Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015 Ran by HP (administrator) on HP-ПК on 08-04-2015 13:29:48 Running from C:\Users\HP\Downloads Loaded Profiles: HP (Available profiles: HP) Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Українська (Україна) Internet Explorer Version 8 (Default browser: Opera) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (ESET) C:\Program Files\ESET\ESET Smart Security\ekrn.exe () C:\Windows\System32\srvany.exe () C:\Windows\System32\KMSService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe (ESET) C:\Program Files\ESET\ESET Smart Security\egui.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe () D:\гамес\GTA SAMP by Elmaldin\gta_sa.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe () C:\Program Files\Opera\23.0.1522.60\opera_crashreporter.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe (Opera Software) C:\Program Files\Opera\23.0.1522.60\opera.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [11430504 2011-10-17] (Realtek Semiconductor) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart HKLM\...\Run: [egui] => C:\Program Files\ESET\ESET Smart Security\egui.exe [5088456 2014-10-01] (ESET) HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [31344744 2015-02-26] (Skype Technologies S.A.) HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\Run: [uTorrent] => C:\Users\HP\AppData\Roaming\uTorrent\uTorrent.exe [1385808 2014-11-21] (BitTorrent Inc.) HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd) HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1 HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\MountPoints2: F - F:\autorun.exe HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\MountPoints2: G - G:\bootstrap.exe HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\...\MountPoints2: {cb9fb066-f482-11e3-903e-001e3769e800} - G:\bootstrap.exe GroupPolicy: Group Policy on Chrome detected <======= ATTENTION CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.ru/cnt/10445?gp=blackbear6 HKU\S-1-5-21-2211227067-3086438257-2939489256-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp URLSearchHook: HKLM - Default Value = {CCC7B151-1D8C-11E3-B2AD-F3EF3D58318D} SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2211227067-3086438257-2939489256-1000 -> DefaultScope {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = http://go.mail.ru/search?q={SearchTerms}&fr=ntg SearchScopes: HKU\S-1-5-21-2211227067-3086438257-2939489256-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = http://go.mail.ru/search?q={SearchTerms}&fr=ntg BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2010-03-25] (Microsoft Corporation) BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2014-01-27] (Oracle Corporation) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2010-02-28] (Microsoft Corporation) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2014-01-27] (Oracle Corporation) Toolbar: HKU\S-1-5-21-2211227067-3086438257-2939489256-1000 -> No Name - {424C542D-5637-006A-76A7-7A786E7484D7} - No File Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.0.27 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_235.dll [2014-12-19] () FF Plugin: @java.com/DTPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-01-27] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2014-01-27] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation) FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation) FF Plugin: @t.garena.com/garenatalk -> C:\Program Files\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll No File FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll No File FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll No File FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] - C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird Chrome: ======= CHR StartupUrls: Default -> "hxxp://google.com.ua/" CHR DefaultSearchKeyword: Default -> bing.com CHR DefaultNewTabURL: Default -> https://www.bing.com/chrome/newtab CHR DefaultSuggestURL: Default -> https://www.bing.com/osjson.aspx?query={searchTerms}&language={language}&PC=U316 CHR Profile: C:\Users\HP\AppData\Local\Google\Chrome\User Data\Default Opera: ======= OPR StartupUrls: "hxxp://mail.ru/cnt/10445" OPR Extension: (VkOpt) - C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\Extensions\hoboppgpbgclpfnjfdidokiilachfcbb [2014-12-20] OPR Extension: (Soundcloud Rainer) - C:\Users\HP\AppData\Roaming\Opera Software\Opera Stable\Extensions\lngalmjbnicjfedhpakibankplbalona [2014-09-28] ========================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 defragsvc; C:\Windows\System32\defragsvc.dll [218624 2009-07-14] (Корпорація Майкрософт) R2 ekrn; C:\Program Files\ESET\ESET Smart Security\ekrn.exe [1349576 2014-10-01] (ESET) R2 KMSService; C:\Windows\system32\srvany.exe [8192 2013-12-27] () [File not signed] U2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14658848 2013-12-10] (NVIDIA Corporation) R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [770944 2015-01-27] (Enigma Software Group USA, LLC.) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation) S3 WPCSvc; C:\Windows\System32\wpcsvc.dll [10752 2009-07-14] (Корпорація Майкрософт) S2 gupdate; "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc [X] S3 gupdatem; "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc [X] S2 WiseBootAssistant; C:\Program Files\Wise\Wise Care 365\BootTime.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 ATSWPDRV; C:\Windows\System32\DRIVERS\ATSwpDrv.sys [146944 2008-05-30] (AuthenTec, Inc.) R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [243128 2014-02-01] (Disc Soft Ltd) R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [191928 2014-10-10] (ESET) R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [135296 2014-10-10] (ESET) R2 epfw; C:\Windows\System32\DRIVERS\epfw.sys [176448 2014-10-10] (ESET) R1 EpfwLWF; C:\Windows\System32\DRIVERS\EpfwLWF.sys [37928 2014-10-10] (ESET) R0 epfwwfp; C:\Windows\System32\DRIVERS\epfwwfp.sys [51288 2014-10-10] (ESET) S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [19984 2015-01-27] () R1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO32.SYS [22688 2014-02-16] (REALiX(tm)) R1 ISODrive; C:\Program Files\UltraISO\drivers\ISODrive.sys [82168 2013-11-21] (EZB Systems, Inc.) S3 NETwLv32; C:\Windows\System32\DRIVERS\NETwLv32.sys [6639616 2010-10-07] (Intel Corporation) R3 NETwLx32; C:\Windows\System32\DRIVERS\NETwLx32.sys [6609920 2010-10-07] (Intel Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-12-05] (NVIDIA Corporation) S3 PortTalk; C:\Windows\System32\Drivers\PortTalk.sys [3567 2002-01-12] (Beyond Logic http://www.beyondlogic.org) [File not signed] R2 rimmptsk; C:\Windows\System32\DRIVERS\rimmptsk.sys [48128 2009-06-25] (REDC) [File not signed] R2 rimsptsk; C:\Windows\System32\DRIVERS\rimsptsk.sys [44544 2009-06-25] (REDC) [File not signed] R2 rismxdp; C:\Windows\System32\DRIVERS\rixdptsk.sys [38400 2009-06-25] (REDC) [File not signed] R3 uti0oda3; C:\Windows\system32\Drivers\uti0oda3.sys [7168 2015-04-07] () [File not signed] S3 VGPU; System32\drivers\rdvgkmd.sys [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-08 13:29 - 2015-04-08 13:30 - 00012125 _____ () C:\Users\HP\Downloads\FRST.txt 2015-04-08 13:29 - 2015-04-08 13:29 - 00000000 ____D () C:\FRST 2015-04-08 13:28 - 2015-04-08 13:29 - 01135104 _____ (Farbar) C:\Users\HP\Downloads\FRST.exe 2015-04-08 13:28 - 2015-04-08 13:28 - 02095616 _____ (Farbar) C:\Users\HP\Downloads\FRST64.exe 2015-04-07 22:20 - 2015-04-07 22:21 - 00024766 _____ () C:\Users\HP\Desktop\Result.txt 2015-04-07 22:20 - 2015-04-07 22:03 - 00409600 _____ () C:\Users\HP\Desktop\MiniToolBox.exe 2015-04-07 16:29 - 2015-04-07 20:46 - 00007168 _____ () C:\Windows\system32\Drivers\uti0oda3.sys 2015-04-07 16:21 - 2015-04-07 20:38 - 00000000 ____D () C:\AdwCleaner 2015-04-07 16:15 - 2015-04-07 20:38 - 00523379 _____ () C:\Windows\WindowsUpdate.log 2015-04-07 16:10 - 2015-04-07 20:39 - 00000336 _____ () C:\Windows\setupact.log 