Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2015 01 Ran by Rexus (administrator) on REXUS-PC on 15-01-2015 20:56:46 Running from D:\Download Loaded Profiles: Rexus (Available profiles: Rexus) Platform: Windows 7 Professional N Service Pack 1 (X64) OS Language: Polski (Polska) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe (Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (MSI) C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe (MSI) C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe (MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () C:\Windows\SysWOW64\PnkBstrA.exe (arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe (Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Microsoft Corporation) C:\Windows\System32\taskmgr.exe (REALiX) C:\Users\Rexus\Desktop\HWiNFO64.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe () C:\Program Files (x86)\Opera\26.0.1656.60\opera_crashreporter.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe () C:\Windows\Temp\svchost.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Microsoft Corporation) C:\Windows\System32\SnippingTool.exe (Microsoft Corporation) C:\Windows\System32\wisptis.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe (Opera Software) C:\Program Files (x86)\Opera\26.0.1656.60\opera.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7506136 2013-12-06] (Realtek Semiconductor) HKLM\...\Run: [MBCfg64] => C:\Windows\system32\RunDLL32.exe C:\Windows\system32\MBCfg64.dll,RunDLLEntry MBCfg64 HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [558496 2014-02-27] (Adobe Systems Incorporated) HKLM\...\Run: [IntelSBA] => C:\Program Files\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [5290688 2013-07-25] (Intel Corporation) HKLM-x32\...\Run: [Sound Blaster Cinema] => C:\Program Files (x86)\Creative\Sound Blaster Cinema\Sound Blaster Cinema\SBCinema.exe [711680 2013-08-16] (Creative Technology Ltd) HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.) HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-09-16] (Intel Corporation) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation) HKLM-x32\...\Run: [Super-Charger] => C:\Program Files (x86)\MSI\Super-Charger\Super-Charger.exe [1047536 2013-11-12] (MSI) HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation) HKLM-x32\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3838800 2014-12-13] (LogMeIn Inc.) HKU\S-1-5-21-3884903845-2231723937-405898034-1000\...\Run: [DAEMON Tools Lite] => "D:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun HKU\S-1-5-21-3884903845-2231723937-405898034-1000\...\Run: [OscarEditor] => C:\Program Files (x86)\X7 Oscar Keyboard Editor\\OscarEditor.exe [3536896 2010-12-24] () HKU\S-1-5-21-3884903845-2231723937-405898034-1000\...\Run: [OscarKeyboard] => C:\Program Files (x86)\X7 Oscar Keyboard Editor\OscarEditor.exe [3536896 2010-12-24] () HKU\S-1-5-21-3884903845-2231723937-405898034-1000\...\Run: [se] => C:\Users\Rexus\AppData\Roaming\SkypEmoticons\SE.exe [5679008 2014-12-24] (SkypEmoticons) HKU\S-1-5-21-3884903845-2231723937-405898034-1000\...\MountPoints2: {8a8b1e0f-40c7-11e4-8f47-448a5b84ce67} - G:\setup.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{A003678C-C125-49A0-90D0-99AE485F6F92}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC) CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://websearch.searchoholic.info/?pid=21073&r=2014/12/24&hid=9533317915051207605&lg=EN&cc=PL&unqvl=72 HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} HKU\S-1-5-21-3884903845-2231723937-405898034-1000\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.delta-homes.com/web/?type=ds&ts=1418830641&from=wpm12173&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} HKU\S-1-5-21-3884903845-2231723937-405898034-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://websearch.searchoholic.info/?pid=21073&r=2014/12/24&hid=9533317915051207605&lg=EN&cc=PL&unqvl=72 