Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 07-01-2015 Ran by Dorota (administrator) on DOROTA-PC on 08-01-2015 11:56:17 Running from C:\Users\Dorota\Desktop Loaded Profile: Dorota (Available profiles: Dorota) Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Polski (Polska) Internet Explorer Version 9 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Adobe Systems Incorporated) C:\Config.Msi\2ffb38.rbf (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Valve Corporation) C:\Program Files\Steam\Steam.exe (ALLPlayer Group Ltd.) C:\Program Files\ALLPlayer Remote\ALLPlayerRemoteControl.exe (GG Network S.A.) C:\Users\Dorota\AppData\Local\GG\Application\gghub.exe ( ) C:\Program Files\ChomikBox\chomikbox.exe (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Microsoft Corporation) C:\Windows\System32\wuauclt.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe () C:\Program Files\Opera\26.0.1656.60\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (GG Network S.A.) C:\Users\Dorota\AppData\Local\GG\Application\ggapp.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Valve Corporation) C:\Program Files\Steam\bin\steamwebhelper.exe (GG Network S.A.) C:\Users\Dorota\AppData\Local\GG\Application\xulrunner\gghub.exe (Microsoft Corporation) C:\Windows\System32\conime.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files\Opera\26.0.1656.60\opera.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-18] (Microsoft Corporation) HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642304 2013-04-29] (Advanced Micro Devices, Inc.) HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-07] (AVAST Software) HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM\...\Run: [AdobeCS5ServiceManager] => C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe [406992 2010-02-22] (Adobe Systems Incorporated) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [31016 2006-10-26] (Microsoft Corporation) HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated) HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [Steam] => C:\Program Files\Steam\steam.exe [1940160 2014-11-18] (Valve Corporation) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ALLUpdate] => C:\Program Files\ALLPlayer\ALLUpdate.exe [3510704 2014-04-17] (ALLPlayer Group Ltd.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ALLPlayer WiFi Remote] => C:\Program Files\ALLPlayer Remote\ALLPlayerRemoteControl.exe [5052800 2014-01-31] (ALLPlayer Group Ltd.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-18] (Microsoft Corporation) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [GG] => C:\Users\Dorota\AppData\Local\GG\Application\gghub.exe [4023360 2014-12-02] (GG Network S.A.) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\Run: [ChomikBox] => C:\Program Files\ChomikBox\chomikbox.exe [6033408 2014-03-11] ( ) HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\RunOnce: [ALLPlayer Remote Update] => C:\Users\Dorota\AppData\Local\Temp\ALLRemote.exe [1961744 2015-01-08] (ALLPlayer ) <===== ATTENTION HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\...\MountPoints2: {141b1043-ecc9-11e3-a7c5-002215f2ecb7} - E:\setup.exe ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Dorota\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank HKU\S-1-5-21-1113750723-2783305751-3862205039-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank BHO: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) Chrome: ======= CHR HomePage: Default -> https://mysearch.avg.com?cid={DE289BFE-EFC6-4173-8DB3-5012550C5C4C}&mid=b4acfa79299247d2bc4ed16b53160544-6d6a121b0d2c7c6e45c51db57f8bd774ff757963&lang=en&ds=px011&coid=avgtbdispx&cmpid=&pr=sa&d=2014-06-19 10:56:34&v=18.1.9.799&pid=safeguard&sg=&sap=hp CHR StartupUrls: Default -> "https://mysearch.avg.com?cid={DE289BFE-EFC6-4173-8DB3-5012550C5C4C}&mid=b4acfa79299247d2bc4ed16b53160544-6d6a121b0d2c7c6e45c51db57f8bd774ff757963&lang=en&ds=px011&coid=avgtbdispx&cmpid=&pr=sa&d=2014-06-19 10:56:34&v=18.1.9.799&pid=safeguard&sg=&sap=hp" CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter} CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\internal-nacl-plugin No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\39.0.2171.95\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\pepflashplayer32_15_0_0_215.dll () CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File CHR Profile: C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Wallet) - C:\Users\Dorota\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-01] CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-05-01] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-01] (AVAST Software) S3 Survarium Update Service; C:\Program Files\Survarium\game\binaries\x86\survarium_service.exe [76408 2014-12-19] () S3 SwitchBoard; C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-05-01] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-05-01] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr.sys [54832 2014-05-15] (AVAST Software) R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-05-01] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software) R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [57672 2014-05-01] (AVAST Software) R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-05-01] () R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdLH3.sys [83984 2012-02-23] (Advanced Micro Devices) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-06-05] (Disc Soft Ltd) R3 L1E; C:\Windows\System32\DRIVERS\L1E60x86.sys [48640 2009-08-05] (Atheros Communications, Inc.) R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [5810 2004-08-13] () S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-08 11:56 - 2015-01-08 11:56 - 00012657 _____ () C:\Users\Dorota\Desktop\FRST.txt 2015-01-08 11:55 - 2015-01-08 11:55 - 00001892 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk 2015-01-08 11:55 - 2015-01-08 11:55 - 00001804 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-01-08 11:51 - 2015-01-08 11:52 - 38966928 _____ (Adobe Systems Incorporated) C:\Users\Dorota\Desktop\AdbeRdr11000_pl_PL.exe 2015-01-08 11:34 - 2015-01-08 11:35 - 17711760 _____ (Adobe Systems Inc.) C:\Users\Dorota\Desktop\AdobeAIRInstaller.exe 2015-01-07 22:00 - 2015-01-07 22:00 - 00350739 _____ () C:\Users\Dorota\Desktop\medal.psd 2015-01-07 18:28 - 2015-01-07 18:38 - 658989833 _____ () C:\Users\Dorota\Desktop\G.rmvb 2015-01-07 18:24 - 2015-01-07 18:24 - 00001786 _____ () C:\Users\Dorota\Documents\gmer.log 2015-01-07 17:56 - 2015-01-07 17:56 - 00380416 _____ () C:\Users\Dorota\Desktop\04ftki5b.exe 2015-01-07 17:55 - 2015-01-07 17:55 - 01115648 _____ (Farbar) C:\Users\Dorota\Desktop\FRST.exe 2015-01-07 17:55 - 2015-01-07 17:55 - 00602112 _____ (OldTimer Tools) C:\Users\Dorota\Desktop\OTL.exe 2015-01-06 19:44 - 2015-01-06 20:33 - 00003524 _____ () C:\Users\Dorota\Desktop\op.txt 2015-01-05 19:36 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\Dorota\Documents\Moje dzieła SPORE 2015-01-05 19:35 - 2015-01-05 19:36 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\SPORE 2015-01-05 19:10 - 2015-01-05 23:18 - 00000000 ____D () C:\Users\Dorota\Desktop\spore 2015-01-05 19:06 - 2015-01-05 19:06 - 00000000 ____D () C:\Users\Dorota\Desktop\Crack 2015-01-04 22:19 - 2015-01-04 22:19 - 00000543 _____ () C:\Users\Public\Desktop\ChomikBox.lnk 2015-01-04 22:19 - 2015-01-04 22:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Chomikuj.pl 2015-01-04 22:19 - 2015-01-04 22:19 - 00000000 ____D () C:\Program Files\ChomikBox 2015-01-04 22:15 - 2015-01-04 22:15 - 28266496 _____ () C:\Users\Dorota\Desktop\ChomikBox.msi 2015-01-02 17:09 - 2015-01-02 17:29 - 154349936 _____ (Macrovision Corporation) C:\Users\Dorota\Desktop\PATCH