2015-04-07 16:10 - 2015-04-07 16:10 - 00000656 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-04-07 16:10 - 2015-04-07 16:10 - 00000000 _____ () C:\Windows\setuperr.log 2015-04-07 02:41 - 2015-04-07 02:41 - 00000213 _____ () C:\Users\HP\Desktop\Counter-Strike Global Offensive.url 2015-04-07 01:56 - 2015-04-07 02:03 - 05886345 _____ () C:\Users\HP\Downloads\assembler-na-primerah.zip 2015-04-07 01:53 - 2015-04-07 01:53 - 00221320 _____ (Deposit Files) C:\Users\HP\Downloads\dfdownloader_p1JqFA_.exe 2015-04-06 22:47 - 2015-04-06 22:47 - 00005791 _____ () C:\Users\HP\Downloads\AdwCleaner%5BR0%5D.txt 2015-04-06 22:17 - 2015-04-06 22:17 - 00355899 _____ () C:\Users\HP\Downloads\allbest-r-00189448.zip 2015-04-06 21:22 - 2015-04-06 21:22 - 00000000 ____D () C:\Users\HP\Downloads\backups 2015-04-06 21:19 - 2015-04-06 21:19 - 00388608 _____ (Trend Micro Inc.) C:\Users\HP\Downloads\HiJackThis.exe 2015-04-06 20:56 - 2015-04-07 20:51 - 00000000 ____D () C:\Users\HP\Desktop\AutoLogger 2015-04-06 20:56 - 2015-04-06 04:33 - 11154958 _____ (Company © regist & Drongo) C:\Users\HP\Desktop\AutoLogger.exe 2015-04-06 20:36 - 2015-04-06 20:42 - 22231406 _____ () C:\Users\HP\Downloads\AutoLogger.zip 2015-04-06 20:33 - 2015-04-06 20:33 - 00061342 _____ () C:\Users\HP\Downloads\CollectionLog-2015.01.24-19.27.zip 2015-04-06 20:28 - 2015-04-06 20:28 - 00818024 _____ () C:\Users\HP\Downloads\yet_another_cleaner_sk_6771769 (1).exe 2015-04-06 20:23 - 2015-04-06 20:23 - 00818024 _____ () C:\Users\HP\Downloads\yet_another_cleaner_sk_6771769.exe 2015-04-06 19:22 - 2015-04-07 01:02 - 4170409984 _____ () C:\Users\HP\Downloads\Windows10_TechnicalPreview_x64_RU-RU_9926.iso 2015-04-06 19:13 - 2015-04-06 19:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-04-06 19:12 - 2015-04-06 19:13 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-04-06 19:10 - 2015-04-06 19:11 - 06958304 _____ (Microsoft Corporation) C:\Users\HP\Downloads\Silverlight.exe 2015-04-06 18:55 - 2015-04-06 18:56 - 06431728 _____ (Microsoft Corporation) C:\Users\HP\Downloads\OSGS14-WindowsUpgradeAssistant-32bitand64bit-ClientSKU-4141411 (1).exe 2015-04-05 22:36 - 2005-03-18 17:19 - 02337488 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_25.dll 2015-03-27 00:49 - 2015-03-27 00:49 - 00000000 _____ () C:\Users\HP\AppData\Local\{92A04DC1-B4BB-41BD-9549-377BB4462C72} 2015-03-27 00:49 - 2015-03-27 00:49 - 00000000 _____ () C:\Users\HP\AppData\Local\{7A4EF36C-9BB7-4082-9CF9-1B0AE8796C33} 2015-03-14 15:45 - 2015-03-14 15:45 - 00010431 _____ () C:\Users\HP\Downloads\Warcraft III TFT v1.26a English.rar.EX.UA.torrent 2015-03-14 15:40 - 2015-03-14 15:40 - 00017510 _____ () C:\Users\HP\Downloads\[rutracker.org].t4050122.torrent 2015-03-14 15:35 - 2015-03-30 16:11 - 00000000 ____D () C:\Program Files\WarCraft III 2015-03-14 15:03 - 2015-03-14 15:30 - 500373920 _____ () C:\Users\HP\Downloads\iccup_war3_win32_ru.exe 2015-03-14 14:21 - 2015-03-30 16:11 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ICCup Launcher 2015-03-14 14:15 - 2015-03-14 14:17 - 12708776 _____ (ICCup ) C:\Users\HP\Downloads\iccup_launcher_setup (1).exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-04-08 13:27 - 2014-01-17 23:41 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Skype 2015-04-08 13:25 - 2014-10-26 01:42 - 00001032 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cf8b8bed287aa8.job 2015-04-08 13:25 - 2014-07-09 17:02 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-04-08 13:24 - 2014-06-29 02:14 - 00012608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-04-08 13:24 - 2014-06-29 02:14 - 00012608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-04-08 02:23 - 2014-10-26 01:42 - 00001028 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cf272df765cabc.job 2015-04-07 22:19 - 2014-12-20 06:07 - 00000000 ____D () C:\Users\HP\Documents\Image-Line 2015-04-07 20:45 - 2014-06-29 02:14 - 00006320 _____ () C:\Windows\system32\PerfStringBackup.TMP 2015-04-07 20:44 - 2014-02-01 22:59 - 00000000 ____D () C:\Users\HP\AppData\Roaming\uTorrent 2015-04-07 20:39 - 2014-06-29 01:49 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-04-07 16:10 - 2015-01-02 23:23 - 00012046 _____ () C:\Windows\PFRO.log 2015-04-07 16:09 - 2014-06-11 18:11 - 00000000 ____D () C:\Program Files\Steam 2015-04-07 16:08 - 2014-03-22 11:52 - 00000000 ____D () C:\Windows\Minidump 2015-04-06 19:47 - 2014-08-03 15:24 - 00000000 ____D () C:\Users\HP\AppData\Local\Amigo 2015-04-05 22:40 - 2014-06-11 18:11 - 00000000 ____D () C:\Program Files\Common Files\Steam 2015-04-03 19:03 - 2014-09-22 23:14 - 00000000 ___RD () C:\Program Files\Skype 2015-04-03 19:03 - 2014-01-17 23:41 - 00000000 ____D () C:\ProgramData\Skype 2015-03-30 16:38 - 2013-12-27 11:37 - 00000000 ____D () C:\Users\HP 2015-03-30 16:38 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\registration 2015-03-30 16:11 - 2015-03-08 20:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo 2 2015-03-30 16:11 - 2014-09-22 23:14 - 00000000 ____D () C:\Program Files\Common Files\Skype 2015-03-30 16:11 - 2014-02-01 23:17 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite 2015-03-30 16:11 - 2014-01-28 20:11 - 00000000 ____D () C:\Users\HP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2015-03-30 16:11 - 2013-12-29 13:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-03-30 16:11 - 2009-07-14 05:37 - 00000000 ____D () C:\Windows\system32\NDF 2015-03-15 10:18 - 2014-01-03 23:31 - 00000340 _____ () C:\Windows\Tasks\Driver Robot.job 2015-03-14 14:32 - 2014-02-01 23:18 - 00000000 ____D () C:\Users\HP\AppData\Roaming\DAEMON Tools Lite ==================== Files in the root of some directories ======= 2014-07-27 11:53 - 2014-07-27 11:53 - 0000006 _____ () C:\Users\HP\AppData\Roaming\smw_inst 2014-02-16 15:56 - 2014-02-19 01:56 - 0000063 _____ () C:\Users\HP\AppData\Roaming\WB.CFG 2013-12-27 12:52 - 2013-12-27 12:52 - 0000000 _____ () C:\Users\HP\AppData\Local\AtStart.txt 2015-02-27 14:02 - 2015-02-27 14:02 - 0000000 ____H () C:\Users\HP\AppData\Local\BIT3EF9.tmp 2015-02-27 14:02 - 2015-02-27 14:02 - 0000000 ____H () C:\Users\HP\AppData\Local\BIT3F0A.tmp 2015-01-28 12:14 - 2015-01-28 12:14 - 0000000 ____H () C:\Users\HP\AppData\Local\BIT83E6.tmp 2013-12-27 12:52 - 2013-12-27 12:52 - 0000000 _____ () C:\Users\HP\AppData\Local\DSwitch.txt 2015-01-29 18:04 - 2015-01-29 18:04 - 0000001 _____ () C:\Users\HP\AppData\Local\llftool.4.40.agreement 2013-12-27 12:52 - 2013-12-27 12:52 - 0000000 _____ () C:\Users\HP\AppData\Local\QSwitch.txt 2014-11-07 14:05 - 2014-11-27 05:26 - 0007605 _____ () C:\Users\HP\AppData\Local\Resmon.ResmonCfg 2015-02-27 14:00 - 2015-02-27 14:00 - 0000000 _____ () C:\Users\HP\AppData\Local\{3B399995-908A-4FD1-9640-D5AB1F36D111} 2015-03-27 00:49 - 2015-03-27 00:49 - 0000000 _____ () C:\Users\HP\AppData\Local\{7A4EF36C-9BB7-4082-9CF9-1B0AE8796C33} 2015-03-27 00:49 - 2015-03-27 00:49 - 0000000 _____ () C:\Users\HP\AppData\Local\{92A04DC1-B4BB-41BD-9549-377BB4462C72} 2015-02-27 14:00 - 2015-02-27 14:00 - 0000000 _____ () C:\Users\HP\AppData\Local\{A5F84A8B-01F4-496B-A0A9-77BB71790487} 2015-01-28 12:14 - 2015-01-28 12:14 - 0000000 _____ () C:\Users\HP\AppData\Local\{E9775F7F-67A4-4FD1-A390-C569BF88672C} Some content of TEMP: ==================== C:\Users\HP\AppData\Local\Temp\Quarantine.exe C:\Users\HP\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\explorer.exe => File is digitally signed C:\Windows\system32\winlogon.exe => File is digitally signed C:\Windows\system32\wininit.exe => File is digitally signed C:\Windows\system32\svchost.exe => File is digitally signed C:\Windows\system32\services.exe => File is digitally signed C:\Windows\system32\User32.dll [2010-11-21 00:29] - [2010-11-21 00:29] - 0811520 ____A (Microsoft Corporation) 8626F0C30D4E3564FFDD25C90F4426F1 C:\Windows\system32\userinit.exe => File is digitally signed C:\Windows\system32\rpcss.dll => File is digitally signed C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-04-07 16:59 ==================== End Of Log ============================