OTL-1

OTL logfile created on: 10/6/2016 12:14:06 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Elang\Downloads\Programs
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16518)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.96 Gb Total Physical Memory | 4.79 Gb Available Physical Memory | 60.13% Memory free
16.34 Gb Paging File | 12.66 Gb Available in Paging File | 77.51% Paging File free
Paging file location(s): c:\pagefile.sys 0 0h:\pagefile.sys 430 32000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97.65 Gb Total Space | 22.16 Gb Free Space | 22.69% Space Free | Partition Type: NTFS
Drive D: | 97.65 Gb Total Space | 81.58 Gb Free Space | 83.53% Space Free | Partition Type: NTFS
Drive E: | 97.65 Gb Total Space | 62.62 Gb Free Space | 64.12% Space Free | Partition Type: NTFS
Drive F: | 102.77 Gb Total Space | 7.00 Gb Free Space | 6.82% Space Free | Partition Type: NTFS
Drive G: | 498.05 Gb Total Space | 86.98 Gb Free Space | 17.46% Space Free | Partition Type: NTFS
Drive H: | 335.80 Gb Total Space | 34.80 Gb Free Space | 10.36% Space Free | Partition Type: NTFS

Computer Name: ELANG | User Name: Elang | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - C:\Users\Elang\Downloads\Programs\OTL.exe (OldTimer Tools)
PRC - H:\Steam\bin\steamwebhelper.exe (Valve Corporation)
PRC - H:\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program Files (x86)\AirDroid\AirDroid.exe (Sand Studio)
PRC - C:\Users\Elang\AppData\Local\MiPhoneManager\main\MiPhoneHelper.exe ()
PRC - C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe (Plays.tv, LLC)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (BlueStack Systems, Inc.)
PRC - C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)
PRC - C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe (Tonec Inc.)
PRC - C:\Program Files (x86)\Macrobile\MacrobileDeviceService.exe ()
PRC - C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe (Disc Soft Ltd)
PRC - C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe (Crystal Rich Ltd)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - H:\Steam\video.dll ()
MOD - H:\Steam\bin\chromehtml.dll ()
MOD - H:\Steam\SDL2.dll ()
MOD - H:\Steam\v8.dll ()
MOD - H:\Steam\icui18n.dll ()
MOD - H:\Steam\icuuc.dll ()
MOD - C:\Program Files (x86)\AirDroid\Android.dll ()
MOD - C:\Program Files (x86)\AirDroid\System.Data.SQLite.dll ()
MOD - C:\Users\Elang\AppData\Local\MiPhoneManager\main\MiPhoneHelper.exe ()
MOD - H:\Steam\bin\libcef.dll ()
MOD - C:\Windows\SysWOW64\GameManager32.dll ()
MOD - H:\Steam\openvr_api.dll ()
MOD - H:\Steam\libavcodec-56.dll ()
MOD - H:\Steam\libavformat-56.dll ()
MOD - H:\Steam\libswscale-3.dll ()
MOD - H:\Steam\libavutil-54.dll ()
MOD - H:\Steam\libavresample-2.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\13372e3b6a7e4126d48827a30c2c1d9a\Microsoft.VisualBasic.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\4412bbbb473c356b5ea3e1ea13b25f52\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Design\4b776e75c1cab7efacbb4917164ab9a8\System.Design.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\b0f9a4f138cc569a7526f97b93808d3e\System.Web.Services.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\4b1795df6372b251625f958595e08d3d\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\59312674865dc2a19c27f9f460b1673b\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\faf3ae85f2470505e1b32d2154de60ef\System.EnterpriseServices.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\cd3556d1162e8f7df77611c9c4253f7c\System.Transactions.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\fe1942c05eda4f9744f80afb4ae76a2d\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\8bc548587e91ecf0552a40e47bbf99cc\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5c24d3b0041ebf4f48a93615b9fa3de9\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\217ece46920546d718414291d463bb1c\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5b6ddf934128d538cd5cd77bf4209b93\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b3a78269847005365001c33870cd121f\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ede2c6c842840e009f01bcc74fa4c457\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\Microsoft Office\Office15\1033\GrooveIntlResource.dll ()
MOD - C:\Program Files\DAEMON Tools Pro\MSIMG32.dll ()
MOD - C:\Program Files (x86)\USB Safely Remove\msimg32.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
MOD - C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll ()