DO SPORE v 5_1.exe 2015-01-02 17:09 - 2015-01-02 17:27 - 152634107 _____ () C:\Users\Dorota\Desktop\spore_dd_patch_all_v5_1.zip 2014-12-31 20:41 - 2014-12-31 22:14 - 00075502 _____ () C:\Users\Dorota\Desktop\Plan.odt 2014-12-31 20:41 - 2014-12-31 20:41 - 00071870 _____ () C:\Users\Dorota\Desktop\powieść.odt 2014-12-29 23:55 - 2014-12-29 23:55 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\Unity 2014-12-29 10:09 - 2015-01-08 11:14 - 00000000 ____D () C:\Program Files\WinZipper 2014-12-29 10:08 - 2014-12-29 22:42 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2014-12-28 20:33 - 2014-12-28 20:33 - 96548610 _____ () C:\Users\Dorota\Desktop\Bez nazwy-2.psd 2014-12-28 18:44 - 2014-12-28 18:44 - 07350204 _____ () C:\Users\Dorota\Desktop\MODIS1000017.tif 2014-12-26 15:38 - 2014-12-26 16:54 - 00000000 ____D () C:\Program Files\auto-clicker 2014-12-26 15:38 - 2014-12-26 15:38 - 00000792 _____ () C:\Users\Dorota\Desktop\auto-clicker.lnk 2014-12-26 15:38 - 2014-12-26 15:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\auto-clicker 2014-12-25 17:07 - 2014-11-01 18:00 - 04238336 _____ () C:\Users\Dorota\Desktop\Crusader Kings 2 V2.2 Steam Trainer +8 MrAntiFun.EXE 2014-12-25 16:26 - 2014-12-25 16:26 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AGOT 2014-12-25 15:17 - 2014-12-25 16:14 - 00000000 ____D () C:\Users\Dorota\Desktop\Crusader Kings II 2014-12-23 21:03 - 2014-12-23 21:03 - 00741788 _____ () C:\Users\Dorota\Desktop\Wspomnienia (Wyznania) gejszy - Golden, Artur.mobi 2014-12-23 17:25 - 2014-12-23 17:26 - 00000000 ____D () C:\Users\Dorota\Desktop\Tor Browser 2014-12-23 17:19 - 2014-12-23 17:20 - 34630867 _____ () C:\Users\Dorota\Desktop\torbrowser-install-4.0.2_pl.exe 2014-12-21 22:51 - 2014-12-21 22:51 - 00002070 _____ () C:\Users\Dorota\Desktop\Skyrim (SKSE).lnk 2014-12-21 14:00 - 2014-12-21 14:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nexus Mod Manager 2014-12-20 09:11 - 2014-12-20 11:13 - 736583680 _____ () C:\Users\Dorota\Desktop\The.Hunger.Games.Catching.Fire.2013.PLSUBBED.LQ.BRRip.XviD-BiDA.avi 2014-12-19 13:10 - 2014-12-19 23:34 - 00000000 ____D () C:\Users\Dorota\Documents\Survarium 2014-12-19 13:10 - 2014-12-19 15:21 - 00000000 ____D () C:\Program Files\Survarium 2014-12-19 13:10 - 2014-12-19 13:10 - 00002081 _____ () C:\Users\Public\Desktop\Play Survarium.lnk 2014-12-19 13:10 - 2014-12-19 13:10 - 00000972 _____ () C:\Windows\certutil.log 2014-12-19 13:10 - 2014-12-19 13:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Survarium 2014-12-15 00:29 - 2014-12-15 00:29 - 00001714 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SumatraPDF.lnk 2014-12-15 00:29 - 2014-12-15 00:29 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\SumatraPDF 2014-12-15 00:29 - 2014-12-15 00:29 - 00000000 ____D () C:\Program Files\SumatraPDF 2014-12-15 00:27 - 2014-12-15 00:27 - 04551776 _____ (Krzysztof Kowalczyk) C:\Users\Dorota\Downloads\SumatraPDF-3.0-install.exe 2014-12-14 13:02 - 2014-12-14 13:39 - 202878300 _____ () C:\Users\Dorota\Desktop\09 - Czwarta Siła.cbr 2014-12-09 20:31 - 2014-12-09 20:31 - 00000000 ____D () C:\ProgramData\Avg_Update_1214tb ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-08 11:56 - 2013-08-20 21:01 - 00000000 ____D () C:\FRST 2015-01-08 11:55 - 2014-05-01 19:58 - 00000000 ____D () C:\Program Files\Common Files\Adobe 2015-01-08 11:55 - 2014-05-01 19:57 - 00000000 ____D () C:\ProgramData\Adobe 2015-01-08 11:54 - 2014-05-01 19:58 - 00000000 ____D () C:\Program Files\Adobe 2015-01-08 11:52 - 2006-11-02 13:52 - 01897459 _____ () C:\Windows\WindowsUpdate.log 2015-01-08 11:50 - 2014-05-01 19:56 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Adobe 2015-01-08 11:40 - 2014-05-02 10:08 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2015-01-08 11:40 - 2014-05-02 10:08 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2015-01-08 11:39 - 2014-05-01 19:59 - 00001036 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-01-08 11:37 - 2014-05-06 20:19 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR 2015-01-08 11:13 - 2014-05-01 19:59 - 00001977 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-01-08 11:13 - 2014-05-01 10:55 - 00000949 _____ () C:\Users\Dorota\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-01-08 11:10 - 2014-05-06 20:34 - 00000000 ____D () C:\Users\Dorota\AppData\Local\PriceMeter 2015-01-08 11:06 - 2014-07-31 19:39 - 00000000 ____D () C:\Users\Dorota\.gstreamer-0.10 2015-01-08 11:06 - 2014-05-01 21:43 - 00000000 ____D () C:\Program Files\Steam 2015-01-08 11:05 - 2014-05-01 19:59 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-08 11:01 - 2006-11-02 13:47 - 00004752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-08 11:01 - 2006-11-02 13:47 - 00004752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-08 11:01 - 2002-01-01 00:02 - 00000008 __RSH () C:\ProgramData\ntuser.pol 2015-01-08 11:00 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-08 10:59 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-01-08 10:59 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\GroupPolicy 2015-01-08 10:58 - 2006-11-02 11:23 - 00000321 _____ () C:\Windows\win.ini 2015-01-08 10:43 - 2014-05-01 22:16 - 00000000 ____D () C:\Users\Dorota\AppData\Roaming\GG 2015-01-07 21:31 - 2014-08-15 11:26 - 00000000 ____D () C:\Users\Dorota\Desktop\Mods 2015-01-07 18:39 - 2014-05-01 22:06 - 00000000 ____D () C:\Users\Dorota\Desktop\sprawozdania 2015-01-07 18:38 - 2014-07-31 19:36 - 00000000 ____D () C:\Users\Dorota\AppData\Local\ChomikBox 2015-01-05 19:22 - 2014-08-01 19:47 - 00000000 ____D () C:\Program Files\Electronic Arts 2015-01-05 19:20 - 2014-05-01 14:59 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information 2015-01-05 18:27 - 2014-05-01 15:03 - 00000000 ____D () C:\Program Files\Opera 2014-12-26 22:56 - 2014-06-05 18:35 - 00000132 _____ () C:\Users\Dorota\AppData\Roaming\Preferencje Adobe CS5 dla formatu PNG 2014-12-26 19:46 - 2014-05-20 20:05 - 00000000 ____D () C:\Users\Dorota\Documents\Universe Sandbox 2014-12-26 17:04 - 2014-10-29 09:59 - 00000000 ____D () C:\Users\Dorota\Desktop\zsjęcia 2014-12-26 17:02 - 2014-05-01 10:54 - 00000000 ____D () C:\Users\Dorota 2014-12-25 10:38 - 2014-05-01 10:54 - 00001356 _____ () C:\Users\Dorota\AppData\Local\d3d9caps.dat 2014-12-23 21:04 - 2014-10-15 12:24 - 00000000 ____D () C:\Users\Dorota\Documents\My Digital Editions 2014-12-23 17:21 - 2014-05-01 22:05 - 00000000 ____D () C:\Users\Dorota\Desktop\skyrim mody 2014-12-22 22:37 - 2014-05-02 08:20 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Skyrim 2014-12-22 22:19 - 2006-11-02 13:52 - 00026252 _____ () C:\Windows\setupact.log 2014-12-21 14:31 - 2014-05-02 07:59 - 00000000 ____D () C:\Users\Dorota\Documents\Nexus Mod Manager 2014-12-21 14:01 - 2014-05-02 07:59 - 00000000 ____D () C:\Users\Dorota\AppData\Local\Black_Tree_Gaming 2014-12-21 14:00 - 2014-05-03 15:42 - 00000882 _____ () C:\Users\Public\Desktop\Nexus Mod Manager.lnk 2014-12-21 14:00 - 2014-05-02 08:55 - 00000000 ____D () C:\Program Files\Nexus Mod Manager 2014-12-17 03:43 - 2014-04-23 19:57 - 00773808 _____ (Microsoft Corporation) C:\Windows\system32\msvcr100.dll 2014-12-17 03:43 - 2014-04-23 19:57 - 00421040 _____ (Microsoft Corporation) C:\Windows\system32\msvcp100.dll Files to move or delete: ==================== C:\Users\Dorota\AppData\Local\Temp\ALLRemote.exe Some content of TEMP: ==================== C:\Users\Dorota\AppData\Local\Temp\ALLRemote.exe C:\Users\Dorota\AppData\Local\Temp\UNINSTALL.EXE ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll => File is digitally signed C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-08 11:10 ==================== End Of Log ============================