I just ran some virus search, it does not found a thing, but for some reason i felt, i have to search specifically in /appdata/temp hidden folder. And found 4 virus/malware named something "runme_..." stuff. Why does the first search overlooked it?