[color=#E56717]========== Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:[b]64bit:[/b] - (ekrn) -- C:\Program Files\ESET\ESET Smart Security\ekrn.exe (ESET)
SRV:[b]64bit:[/b] - (LogiRegistryService) -- C:\Program Files\Logitech Gaming Software\Drivers\APOService\LogiRegistryService.exe (Logitech Inc.)
SRV:[b]64bit:[/b] - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:[b]64bit:[/b] - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV:[b]64bit:[/b] - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:[b]64bit:[/b] - (OpenVPNService) -- C:\Program Files\OpenVPN\bin\openvpnserv.exe (The OpenVPN Project)
SRV:[b]64bit:[/b] - (ISCTAgent) -- C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe ()
SRV:[b]64bit:[/b] - (PSI_SVC_2_x64) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe (arvato digital services llc)
SRV:[b]64bit:[/b] - (TlntSvr) -- C:\Windows\SysNative\tlntsvr.exe (Microsoft Corporation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (HiPatchService) -- H:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (AdobeARMservice) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (PlaysService) -- C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe (Plays.tv, LLC)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes)
SRV - (EasyAntiCheat) -- C:\Windows\SysWOW64\EasyAntiCheat.exe (EasyAntiCheat Ltd)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (Origin Client Service) -- C:\Program Files (x86)\Origin\OriginClientService.exe (Electronic Arts)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (BstHdAndroidSvc) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.)
SRV - (BstHdUpdaterSvc) -- C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe (BlueStack Systems, Inc.)
SRV - (BstHdLogRotatorSvc) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (MacrobileDeviceService) -- C:\Program Files (x86)\Macrobile\MacrobileDeviceService.exe ()
SRV - (USBSafelyRemoveService) -- C:\Program Files (x86)\USB Safely Remove\USBSRService.exe (Crystal Rich Ltd)
SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation)
SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation)
SRV - (PinnacleUpdateSvc) -- C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe (PowerUp Software, LLC)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - (SWDUMon) -- C:\Windows\SysNative\drivers\SWDUMon.sys (SlimWare Utilities, Inc.)
DRV:[b]64bit:[/b] - (MBAMSwissArmy) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys (Malwarebytes)
DRV:[b]64bit:[/b] - (WPRO_41_2001) -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys ()
DRV:[b]64bit:[/b] - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:[b]64bit:[/b] - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:[b]64bit:[/b] - (eamonm) -- C:\Windows\SysNative\drivers\eamonm.sys (ESET)
DRV:[b]64bit:[/b] - (epfw) -- C:\Windows\SysNative\drivers\epfw.sys (ESET)
DRV:[b]64bit:[/b] - (ehdrv) -- C:\Windows\SysNative\drivers\ehdrv.sys (ESET)
DRV:[b]64bit:[/b] - (ekbdflt) -- C:\Windows\SysNative\drivers\ekbdflt.sys (ESET)
DRV:[b]64bit:[/b] - (epfwwfp) -- C:\Windows\SysNative\drivers\epfwwfp.sys (ESET)
DRV:[b]64bit:[/b] - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:[b]64bit:[/b] - (SmbDrvI) -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys (Synaptics Incorporated)
DRV:[b]64bit:[/b] - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (MEIx64) -- C:\Windows\SysNative\drivers\TeeDriverx64.sys (Intel Corporation)
DRV:[b]64bit:[/b] - (MBAMWebAccessControl) -- C:\Windows\SysNative\drivers\mwac.sys (Malwarebytes Corporation)
DRV:[b]64bit:[/b] - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes)
DRV:[b]64bit:[/b] - (VBAudioVMVAIOMME) -- C:\Windows\SysNative\drivers\vbaudio_vmvaio64_win7.sys (Windows (R) Win 7 DDK provider)
DRV:[b]64bit:[/b] - (EpfwLWF) -- C:\Windows\SysNative\drivers\EpfwLWF.sys (ESET)
DRV:[b]64bit:[/b] - (LGCoreTemp) -- C:\Program Files\Logitech Gaming Software\Drivers\LgCoreTemp\LgCoreTemp.sys (Logitech)
DRV:[b]64bit:[/b] - (LGJoyXlCore) -- C:\Windows\SysNative\drivers\LGJoyXlCore.sys (Logitech Inc.)
DRV:[b]64bit:[/b] - (LGBusEnum) -- C:\Windows\SysNative\drivers\LGBusEnum.sys (Logitech Inc.)
DRV:[b]64bit:[/b] - (amdkmpfd) -- C:\Windows\SysNative\drivers\amdkmpfd.sys (Advanced Micro Devices, Inc.)
DRV:[b]64bit:[/b] - (IDMWFP) -- C:\Windows\SysNative\drivers\idmwfp.sys (Tonec Inc.)
DRV:[b]64bit:[/b] - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Oracle Corporation)
DRV:[b]64bit:[/b] - (ISCT) -- C:\Windows\SysNative\drivers\ISCTD.sys ()
DRV:[b]64bit:[/b] - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:[b]64bit:[/b] - (ssadmdm) -- C:\Windows\SysNative\drivers\ssadmdm.sys (MCCI Corporation)
DRV:[b]64bit:[/b] - (ssadbus) -- C:\Windows\SysNative\drivers\ssadbus.sys (MCCI Corporation)
DRV:[b]64bit:[/b] - (androidusb) -- C:\Windows\SysNative\drivers\ssadadb.sys (Google Inc)
DRV:[b]64bit:[/b] - (ssadmdfl) -- C:\Windows\SysNative\drivers\ssadmdfl.sys (MCCI Corporation)
DRV:[b]64bit:[/b] - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys (Duplex Secure Ltd.)
DRV:[b]64bit:[/b] - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:[b]64bit:[/b] - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:[b]64bit:[/b] - (DFX11_1) -- C:\Windows\SysNative\drivers\dfx11_1x64.sys (Windows (R) Win 7 DDK provider)
DRV:[b]64bit:[/b] - (Apowersoft_AudioDevice) -- C:\Windows\SysNative\drivers\Apowersoft_AudioDevice.sys (Wondershare)
DRV:[b]64bit:[/b] - (andnetndis) -- C:\Windows\SysNative\drivers\lgandnetndis64.sys (LG Electronics Inc.)
DRV:[b]64bit:[/b] - (andnetadb) -- C:\Windows\SysNative\drivers\lgandnetadb.sys (Google Inc)
DRV:[b]64bit:[/b] - (ANDNetModem) -- C:\Windows\SysNative\drivers\lgandnetmodem64.sys (LG Electronics Inc.)
DRV:[b]64bit:[/b] - (AndNetDiag) -- C:\Windows\SysNative\drivers\lgandnetdiag64.sys (LG Electronics Inc.)
DRV:[b]64bit:[/b] - (imsevent) -- C:\Windows\SysNative\drivers\imsevent.sys ()
DRV:[b]64bit:[/b] - (ikbevent) -- C:\Windows\SysNative\drivers\ikbevent.sys ()
DRV:[b]64bit:[/b] - (RTL8169) -- C:\Windows\SysNative\drivers\Rtlh64.sys (Realtek                                            )
DRV:[b]64bit:[/b] - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:[b]64bit:[/b] - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (ScreamBAudioSvc) -- C:\Windows\SysNative\drivers\ScreamingBAudio64.sys (Screaming Bee LLC)
DRV:[b]64bit:[/b] - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:[b]64bit:[/b] - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:[b]64bit:[/b] - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:[b]64bit:[/b] - (xnacc) -- C:\Windows\SysNative\drivers\xnacc.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:[b]64bit:[/b] - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:[b]64bit:[/b] - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:[b]64bit:[/b] - (VCSVADHWSer) -- C:\Windows\SysNative\drivers\vcsvad.sys (Avnex)
DRV:[b]64bit:[/b] - (RimUsb) -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys (Research In Motion Limited)
DRV:[b]64bit:[/b] - (copperhd) -- C:\Windows\SysNative\drivers\copperhd.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (BstHdDrv) -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys (BlueStack Systems)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)


[color=#E56717]========== Standard Registry (All) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation)
IE - HKCU\..\SearchScopes,DefaultScope = {086C067E-F4C7-4301-BF62-F29CEDC507AA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR
IE - HKCU\..\SearchScopes\{086C067E-F4C7-4301-BF62-F29CEDC507AA}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.countryCode: "ID"
FF - prefs.js..browser.search.highlightCount: 4
FF - prefs.js..browser.search.region: "ID"
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:39.0
FF - user.js - File not found

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_20_0_0_235.dll File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelogx64.dll (EA Digital Illusions CE AB)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_20_0_0_235.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@esn/npbattlelog,version=2.7.0: C:\Program Files (x86)\Battlelog Web Plugins\2.7.0\npbattlelog.dll (EA Digital Illusions CE AB)
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.45.2: C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.45.2: C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@t.garena.com/garenatalk: C:\Program Files (x86)\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.2.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Elang\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKCU\Software\MozillaPlugins\electronicarts.com/GameFacePlugin: C:\Users\Elang\AppData\Roaming\Electronic Arts\Game Face\npGameFacePlugin.dll (Electronic Arts)

64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\PROGRAM FILES\ESET\ESET SMART SECURITY\MOZILLA THUNDERBIRD
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 39.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 39.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2016/02/21 02:04:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET Smart Security\Mozilla Thunderbird
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Elang\AppData\Roaming\IDM\idmmzcc5 [2014/11/05 04:29:03 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\SeaMonkey\Extensions\\mozilla_cc@internetdownloadmanager.com: C:\Users\Elang\AppData\Roaming\IDM\idmmzcc5 [2014/11/05 04:29:03 | 000,000,000 | ---D | M]

[2015/03/23 09:37:02 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elang\AppData\Roaming\Mozilla\Extensions
[2015/04/16 04:22:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Elang\AppData\Roaming\Mozilla\Firefox\Profiles\3tashdvs.default\extensions
[2016/02/21 02:04:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2016/02/21 02:04:43 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013/10/17 11:25:52 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll

[color=#E56717]========== Chrome  ==========[/color]


O1 HOSTS File: ([2016/04/30 06:44:40 | 000,000,063 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: 127.0.0.1 www.bitsumactivationserver.com
O2:[b]64bit:[/b] - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll (Internet Download Manager, Tonec Inc.)
O2:[b]64bit:[/b] - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2:[b]64bit:[/b] - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:[b]64bit:[/b] - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
O2:[b]64bit:[/b] - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2:[b]64bit:[/b] - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (IDM integration (IDMIEHlprObj Class)) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll (Oracle Corporation)
O4:[b]64bit:[/b] - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:[b]64bit:[/b] - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:[b]64bit:[/b] - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:[b]64bit:[/b] - HKLM..\Run: [StartCN] C:\Program Files\AMD\CNext\CNext\RadeonSettings.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [DriverPack Notifier] C:\Program Files (x86)\DriverPack Notifier\DriverPackNotifier.exe ()
O4 - HKCU..\Run: [AirDroid 3] C:\Program Files (x86)\AirDroid\AirDroid.exe (Sand Studio)
O4 - HKCU..\Run: [CCleaner Monitoring] C:\Program Files\CCleaner\CCleaner64.exe (Piriform Ltd)
O4 - HKCU..\Run: [DAEMON Tools Pro Agent] C:\Program Files\DAEMON Tools Pro\DTAgent.exe (Disc Soft Ltd)
O4 - HKCU..\Run: [IDMan] C:\Program Files (x86)\Internet Download Manager\IDMan.exe (Tonec Inc.)
O4 - HKCU..\Run: [MiPhoneManager] C:\Users\Elang\AppData\Local\MiPhoneManager\main\MiPhoneHelper.exe ()
O4 - HKCU..\Run: [Steam] H:\Steam\steam.exe (Valve Corporation)
O4 - HKCU..\Run: [USB Safely Remove] C:\Program Files (x86)\USB Safely Remove\USBSafelyRemove.exe (Crystal Rich Ltd)
O4 - HKCU..\Run: [uTorrent] C:\Users\Elang\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
O4 - HKLM..\RunOnceEx: [BlueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe (BlueStack Systems, Inc.)
O4 - Startup: C:\Users\Elang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainmeter.lnk = C:\Program Files\Rainmeter\Rainmeter.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 1
O8:[b]64bit:[/b] - Extra context menu item: Assign &hot key - C:\Program Files (x86)\Hot Keyboard Pro\IEScript.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8:[b]64bit:[/b] - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8:[b]64bit:[/b] - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O8:[b]64bit:[/b] - Extra context menu item: Open with Scansoft PDF Converter 3.0 - C:\Program Files (x86)\ScanSoft\PDF Converter 3.0\IEShellExt.dll (ScanSoft, Inc.)
O8:[b]64bit:[/b] - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Assign &hot key - C:\Program Files (x86)\Hot Keyboard Pro\IEScript.htm ()
O8 - Extra context menu item: Download all links with IDM - C:\Program Files (x86)\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download with IDM - C:\Program Files (x86)\Internet Download Manager\IEExt.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - C:\Program Files (x86)\ScanSoft\PDF Converter 3.0\IEShellExt.dll (ScanSoft, Inc.)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:[b]64bit:[/b] - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files (x86)\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files (x86)\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files (x86)\Bonjour\ExplorerPlugin.dll (Apple Inc.)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O15:[b]64bit:[/b] - ..Trusted Domains: eset.com ([help] http in Trusted sites)
O15 - HKLM\..Trusted Domains: eset.com ([help] http in Trusted sites)
O15 - HKCU\..Trusted Domains: drp.su ([update] http in Local intranet)
O15 - HKCU\..Trusted Domains: drp.su ([update] https in Local intranet)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F0DB6F6-E321-475B-A769-4ABCD924C929}: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8F0DB6F6-E321-475B-A769-4ABCD924C929}: NameServer = 127.0.0.1
O18:[b]64bit:[/b] - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation)
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files (x86)\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation)
O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation)
O18:[b]64bit:[/b] - Protocol\Filter\text/xml {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKCU Winlogon: Shell - (expstart.exe) - C:\Windows\expstart.exe ()
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22:[b]64bit:[/b] - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Program Files (x86)\Stardock\ObjectDockPlus2\ODMenu64.dll (Stardock)
O29:[b]64bit:[/b] - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation)
O30:[b]64bit:[/b] - LSA: Security Packages - (livessp) - C:\Windows\SysNative\livessp.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation)
O30 - LSA: Security Packages - (livessp) - C:\Windows\SysWow64\livessp.dll (Microsoft Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/09/21 22:59:29 | 000,000,000 | ---- | M] () - D:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{0d525154-efa8-11e4-9cf5-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0d525154-efa8-11e4-9cf5-806e6f6e6963}\Shell\AutoRun\command - "" = I:\Autorun.exe
O33 - MountPoints2\{4d521adb-7c3e-11e4-9073-bc5ff4c9c9c1}\Shell - "" = AutoRun
O33 - MountPoints2\{4d521adb-7c3e-11e4-9073-bc5ff4c9c9c1}\Shell\AutoRun\command - "" = K:\iLinker.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2016/10/06 12:03:59 | 000,000,000 | ---D | C] -- C:\Windows\LastGood
[2016/10/06 12:03:13 | 001,030,400 | ---- | C] (Realtek                                            ) -- C:\Windows\SysNative\drivers\Rt64win7.sys
[2016/10/06 11:54:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimDrivers
[2016/10/06 11:54:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SlimDrivers
[2016/09/23 00:38:01 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Local\HirezLauncherUI
[2016/09/23 00:34:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios
[2016/09/23 00:33:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Hi-Rez Studios
[2016/09/16 04:33:27 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Local\CrashRpt
[2016/09/15 11:10:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bonjour
[2016/09/15 11:10:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2016/09/15 04:48:06 | 000,082,544 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\SysNative\RtNicProp64.dll
[2016/09/15 04:47:59 | 001,355,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msvbvm50.dll
[2016/09/15 04:47:59 | 000,935,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System\Vb40016.dll
[2016/09/15 04:47:59 | 000,398,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System\Vbrun300.dll
[2016/09/15 04:47:59 | 000,356,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System\vbrun200.dll
[2016/09/15 04:47:58 | 001,066,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MSCOMCTL32.OCX
[2016/09/15 04:47:58 | 001,060,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71.dll
[2016/09/15 04:47:58 | 001,054,208 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71u.dll
[2016/09/15 04:47:58 | 001,017,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70u.dll
[2016/09/15 04:47:58 | 000,660,120 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomct2.ocx
[2016/09/15 04:47:58 | 000,444,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MShflxgd.ocx
[2016/09/15 04:47:58 | 000,279,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msdatgrd.ocx
[2016/09/15 04:47:58 | 000,259,736 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msflxgrd.ocx
[2016/09/15 04:47:58 | 000,253,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msdatlst.ocx
[2016/09/15 04:47:58 | 000,179,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msmask32.ocx
[2016/09/15 04:47:58 | 000,130,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msstdfmt.dll
[2016/09/15 04:47:58 | 000,119,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mscomm32.ocx
[2016/09/15 04:47:58 | 000,065,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71DEU.DLL
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71ITA.DLL
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71FRA.DLL
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71ESP.DLL
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70ita.dll
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70fra.dll
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70esp.dll
[2016/09/15 04:47:58 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70deu.dll
[2016/09/15 04:47:58 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71ENU.DLL
[2016/09/15 04:47:58 | 000,057,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70enu.dll
[2016/09/15 04:47:58 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71KOR.DLL
[2016/09/15 04:47:58 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71JPN.DLL
[2016/09/15 04:47:58 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70kor.dll
[2016/09/15 04:47:58 | 000,049,152 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70jpn.dll
[2016/09/15 04:47:58 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71CHT.DLL
[2016/09/15 04:47:58 | 000,045,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70cht.dll
[2016/09/15 04:47:58 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MFC71CHS.DLL
[2016/09/15 04:47:58 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70chs.dll
[2016/09/15 04:47:57 | 001,024,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mfc70.dll
[2016/09/15 04:47:57 | 000,416,408 | ---- | C] (Microsoft Corporation ) -- C:\Windows\SysWow64\comct332.ocx
[2016/09/15 04:47:57 | 000,218,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\dblist32.ocx
[2016/09/15 04:47:57 | 000,212,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mci32.ocx
[2016/09/15 04:47:57 | 000,090,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\atl71.dll
[2016/09/15 04:47:57 | 000,086,016 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\atl70.dll
[2016/09/15 04:47:40 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DAX2
[2016/09/15 04:46:30 | 002,706,864 | ---- | C] (DTS, Inc.) -- C:\Windows\SysNative\sltech64.dll
[2016/09/15 04:46:30 | 002,203,752 | ---- | C] (DTS, Inc.) -- C:\Windows\SysNative\slcnt64.dll
[2016/09/15 04:46:30 | 001,382,240 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\SysNative\tosade.dll
[2016/09/15 04:46:30 | 001,337,648 | ---- | C] (Toshiba Client Solutions Co., Ltd.) -- C:\Windows\SysNative\tossaeapo64.dll
[2016/09/15 04:46:30 | 001,041,744 | ---- | C] (DTS, Inc.) -- C:\Windows\SysNative\sl3apo64.dll
[2016/09/15 04:46:30 | 000,962,136 | ---- | C] (Toshiba Client Solutions Co., Ltd.) -- C:\Windows\SysNative\tosasfapo64.dll
[2016/09/15 04:46:30 | 000,873,464 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\SysNative\tadefxapo264.dll
[2016/09/15 04:46:30 | 000,601,144 | ---- | C] (Toshiba Client Solutions Co., Ltd.) -- C:\Windows\SysNative\tossaemaxapo64.dll
[2016/09/15 04:46:30 | 000,571,376 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\tbb_waves.dll
[2016/09/15 04:46:30 | 000,447,184 | ---- | C] (Toshiba Client Solutions Co., Ltd.) -- C:\Windows\SysNative\toseaeapo64.dll
[2016/09/15 04:46:30 | 000,258,864 | ---- | C] (TODO: <Company name>) -- C:\Windows\SysNative\slprp64.dll
[2016/09/15 04:46:30 | 000,158,704 | ---- | C] (TOSHIBA Corporation) -- C:\Windows\SysNative\tadefxapo.dll
[2016/09/15 04:46:30 | 000,075,544 | ---- | C] (TOSHIBA CORPORATION.) -- C:\Windows\SysNative\tepeqapo64.dll
[2016/09/15 04:46:25 | 015,202,040 | ---- | C] (Yamaha Corporation) -- C:\Windows\SysNative\YamahaAE3.dll
[2016/09/15 04:46:25 | 003,299,824 | ---- | C] (Yamaha Corporation) -- C:\Windows\SysNative\YamahaAE2.dll
[2016/09/15 04:46:25 | 002,190,992 | ---- | C] (Yamaha Corporation) -- C:\Windows\SysNative\YamahaAE.dll
[2016/09/15 04:46:25 | 002,110,600 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\WavesGUILib64.dll
[2016/09/15 04:46:25 | 001,435,144 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SRRPTR64.dll
[2016/09/15 04:46:25 | 000,965,032 | ---- | C] (Sony Corporation) -- C:\Windows\SysNative\SFSS_APO.dll
[2016/09/15 04:46:25 | 000,532,384 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSX64.dll
[2016/09/15 04:46:25 | 000,467,160 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SRAPO64.dll
[2016/09/15 04:46:25 | 000,381,416 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SRCOM64.dll
[2016/09/15 04:46:25 | 000,341,152 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysWow64\SRCOM.dll
[2016/09/15 04:46:25 | 000,341,152 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SRCOM.dll
[2016/09/15 04:46:25 | 000,221,968 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSTSH64.dll
[2016/09/15 04:46:25 | 000,209,536 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSHP64.dll
[2016/09/15 04:46:25 | 000,166,208 | ---- | C] (SRS Labs, Inc.) -- C:\Windows\SysNative\SRSWOW64.dll
[2016/09/15 04:46:21 | 000,231,920 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFNHK64.dll
[2016/09/15 04:46:20 | 001,001,800 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysNative\SEHDHF64.dll
[2016/09/15 04:46:20 | 000,864,344 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysWow64\SEHDHF32.dll
[2016/09/15 04:46:20 | 000,858,200 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysNative\SEHDRA64.dll
[2016/09/15 04:46:20 | 000,854,032 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysNative\SECOMN64.dll
[2016/09/15 04:46:20 | 000,725,944 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysWow64\SECOMN32.dll
[2016/09/15 04:46:20 | 000,498,648 | ---- | C] (Sound Research, Corp.) -- C:\Windows\SysNative\SEAPO64.dll
[2016/09/15 04:46:20 | 000,343,712 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtlCPAPI64.dll
[2016/09/15 04:46:20 | 000,090,920 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFCOM64.dll
[2016/09/15 04:46:20 | 000,088,328 | ---- | C] (Synopsys, Inc.) -- C:\Windows\SysNative\SFAPO64.dll
[2016/09/15 04:46:20 | 000,083,632 | ---- | C] (Virage Logic Corporation / Sonic Focus) -- C:\Windows\SysWow64\SFCOM.dll
[2016/09/15 04:46:16 | 003,283,248 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkApi64.dll
[2016/09/15 04:46:16 | 003,203,592 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtPgEx64.dll
[2016/09/15 04:46:16 | 003,134,720 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RltkAPO64.dll
[2016/09/15 04:46:16 | 002,895,104 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTSnMg64.cpl
[2016/09/15 04:46:16 | 002,776,224 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysWow64\RltkAPO.dll
[2016/09/15 04:46:16 | 002,073,096 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoInstII64.dll
[2016/09/15 04:46:16 | 001,360,520 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RTCOM64.dll
[2016/09/15 04:46:16 | 000,689,888 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtDataProc64.dll
[2016/09/15 04:46:16 | 000,387,320 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEP64A.dll
[2016/09/15 04:46:16 | 000,321,720 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DHT64.dll
[2016/09/15 04:46:16 | 000,321,720 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RP3DAA64.dll
[2016/09/15 04:46:16 | 000,214,832 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEED64A.dll
[2016/09/15 04:46:16 | 000,192,984 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCfg64.dll
[2016/09/15 04:46:16 | 000,110,984 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEL64A.dll
[2016/09/15 04:46:16 | 000,088,352 | ---- | C] (Dolby Laboratories, Inc.) -- C:\Windows\SysNative\RTEEG64A.dll
[2016/09/15 04:46:16 | 000,023,696 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RtkCoLDR64.dll
[2016/09/15 04:46:14 | 072,520,720 | ---- | C] (Realtek Semiconductor Corp.) -- C:\Windows\SysNative\RCoRes64.dat
[2016/09/15 04:46:14 | 007,172,920 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEP64A.dll
[2016/09/15 04:46:14 | 006,374,320 | ---- | C] (Nahimic Inc) -- C:\Windows\SysNative\NAHIMICV3apo.dll
[2016/09/15 04:46:14 | 001,003,864 | ---- | C] (Nahimic Inc) -- C:\Windows\SysNative\NahimicAPONSControl.dll
[2016/09/15 04:46:14 | 000,447,720 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EED64A.dll
[2016/09/15 04:46:14 | 000,151,792 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEL64A.dll
[2016/09/15 04:46:14 | 000,134,200 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEA64A.dll
[2016/09/15 04:46:14 | 000,084,616 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\R4EEG64A.dll
[2016/09/15 04:46:13 | 013,122,584 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVoiceAPO3064.dll
[2016/09/15 04:46:13 | 012,988,352 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVoiceAPO4064.dll
[2016/09/15 04:46:13 | 005,793,528 | ---- | C] (Nahimic Inc) -- C:\Windows\SysNative\NAHIMICV2apo.dll
[2016/09/15 04:46:13 | 005,593,616 | ---- | C] (Nahimic Inc) -- C:\Windows\SysNative\NAHIMICAPOlfx.dll
[2016/09/15 04:46:13 | 001,334,384 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxSpeechAPO64.dll
[2016/09/15 04:46:13 | 000,999,856 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVoiceAPO2064.dll
[2016/09/15 04:46:13 | 000,677,672 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxVolumeSDAPO.dll
[2016/09/15 04:46:12 | 024,414,760 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRenderAVX64.dll
[2016/09/15 04:46:12 | 024,323,312 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRender64.dll
[2016/09/15 04:46:12 | 014,057,256 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioRealtek64.dll
[2016/09/15 04:46:12 | 002,050,184 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioEQ64.dll
[2016/09/15 04:46:11 | 017,377,488 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioCapture64.dll
[2016/09/15 04:46:11 | 002,825,104 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO7064.dll
[2016/09/15 04:46:11 | 001,422,928 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO6064.dll
[2016/09/15 04:46:11 | 001,213,664 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO5064.dll
[2016/09/15 04:46:11 | 001,166,160 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO4064.dll
[2016/09/15 04:46:11 | 000,931,624 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPOShell64.dll
[2016/09/15 04:46:11 | 000,678,184 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO30.dll
[2016/09/15 04:46:11 | 000,330,568 | ---- | C] (Waves Audio Ltd.) -- C:\Windows\SysNative\MaxxAudioAPO20.dll
[2016/09/15 04:46:09 | 010,534,696 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\IntelSSTAPO.dll
[2016/09/15 04:46:09 | 001,186,840 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\IntelSstCApoPropPage.dll
[2016/09/15 04:46:09 | 000,923,744 | ---- | C] (Sony Corporation) -- C:\Windows\SysNative\MISS_APO.dll
[2016/09/15 04:46:09 | 000,618,192 | ---- | C] (Knowles Acoustics ) -- C:\Windows\SysNative\KAAPORT64.dll
[2016/09/15 04:46:09 | 000,472,312 | ---- | C] (ICEpower a/s) -- C:\Windows\SysNative\ICEsoundAPO64.dll
[2016/09/15 04:46:09 | 000,416,512 | ---- | C] (Harman) -- C:\Windows\SysNative\HMUI.dll
[2016/09/15 04:46:09 | 000,372,744 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\HiFiDAX2API.dll
[2016/09/15 04:46:09 | 000,366,128 | ---- | C] (Windows (R) Win 7 DDK provider) -- C:\Windows\SysNative\HMAPO.dll
[2016/09/15 04:46:09 | 000,360,344 | ---- | C] (Harman) -- C:\Windows\SysNative\HMClariFi.dll
[2016/09/15 04:46:09 | 000,203,848 | ---- | C] (Harman) -- C:\Windows\SysNative\HMHVS.dll
[2016/09/15 04:46:09 | 000,190,936 | ---- | C] (Harman) -- C:\Windows\SysNative\HMEQ_Voice.dll
[2016/09/15 04:46:09 | 000,190,936 | ---- | C] (Harman) -- C:\Windows\SysNative\HMEQ.dll
[2016/09/15 04:46:09 | 000,179,600 | ---- | C] (Harman) -- C:\Windows\SysNative\HMLimiter.dll
[2016/09/15 04:46:09 | 000,154,368 | ---- | C] (Harman) -- C:\Windows\SysNative\HarmanAudioInterface.dll
[2016/09/15 04:46:07 | 007,096,192 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPP64A.dll
[2016/09/15 04:46:07 | 006,264,640 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPP64AF3.dll
[2016/09/15 04:46:07 | 005,341,352 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DolbyDAX2APOv211.dll
[2016/09/15 04:46:07 | 003,291,320 | ---- | C] (Fortemedia Corporation) -- C:\Windows\SysNative\FMAPO64.dll
[2016/09/15 04:46:07 | 002,439,048 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DolbyDAX2APOv201.dll
[2016/09/15 04:46:07 | 001,780,624 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2SpeakerDLL64.dll
[2016/09/15 04:46:07 | 001,591,064 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSS2HeadphoneDLL64.dll
[2016/09/15 04:46:07 | 001,508,936 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBoostDLL64.dll
[2016/09/15 04:46:07 | 001,115,144 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DolbyDAX2APOProp.dll
[2016/09/15 04:46:07 | 000,743,968 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSBassEnhancementDLL64.dll
[2016/09/15 04:46:07 | 000,727,440 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSSymmetryDLL64.dll
[2016/09/15 04:46:07 | 000,708,312 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSVoiceClarityDLL64.dll
[2016/09/15 04:46:07 | 000,514,528 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PLFX64.dll
[2016/09/15 04:46:07 | 000,504,312 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSNeoPCDLL64.dll
[2016/09/15 04:46:07 | 000,500,560 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PGFX64.dll
[2016/09/15 04:46:07 | 000,445,400 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLimiterDLL64.dll
[2016/09/15 04:46:07 | 000,441,272 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGainCompensatorDLL64.dll
[2016/09/15 04:46:07 | 000,428,232 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSU2PREC64.dll
[2016/09/15 04:46:07 | 000,253,904 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPO64.dll
[2016/09/15 04:46:07 | 000,253,864 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSLFXAPO64.dll
[2016/09/15 04:46:07 | 000,252,880 | ---- | C] (DTS) -- C:\Windows\SysNative\DTSGFXAPONS64.dll
[2016/09/15 04:46:06 | 001,965,816 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPD64A.dll
[2016/09/15 04:46:06 | 001,959,608 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPD64AF3.dll
[2016/09/15 04:46:06 | 001,607,136 | ---- | C] (Conexant Systems Inc.) -- C:\Windows\SysNative\CX64APO.dll
[2016/09/15 04:46:06 | 001,529,144 | ---- | C] (Conexant Systems Inc.) -- C:\Windows\SysNative\CX64Proxy.dll
[2016/09/15 04:46:06 | 000,574,760 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAC64.dll
[2016/09/15 04:46:06 | 000,438,696 | ---- | C] (Conexant Systems, Inc.) -- C:\Windows\SysNative\CAF64APO2.dll
[2016/09/15 04:46:06 | 000,362,056 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPO64AF3.dll
[2016/09/15 04:46:06 | 000,327,456 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPO64A.dll
[2016/09/15 04:46:06 | 000,310,424 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPA64F3.dll
[2016/09/15 04:46:06 | 000,272,720 | ---- | C] (Dolby Laboratories) -- C:\Windows\SysNative\DDPA64.dll
[2016/09/15 04:46:06 | 000,122,320 | ---- | C] (Real Sound Lab SIA) -- C:\Windows\SysNative\CONEQMSAPOGUILibrary.dll
[2016/09/15 04:46:06 | 000,118,600 | ---- | C] (Andrea Electronics Corporation) -- C:\Windows\SysNative\AERTAR64.dll
[2016/09/15 04:46:06 | 000,112,496 | ---- | C] (Conexant Systems, Inc.) -- C:\Windows\SysNative\Caf64api.dll
[2016/09/15 04:20:33 | 001,795,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WdfCoInstaller01011.dll
[2016/09/15 04:20:33 | 000,181,304 | ---- | C] (Intel Corporation) -- C:\Windows\SysNative\drivers\TeeDriverx64.sys
[2016/09/15 04:19:52 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Roaming\DriverPack Notifier
[2016/09/15 04:19:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
[2016/09/15 04:19:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DriverPack Notifier
[2016/09/15 04:17:09 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Roaming\DRPSu
[2016/09/15 03:57:03 | 000,000,000 | ---D | C] -- C:\Program Files\Synaptics
[2016/09/15 03:56:43 | 000,051,320 | ---- | C] (Synaptics Incorporated) -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys
[2016/09/15 03:52:51 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Roaming\Innovative Solutions
[2016/09/15 03:52:48 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Local\Innovative Solutions
[2016/09/15 03:52:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Innovative Solutions
[2016/09/15 03:37:27 | 000,016,056 | ---- | C] (SlimWare Utilities, Inc.) -- C:\Windows\SysNative\drivers\SWDUMon.sys
[2016/09/15 03:37:23 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Local\SlimWare Utilities Inc
[2016/09/15 03:10:54 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Downloaded Installers
[2016/09/12 07:10:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EveryonePiano
[2016/09/11 08:40:27 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Roaming\MusicBee
[2016/09/11 08:35:37 | 000,000,000 | ---D | C] -- C:\Users\Elang\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MusicBee
[2016/09/11 08:35:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MusicBee
[2016/09/11 08:35:37 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MusicBee
[2013/12/09 04:47:51 | 000,067,584 | ---- | C] (Genry) -- C:\ProgramData\ISTask.dll
[9 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2016/10/06 11:55:49 | 000,075,614 | ---- | M] () -- C:\Users\Elang\Documents\cc_20161006_115538.reg
[2016/10/06 11:54:20 | 000,000,410 | ---- | M] () -- C:\Windows\tasks\SlimDrivers Startup.job
[2016/10/06 11:54:13 | 000,016,056 | ---- | M] (SlimWare Utilities, Inc.) -- C:\Windows\SysNative\drivers\SWDUMon.sys
[2016/10/06 11:54:08 | 000,002,483 | ---- | M] () -- C:\Users\Public\Desktop\SlimDrivers.lnk
[2016/10/06 11:48:34 | 000,029,200 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2016/10/06 11:48:34 | 000,029,200 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2016/10/06 11:43:02 | 000,192,216 | ---- | M] (Malwarebytes) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2016/10/06 11:39:02 | 000,034,752 | ---- | M] () -- C:\Windows\SysNative\drivers\WPRO_41_2001.sys
[2016/10/06 11:38:32 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2016/10/06 11:38:26 | 2114,945,023 | -HS- | M] () -- C:\hiberfil.sys
[2016/10/06 11:37:43 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\spu_storage.bin
[2016/10/06 09:28:01 | 000,119,296 | ---- | M] () -- C:\Windows\SysWow64\zlib.dll
[2016/10/05 13:27:36 | 000,785,794 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2016/10/05 13:27:36 | 000,656,834 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2016/10/05 13:27:36 | 000,122,646 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2016/10/04 07:09:31 | 000,002,173 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2016/09/25 03:24:14 | 000,103,736 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2016/09/21 18:53:31 | 000,000,202 | ---- | M] () -- C:\Users\Elang\Desktop\Paladins.url
[2016/09/19 06:39:44 | 000,002,273 | ---- | M] () -- C:\Users\Elang\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2016/09/15 04:47:46 | 000,000,000 | -H-- | M] () -- C:\ProgramData\DP45977C.lfl
[2016/09/15 04:20:43 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
[2016/09/15 04:06:14 | 000,000,894 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore1d040993bb2e579.job
[2016/09/15 04:06:14 | 000,000,366 | ---- | M] () -- C:\Windows\tasks\SlimCleaner Plus (Scheduled Scan - Elang).job
[2016/09/15 03:57:20 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
[2016/09/15 03:22:06 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2016/09/11 08:35:47 | 000,001,011 | ---- | M] () -- C:\Users\Elang\Desktop\MusicBee.lnk
[2016/09/08 22:11:44 | 000,769,660 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[9 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[8 C:\Windows\SysNative\*.tmp files -> C:\Windows\SysNative\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2016/10/06 11:55:41 | 000,075,614 | ---- | C] () -- C:\Users\Elang\Documents\cc_20161006_115538.reg
[2016/10/06 11:54:19 | 000,000,410 | ---- | C] () -- C:\Windows\tasks\SlimDrivers Startup.job
[2016/10/06 11:54:08 | 000,002,483 | ---- | C] () -- C:\Users\Public\Desktop\SlimDrivers.lnk
[2016/09/21 18:53:31 | 000,000,202 | ---- | C] () -- C:\Users\Elang\Desktop\Paladins.url
[2016/09/15 07:04:38 | 000,002,273 | ---- | C] () -- C:\Users\Elang\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2016/09/15 07:04:38 | 000,002,185 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
[2016/09/15 07:04:38 | 000,002,173 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2016/09/15 04:47:59 | 000,271,264 | ---- | C] () -- C:\Windows\System\vbrun100.dll
[2016/09/15 04:47:46 | 000,000,000 | -H-- | C] () -- C:\ProgramData\DP45977C.lfl
[2016/09/15 04:46:25 | 005,804,772 | ---- | C] () -- C:\Windows\SysNative\drivers\rtvienna.dat
[2016/09/15 04:46:25 | 001,920,820 | ---- | C] () -- C:\Windows\SysNative\drivers\rtkSSTsetting.dat
[2016/09/15 04:46:25 | 000,105,304 | ---- | C] () -- C:\Windows\SysNative\audioLibVc.dll
[2016/09/15 04:46:25 | 000,005,604 | ---- | C] () -- C:\Windows\SysNative\cxapo.lncs
[2016/09/15 04:46:25 | 000,000,736 | ---- | C] () -- C:\Windows\SysNative\cxapo.prop
[2016/09/15 04:46:16 | 006,947,183 | ---- | C] () -- C:\Windows\SysNative\drivers\RTAIODAT.DAT
[2016/09/15 04:46:06 | 000,118,592 | ---- | C] () -- C:\Windows\SysNative\AcpiServiceVnA64.dll
[2016/09/15 04:22:13 | 000,044,744 | ---- | C] () -- C:\Windows\SysNative\drivers\ISCTD.sys
[2016/09/15 04:20:43 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
[2016/09/15 03:57:20 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
[2016/09/15 03:44:31 | 000,000,366 | ---- | C] () -- C:\Windows\tasks\SlimCleaner Plus (Scheduled Scan - Elang).job
[2016/09/15 03:22:06 | 000,001,151 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2016/09/11 08:35:47 | 000,001,011 | ---- | C] () -- C:\Users\Elang\Desktop\MusicBee.lnk
[2016/07/19 03:39:04 | 000,223,744 | ---- | C] () -- C:\Windows\SysWow64\GameManager32.dll
[2016/07/19 03:38:58 | 000,192,000 | ---- | C] () -- C:\Windows\SysWow64\atieah32.exe
[2016/07/19 03:38:50 | 000,204,800 | ---- | C] () -- C:\Windows\SysWow64\amdgfxinfo32.dll
[2016/07/19 03:29:16 | 000,217,088 | ---- | C] () -- C:\Windows\SysWow64\hsa-thunk.dll
[2016/06/24 01:22:00 | 000,264,992 | ---- | C] () -- C:\Windows\SysWow64\vulkan-1-1-0-17-0.dll
[2016/06/24 01:21:24 | 000,110,880 | ---- | C] () -- C:\Windows\SysWow64\vulkaninfo-1-1-0-17-0.exe
[2016/06/10 18:56:58 | 000,089,706 | ---- | C] () -- C:\Users\Elang\693409_201606101241230774.jpg
[2016/06/09 11:10:48 | 000,123,729 | ---- | C] () -- C:\Users\Elang\IMGP8222.JPG
[2016/05/27 11:22:58 | 000,023,901 | ---- | C] () -- C:\Users\Elang\10444618_10204189691613777_2796881952419453070_n.jpg
[2016/05/27 11:22:45 | 000,012,776 | ---- | C] () -- C:\Users\Elang\10151886_10204189691293769_8654277854575715653_n.jpg
[2016/04/25 11:18:38 | 000,264,992 | ---- | C] () -- C:\Windows\SysWow64\vulkan-1.dll
[2016/04/25 11:18:38 | 000,110,880 | ---- | C] () -- C:\Windows\SysWow64\vulkaninfo.exe
[2016/03/23 03:46:01 | 000,000,000 | ---- | C] () -- C:\Users\Elang\AppData\Local\{B8003E23-B7E7-4E87-9316-F896FCEA3DEF}
[2016/03/15 08:11:26 | 000,148,992 | ---- | C] () -- C:\Windows\SysWow64\OPENENCODEVFW.DLL
[2016/02/16 06:27:00 | 000,125,720 | ---- | C] () -- C:\Windows\SysWow64\vulkan-1-1-0-3-1.dll
[2016/02/16 06:25:40 | 000,042,264 | ---- | C] () -- C:\Windows\SysWow64\vulkaninfo-1-1-0-3-1.exe
[2015/11/01 13:53:15 | 000,002,858 | ---- | C] () -- C:\Users\Elang\AppData\Roaming\VoiceMeeterDefault.xml
[2015/10/20 17:31:52 | 000,007,600 | ---- | C] () -- C:\Users\Elang\AppData\Local\Resmon.ResmonCfg
[2015/09/22 21:35:27 | 000,674,600 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2015/09/19 22:11:32 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2015/08/27 05:45:03 | 000,000,000 | ---- | C] () -- C:\Users\Elang\AppData\Local\{FAAF767A-FCD1-40C6-967A-1C58B6823B0E}
[2015/08/22 13:42:43 | 000,000,045 | ---- | C] () -- C:\Users\Elang\AppData\Roaming\xlaccolsetupstatus.ini
[2015/08/22 07:55:47 | 000,000,067 | ---- | C] () -- C:\Users\Elang\AppData\Roaming\xlgdlapp.ini
[2015/08/03 23:45:01 | 000,000,000 | ---- | C] () -- C:\Users\Elang\AppData\Local\{628B6AE3-7DC3-4D6C-87A2-2BB3DB3AC2AD}
[2015/07/04 01:55:08 | 000,000,273 | ---- | C] () -- C:\Windows\game.ini
[2015/05/02 01:57:50 | 000,001,456 | ---- | C] () -- C:\Users\Elang\AppData\Local\Adobe Save for Web 13.0 Prefs
[2015/03/31 16:35:44 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2015/03/20 12:59:24 | 000,000,355 | ---- | C] () -- C:\Users\Elang\Homegroup - Shortcut.lnk
[2014/11/04 07:07:47 | 000,002,006 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2014/11/04 07:07:47 | 000,001,942 | ---- | C] () -- C:\Windows\Sandboxie.ini.BackupBySandboxiePortable
[2014/06/16 17:06:49 | 000,000,104 | -H-- | C] () -- C:\Users\Elang\AppData\Roaming\WPVXAP.setting
[2014/05/27 15:55:51 | 000,000,642 | RHS- | C] () -- C:\Users\Elang\ntuser.pol

[color=#E56717]========== ZeroAccess Check ==========[/color]

[2009/07/14 11:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/07/26 09:24:09 | 014,176,256 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/07/26 08:56:00 | 012,874,752 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/14 08:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010/11/21 10:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/14 08:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

[color=#E56717]========== LOP Check ==========[/color]

[2015/03/08 22:31:02 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\.ACEStream
[2015/03/08 22:31:02 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\ACEStream
[2016/06/23 23:29:58 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\AdvertismentImages
[2016/02/26 09:15:31 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\AMD
[2014/12/15 18:14:30 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Anvsoft
[2014/12/15 18:54:06 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Apowersoft
[2016/09/01 19:13:07 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Audacity
[2016/08/12 00:07:03 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Avnex
[2016/03/20 06:15:17 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\BANDISOFT
[2016/10/06 11:48:59 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\DAEMON Tools Pro
[2016/10/06 12:12:53 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\DMCache
[2016/09/27 00:07:31 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\DriverPack Notifier
[2014/06/30 18:27:58 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Dropbox
[2014/06/30 18:27:57 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\DropboxMaster
[2016/09/15 04:17:57 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\DRPSu
[2014/04/20 02:30:34 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Easy2Convert
[2015/01/27 13:43:58 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Electronic Arts
[2013/11/22 10:12:46 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\ESET
[2015/08/19 11:17:19 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Foxit Software
[2016/06/23 22:29:28 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Free M4a to MP3 Converter
[2015/06/24 14:27:59 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Garena
[2016/02/26 10:02:39 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\GoldWave
[2016/10/06 11:53:24 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\IDM
[2016/09/15 03:52:51 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Innovative Solutions
[2015/03/01 00:06:10 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\library_dir
[2015/03/10 20:17:27 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\livestreamer
[2016/10/04 05:57:16 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\MiniLyrics
[2013/11/22 11:26:08 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\MPC-HC
[2016/09/11 20:23:20 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\MusicBee
[2014/01/12 17:31:32 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Nitroplus
[2015/09/09 22:58:50 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Notepad++
[2016/07/14 09:55:51 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\OBS
[2015/08/05 17:27:33 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\OnTopReplica
[2015/06/04 20:19:35 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Origin
[2014/05/27 16:26:23 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\PandoraRecovery
[2015/07/08 06:17:35 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\PFStaticIP
[2016/03/15 10:11:41 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\PlaysTV
[2015/09/29 10:12:22 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\PortForward.com
[2016/06/29 13:01:29 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\ProcessLasso
[2014/10/11 22:49:15 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Publish Providers
[2014/01/07 22:54:32 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\qBittorrent
[2015/09/21 06:23:12 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Rainmeter
[2016/03/23 06:21:32 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Raptr
[2014/07/29 22:33:50 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Screaming Bee
[2015/08/22 07:55:47 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\smzh0724_setup
[2014/10/14 10:54:39 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Sony
[2015/05/02 04:16:06 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Sony Creative Software Inc
[2014/05/27 15:46:19 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Stardock
[2015/01/01 16:56:42 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Steam
[2015/08/22 23:42:04 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Tencent
[2013/11/22 17:41:14 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\TeraCopy
[2013/12/07 23:40:49 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Thinstall
[2016/05/06 00:29:51 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\TS3Client
[2013/12/18 19:52:36 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\TuneUp Software
[2014/06/22 18:39:20 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Unity
[2015/09/29 10:27:59 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\UnknownApplicationVendor
[2016/10/06 11:39:12 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\USBSafelyRemove
[2016/10/06 11:53:03 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\uTorrent
[2016/03/22 09:45:56 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\VideoScribeDesktop
[2016/08/17 21:48:32 | 000,000,000 | ---D | M] -- C:\Users\Elang\AppData\Roaming\Xiaomi

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:SummaryInformation
@Alternate Data Stream - 128 bytes -> C:\Windows\SysWow64\zlib.dll:DocumentSummaryInformation

< End of report >