi.exe C:\Users\ppp\AppData\Local\Temp\PartnerInstaller_smtyc.exe C:\Users\ppp\AppData\Local\Temp\raptrpatch.exe C:\Users\ppp\AppData\Local\Temp\setup.exe C:\Users\ppp\AppData\Local\Temp\setup_fst_pl.exe C:\Users\ppp\AppData\Local\Temp\SPSetup.exe C:\Users\ppp\AppData\Local\Temp\TsuB0E941FE.dll C:\Users\ppp\AppData\Local\Temp\tu17p84.exe C:\Users\ppp\AppData\Local\Temp\unelevate.exe C:\Users\ppp\AppData\Local\Temp\unicows.dll C:\Users\ppp\AppData\Local\Temp\Uninstall.exe C:\Users\ppp\AppData\Local\Temp\xmlUpdater.exe C:\Users\ppp\AppData\Local\Temp\_is1F4.exe C:\Users\ppp\AppData\Local\Temp\_is7022.exe C:\Users\ppp\AppData\Local\Temp\_isACEA.exe C:\Users\ppp\AppData\Local\Temp\_isBA21.exe C:\Users\ppp\AppData\Local\Temp\_isCD73.exe C:\Users\ppp\AppData\Local\Temp\_isD615.exe C:\Users\ppp\AppData\Local\Temp\_isE964.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed