Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by qba (administrator) on QBA-PC on 25-06-2015 21:33:41
Running from C:\Users\qba\Downloads
Loaded Profiles: qba (Available Profiles: qba & UpdatusUser & ewa)
Platform: Windows 7 Ultimate (X64) OS Language: Angielski (Stany Zjednoczone)
Internet Explorer Version 8 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Garmin Ltd. or its subsidiaries) C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe
(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Clarus, Inc.) C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Disc Soft Ltd) C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(AVG Technologies CZ, s.r.o.) C:\ProgramData\MFAData\SelfUpd\avgmfapx.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [5583120 2015-02-26] (Disc Soft Ltd)
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\MountPoints2: F - F:\autorun.exe
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\MountPoints2: {9816162f-d78a-11e4-ad5d-001a4d486517} - G:\setup.exe
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\MountPoints2: {b8261419-c42e-11e4-8b41-001a4d486517} - F:\autorun.exe
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\MountPoints2: {ef530b12-fa03-11e4-bc4e-001a4d486517} - F:\AutoRun.exe
HKU\S-1-5-21-2581988766-3747430470-976653192-1000\...\MountPoints2: {ef530b2a-fa03-11e4-bc4e-001a4d486517} - F:\AutoRun.exe
HKU\S-1-5-18\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\tray.exe [1010008 2015-04-08] (Garmin Ltd. or its subsidiaries)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => No File
BootExecute: autocheck autochk * sdnclean64.exe
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-2581988766-3747430470-976653192-1000 -> {06AFA35A-EEBA-425F-8DA2-EA6CDEE0A9B2} URL = http://search.us.com/serp?guid={4004F2FB-F284-408B-9330-76FFC4A56CC1}&k={searchTerms}
SearchScopes: HKU\S-1-5-21-2581988766-3747430470-976653192-1000 -> {7C3B1C1B-CF7D-422C-986A-8343E85F71B1} URL = http://search.us.com/serp?guid={0EB02F6D-B8FA-4B0C-AF74-EA5B690AB432}&k={searchTerms}
SearchScopes: HKU\S-1-5-21-2581988766-3747430470-976653192-1000 -> {B5B71304-EFF2-4414-90AF-1C1BBB6EA7BF} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10513
SearchScopes: HKU\S-1-5-21-2581988766-3747430470-976653192-1000 -> {C9817A0F-9632-4F83-9B91-13D6C2B2BF72} URL = http://www.idg.pl?q={searchTerms}
Filter: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: deflate - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\System32\urlmon.dll [2009-07-14] (Microsoft Corporation)
Filter-x32: gzip - {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\Windows\SysWOW64\urlmon.dll [2009-07-14] (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_257.dll [2015-01-15] ()
FF Plugin: @garmin.com/GpsControl -> C:\Program Files\Garmin GPS Plugin\npGarmin.dll [2013-10-09] (GARMIN Corp.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll [2015-01-15] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @garmin.com/GpsControl -> C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll [2013-10-09] (GARMIN Corp.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2015-05-21] (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-02-09] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-02-09] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
Chrome:
=======
CHR dev: Chrome dev build detected! <======= ATTENTION
CHR Profile: C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Drive) - C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-06-25]
CHR Extension: (YouTube) - C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-06-25]
CHR Extension: (Google Search) - C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-06-25]
CHR Extension: (Google Wallet) - C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-06-25]
CHR Extension: (Gmail) - C:\Users\qba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-06-25]
CHR HKLM-x32\...\Chrome\Extension: [ifllmjhoijmmhobcnjdhelmboobmenij] - C:\Program Files (x86)\Wondershare\AllMyTube\SVRChromePlugin.crx [Not Found]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 Disc Soft Lite Bus Service; C:\Program Files\DAEMON Tools Lite\DiscSoftBusService.exe [1272592 2015-02-26] (Disc Soft Ltd)
R2 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [50688 2012-07-31] (Hewlett-Packard) [File not signed]
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [167424 2012-12-07] () [File not signed]
S2 PLAY ONLINE. RunOuc; C:\Program Files (x86)\PLAY ONLINE\UpdateDog\ouc.exe [246112 2015-05-14] ()
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [66048 2012-07-31] (Hewlett-Packard) [File not signed]
R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [337776 2013-09-13] (arvato digital services llc)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 SZDrvSvc; C:\Program Files (x86)\Clarus\Samsung Drive Manager\SZDrvSvc.exe [18432 2013-12-18] (Clarus, Inc.) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2009-07-14] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R3 dtlitescsibus; C:\Windows\System32\DRIVERS\dtlitescsibus.sys [30352 2015-03-06] (Disc Soft Ltd)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [17480 2013-03-07] () [File not signed]
S3 epmntdrv; C:\Windows\SysWOW64\epmntdrv.sys [13896 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9800 2013-03-07] () [File not signed]
S3 EuGdiDrv; C:\Windows\SysWOW64\EuGdiDrv.sys [9160 2013-03-07] () [File not signed]
U5 ew_hwusbdev; C:\Windows\System32\Drivers\ew_hwusbdev.sys [117248 2015-05-14] (Huawei Technologies Co., Ltd.)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2014-01-23] () [File not signed]
S3 HtcVCom32; C:\Windows\System32\DRIVERS\HtcVComV64.sys [121800 2010-03-08] (QUALCOMM Incorporated)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-02-09] (REALiX(tm))
R3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2011-05-17] (http://libusb-win32.sourceforge.net)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2015-02-09] (Synaptics Incorporated)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [381608 2015-03-06] (Duplex Secure Ltd.)
S3 mdf16; \??\C:\Users\qba\AppData\Local\Temp\mdf16.sys [X]
S3 mvd23; \??\C:\Users\qba\AppData\Local\Temp\mvd23.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-25 21:32 - 2015-06-25 21:34 - 00000000 ____D C:\ProgramData\MFAData
2015-06-25 21:32 - 2015-06-25 21:32 - 00000000 ____D C:\Users\qba\AppData\Local\MFAData
2015-06-25 21:32 - 2015-06-25 21:32 - 00000000 ____D C:\Users\qba\AppData\Local\Avg2015
2015-06-25 21:31 - 2015-06-25 21:32 - 05017672 _____ (AVG Technologies) C:\Users\qba\Downloads\avg_free_stb_all_2015_ltst_639.exe
2015-06-25 21:17 - 2015-06-25 21:19 - 00044194 _____ C:\Users\qba\Downloads\Addition.txt
2015-06-25 21:16 - 2015-06-25 21:33 - 00013828 _____ C:\Users\qba\Downloads\FRST.txt
2015-06-25 21:16 - 2015-06-25 21:33 - 00000000 ____D C:\FRST
2015-06-25 21:15 - 2015-06-25 21:15 - 02112512 _____ (Farbar) C:\Users\qba\Downloads\FRST64.exe
2015-06-24 23:39 - 2015-06-24 23:38 - 00450811 ____R C:\Windows\system32\Drivers\etc\hosts.20150624-233946.backup
2015-06-24 23:38 - 2015-02-17 20:53 - 00000864 _____ C:\Windows\system32\Drivers\etc\hosts.20150624-233846.backup
2015-06-24 21:54 - 2015-06-24 21:54 - 00001391 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2015-06-24 21:54 - 2015-06-24 21:54 - 00001379 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2015-06-24 21:54 - 2015-06-24 21:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2015-06-24 21:54 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2015-06-20 08:48 - 2015-06-25 20:55 - 00000448 _____ C:\Windows\setupact.log
2015-06-20 08:48 - 2015-06-20 08:48 - 00000000 _____ C:\Windows\setuperr.log
2015-06-12 23:04 - 2015-06-12 23:04 - 00002156 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth.lnk
2015-05-31 21:35 - 2015-05-31 21:37 - 00000000 ____D C:\zdjecia
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-25 21:19 - 2009-07-14 06:45 - 00019760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-25 21:19 - 2009-07-14 06:45 - 00019760 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-25 21:00 - 2014-03-26 11:04 - 00001048 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-25 20:59 - 2015-02-09 19:05 - 01207665 _____ C:\Windows\WindowsUpdate.log
2015-06-25 20:55 - 2014-03-26 11:04 - 00001044 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-25 20:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-24 23:47 - 2013-02-21 16:34 - 00000000 ____D C:\incoming
2015-06-24 23:47 - 2013-02-20 23:56 - 00000000 ____D C:\Users\qba\AppData\Local\Google
2015-06-24 23:19 - 2014-12-01 11:14 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2015-06-24 22:02 - 2014-12-01 11:14 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2015-06-24 21:23 - 2015-04-22 14:27 - 00000000 ____D C:\AdwCleaner
2015-06-24 21:13 - 2015-04-15 18:40 - 00000020 _____ C:\Users\qba\AppData\Roaming\appdataFr3.bin
2015-06-23 21:51 - 2014-12-24 10:06 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-21 21:18 - 2015-04-16 09:35 - 00000020 _____ C:\Users\ewa\AppData\Roaming\appdataFr3.bin
2015-06-21 21:17 - 2015-02-09 18:18 - 00002782 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-06-19 07:26 - 2015-02-09 18:18 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2015-06-19 07:26 - 2015-02-09 18:18 - 00000000 ____D C:\Program Files\CCleaner
2015-06-18 23:20 - 2015-03-06 20:24 - 00000000 ____D C:\Users\qba\AppData\Roaming\DAEMON Tools Lite
2015-06-18 23:20 - 2013-02-21 16:35 - 00000000 ____D C:\Users\qba\AppData\Roaming\uTorrent
2015-06-13 08:30 - 2013-02-21 15:01 - 00738954 _____ C:\Windows\system32\perfh015.dat
2015-06-13 08:30 - 2013-02-21 15:01 - 00155064 _____ C:\Windows\system32\perfc015.dat
2015-06-13 08:30 - 2009-07-14 07:13 - 01666088 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-12 23:04 - 2014-03-26 11:03 - 00000000 ____D C:\Program Files (x86)\Google
2015-06-10 22:40 - 2013-02-22 15:34 - 00000000 ____D C:\Users\qba\AppData\Roaming\Mp3tag
2015-06-10 22:32 - 2013-02-22 20:18 - 00000000 ____D C:\Users\qba\AppData\Roaming\foobar2000
2015-06-10 22:24 - 2013-02-25 17:12 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP
2015-06-10 22:16 - 2013-02-25 17:12 - 00001161 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2015-06-10 22:16 - 2013-02-25 17:12 - 00001105 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2015-05-29 21:06 - 2014-04-24 08:19 - 00000979 _____ C:\Users\Public\Desktop\Mp3tag.lnk
2015-05-29 21:06 - 2013-02-22 15:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mp3tag
2015-05-29 21:06 - 2013-02-22 15:33 - 00000000 ____D C:\Program Files (x86)\Mp3tag
2015-05-29 20:47 - 2013-02-23 16:15 - 00000000 ____D C:\ProgramData\Freemake
2015-05-29 20:38 - 2013-02-23 16:19 - 00001320 _____ C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2015-05-29 20:38 - 2013-02-23 16:15 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
==================== Files in the root of some directories =======
2015-04-15 18:40 - 2015-06-24 21:13 - 0000020 _____ () C:\Users\qba\AppData\Roaming\appdataFr3.bin
2015-02-17 20:39 - 2015-02-17 20:50 - 0000003 _____ () C:\Users\qba\AppData\Local\proxy.log
2014-03-12 18:59 - 2014-03-12 18:59 - 0107837 _____ () C:\Users\qba\AppData\Local\soulseek-client.dat.1394643596675
2014-03-12 19:34 - 2014-03-12 19:34 - 0093428 _____ () C:\Users\qba\AppData\Local\soulseek-client.dat.1394645655041
2014-03-12 19:50 - 2014-03-12 19:50 - 0093436 _____ () C:\Users\qba\AppData\Local\soulseek-client.dat.1394646634418
2014-03-12 20:53 - 2014-03-12 20:53 - 0093463 _____ () C:\Users\qba\AppData\Local\soulseek-client.dat.1394650415683
2015-04-16 09:09 - 2015-04-16 09:09 - 0011582 _____ () C:\Users\qba\AppData\Local\Temp-log.txt
Some files in TEMP:
====================
C:\Users\qba\AppData\Local\Temp\Quarantine.exe
C:\Users\qba\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-19 12:40
==================== End of log ============================