HKU\S-1-5-21-3884903845-2231723937-405898034-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.istartsurf.com/?type=hp&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1 HKU\S-1-5-21-3884903845-2231723937-405898034-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.delta-homes.com/web/?type=ds&ts=1418830641&from=wpm12173&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} SearchScopes: HKLM -> DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} SearchScopes: HKLM -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} SearchScopes: HKLM-x32 -> DefaultScope {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.searchoholic.info/?l=1&q={searchTerms}&pid=21073&r=2014/12/24&hid=9533317915051207605&lg=EN&cc=PL&unqvl=72 SearchScopes: HKLM-x32 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://www.istartsurf.com/web/?type=ds&ts=1411227469&from=smt&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} SearchScopes: HKLM-x32 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.searchoholic.info/?l=1&q={searchTerms}&pid=21073&r=2014/12/24&hid=9533317915051207605&lg=EN&cc=PL&unqvl=72 SearchScopes: HKU\S-1-5-21-3884903845-2231723937-405898034-1000 -> {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = http://search.delta-homes.com/web/?type=ds&ts=1418830641&from=wpm12173&uid=WDCXWD10PURX-64D85Y0_WD-WCC4JAJL0TS1L0TS1&q={searchTerms} SearchScopes: HKU\S-1-5-21-3884903845-2231723937-405898034-1000 -> {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = http://websearch.searchoholic.info/?l=1&q={searchTerms}&pid=21073&r=2014/12/24&hid=9533317915051207605&lg=EN&cc=PL&unqvl=72 BHO: DealEXpress -> {1b610c06-9f6b-426d-a15e-a2f4ba3e3d84} -> C:\ProgramData\DealEXpress\512BiRTgpTmB1x.x64.dll () BHO: NetoCoupouN -> {231f21aa-c30f-4c33-bd93-97dfed95b866} -> C:\ProgramData\NetoCoupouN\pYUHxwTc8k3yal.x64.dll () BHO: ReGGullarDeals -> {3ff7c66a-d61c-43d0-bce9-3a6a90f7b706} -> C:\ProgramData\ReGGullarDeals\t7WjvkuWQ45UTr.x64.dll () BHO: YoutubeAddBLLocke -> {526a1486-675a-4b07-84a6-233d4124db3d} -> C:\Program Files (x86)\YoutubeAddBLLocke\bLFjwQFvAQ3ZTW.x64.dll () BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation) BHO: EuxstraaSaavinggs -> {84a01b62-1e77-44c4-b65e-6acea47d8ac1} -> C:\ProgramData\EuxstraaSaavinggs\habdOjeOJvnsdC.x64.dll () BHO: BitSoaveR -> {9a6fed18-f22c-493b-93d9-5e4ae0e19d89} -> C:\ProgramData\BitSoaveR\nJqWbRDuQFRuW5.x64.dll () BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: DealEXpress -> {1b610c06-9f6b-426d-a15e-a2f4ba3e3d84} -> C:\ProgramData\DealEXpress\512BiRTgpTmB1x.dll () BHO-x32: NetoCoupouN -> {231f21aa-c30f-4c33-bd93-97dfed95b866} -> C:\ProgramData\NetoCoupouN\pYUHxwTc8k3yal.dll () BHO-x32: ReGGullarDeals -> {3ff7c66a-d61c-43d0-bce9-3a6a90f7b706} -> C:\ProgramData\ReGGullarDeals\t7WjvkuWQ45UTr.dll () BHO-x32: YoutubeAddBLLocke -> {526a1486-675a-4b07-84a6-233d4124db3d} -> C:\Program Files (x86)\YoutubeAddBLLocke\bLFjwQFvAQ3ZTW.dll () BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: EuxstraaSaavinggs -> {84a01b62-1e77-44c4-b65e-6acea47d8ac1} -> C:\ProgramData\EuxstraaSaavinggs\habdOjeOJvnsdC.dll () BHO-x32: BitSoaveR -> {9a6fed18-f22c-493b-93d9-5e4ae0e19d89} -> C:\ProgramData\BitSoaveR\nJqWbRDuQFRuW5.dll () BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll (EA Digital Illusions CE AB) FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.5 -> D:\Programy\VLC\npvlc.dll (VideoLAN) FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\3.0.40818.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF Plugin HKU\S-1-5-21-3884903845-2231723937-405898034-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Rexus\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll No File Chrome: ======= CHR dev: Chrome dev build detected! <======= ATTENTION ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 fc67e7a0; c:\Program Files (x86)\DeltaFix\DeltaFix.dll [4096512 2014-12-24] () [File not signed] <==== ATTENTION R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed] R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-09-20] (Cherished Technololgy LIMITED) R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed] S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation) R2 intelsba; C:\Program Files\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [54976 2013-07-25] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation) S2 KMService; C:\Windows\SysWOW64\srvany.exe [8192 2014-09-20] () [File not signed] R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [417552 2014-12-02] (LogMeIn, Inc.) R2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super-Charger\ChargeService.exe [161776 2013-09-09] (MSI) R2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-09-26] (MICRO-STAR INTERNATIONAL CO., LTD.) R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation) R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [57617752 2009-03-30] (Microsoft Corporation) R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation) S3 Origin Client Service; D:\Origin\OriginClientService.exe [1903472 2014-12-20] (Electronic Arts) R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76152 2014-11-08] () R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2014-04-30] (arvato digital services llc) R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [340480 2013-09-11] (Qualcomm Atheros) [File not signed] S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [427880 2009-03-30] (Microsoft Corporation) R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5426448 2014-12-15] (TeamViewer GmbH) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [485376 2014-12-16] (Fuyu LIMITED) [File not signed] R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [424624 2015-01-12] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ATTENTION ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-20] (Disc Soft Ltd) R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation) R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super-Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) R1 {8aefbcaf-640f-4dca-9a92-ed05ee387238}Gw64; C:\Windows\System32\drivers\{8aefbcaf-640f-4dca-9a92-ed05ee387238}Gw64.sys [48776 2014-12-21] (StdLib) S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X] R3 HWiNFO32; \??\C:\Users\Rexus\AppData\Local\Temp\HWiNFO64A.SYS [X] S1 iSafeKrnlMon; \??\C:\Program Files (x86)\Elex-tech\YAC\iSafeKrnlMon.sys [X] S3 MSICDSetup; \??\E:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-15 20:55 - 2015-01-15 20:56 - 00000000 ____D () C:\FRST 2015-01-15 20:47 - 2015-01-15 20:47 - 00007606 _____ () C:\Users\Rexus\AppData\Local\Resmon.ResmonCfg 2015-01-15 17:07 - 2015-01-15 17:07 - 00000000 ____D () C:\Windows\system32\log 2015-01-15 17:05 - 2015-01-15 17:05 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Temp{1C15B624-7D99-465B-9C61-93A1B5A0FACC} 2015-01-15 16:45 - 2015-01-15 16:45 - 00000000 ____D () C:\ProgramData\Extreme Blocker 2015-01-14 15:42 - 2015-01-14 15:43 - 00000000 ____D () C:\ProgramData\DealEXpress 2015-01-13 23:15 - 2015-01-13 23:20 - 00000010 _____ () C:\Users\Rexus\Desktop\ustawienia csgo.txt 2015-01-13 14:33 - 2015-01-13 14:34 - 00000000 ____D () C:\ProgramData\ReGGullarDeals 2015-01-09 13:47 - 2015-01-15 16:06 - 00062292 _____ () C:\Windows\temp023423.vbe 2015-01-08 18:48 - 2015-01-15 20:47 - 00002865 _____ () C:\Users\Rexus\Desktop\HWiNFO64.INI 2015-01-08 18:48 - 2014-11-26 11:35 - 02361744 _____ (REALiX) C:\Users\Rexus\Desktop\HWiNFO64.exe 2015-01-08 18:40 - 2015-01-08 18:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO64 2015-01-08 18:40 - 2015-01-08 18:40 - 00000000 ____D () C:\Program Files\HWiNFO64 2015-01-05 21:02 - 2015-01-05 21:02 - 00000000 ____D () C:\ProgramData\NetoCoupouN 2015-01-05 21:02 - 2015-01-05 21:02 - 00000000 ____D () C:\ProgramData\EuxstraaSaavinggs 2015-01-05 12:56 - 2015-01-05 12:56 - 00000000 _____ () C:\Users\Rexus\Desktop\profile.php 2015-01-04 00:29 - 2015-01-04 12:02 - 00002707 _____ () C:\Users\Rexus\Desktop\login.php 2015-01-03 22:15 - 2015-01-14 23:26 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\Skype 2015-01-03 22:15 - 2015-01-03 22:15 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Skype 2015-01-03 22:15 - 2015-01-03 22:15 - 00000000 ____D () C:\ProgramData\Skype 2015-01-03 22:15 - 2015-01-03 22:15 - 00000000 ____D () C:\Program Files (x86)\Skype 2015-01-03 15:18 - 2015-01-03 15:17 - 00001121 _____ () C:\Users\Rexus\Desktop\TS4-Launcher — skrót.lnk 2015-01-03 13:53 - 2015-01-03 13:53 - 00000679 _____ () C:\Users\Rexus\Desktop\EVEREST Home Edition.lnk 2015-01-03 13:53 - 2015-01-03 13:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lavalys 2015-01-03 13:52 - 2015-01-03 13:52 - 04179293 _____ (Lavalys, Inc. ) C:\Users\Rexus\Downloads\everesthome220(dobreprogramy.pl).exe 2015-01-01 14:50 - 2014-12-13 01:47 - 00620176 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-01-01 14:49 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 16040184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-01 14:49 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434709.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434709.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00994384 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00876976 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00178632 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-01-01 14:49 - 2014-12-13 11:08 - 00165760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-01-01 14:49 - 2014-10-09 18:02 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2015-01-01 14:49 - 2014-10-09 18:02 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2015-01-01 14:49 - 2014-10-09 08:17 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco64.dll 2014-12-31 22:51 - 2014-12-31 22:51 - 00000000 __SHD () C:\Users\Rexus\AppData\Local\EmieUserList 2014-12-31 22:51 - 2014-12-31 22:51 - 00000000 __SHD () C:\Users\Rexus\AppData\Local\EmieSiteList 2014-12-31 22:51 - 2014-12-31 22:51 - 00000000 __SHD () C:\Users\Rexus\AppData\Local\EmieBrowserModeList 2014-12-31 11:25 - 2015-01-14 15:43 - 00000000 ____D () C:\ProgramData\4583814f9fa67008 2014-12-31 11:25 - 2014-12-31 11:25 - 00000000 ____D () C:\ProgramData\BitSoaveR 2014-12-28 11:22 - 2014-12-28 11:22 - 00000000 ____D () C:\Users\Rexus\Documents\Electronic Arts 2014-12-28 11:13 - 2015-01-15 16:06 - 00003090 _____ () C:\Windows\System32\Tasks\Origin 2014-12-28 11:04 - 2014-12-28 11:08 - 00000000 ____D () C:\Users\Rexus\Downloads\Nowy folder 2014-12-27 02:06 - 2014-12-27 02:06 - 00000000 ____D () C:\ProgramData\Orbit 2014-12-26 20:21 - 2014-12-27 12:38 - 00000000 ____D () C:\Program Files (x86)\TeamViewer 2014-12-26 20:21 - 2014-12-26 20:31 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\TeamViewer 2014-12-26 20:21 - 2014-12-26 20:21 - 00001043 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 10.lnk 2014-12-26 17:06 - 2014-12-31 22:51 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Google 2014-12-26 17:06 - 2014-12-31 22:51 - 00000000 ____D () C:\Program Files (x86)\Google 2014-12-26 06:54 - 2014-12-26 06:54 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\REngLauncher 2014-12-26 06:52 - 2014-12-26 06:52 - 00000000 ____D () C:\Users\Rexus\Documents\BnS 2014-12-26 06:52 - 2014-12-26 06:52 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\Awesomium 2014-12-26 02:44 - 2014-12-26 02:44 - 00001126 _____ () C:\Users\Public\Desktop\Blade and Soul.lnk 2014-12-26 02:44 - 2014-12-26 02:44 - 00000000 ____D () C:\Users\Rexus\AppData\Local\BNSUpdater 2014-12-26 02:41 - 2014-12-26 02:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Blade and Soul 2014-12-26 02:41 - 2014-12-26 02:41 - 00000000 ____D () C:\Program Files (x86)\PlayBns.com 2014-12-26 02:38 - 2014-12-26 02:39 - 00000000 ____D () C:\Windows\SysWOW64\directx 2014-12-25 17:02 - 2014-12-25 17:02 - 00001106 _____ () C:\Users\Rexus\Desktop\CSGO.lnk 2014-12-25 17:01 - 2014-12-25 17:01 - 00001312 _____ () C:\Users\Rexus\Desktop\Battlefield 3.lnk 2014-12-25 17:01 - 2014-12-25 17:01 - 00000789 _____ () C:\Users\Rexus\Desktop\Far Cry 4.lnk 2014-12-25 13:33 - 2014-12-25 13:33 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2014-12-25 13:32 - 2014-12-25 13:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi 2014-12-25 13:32 - 2014-12-25 13:32 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi 2014-12-24 20:20 - 2015-01-04 17:28 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\SkypEmoticons 2014-12-24 20:20 - 2014-12-24 20:26 - 00000000 ____D () C:\Program Files (x86)\Driver Pro 2014-12-24 20:20 - 2014-12-24 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SkypEmoticons 2014-12-24 20:20 - 2014-12-24 20:20 - 00000000 ____D () C:\Program Files (x86)\DeltaFix 2014-12-24 20:20 - 2014-12-24 20:20 - 00000000 ____D () C:\Program Files (x86)\Auto Reload 2014-12-24 20:19 - 2014-12-24 20:25 - 00000000 ____D () C:\Program Files\DD7191F4-293C-452F-8784-D96DE9582EC4 2014-12-24 20:19 - 2014-12-24 20:19 - 00000000 ____D () C:\ProgramData\5008989389547008008 2014-12-24 20:19 - 2014-12-24 20:19 - 00000000 ____D () C:\Program Files (x86)\YoutubeAddBLLocke 2014-12-24 20:19 - 2014-12-24 20:19 - 00000000 ____D () C:\Program Files (x86)\BuyNsavae 2014-12-22 10:52 - 2014-12-22 10:52 - 00000000 ____D () C:\ts3overlay 2014-12-22 10:27 - 2014-12-24 20:20 - 00000000 ____D () C:\ProgramData\1837308050 2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\Users\Rexus\Documents\Optimizer Pro 2014-12-22 10:25 - 2014-12-21 14:23 - 00048776 _____ (StdLib) C:\Windows\system32\Drivers\{8aefbcaf-640f-4dca-9a92-ed05ee387238}Gw64.sys 2014-12-22 10:22 - 2014-12-22 10:52 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Gameo 2014-12-22 10:22 - 2014-12-22 10:28 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\Gameo 2014-12-22 10:22 - 2014-12-22 10:22 - 00000171 _____ () C:\Users\Rexus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Play Games Online.url 2014-12-22 10:22 - 2014-12-22 10:22 - 00000000 ___HD () C:\Users\Rexus\AppData\Roaming\GoldenGate 2014-12-20 16:09 - 2014-12-20 16:09 - 00000000 ____D () C:\ProgramData\dbg 2014-12-20 16:01 - 2014-12-23 17:09 - 00000000 ____D () C:\Program Files (x86)\Overwolf 2014-12-20 15:52 - 2014-12-23 17:09 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Overwolf 2014-12-18 15:50 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-12-18 15:50 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-12-17 16:37 - 2015-01-15 20:26 - 00000000 ____D () C:\Program Files (x86)\WinZipper 2014-12-17 16:37 - 2015-01-15 16:35 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\WinZipper 2014-12-17 16:37 - 2014-12-17 16:37 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-15 20:37 - 2014-09-15 17:40 - 01252445 _____ () C:\Windows\WindowsUpdate.log 2015-01-15 20:36 - 2014-10-13 17:19 - 00000000 ____D () C:\Users\Rexus\AppData\Local\LogMeIn Hamachi 2015-01-15 20:30 - 2009-07-14 05:50 - 00030992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-15 20:30 - 2009-07-14 05:50 - 00030992 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-15 20:28 - 2011-04-12 13:11 - 00803902 _____ () C:\Windows\system32\perfh015.dat 2015-01-15 20:28 - 2011-04-12 13:11 - 00179680 _____ () C:\Windows\system32\perfc015.dat 2015-01-15 20:28 - 2009-07-14 06:12 - 01849282 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-15 20:24 - 2014-09-15 17:54 - 00000930 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-15 20:23 - 2009-07-14 05:56 - 00109491 _____ () C:\Windows\setupact.log 2015-01-15 20:22 - 2014-09-15 18:06 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-01-15 20:22 - 2010-11-21 04:47 - 00035254 _____ () C:\Windows\PFRO.log 2015-01-15 20:22 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-15 16:17 - 2014-09-16 12:58 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\TS3Client 2015-01-15 16:15 - 2014-10-04 18:58 - 00000000 ____D () C:\Users\Rexus\AppData\Local\Adobe 2015-01-15 16:06 - 2014-09-18 19:22 - 00000000 ____D () C:\ProgramData\Origin 2015-01-14 22:03 - 2014-11-08 15:43 - 00348928 _____ () C:\Windows\SysWOW64\PnkBstrB.exe 2015-01-14 22:03 - 2014-09-20 21:34 - 00348928 _____ () C:\Windows\SysWOW64\PnkBstrB.xtr 2015-01-14 22:02 - 2014-09-20 21:25 - 00280904 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0 2015-01-14 21:52 - 2014-09-15 20:28 - 00080882 _____ () C:\Windows\DirectX.log 2015-01-14 20:24 - 2014-09-15 17:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-14 20:24 - 2014-09-15 17:54 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-01-14 20:24 - 2014-09-15 17:54 - 00003868 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-14 16:39 - 2014-09-19 20:40 - 00003924 _____ () C:\Windows\windefendam.log 2015-01-14 16:39 - 2014-09-19 20:40 - 00000020 _____ () C:\Windows\capsys184523.log 2015-01-13 23:32 - 2014-09-25 21:52 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\vlc 2015-01-13 21:48 - 2014-09-15 17:40 - 00000000 ____D () C:\Users\Rexus 2015-01-12 21:01 - 2014-09-15 17:58 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\GG 2015-01-04 00:21 - 2014-11-11 17:01 - 00000000 ____D () C:\Users\Rexus\AppData\Local\CrashDumps 2015-01-01 14:51 - 2014-09-15 18:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2014-12-31 12:14 - 2010-11-21 04:27 - 00298120 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-12-28 11:22 - 2014-10-04 19:23 - 00000000 ____D () C:\ProgramData\Package Cache 2014-12-28 11:16 - 2014-09-18 19:34 - 00000000 ___HD () C:\Users\Rexus\AppData\Roaming\Origin 2014-12-27 20:37 - 2009-07-14 06:08 - 00032604 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-12-27 12:41 - 2014-12-09 18:32 - 00000000 ____D () C:\Users\Rexus\AppData\Local\GG 2014-12-27 02:31 - 2014-10-04 18:10 - 00000000 ____D () C:\Users\Rexus\AppData\Roaming\uTorrent 2014-12-27 01:33 - 2009-07-14 05:50 - 00413408 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-12-27 00:00 - 2014-09-15 17:53 - 00111264 _____ () C:\Users\Rexus\AppData\Local\GDIPFONTCACHEV1.DAT 2014-12-26 02:44 - 2009-07-14 06:38 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2014-12-22 14:44 - 2009-07-14 03:34 - 00000269 _____ () C:\Windows\win.ini 2014-12-17 16:36 - 2014-09-20 16:38 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect 2014-12-17 15:40 - 2014-09-15 17:55 - 00003872 _____ () C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1410800159 2014-12-17 15:40 - 2014-09-15 17:55 - 00000000 ____D () C:\Program Files (x86)\Opera Files to move or delete: ==================== C:\Users\Rexus\AppData\Roaming\Origin\update.vbe Some content of TEMP: ==================== C:\Users\Rexus\AppData\Local\Temp\9Cd15.exe C:\Users\Rexus\AppData\Local\Temp\drvprosetup.exe C:\Users\Rexus\AppData\Local\Temp\ICReinstall_UltraStar 1.0.2.exe C:\Users\Rexus\AppData\Local\Temp\nswDF2B.tmp.exe C:\Users\Rexus\AppData\Local\Temp\nvSCPAPI.dll C:\Users\Rexus\AppData\Local\Temp\nvSCPAPI64.dll C:\Users\Rexus\AppData\Local\Temp\nvStInst.exe C:\Users\Rexus\AppData\Local\Temp\optprosetup.exe C:\Users\Rexus\AppData\Local\Temp\Protect4a647d98.dll C:\Users\Rexus\AppData\Local\Temp\sSetup-se.exe C:\Users\Rexus\AppData\Local\Temp\update.exe C:\Users\Rexus\AppData\Local\Temp\utils.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-04 11:49 ==================== End Of Log ============================